{ "type": "bundle", "id": "bundle--d5c8a919-6a09-5f90-aa5e-159a80d2308a", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Analyste CTI independant", "identity_class": "individual" }, { "type": "malware", "spec_version": "2.1", "id": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Famille Ghost", "is_family": true, "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Proxy SOCKS inverse RevSocks", "is_family": true, "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Encrypteur INC", "is_family": true, "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Framework Phantom", "is_family": true, "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--47813c3d-93d5-5236-a93c-c64719854686", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Meterpreter", "is_family": true, "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7ff7ecb2-8571-5dad-8b4e-2838b841fb6a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_agent_x86.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = 'ba3689bf7bc6f8d8468dde5c36df56163b40d0ddfc1991e35dde258cd25428b2']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2daa6c80-1c82-54e9-8f6a-f3afbae8734f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--7ff7ecb2-8571-5dad-8b4e-2838b841fb6a", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bd724dca-e316-5ecf-bc68-7e5de194afc4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_monitor_debug.dll", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = 'ad03ef341dfc36fbe7f74392b5619293894ee9554a164ec277d66dd21b780a2d']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--01164879-be5f-55cd-aeec-f2a60238c704", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--bd724dca-e316-5ecf-bc68-7e5de194afc4", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--041bd622-def7-5907-853a-e3cde612c4c9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_armv7-unknown-linux-gnueabi", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '8d6761f6824176848db7297a3e98694b32215dc44ec6be5780d877639b05bb37']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1bc23d22-1ca0-55d6-bf2d-67da36d51c48", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--041bd622-def7-5907-853a-e3cde612c4c9", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d1e3b6b-2891-5bf2-bcea-72aa6f16a736", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit_x86_64-pc-windows-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'ffd47c59a9960a293002c4fff481f613892599191356589eb7b6950ef7465918']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86ddb75f-2404-50fc-b829-b78810487408", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--5d1e3b6b-2891-5bf2-bcea-72aa6f16a736", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5665fff5-13f0-5881-ab5d-9ddfb7678fa1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_x86_64-unknown-linux-esxi", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'e02ae43c682eb8a969b0b667d8562274762044930686389bc0539ed0f58dd0f1']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--31f78563-0705-5157-87fc-da4b7499c6bd", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--5665fff5-13f0-5881-ab5d-9ddfb7678fa1", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--35b3d756-d3aa-5b8e-9aae-b0616c5ef47e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_netcheck_win_amd64.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '57f7a66f829e6ff154a93171100252157fe3ff0cc136dfa33fe3329f087a7eb8']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--abd7533c-f87e-5a61-b2b7-c2ad31686ca5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--35b3d756-d3aa-5b8e-9aae-b0616c5ef47e", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9628a3e5-7061-5c05-9f9d-93d0ecdfd285", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_powerpc-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '230c3debc5c42fad37ac8ffa2f9ce84a7694ccb20f5a92963c345bc434e3b0f7']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7975d6e6-7a5e-506c-bbf3-32563f6353a4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--9628a3e5-7061-5c05-9f9d-93d0ecdfd285", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e3305821-e439-5984-8390-3c0f242d52c6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_armv7-unknown-linux-gnueabi", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'dfb0482d39b66bcb62f794631f39971993da18da4d6c92817c3335f1711b1dd3']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7802b42a-7773-5ba4-9992-d756fbca138f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--e3305821-e439-5984-8390-3c0f242d52c6", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4126ffed-61b8-583c-9fc2-2272b91f44a6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_agent_cf_x86.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = '2d49a9e3e31062a711b4027f834554f8bce5f479e01df5315d237903181b351d']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c58b9e3-7a2b-5cd8-9ede-e156e2afa852", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--4126ffed-61b8-583c-9fc2-2272b91f44a6", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cf170276-cd15-50f5-ae7d-549bcebc5fa1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_inject_explorer.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = 'd4ae978d0fa31d31144a0289f2307393deb992a54e4e7335e923511ac6bbc47e']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--57901e60-3d10-54c6-bacb-1b4aba4657af", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--cf170276-cd15-50f5-ae7d-549bcebc5fa1", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e448592d-5941-541a-a38e-fa35d7bdc150", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_vmware-usbarbitrator", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = 'c11d57472a70943367581b31d8732b29885470741b8aed1c7692956d9666eb91']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5656f522-c19d-51fb-95d4-daf661319386", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--e448592d-5941-541a-a38e-fa35d7bdc150", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4f5b6d4e-8cf8-568b-bad4-779be06405c1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_aarch64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '29009de86551267b66080bcf4bb97609e09e383eb05b63c8f91aab5bbe30894c']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6517db87-14b2-5da7-9339-8e17453f785b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--4f5b6d4e-8cf8-568b-bad4-779be06405c1", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--65dadeaa-3fa1-56bd-be14-af83f3aba0c3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_powerpc64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '7c0e0b139e8b6a4dfb6aae8121dec5c88e90481ed1de7f273f6f36726409e26a']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a3cacff4-5ac5-589f-9399-6e44f2f08106", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--65dadeaa-3fa1-56bd-be14-af83f3aba0c3", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--290735a1-e39b-5734-8773-723afcf9afbc", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_monitor.dll", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = 'ec511c74666b6e537725a1238a2429ab95d2b2ab01a5456d5d04a03f2a062649']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b3d349ae-71f0-5eea-bf07-92dbb7759498", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--290735a1-e39b-5734-8773-723afcf9afbc", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8ee84ec8-19da-55f8-a384-e3168f728c12", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_BackupAgent.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'c0109510d5dc388e31211f0fd9a4f90bbf3420945775ffed6f18b1e9693e3555']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7167af56-4ef3-5e85-bc7c-f2b55d684cc8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--8ee84ec8-19da-55f8-a384-e3168f728c12", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ddc73635-8bfa-5553-855a-8901c4cb2b47", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_inject_system.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = '8bba473887e6d31f60d13c4fdc903bfbf688f912ad8aa5ea171ae626d3a7b9a4']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9cc6c788-3441-521e-9edd-620445186139", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--ddc73635-8bfa-5553-855a-8901c4cb2b47", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--33bddf44-56f9-569b-a0d9-d160df2bc6ac", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_phantom-cli", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'e9ad2f3a267741db5bbd7e687b7129eccd479c674fca19e2419b868f6b1e449a']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ffe0432e-0b44-55b8-b043-db8da9ccaa90", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--33bddf44-56f9-569b-a0d9-d160df2bc6ac", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8c9629ac-d829-53da-b3c3-7bd8bfda2a58", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_stage2_inject", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'adefbec6608c664c793d37e0a41a36ab19af1a5ba9e81e89e76252b49cfeb361']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bbcb62e0-dd16-5b83-8b43-051f40594d91", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--8c9629ac-d829-53da-b3c3-7bd8bfda2a58", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e42fbe0f-c5c0-515e-9801-8515f2b877f7", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_armv7-unknown-linux-gnueabihf", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '9afa980905b73ca88f387bbb795341d3666530000447f36bdcb8502bf50470be']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23febddd-1b0a-5321-926c-501315847a8e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--e42fbe0f-c5c0-515e-9801-8515f2b877f7", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8018e7d2-b94f-5908-98e7-05625ce75f15", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_mcp-bridge", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'fbb85ddbd561784840349cbcf306771a6ffc698bd6955a3de1338d92d1670d11']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c0c85f15-812a-59f9-926e-b5ac6707d04f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--8018e7d2-b94f-5908-98e7-05625ce75f15", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cac94f4d-46d9-599c-9531-8b732be46853", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit_x86_64-unknown-linux-musl", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '0120990444ff05bbbe7d31f874319b23d43e2376052840e7f42696c69638206c']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86606809-ba7a-55a7-a935-384d264f4933", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--cac94f4d-46d9-599c-9531-8b732be46853", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f6cd304b-a94e-5fea-88c1-00ac06b3b4d9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_rks3_v02.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'be3bc809131c283b8deb542e11ed0878468b8db531696fdbee03978fde55be0e']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be969549-20ea-546b-a3d8-93ab233de3df", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--f6cd304b-a94e-5fea-88c1-00ac06b3b4d9", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--48c27421-892a-5c87-a5e5-075adce399d5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit_x86_64-pc-windows-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'ec4ba1d570601eaa1474ab7cfffafcff218a717e44e8d2d22ed0573676b0463e']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3f07b110-2331-59f2-8d43-9042674ae303", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--48c27421-892a-5c87-a5e5-075adce399d5", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--657f5ac2-20d7-5038-9c48-e3011eb20b78", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_wp2shell.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '839cceb4d34eae502cac95ce4459c5080d8a42f8c3b9dcb6e51af4ff565e4c2e']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cbab5398-1fc9-5096-aa18-6b4caf106466", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--657f5ac2-20d7-5038-9c48-e3011eb20b78", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8b94167d-4a02-588f-bb07-30054c80319b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_quickheal-killer2.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '12fe4665c093505b17a1b6807d8c508bc71a2d43ff9b9ffdf712ec4345e25866']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--251586a9-a946-52be-a196-88fbcc6df074", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--8b94167d-4a02-588f-bb07-30054c80319b", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9ea4d1a3-fb7e-58ea-9900-ee35c5bfd5ba", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_riscv64gc-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'b05c73ef9731d2087fdae483350a9d08e58e4bc4ec84062d7ae3efc87982ea37']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a2f8003-55b3-5689-9997-8793ee30fbef", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--9ea4d1a3-fb7e-58ea-9900-ee35c5bfd5ba", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7fdaab43-4687-5831-bcc6-415e9259d036", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_nethost_win_amd64.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '253d02cfe9f5c222ae1544c6e57900093de6fd01162d6584f52e2833174fdc24']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--16d720ce-4ba8-5a4a-9cd8-a6b90e1f7b0b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--7fdaab43-4687-5831-bcc6-415e9259d036", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b9f0a4e3-bc5c-53a9-9698-0e31b27bb56c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_phantom_agent_silent.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '0c9ce8e07011b5afd00ae5cdebeca156c5cc606c2d5820a03d8c0a89f2d7c0fa']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f76ac7d0-bf35-5915-bc2e-23057ad8c0f1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--b9f0a4e3-bc5c-53a9-9698-0e31b27bb56c", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ba18842d-7f12-589f-936b-3a21c1fc3d4a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_riscv64gc-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '40955ab5c1307aac6c2f5074dce860e8a9e120d9b57beeb27aa4d389f9d484df']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d3edc8cd-e5f4-5426-9ec2-3e8232f1cd1d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--ba18842d-7f12-589f-936b-3a21c1fc3d4a", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--aa3d535b-6442-5200-b158-7514ec0cbcca", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_phantom_agent.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'ea0b2f4ba9611770b640cfffe78fc60c5158d11cc32d235b966ec4a91c168ff4']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cf776d87-4678-5d11-a81e-a04bf1598bde", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--aa3d535b-6442-5200-b158-7514ec0cbcca", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fc55a2ff-b918-56a8-ab03-25187839fb5b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_G6B77FE12.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '11942f525df4f7681006b3e681656ef32e3afd248e2d51d3660a80b958f4947e']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8f4f7334-2e94-54f5-989b-beaf21f6baa7", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--fc55a2ff-b918-56a8-ab03-25187839fb5b", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ca563d83-de68-5dae-ac03-bcbb822ce789", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_ntlm_test.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '19bd1314e268493503c5570a5dda6b55eac3aac6608ec16257874bd799b285d8']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b92e54e-dfdd-5f72-80cd-73e77f579d1c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--ca563d83-de68-5dae-ac03-bcbb822ce789", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--352822e7-4fcf-55eb-9c23-47f1d80010c8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_x86_64-unknown-linux-musl", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '41d056e80567216c565ab5796c9bd4e4b7a56fd14a8f99c044ea0206c079be76']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0a641fc6-7eaf-5e28-88d9-dbccf3c6b617", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--352822e7-4fcf-55eb-9c23-47f1d80010c8", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--71692098-5fe2-55e1-980b-1ecaf1176527", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit1_armv7-unknown-linux-gnueabi", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'fda97b7e922b4cc08a77d6eda4ccabcbc1cfd8a5459166e4c1d0c4aeafef9678']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f4892a18-cb83-56b4-8833-706bc0bf45a8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--71692098-5fe2-55e1-980b-1ecaf1176527", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7cee7fcc-c3c0-583e-a2ee-2b198bfa649a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_pnloader.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '1884ea40e0f30433b31bfae38391aae4e632422fd895bb6d0ee79256e6259d81']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b2cc6a95-61b6-5b38-b594-317bd73be6b8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--7cee7fcc-c3c0-583e-a2ee-2b198bfa649a", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4bc2017f-66a1-56c0-bd67-b6101a59da2e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit1_armv7-unknown-linux-gnueabihf", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '53b99df3805f084ba95710955746fe4e4ff410983b15bc7a574a60d6976629a9']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d2515efe-4d8e-5b5f-a2d3-2055b280c6ae", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--4bc2017f-66a1-56c0-bd67-b6101a59da2e", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--16f799ad-a85a-5b11-8bfa-21d94fb55c11", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_campaign_template", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '6fc6b7a65481e9351a92b85b6ce041b7f6d3ffb1f7833748f0cb80b296ba6e41']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ace6c55-ee2f-5d35-a7f7-2c45597d55eb", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--16f799ad-a85a-5b11-8bfa-21d94fb55c11", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9da92515-a1e8-5b9d-9939-8f5b87a92322", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit_x86_64-unknown-linux-esxi", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '612689acd0dee5373e7b6020069b55a3e031218942be20367ee342420357cad4']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cefc9790-cd27-57c6-b7fe-e487457a2f14", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--9da92515-a1e8-5b9d-9939-8f5b87a92322", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--265190da-ea26-546e-9c74-09aefabd51b1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_netscanner_cli_linux", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '8148ab6928e472a7748348ed1b7e2e9ff572cd74ecd6cc68d74ea354475e10ab']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c05b0c0b-dbee-5efc-9997-26a5f9639c26", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--265190da-ea26-546e-9c74-09aefabd51b1", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--170b0193-398d-5b73-8c8e-66895ec8b4b6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_netscanner.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'dc6f7a16016a2437a9711f8e734021d4a10e61b3c60cb8b09d805d75c8969336']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3033e231-f10e-5430-b128-2ae501c960c3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--170b0193-398d-5b73-8c8e-66895ec8b4b6", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d2b0162a-06e7-5ab1-9ada-79b031af7e66", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_uac_bypass.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = 'f377698712265c87ceba162f0c33a26b86d23724a2613c637dd9af8b11c21da6']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5cdbee0a-91f3-52b9-81c1-1020ebb401c4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--d2b0162a-06e7-5ab1-9ada-79b031af7e66", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0d024d95-af50-5d36-b522-8f5d86e58fea", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_arm-unknown-linux-gnueabi", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '9a5020855a37a861898bcc15c7bba0f1498a85104fc97a59bbcd31f26b7b2e68']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bc6e83b3-badb-5d22-a561-31578614956b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--0d024d95-af50-5d36-b522-8f5d86e58fea", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5861542f-509d-590b-9109-3403d81edad9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_aarch64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'c26520e6e7f31183418a05793ee0d2a63e19578997176c130a5791f1cc2d72a7']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db64daf8-d16c-5e54-90f7-7e4ea47ae6b8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--5861542f-509d-590b-9109-3403d81edad9", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d49f0101-a732-5b1a-ac88-099cc5209684", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_x86_64-unknown-linux-musl", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '190178582dd9876ca6f8fd012deb9e0739c6040e68f858202d8dc4d513a6afe7']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f226d211-7fa5-5193-b24f-847c366de2d2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--d49f0101-a732-5b1a-ac88-099cc5209684", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e151210c-6e0a-5f62-84b9-b7294df657f5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_agent.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = 'fc0269ad99451a97de8348efbdb248a5ba341d3684952bc448ec62817537252d']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4d684d1f-9743-5935-b678-546d261d2588", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--e151210c-6e0a-5f62-84b9-b7294df657f5", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--95a142ca-de3a-5a4d-8a62-77e7dd2539f4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_quickheal-killer.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '6a7a89d1573d28a5803a4f4d18a08aa75a7136328ccd60df42e1d524d7886877']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd495cc6-b307-5909-921d-590ae7a30b0f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--95a142ca-de3a-5a4d-8a62-77e7dd2539f4", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d680cc3e-f71c-5917-8fea-7fcf62d8b5d0", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_G00F9FCB5.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '118c38f1051be7f51c34044429bc06d0eca114c0196b7b7482221c7add2063c6']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9f8329cf-3aff-5809-8057-1e175de402cf", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--d680cc3e-f71c-5917-8fea-7fcf62d8b5d0", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6cb10d0f-c602-56af-a0b7-d4f37786cc3f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit_x86_64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '70f28e18e7f4083cd542e6bff6b2682f3876c5ef4bcf4323aa22a6d03d4a8a82']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4fd45dff-8614-5eff-9de5-5d22803729fb", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--6cb10d0f-c602-56af-a0b7-d4f37786cc3f", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--16047581-f542-5aaa-9d0d-2e40dad72be8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_elevate.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '2013668a450713b24fdfb34ec2488b7893bc01836879f9b1c0f739d5deee573a']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c1e9f13b-a6b3-5215-b6d6-fd9450e39fe8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--16047581-f542-5aaa-9d0d-2e40dad72be8", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b4dc6462-f17d-559b-b64a-3b6b3239a37f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Staging_ligagent_upx", "description": "Staging", "pattern": "[file:hashes.'SHA-256' = 'ae593146b2cd736b65d71386caa86669577527bd1574b4e4beb9539b566f1190']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a8919209-4928-5c16-9c0e-a88fec735d16", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_agent_cf.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = '29f87d32b658cba4093f0b90257404c262bc1d5a65de28ba6ad4ffdf4f65fe6e']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--178bd409-5c6d-52b5-bfb1-319f31a42bec", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--a8919209-4928-5c16-9c0e-a88fec735d16", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0a7a41c4-3787-5a37-8060-6f96d82dd36f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_injectWmiprvse.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = '27d39120cdc08ce2ae074abcdde208d533aa8f3f6569c0c182600f3abfd96851']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b06a3b5-5f3c-5584-b436-f66e1d61658e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--0a7a41c4-3787-5a37-8060-6f96d82dd36f", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--56366fdd-bde5-52cb-bc7c-afb2a3a6a8d3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_loader.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = 'f6fbe16811654ff1fb44d939bd989f3d1eac5e28f986157030cb9bf3da290c60']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--01ad03dd-56c4-51b1-a20c-461b9cb26ad2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--56366fdd-bde5-52cb-bc7c-afb2a3a6a8d3", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--534c366c-0b6b-5e69-9a2a-fa696eb3d030", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_arm-unknown-linux-gnueabi", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '51745597945a0966846bb97ae18524649e1f759268b949d8aeaea4a53a9a1b96']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3fb82cf6-ac08-5aa4-82f6-1bd4edb3f700", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--534c366c-0b6b-5e69-9a2a-fa696eb3d030", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0ed38c60-1b22-5c05-83ca-893b953f379a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_s390x-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '1d2bf492f606d7469e6895c52d763406c1bb0e36435d1f323ce5cdb2889d3efc']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--60e912ec-35ed-5c36-878b-7e68fb968f00", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--0ed38c60-1b22-5c05-83ca-893b953f379a", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--83b96363-8d43-5eeb-96c8-3b1de33b38cd", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_powerpc-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '67360b25498795a7dab3e15c74b5814987a991c08457ce1ec3baf0de95f81c82']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--16929f7f-1e76-520e-8853-69b7dcacef94", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--83b96363-8d43-5eeb-96c8-3b1de33b38cd", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2519916c-b76d-5ddb-933f-9cfcad625bed", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_QuickLine_cf.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'c4f5e0b453347dee387a91d0da2c4db65b8106dfe3511a6fcd6f79756b031096']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e63e02b8-9c71-5ef1-8172-c7ac22708ac7", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--2519916c-b76d-5ddb-933f-9cfcad625bed", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5165ab74-141d-5102-b5e4-1116ecb1db7a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit1_sparc64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '935ee232fe107c1b452abaa2a3e7290b7b0021b0399cc038df7d298030bb638a']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a7afb58c-efd3-56d6-a682-d3991c759a91", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--5165ab74-141d-5102-b5e4-1116ecb1db7a", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dc578f7a-6e3d-537a-9e75-02a18ea52f67", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit_x86_64-pc-windows-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'ca02f60942a43d8f8b973baa3231df1f8c26328750baa2ed8d4cf07335084ebb']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8a2b342e-3824-5437-a3a2-7da86705b95a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--dc578f7a-6e3d-537a-9e75-02a18ea52f67", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--68abeb0f-2e32-5e46-97b5-01f2b959f2a4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_zloader.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '129f838cc7d6a60993aa1e622aa56b748fb511b9578d35c7da200e837c7cc291']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--998e2a5d-1a04-5063-b70e-9263e3f14417", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--68abeb0f-2e32-5e46-97b5-01f2b959f2a4", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--91653577-b16f-5bc6-8468-f4117d256a6a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_win.exe", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '0ae4447d755593ee1931170d4187a07a29bf0690179acc39b7400a4c65cd07c5']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b57f4f7f-a2ad-5656-b39a-036824d6ba0b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--91653577-b16f-5bc6-8468-f4117d256a6a", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bb2bd4cb-5e77-55bf-ac03-c070d75a05bc", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_BackupConsole.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'bc906faf69697803a7b652ea2196bda2ab7667587fb7c39a257b6a16cf72dccf']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--686f2f20-5582-5782-b682-b04c164ce409", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--bb2bd4cb-5e77-55bf-ac03-c070d75a05bc", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--439e9bda-f1e4-5cf2-b6ef-b89acb809bbb", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_svc", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '09c028c2289a401b45210b75f720ccad711216c756bce5ac04fb79620a91aee0']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--318b9f7c-c8cb-5f09-b318-681759f2cffa", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--439e9bda-f1e4-5cf2-b6ef-b89acb809bbb", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5427c82a-3a5b-587e-b261-92650a68e441", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_WUServiceHost.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '09ac4a095622cc699022c5ecb83234df2b7dbf3035f1dc6fb439dc1e0059a480']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--26876620-acc1-5f57-aea3-36e4c583e996", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--5427c82a-3a5b-587e-b261-92650a68e441", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--740b8a79-954f-588b-a572-13b783940878", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit1_aarch64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'e7c546134a20c98eddf47f85f661fc304e932d536781ddc35d52962762d402f5']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4e69f198-5320-5638-9256-5b86bdcb941d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--740b8a79-954f-588b-a572-13b783940878", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--25dd1f9e-0f6e-5b0a-8c61-6238124445a8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_loader_v1.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = 'bef87021caf35bf50370c0a11ccf83de14cbc1558380b690a63f87f1bf4cb366']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6a0769ad-6238-5dcd-909c-9274dd1822de", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--25dd1f9e-0f6e-5b0a-8c61-6238124445a8", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0b4bb385-f7e7-5062-9520-8b6e8e26900c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_agent.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = '90fe2b57f37d6bd045d22841fd192fccf4233bf8b21d85e5e927b68b0157b8f2']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7d3853ed-2571-5fa7-a4f4-7c349c2fdc12", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--0b4bb385-f7e7-5062-9520-8b6e8e26900c", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2c52c061-cceb-5104-aee0-53fa29bedd05", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit1_powerpc-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'cf1f4e50e28a697123dcabdc31514ae2dc058bfba762e7c10b5bc71f9adf443a']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0a49eae9-3dac-5d35-9de6-ba8f0f8d4562", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--2c52c061-cceb-5104-aee0-53fa29bedd05", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--19c44949-a9fd-564a-8bf3-0e49b3e74693", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_rks3.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '4feb0b3c0fc8a7347395d85cc11d57e8f2d585ccfd0836e65525a83e244cc883']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--626b5482-2ece-5d44-b263-b7f72e5d838f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--19c44949-a9fd-564a-8bf3-0e49b3e74693", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d19ef624-8463-5964-9de6-c39b1bd3de65", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_ghost_loader.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '0fcd7c4f78648a396eda077072706ceab6dee00e8ea22a7ff35a01740d0af805']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f660ed53-93f4-5b7c-8bc4-4003e83751ee", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--d19ef624-8463-5964-9de6-c39b1bd3de65", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3a96713c-2e4b-5ab0-b10a-6c11cb866adb", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_QuickLine.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '3580879264f6639e965c8df100501fe1878c38321d9115895ab6ad2410539e9b']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a345bb8a-83d6-5431-ae3e-a5be21444193", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--3a96713c-2e4b-5ab0-b10a-6c11cb866adb", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--13f3a13c-169c-5146-bacb-c0cae109f070", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit1_arm-unknown-linux-gnueabi", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '26eb4e606d4a18f15b7c03bd0f479101727bdf550db0c5d71325d889a986c58b']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e726e8b0-e6c4-545d-b02c-7b006b7e3dbd", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--13f3a13c-169c-5146-bacb-c0cae109f070", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ffd81289-37df-57bb-a8d4-ad5af663fd2c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_sparc64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '91218ee352ba3942fc358e49b84bdb1aea26e8b0885fce82d5d8bba4dc71c16a']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3649cb96-2a7c-586e-b1a0-05cd25933a64", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--ffd81289-37df-57bb-a8d4-ad5af663fd2c", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b3882dbc-84fa-59cd-a1ed-23c20975b365", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_template", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '0a27d422d8ab0e1cc58258e431a83834239fec7285146b62e5de9b11cd3b3e9e']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bea6ad64-5ddc-52d7-abef-7216fc709b12", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--b3882dbc-84fa-59cd-a1ed-23c20975b365", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--34418d1f-2cae-5f80-a87b-c8ef20e7eff4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_s390x-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '413a6a2294dd1e2839364e1c43354d1b3effd047e3f051b94f8e3a9d8738ad72']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5a5ccfcb-7202-5139-b9f5-d08d99e6f315", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--34418d1f-2cae-5f80-a87b-c8ef20e7eff4", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c28a72cb-343f-52e5-bd2d-bc5c050f32ac", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_wp2shell", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'bda528cc5bbd85a350ae5329f9c87ca6a8eca5bf2e8579d878636de5ab99f2da']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--af614fe3-4d4c-5af6-9120-4ac0fb59fc5a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--c28a72cb-343f-52e5-bd2d-bc5c050f32ac", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--374ab826-d9aa-5226-bad8-18dd3b6e9687", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_netcheck.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '477b2dd5a1d23713d56fcc976932b3ef0620b1b63f91cc0fde5a3587e2954981']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c4b62516-79f1-5915-9311-b71d8816de97", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--374ab826-d9aa-5226-bad8-18dd3b6e9687", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--045935b1-ca3c-5f37-b9ca-7d66d03db58b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_armv7-unknown-linux-gnueabihf", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '995c64d437288c1d1f9403e5cbb98b33b736df00515e5cf73dfdf18fe731fb49']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8827d6fe-d67b-5af4-8fe3-df36103da6c1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--045935b1-ca3c-5f37-b9ca-7d66d03db58b", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2744c1a1-ebfb-556c-8932-ea46004abc3f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_colorui5_signed.dll", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = 'ad53d8cb65833146fc6740be5dd6938fe90d94256e428468dfd508c80346d511']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b1c44b3b-1c02-59fe-a7ce-7eed5153a3af", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--2744c1a1-ebfb-556c-8932-ea46004abc3f", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d4eb406a-41d5-57f0-88d7-ffc89acdf68e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit1_arm-unknown-linux-gnueabihf", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '6565bcda727664399cca345aae74de387aefd9f416b05ef1153ee5f16cf8c586']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2b2fa3ee-d840-5854-b319-b1c6a4435b67", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--d4eb406a-41d5-57f0-88d7-ffc89acdf68e", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--53a8e954-aaf5-5b9a-b5b7-6cde5beb6cef", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_OneDriveSync.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '74b35f75ad33504cb9e61ba7061d2425dae3870fc5230cf265f7d2ceef1911f2']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--40f5679d-1248-54a2-b092-fe173b8eb9d1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--53a8e954-aaf5-5b9a-b5b7-6cde5beb6cef", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--648418fb-999c-5c05-9983-80afe6cd4397", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit_x86_64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '4286e7035096d002a0f90aca19b93504d7c69354cf0c76eb8b3c93bae2b7885a']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--940a9613-3e28-5a20-ba10-401e513ae851", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--648418fb-999c-5c05-9983-80afe6cd4397", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6ad51e24-227b-53b8-9ba7-3337322c743e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_cve202562215_fixed.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '90d14626e53c4391401e09607d758635348f3ce93f52d337741e95f60f36c720']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--75cf6052-7e00-5291-886a-867290bdd35f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--6ad51e24-227b-53b8-9ba7-3337322c743e", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bb39d78b-a47a-55e0-9f59-9568d47e2539", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_x86_64-pc-windows-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'c20411a88faf07c7f4029c679d89be3b7140cf117a4c099f127000d799fbb418']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ce6b7bd0-7b5d-5840-9094-96758c70c78e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--bb39d78b-a47a-55e0-9f59-9568d47e2539", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ccfa730f-2253-5ade-afd3-93a9520b3441", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_loader_v2.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = 'e2b5fc7e457661fb886e8bac99d15b0cba3871fc72950ca4802aa6f0c4494553']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6a293ed5-d518-583a-8bcf-4a05ca856c79", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--ccfa730f-2253-5ade-afd3-93a9520b3441", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9a335d17-9840-5f4d-8060-6efc62b0662a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_x86_64-unknown-linux-esxi", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '40d03f68520be536eaf020b60ac9d3937b0abfba833f2926f7f005f14860d376']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b2c76d21-2d81-582d-ab6b-42886fc76d37", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--9a335d17-9840-5f4d-8060-6efc62b0662a", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a9cf4312-b377-584f-8fdb-6051b8566938", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit1_riscv64gc-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '31d11693da0c7ae79e8a5ec8ca6e59bf6141ac1bff82a986d120de021e140fd8']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fba06f8e-d779-5223-a53c-a6a8eebddc5d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--a9cf4312-b377-584f-8fdb-6051b8566938", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f9e77e42-7006-58fc-92b4-f2a109fbb252", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_rks3_auto.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'b15dcba2635f3329822d030c98a6dd92d7e6a19941797257e7e6a583dfa54efc']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--235f860a-956e-52bd-9517-fd018c235c42", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--f9e77e42-7006-58fc-92b4-f2a109fbb252", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--56e11db4-e075-5b75-80f4-ff70c1768cdf", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_arm-unknown-linux-gnueabihf", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'c42a476182f22a2571711d3ad173884e9d394e00bc777011d01998573626f88d']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58cdc16d-8301-5487-b35b-b1fe16c533de", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--56e11db4-e075-5b75-80f4-ff70c1768cdf", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--60636bcf-5a0b-584f-8d66-347a79586af6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_win.exe", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'ffca6aa96572743200f9f0040a3e435766f6d7c15d6a4c72045a0cbb4db72eb4']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a1d62535-2510-5a9a-bb37-d57e57f3a611", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--60636bcf-5a0b-584f-8d66-347a79586af6", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c1b4ea8e-62a9-58c0-b5cf-1bc48a9c4607", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_phantom-cli.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'a5c6a4ffe798d6a23e8ec1532c04df2eb7a365a4f68c2b0dd1f48eadc6d31b04']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--931ea2c1-43c4-5a5d-be08-6b8b99b37ba2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--c1b4ea8e-62a9-58c0-b5cf-1bc48a9c4607", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ce16b960-d625-5766-b8fe-0c36c465be96", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_agent_x86.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = '9113fcddc88f6eb5d38910e5bee2ce95736c9ad7a27984c1ce136790325d0382']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--94d9db4d-47a3-5faa-bdd7-e9a7dfcbc491", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--ce16b960-d625-5766-b8fe-0c36c465be96", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4f174c5f-9cd4-53d3-b08b-b4eb73cc64fa", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit1_powerpc64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '8f7fa78a7244ad95a1deee10bc8a30250dbdc6a4e94562d174737151d1533dc0']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--24d9e9a6-aef1-5530-bcae-87a422cfc1d5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--4f174c5f-9cd4-53d3-b08b-b4eb73cc64fa", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cc6bd7cc-7a5a-57b7-9f6c-7b0bcc3a1321", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_colorui5", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '2f2b21bc394589466cfdc813aad597347892cc9a43a3742808adc7ce44c907bb']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1feee671-6a39-5646-8023-be977c969619", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--cc6bd7cc-7a5a-57b7-9f6c-7b0bcc3a1321", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--62ba219f-be7b-5705-91b6-d50dda934db5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_cf_debug.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = 'e26df3b6bc8c55f7d07d178707f173e6a3881016eb3644498e162f0dc97da92d']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--68d829f8-3d2c-54ed-99dd-5ed3011f77ce", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--62ba219f-be7b-5705-91b6-d50dda934db5", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--812acf90-0ddd-5cdd-b751-b7ca5b6681bf", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_G7CDD6836_stealth.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '8795abe52d8d274a2ae11fbc7df36809c810333fda63e64da495aa3278321350']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1bfd9224-d427-5b52-858f-cd6570ec8855", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--812acf90-0ddd-5cdd-b751-b7ca5b6681bf", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ae464ddd-116f-5400-8dbe-69f72738a414", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_agent.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = 'f55ad6ac989ab71a393c9d038f5cec473fe8ebd00197966b7051d493c53b59c8']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ef2eebc5-4187-584a-a80f-e33f3bd8baf4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--ae464ddd-116f-5400-8dbe-69f72738a414", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c8c4e977-0b0b-5cb5-8cfd-c26cc48c2694", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_sysconfig", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = 'cd56540cd8689a6874aeeed76841456c08d6afdaf3034598e60cf620f0ae0591']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5f8fc995-9b0d-58f3-b50c-e062c5e4ddab", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--c8c4e977-0b0b-5cb5-8cfd-c26cc48c2694", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6f9c5ebc-24ea-5f20-9bc4-a3266027df46", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_win.exe", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '14b711bd51096796ac6b38c30e3cced197831092956a4c6ff8d1f5ebb4432212']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--532f0a1a-c6be-5f4d-82fd-24b2fd3a1d5d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--6f9c5ebc-24ea-5f20-9bc4-a3266027df46", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--05c3bae0-5473-5fb5-82ad-1b15f5c1286f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_sparc64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '1e9d18d242e3eb9165dde2704a9164e2520813c50467d16b444a738b49cfb4e9']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bd185b8a-28cd-5d2e-b1b1-e8bb6537a163", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--05c3bae0-5473-5fb5-82ad-1b15f5c1286f", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ad874073-48a4-5115-9f84-7236cb197fd4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_agent.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '4cde84a979fc9c967a3886fba6feeddf5c1ea7cb708762f1ea5ecd4d3cda62cc']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fd370d30-0f6b-55f0-a1a8-8836fce97d4a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--ad874073-48a4-5115-9f84-7236cb197fd4", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f7288f39-f2d8-5f7f-bf71-bdadcc7a1e8a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_AetherPulse.dll", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '293b1dc6e080ae3eac1de84ea384671c44cdf1d03fe51e5110749f8f358cbd64']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a533787b-d675-5cd7-ad27-d963968ac920", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--f7288f39-f2d8-5f7f-bf71-bdadcc7a1e8a", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0b43094f-04e0-5bd9-82d8-0326006a7ca7", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_cve202562215.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'ffd41695457a2fc2abe85c553553f3ac0603cf2669604b5733120b794adbd818']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--efe65c35-5db8-5c19-9659-e5ccfd0f8bb0", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--0b43094f-04e0-5bd9-82d8-0326006a7ca7", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--29ae0e28-0e12-5be4-a21e-00c00e13bb07", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_dloader.exe", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '22d4777f8a1da4131b37cbc3d5eb60dbae2a1c3db2d658d17a91ef67d3378622']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fed8d7cf-ed78-516b-9bd9-a7a4c499dc66", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--29ae0e28-0e12-5be4-a21e-00c00e13bb07", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b40e345f-4228-57b8-a589-0d51d23ee734", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit3_powerpc64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '7dc1e88b946583e7fb47a1d5797eda8e9043ed8840337d4ea00cd9414ad7532e']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e2e0095-1bd0-5729-85b5-a20b62d90154", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--b40e345f-4228-57b8-a589-0d51d23ee734", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--463defda-7c1d-52bd-8559-bc900f16f25d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit_x86_64-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '7ad718a530a2913f775e62c656060af79ffde5c1f2c04138bcc068142f162a20']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--575a52e8-f1fc-534d-9475-75a7c3c7d3f1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--463defda-7c1d-52bd-8559-bc900f16f25d", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9fd58a3b-9d2c-54f1-ad84-f6c8266bfb37", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit2_arm-unknown-linux-gnueabihf", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = '6244ffbbcb71729d31d1099b60545815a286062eb2ee2b00be07d6f05e4dc721']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9e9b7470-8118-5800-bde9-d5f2782845e0", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--9fd58a3b-9d2c-54f1-ad84-f6c8266bfb37", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--830b70cb-1659-54b5-9d20-0bb3f523cbae", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "INC_kit1_s390x-unknown-linux-gnu", "description": "Encrypteur INC (Rust, patché par victime)", "pattern": "[file:hashes.'SHA-256' = 'f9657e6ce75007f96c25bf78fd1808c0e5f7478c55ce7f976aa76765cb46443f']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5c396ea-e7f4-5047-b991-e837df3a9d00", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--830b70cb-1659-54b5-9d20-0bb3f523cbae", "target_ref": "malware--1ee662fb-9c10-5b65-8d08-9a259ee38ab5", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--394cc54c-dc5f-5c65-b741-0aa133eac42a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_BackupConsole.exe", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = '3d987e833b8dc2b4871ab1dcb8719a4159ab11d8d28b884ad84236688b428151']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e44ff1c0-ad17-5939-b0a0-1f6ea6de9bda", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--394cc54c-dc5f-5c65-b741-0aa133eac42a", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5cd0d918-02b4-5aa7-b360-39ad06521e8f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Ghost_dump_ppl", "description": "Famille Ghost (loaders, implants, outils)", "pattern": "[file:hashes.'SHA-256' = '609aa250c4b5ac9457f41f9dcfe63f983886fa7cd120e188538ebe247244ade1']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0829a865-b19f-5b0a-af0b-1bca443d63b8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--5cd0d918-02b4-5aa7-b360-39ad06521e8f", "target_ref": "malware--180b12cb-fb33-5125-a43d-0fb5c6ed8c4b", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ad7d7e5f-42b8-5e16-975f-7eb5e10d27ea", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_injectExplorer.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = '7114be5cb487e2975d2167a8660f164a3b2ec8dc1323b0f7919c5013fb5027de']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--66f9ff7d-3962-5ba6-bb54-8cf8b15b2918", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--ad7d7e5f-42b8-5e16-975f-7eb5e10d27ea", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3042513b-12e0-52ec-a971-993ef2386a39", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Phantom_nightmare.dll", "description": "Framework Phantom (post-exploitation)", "pattern": "[file:hashes.'SHA-256' = 'e9285e5adc7bded1b4883e4f16cec6ea332d73d9f495f807229222fbac1dd2ce']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3b88a785-c3ea-5b2d-ba3c-a35001c019bc", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--3042513b-12e0-52ec-a971-993ef2386a39", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--680574c7-e019-56ec-8c22-75d5efb75bb4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_agent_x86.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = '4bb026581df62b024c8e3a15d0e52ff8d45124695c6e71ea14756abec409b15e']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b7a3f72d-9a1b-54fe-8db1-c7beedf2420d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--680574c7-e019-56ec-8c22-75d5efb75bb4", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c47e112d-6c09-5d53-b08e-ca5f72ca456e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "RevSocks_agent.exe", "description": "Proxy SOCKS inverse RevSocks", "pattern": "[file:hashes.'SHA-256' = 'd91e304a337858f2dcfbf1e6a366f95320fb0400022a4326487b648b9898a36d']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c587bc66-572f-5b61-937f-2a9c72f90da6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--c47e112d-6c09-5d53-b08e-ca5f72ca456e", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--05983e98-d36e-56b6-bacd-307b2b79e287", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Global\\WinSvcUpdate_7B3F", "description": "Ghost_loader.exe", "pattern": "[mutex:name = 'Global\\\\WinSvcUpdate_7B3F']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--25fb0bdb-1796-5322-a0de-9c14a49546a8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Global\\31ae8e4090b03c3e", "description": "Ghost G6B77FE12", "pattern": "[mutex:name = 'Global\\\\31ae8e4090b03c3e']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5318f6cf-3f54-5943-bf4b-690f1c2e6f87", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Global\\d7fe5d6dcf01bf1b", "description": "Ghost G00F9FCB5", "pattern": "[mutex:name = 'Global\\\\d7fe5d6dcf01bf1b']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fa5857af-2d3f-590c-acd4-486c3ca6d759", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Local\\RustBacktraceMutex", "description": "Artefact de la bibliotheque standard Rust, present dans de nombreux programmes Rust : indicateur faible, ne pas utiliser seul", "pattern": "[mutex:name = 'Local\\\\RustBacktraceMutex']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--267fcafd-7bbe-5fa7-b2ff-cb645073d7f0", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "89.185.83.8", "description": "Origine du C2 Meterpreter (HTTPS 443), hébergeur VDSCLOUD / Digi Cloud", "pattern": "[ipv4-addr:value = '89.185.83.8']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ab72c094-5879-532e-bce3-afafb0a157bc", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--267fcafd-7bbe-5fa7-b2ff-cb645073d7f0", "target_ref": "malware--47813c3d-93d5-5236-a93c-c64719854686", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--22626223-7c6f-51d3-93bf-7db14126b8ed", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "77.110.109.248", "description": "RevSocks (dl/jeton, agent), Ghost_agent, NetCrafters OU", "pattern": "[ipv4-addr:value = '77.110.109.248']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--531964a3-a396-57b0-b7b1-3cbc77694a46", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--22626223-7c6f-51d3-93bf-7db14126b8ed", "target_ref": "malware--7a7f2c05-1658-58a4-b5ed-f98b5ed87c44", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2b472438-6e76-5351-b47e-817a0273ae48", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "138.124.123.56", "description": "Agent Phantom mcp-agent, HTTPS 8443, NetCrafters OU (absent de l article)", "pattern": "[ipv4-addr:value = '138.124.123.56']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9d4b3278-540f-57cb-9cab-d9fde0f8bfc3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--2b472438-6e76-5351-b47e-817a0273ae48", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2fd8dd4d-1cb1-5a7d-932e-e5df8a7916a3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "45.227.254.45", "description": "Hub de livraison stage1.cmd (port 8000), XWIN UNIVERSAL LTD", "pattern": "[ipv4-addr:value = '45.227.254.45']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a33f940d-cf27-5c67-995c-fc9e1854a301", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--2fd8dd4d-1cb1-5a7d-932e-e5df8a7916a3", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--94d8bc2b-5c44-5252-bfaf-7a54b49fdbf1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "45.227.254.43", "description": "Base de connaissances et source Phantom (article)", "pattern": "[ipv4-addr:value = '45.227.254.43']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--83398cc9-25ba-531b-8fef-ae8d2021b96f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "45.227.254.84", "description": "VM opérateur (article)", "pattern": "[ipv4-addr:value = '45.227.254.84']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bb8ec5f-9829-5bcd-92da-0d07aab07111", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "179.60.149.68", "description": "Rebond de staging (article), FINEISP LIMITED", "pattern": "[ipv4-addr:value = '179.60.149.68']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fbc30ad3-506f-504d-8675-1b579e838175", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "138.124.113.210", "description": "Panneau Ghost (article), Aeza Group", "pattern": "[ipv4-addr:value = '138.124.113.210']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--df0b8e37-da7e-555e-af62-32ee3d03d2d9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "api.system-strategy.org", "description": "Host Meterpreter, C2 Ghost gen A, cradle PS /api/v2/update", "pattern": "[domain-name:value = 'api.system-strategy.org']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9baa5e30-8ecd-59ce-9368-94810afc125b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--df0b8e37-da7e-555e-af62-32ee3d03d2d9", "target_ref": "malware--47813c3d-93d5-5236-a93c-c64719854686", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--12ab10fc-0493-56e8-942d-d5a58b213d05", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "cdn.system-strategy.org", "description": "RevSocks agent_cf (Cloudflare)", "pattern": "[domain-name:value = 'cdn.system-strategy.org']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--815b83d3-f38e-5600-8aa1-66c4aa88f77c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "system-strategy.org", "description": "Zone redirecteur Ghost/Phantom", "pattern": "[domain-name:value = 'system-strategy.org']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c924dda6-6279-5dce-b1a7-67cc565e99b9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "iquickline.com", "description": "Zone C2 Phantom/Athena (article), enregistré 2026-08-07 17:13 UTC", "pattern": "[domain-name:value = 'iquickline.com']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c0e4a06c-3ba3-5fa5-b191-23e7675796ad", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "mcgrawney.com", "description": "Zone redirecteur Phantom (article), enregistré 2026-08-07 17:14 UTC", "pattern": "[domain-name:value = 'mcgrawney.com']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--69910b68-c47a-5ebb-9e91-986b3fa967fe", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "driverupdate.app", "description": "Zone C2 retirée (article), enregistré 2026-04-28", "pattern": "[domain-name:value = 'driverupdate.app']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b0b2d894-317d-5359-8878-0c4828f5377a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "stackpathcloud.com", "description": "Zone C2 retirée (article), enregistré 2026-05-01", "pattern": "[domain-name:value = 'stackpathcloud.com']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d9ea704b-0e01-531a-b054-604f9ff7e615", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "cloud-update.live", "description": "Front MeshCentral (article), enregistré 2026-04-17", "pattern": "[domain-name:value = 'cloud-update.live']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f94bafb8-5e00-531a-bfaa-0920312fe568", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "bossprotect.com", "description": "Messagerie / hameçonnage (article), enregistré 2026-06-24", "pattern": "[domain-name:value = 'bossprotect.com']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--062bf156-8a72-5116-8678-b55a01456e24", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "http://45.227.254.45:8000/scripts/stage1.cmd", "description": "Cible du curl lancé par la macro Word", "pattern": "[url:value = 'http://45.227.254.45:8000/scripts/stage1.cmd']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0d6413cd-0739-5057-9234-01247e63eef4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "https://api.system-strategy.org/api/v2/update", "description": "Blob chiffré récupéré par le cradle PowerShell", "pattern": "[url:value = 'https://api.system-strategy.org/api/v2/update']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2108130d-7a12-5162-a084-fe2aa1ceb152", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "https://77.110.109.248:443/dl/6599207047fdf950a83e680bc24750da/agent.enc", "description": "Charge RevSocks (loader v2)", "pattern": "[url:value = 'https://77.110.109.248:443/dl/6599207047fdf950a83e680bc24750da/agent.enc']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bb28849b-a57d-5a43-8a07-52bec13506f6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "https://77.110.109.248:443/dl/6599207047fdf950a83e680bc24750da/agent_sc.enc", "description": "Charge RevSocks (injecteurs)", "pattern": "[url:value = 'https://77.110.109.248:443/dl/6599207047fdf950a83e680bc24750da/agent_sc.enc']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--11ab2c06-30a0-57d5-99de-787480dbd321", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "url_path : /api/v3/be13a10b476f (Chemin C2 Ghost G6B77FE12)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "url_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--cbab6687-42c9-50d6-a5d1-d76d0b657c80", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "telegram_bot_id : 8942393139 (Bot Telegram de Ghost G00F9FCB5 (secret volontairement non reproduit))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "telegram_bot_id" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f6174718-e30d-5afc-b3b1-499d616a8a13", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "telegram_chat_id : 8809711703 (Conversation de destination, Ghost G00F9FCB5)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "telegram_chat_id" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--4fa97245-753c-5714-b997-fe0459360072", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : %TEMP%\\u.cmd (Dépôt de stage1.cmd par la macro)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--c19caba0-3098-51ca-8dec-7de64a9d89bd", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : %TEMP%\\msedge_update.exe (Dépôt par RevSocks_loader_v2)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--ad28affb-8e85-5560-b2d3-5e3cb0cea2f8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\marker.tmp (Marqueur du cradle PowerShell)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--4fd0ba9b-aaf2-59f1-86d8-0f386c3fb7bc", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\Windows\\Temp\\d.dmp (Dump LSASS (zloader, pnloader))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a34078ad-fc80-5354-ae60-f207acd1599f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert : CN=Microsoft Corporation, O=Microsoft Corporation (auto-signé) (Binaires Ghost signés)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--fc586d3c-eb33-5ff9-973b-092a1098b0ef", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert : CN=SysTool Software Ltd. (auto-signé, validité 2026-06-25 à 2036-06-22) (Outils de sauvegarde / exfiltration)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6c7cbe61-e535-573d-934b-7df0b84aa11f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "build_path : C:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-* (Encrypteur INC compilé sur runner GitHub Actions)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "build_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--70f8f34a-46fe-5c3c-95a1-f289f13f935e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "91.199.163.67", "description": "Messagerie de bossprotect.com (SPF/MX), AS209272, absent des flux publics", "pattern": "[ipv4-addr:value = '91.199.163.67']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--2405f15f-bc1a-5b17-933d-2939943ea4d6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "asn : AS209272 (AS-ALVIVA Alviva Holding (Digi Cloud) : 89.185.83.8, 179.60.149.68, 91.199.163.67 ; 6 prefixes /24)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "asn" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--d9858f05-a04a-5dd2-9506-adc3ac85cc38", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "asn : AS203273 (NetCrafters OU : 77.110.109.248, 138.124.123.56)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "asn" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--88bd8242-304f-5e80-8152-39ccfc4b7c47", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "prefix : 89.185.83.0/24 (AS209272, origine Meterpreter)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "prefix" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--8098cd7d-d601-5c2c-a1fe-ac11927a1bed", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "prefix : 91.199.163.0/24 (AS209272, messagerie)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "prefix" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--03261bcb-2baa-5711-8b34-2db462819112", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "prefix : 179.60.149.0/24 (AS209272, rebond de staging)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "prefix" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--d0eb4beb-63a2-5b31-a815-19499cb67e6d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "prefix : 77.110.109.0/24 (AS203273, RevSocks)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "prefix" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--abeb2985-2a0d-53fe-b5f6-90a3c93388a7", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "prefix : 138.124.123.0/24 (AS203273, mcp-agent)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "prefix" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--d042bfb8-4fb2-5b1d-923e-c0fe774ee3df", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "http_title : StackPath - Edge Services (Page de leurre sur system-strategy.org (Cloudflare))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "http_title" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--0a444ec4-aec5-595a-bb64-de8c3268b4c6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "http_header : Host: api.system-strategy.org (destination IP directe) (Meterpreter vers 89.185.83.8)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "http_header" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--721aa5f3-2e1b-5662-81b1-d3574afc9236", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "dns_ns : coco.ns.cloudflare.com / remy.ns.cloudflare.com (Paire de serveurs de noms Cloudflare commune a cinq domaines de la campagne)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "dns_ns" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--b9798e54-6cae-5fda-b0aa-51b6198cbf23", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : tz70miRVgkbFzm/bTgs+GYk1QzVijUOTC5NjKE0MIlo= (Clé publique opérateur, lot kit1 (ELF et build Windows ec4ba1d5))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6963b707-c94f-5523-9c81-43d8182cbf41", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : pJQXFuNkDzzlRP34SykLQePNR2pUE95vPQQsIPy/cw0= (Clé publique opérateur, lot kit2 (ELF et build Windows ca02f609))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--e519e63a-d630-5580-b445-868295144544", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : rCdf4MoDNZi3/Si/Rg/nrTpExpo0UXeqzvKqqZdcS1o= (Clé publique opérateur, lot kit3 (ELF et build Windows ffd47c59))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--849341d2-1095-5ed8-a81c-72b8ebbc1d3d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "inc_id : 6abca7549cd108bf266171a6 (Identifiant patché, ELF kit1, 2026-09-30 06:08:20 UTC)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "inc_id" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--66ece1b8-d3e1-5035-9593-13d97916ed0a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "inc_id : 6abca61a9cd108bf26614b0d (Identifiant patché, ELF kit2, 2026-09-30 06:03:06 UTC)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "inc_id" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a9f0a640-9a37-511e-8b49-5ebe79ae0a85", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "inc_id : 6abca9929cd108bf2661b1cb (Identifiant patché, ELF kit3, 2026-09-30 06:17:54 UTC)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "inc_id" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f0941d0c-8c13-5ee6-a45f-aeac91e88000", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion", "description": "Blog de fuite INC, note de rançon des ELF (non visité)", "pattern": "[domain-name:value = 'incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5fea1ef1-c637-5244-b837-f06d1ee9e990", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion", "description": "Salon de négociation INC, note de rançon des ELF (non visité)", "pattern": "[domain-name:value = 'incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--378752fc-2c8e-5018-aaec-c2d7e9f2a02c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incblog.su", "description": "Miroir clair du blog de fuite INC, note de rançon des ELF (non visité)", "pattern": "[domain-name:value = 'incblog.su']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--b271604f-d489-57ba-8101-40e73373c936", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "telegram_bot_id : 8986910514 (Bot Telegram de Ghost G7CDD6836 stealth, sha256 8795abe5 (secret volontairement non reproduit))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "telegram_bot_id" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--98e674e0-484d-57f0-9dca-94f9866e8780", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Global\\5905a2d1ededb1d5", "description": "Ghost G7CDD6836 stealth", "pattern": "[mutex:name = 'Global\\\\5905a2d1ededb1d5']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--535fec8d-2cc7-54f5-b2e6-492c0a8df733", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "api.iquickline.com", "description": "C2 HTTPS 443 de l agent Mythic Athena (QuickLine.exe), profil HTTP", "pattern": "[domain-name:value = 'api.iquickline.com']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0a12bbcb-ae07-509a-a14e-f4b31f38ec60", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--535fec8d-2cc7-54f5-b2e6-492c0a8df733", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ccb3a0d9-d09e-5be0-8346-7187bfa1b37f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "https://api.iquickline.com:443", "description": "Rappel de l agent QuickLine.exe (parametres de requete q et data, chemin index)", "pattern": "[url:value = 'https://api.iquickline.com:443']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d8a8c7ae-56c3-58fb-8e27-33312514d89d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--ccb3a0d9-d09e-5be0-8346-7187bfa1b37f", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "note", "spec_version": "2.1", "id": "note--4d310887-b875-5585-a06f-3de310aea642", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "mythic_uuid : 1b1270ff-6b8f-4f62-88f4-304cc11c0662 (Identifiant de charge Mythic Athena dans QuickLine.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "mythic_uuid" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--408c6055-2d71-5653-b068-db2fae962b9b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "psk_sha256 : 613c9b9c35606656a45dd4fa56fd7388e47ec4591f547085c526d02934e61fbb (SHA-256 de la chaine base64 de la cle pre-partagee AES de QuickLine (prefixe hzbURKaR, cle non reproduite))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "psk_sha256" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--42d5b4c7-d63f-5143-a26d-aa7e01e54031", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "user_agent : Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 (User-Agent du profil HTTP de QuickLine (Athena))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "user_agent" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6691ec7e-d139-514f-97c1-9e1708ec22cf", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "user_agent : Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.3296.68 (User-Agent decode de colorui5.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "user_agent" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--78e5a3d4-16c5-5b05-af00-27668f7aa189", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "date : 2026-08-11 12:56 (Date interne de QuickLine.exe dans le zip (quatre jours apres l enregistrement de iquickline.com))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "date" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1d4ea5e1-8f9b-5d02-adb1-fa1d1b62e99f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "https://api.system-strategy.org:443/api/v2/update", "description": "Telechargement de colorui5.dll (meme charge que le cradle PowerShell)", "pattern": "[url:value = 'https://api.system-strategy.org:443/api/v2/update']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ee3e37fe-20a2-54fb-b624-7583511ce410", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "Global\\WinCC_SVC", "description": "colorui5.dll, cree seulement sous SYSTEM", "pattern": "[mutex:name = 'Global\\\\WinCC_SVC']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--18b5f34d-4ea1-52b9-8979-ec1ca99b09cd", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "export : LaunchColorCpl (colorui5.dll (exports aleatoires ClrDtlsl, ClrIeqluykod, ClrKlwpwvy))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "export" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--4f7c8215-8a95-5286-ad3d-27240667254a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_serial : 27:88:27:bd:7d:71:f8:67:4f:c1:c8:31:fa:d3:bc:18:35:2e:e0:7c (Certificat auto-signe Microsoft Corporation de colorui5_signed.dll, valide des 2026-07-09 08:04:25)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_serial" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--17271ae6-c564-520c-89e3-27fd32c8201e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_sha256 : 98:9E:66:FF:F9:9C:B6:1C:D5:BF:60:66:D8:74:EB:1E:2C:9E:37:BD:1B:57:35:2F:7F:DC:B9:9C:77:3C:EF:E4 (Empreinte du certificat de colorui5_signed.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_sha256" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f4dbe3d3-5965-5117-a68f-e4688802bb21", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_serial : 3c:0c:7f:d8:36:eb:9d:4d:7c:89:3f:52:29:c6:6e:56:1e:96:06:9d (Certificat auto-signe de Ghost_monitor.dll (Microsoft Print Service Monitor), valide des 2026-07-12 15:03:32)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_serial" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--228d01fd-69da-583e-b940-45423ee1b6bd", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_sha256 : 8B:3F:82:04:7A:33:4B:63:22:0D:8E:EF:E6:88:70:88:C6:BC:30:22:57:AC:E8:F9:C6:99:1D:7A:CC:30:51:CC (Empreinte du certificat de Ghost_monitor.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_sha256" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--ed6f0ef2-4241-58f4-9f24-5e22799422e7", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\Users\\Public\\printmon_debug.txt (Journal de Ghost_monitor_debug.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--228db41c-1d3a-5a9c-a501-313d90309f6e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\Users\\Public\\dll_debug.txt (Journal de la WINMM.dll embarquee dans Ghost_uac_bypass.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--401aac9b-91e7-52cd-bf99-b43779d36312", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : \\\\?\\C:\\Windows \\System32\\cmd.dat (Commande a executer deposee par Ghost_uac_bypass.exe (dossier avec espace))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--70484c32-1c5f-57e2-8a7f-8d4f0d29e450", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\Windows \\System32\\winSAT.exe (Copie de winSAT.exe dans le dossier fantome (Ghost_uac_bypass.exe))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--9a841126-124f-564e-afbc-40e65a5b4eae", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\Uyap\\colorcpl.exe (Cible par defaut de Phantom_elevate.exe (moniker COM CMSTPLUA))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--c66fdb60-02a1-5765-939c-84faee692767", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "clsid : {3E5FC7F9-9A51-4367-9063-A120244FBEC7} (CMSTPLUA utilise par Phantom_elevate.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "clsid" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6c6db2ea-9326-5cac-b79b-8cbd184a1d70", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "account : pnadmin (Compte administrateur cree par nightmare.dll, zloader et les exploits CVE-2025-62215)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "account" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--e3905b8b-fc22-5517-b13e-fc59cfcd6392", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "password : Str0ng!Pass99 (Mot de passe code en dur du compte pnadmin)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "password" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--2137f836-726f-58da-8305-d3762e94e0c7", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\Windows\\Temp\\s.dat (Ruche SAM sauvegardee (zloader, nightmare.dll, exploits))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--92277013-e119-52cb-bd27-44a0eafed758", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\Windows\\Temp\\sy.dat (Ruche SYSTEM sauvegardee)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--3b9c0dd6-7980-5710-9db9-732498dbcb73", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\Windows\\Temp\\se.dat (Ruche SECURITY sauvegardee)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--4904ad9b-7690-551e-86cb-69f07b1e0a38", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\Windows\\Temp\\pn_done.txt (Marqueur de reussite PrintNightmare et exploits)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--9ecc8563-607b-59e1-8208-df5ca8ba3b98", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\Windows\\System32\\spool\\drivers\\x64\\3\\nightmare.dll (Copie de repli de pnloader)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f2a902d6-ad2e-5306-b95a-2998b4e12e7c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cve : CVE-2021-1675 (PrintNightmare, Phantom_pnloader.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cve" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--87ddcd66-ca09-5487-bbd6-2c52db61931c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cve : CVE-2025-62215 (Tentative d elevation de privileges noyau, Phantom_cve202562215*.exe (primitive non demontree))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cve" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--621725b6-aba6-5fa1-9d0b-8c2e08c4ec8a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cve : CVE-2026-63030 (wp2shell.exe, desynchronisation du gestionnaire REST /batch/v1 de WordPress)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cve" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--5977fc20-fa4c-5591-9810-e957641bbbc9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cve : CVE-2026-60137 (wp2shell.exe, injection SQL via author__not_in de WP_Query)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cve" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--d60251e9-fedc-5119-a080-ed1703dba5b4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "service : ZemanaAM (Service cree par Phantom_zloader.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "service" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--31228b23-d9c0-56b3-a4a6-4e55724ce50a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "device : \\\\.\\ZemanaAntiMalware (Peripherique ouvert par zloader (IOCTL 0x80002048))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "device" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--278e6eec-7070-5f41-b7af-1c1871a2c20f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "device : \\Device\\B5A6B7C9-1E31-4E62-91CB-6078ED1E9A4F (Peripherique du pilote embarque dans quickheal-killer2)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "device" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--617d0ac4-7f61-54bb-a82b-8b9a8c6955c2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : %ProgramData%\\Microsoft\\Crypto\\RSA\\update.sct (Scriptlet de persistance (commande persist de Ghost G6B77FE12))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--9746d681-5fff-54c5-907b-4b00db975468", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "registry : HKCU\\Software\\Classes\\TypeLib\\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\\1.1\\0\\win64 (Detournement de bibliotheque de types, valeur script: (Ghost persist))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "registry" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--ce9c6da2-6bf3-53e2-b028-90e5183dec66", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "registry : HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command (Detournement fodhelper, valeur DelegateExecute vide (Ghost commande uac))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "registry" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--69cf7b6c-9f2b-57ba-9993-18a885f3b6d2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "clsid : {66666666-6666-6666-6666-666666666666} (Classid du scriptlet update.sct (progid MSUpdate))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "clsid" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--995c9cc5-20ce-5a86-adcd-f07a536424a1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "scheduled_task : RealtekAudioSvc (Tache planifiee et valeur Run HKLM de svc.py (persist))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "scheduled_task" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--4e5c4363-836f-51e7-9ed9-f43fab1e6eab", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "registry : HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\RealtekAudioSvc (Persistance de svc.py)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "registry" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--29c581f3-a0eb-5015-a6b8-67431e6fcefd", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "http_header : X-Token (En-tete d authentification de svc.py et phantom_agent)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "http_header" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--9f1d9703-502f-588f-b676-8125e2c3de63", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "url_path : /checkin ; /task?id= ; /result ; /report (Points d acces de svc.py et du mode implant de phantom_agent 2.7.0)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "url_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--024b6e60-49d4-5fc5-8001-207bc74d1ca3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : 4.0.0-svc (Version de svc.py)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--958cf963-f2e8-5e7b-9059-45bd85486bfc", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : 2.7.0 (Version de phantom_agent (WUServiceHost.exe))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--7022b099-9cfa-5e5b-8b09-3dfec589a9d8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : phantomEDR (Jeton par defaut de svc.py)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--44e4869f-5469-547f-9146-daa0c31c0571", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "vba_project_guid : {9A82AAA3-40CF-4072-A655-291C6B487148} (Identifiant du projet VBA du modele Word piege)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "vba_project_guid" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--045896c2-c090-5410-99e7-df2b0c6d858c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "doc_metadata : creator=Administrator; lastModifiedBy=Administrator; Company=[entreprise tierce, voir les notes restreintes] (Metadonnees des deux modeles Word (piste, pas une preuve))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "doc_metadata" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a8bd84fc-d001-5e08-93c3-34095bdf6694", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "timestamp : 2026-09-01 05:29:00 UTC (Creation du modele Word piege (0a27d422))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "timestamp" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6eccb9fe-2bfa-5ddf-9371-7cef6b035e29", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "timestamp : 2026-09-01 07:52:00 UTC (Creation du modele Word vide (6fc6b7a6))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "timestamp" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--59676225-9cf9-5923-9c3d-455661bebf77", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : %ProgramData%\\Microsoft\\Windows\\WER\\ReportQueue\\marker.tmp (Marqueur du cradle PowerShell, valable 50 minutes (deja connu, precision))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--4b648d45-f978-5584-9f3f-8765176a5e46", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : C:\\Windows\\System32\\fodhelper.exe (Binaire lance apres ecriture de la cle ms-settings (Ghost uac))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--aff51f1c-4f32-5fc4-a3b3-f9c5c7cffae5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "mythic_payload_uuid : 1b1270ff-6b8f-4f62-88f4-304cc11c0662 (QuickLine (agent Mythic .NET), UUID de charge utile)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "mythic_payload_uuid" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0fe3d521-05b1-5a70-bb2b-ee79862935f8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "https://api.iquickline.com", "description": "C2 HTTP de QuickLine, port 443, profil HTTP Mythic", "pattern": "[url:value = 'https://api.iquickline.com']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cfdca156-970f-523f-b2d5-8da1da85d917", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "relationship_type": "indicates", "source_ref": "indicator--0fe3d521-05b1-5a70-bb2b-ee79862935f8", "target_ref": "malware--b5455d1b-3e4d-5f4a-9991-96feecc66e1f", "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" }, { "type": "note", "spec_version": "2.1", "id": "note--92c94869-bd75-5054-8b83-fa66acfe8ae8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "c2_key_sha256 : 613c9b9c35606656a45dd4fa56fd7388e47ec4591f547085c526d02934e61fbb (Empreinte de la clé AES de session QuickLine (chaîne base64), clé non reproduite)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "c2_key_sha256" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--218542ed-1aa8-5635-8cba-6a0de6acd6b2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "kill_date : 2027-01-01 (QuickLine, date d extinction configurée)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "kill_date" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--41fde32b-15ca-5bc9-9862-4920c48399a6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "vcs_revision : 125a84a1d3c20fe94227982104cc60664ac06adf (Dépôt rks3, révision du 2026-07-06 07:31:05 UTC, arbre modifié)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "vcs_revision" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6efb6c1c-9073-5bc5-b417-003546297348", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "build_path : /root/chat/DOWNLOADER/rks3/ (Chemin de compilation Linux de rks3 (variantes v02 et auto))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "build_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--c49c869d-6e9e-52f2-ba0d-52ea5db52a7d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "scheduled_task : Microsoft\\Windows\\Maintenance\\StorageSync (Tâche planifiée de persistance de rks3)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "scheduled_task" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--0e071b64-8785-52d4-b952-b48173280257", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "vcs_revision : 82bec5be5e2368dd85448525cd63cc8a90b9734e (Commit amont Ligolo-ng 0.8.2 utilisé par ligagent, vcs.modified=true)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "vcs_revision" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--abc956cd-dc07-58b0-b286-fbef39f93d7f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "13rzip.ru", "description": "Domaine d'hameçonnage Microsoft sur l'IP de l'agent Phantom mcp-agent, enregistré 2026-08-26 chez FE-RU, serveurs de noms Aeza, certificats Let's Encrypt depuis 2026-08-27, confiance moyenne sur le lien avec la campagne", "pattern": "[domain-name:value = '13rzip.ru']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9dbba0cd-59ed-5834-9743-9236395abd0e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "login.microsoftonline.ms.gsmexchange.13rzip.ru", "description": "Sous-domaine d'hameçonnage d'identifiants Microsoft, page Sign in Payroll Portal, résout vers 138.124.123.56", "pattern": "[domain-name:value = 'login.microsoftonline.ms.gsmexchange.13rzip.ru']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d25bf0db-bf4c-54bf-8047-906c83089042", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "microsoft.ms.gsmexchange.13rzip.ru", "description": "Sous-domaine d'hameçonnage d'identifiants Microsoft, page Sign in Payroll Portal, résout vers 138.124.123.56", "pattern": "[domain-name:value = 'microsoft.ms.gsmexchange.13rzip.ru']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ff2175b-54f8-5ffe-a69a-8a19d449bd38", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "login.gsmexchange.13rzip.ru", "description": "Sous-domaine d'hameçonnage d'identifiants Microsoft, page Sign in Payroll Portal, résout vers 138.124.123.56", "pattern": "[domain-name:value = 'login.gsmexchange.13rzip.ru']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c9ea0110-1ab3-54dd-9bf6-c3af3df6cc41", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "login.13rzip.ru", "description": "Sous-domaine d'hameçonnage d'identifiants Microsoft, page Sign in Payroll Portal, résout vers 138.124.123.56", "pattern": "[domain-name:value = 'login.13rzip.ru']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f82dd9af-97d8-5ee1-82b5-8eefc6b1a126", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "login.microsoft.onedrive.13rzip.ru", "description": "Sous-domaine d'hameçonnage d'identifiants Microsoft, page Sign in Payroll Portal, résout vers 138.124.123.56", "pattern": "[domain-name:value = 'login.microsoft.onedrive.13rzip.ru']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8f86ba63-4ac8-5370-b02a-92850c47c2a1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "logon.microsoft.onedrive.13rzip.ru", "description": "Sous-domaine d'hameçonnage d'identifiants Microsoft, page Sign in Payroll Portal, résout vers 138.124.123.56", "pattern": "[domain-name:value = 'logon.microsoft.onedrive.13rzip.ru']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6456e8dd-f588-532b-8068-6af2d89ef3eb", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "autologon.microsoft.onedrive.13rzip.ru", "description": "Sous-domaine d'hameçonnage d'identifiants Microsoft, page Sign in Payroll Portal, résout vers 138.124.123.56", "pattern": "[domain-name:value = 'autologon.microsoft.onedrive.13rzip.ru']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ec84ca46-dd1f-5b3e-8e8a-de1f3e5f3370", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "https://login.microsoftonline.ms.gsmexchange.13rzip.ru/login.php", "description": "Page de collecte d'identifiants vue par urlscan.io le 2026-10-19", "pattern": "[url:value = 'https://login.microsoftonline.ms.gsmexchange.13rzip.ru/login.php']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--36fceb03-7d58-5bf6-b8cf-ff6c2aaa4f5d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "asn : AS267784 (Flyservers S.A., héberge 45.227.254.0/24 (livraison stage1.cmd, base de connaissances, VM opérateur), contact info@xwinnet.biz)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "asn" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--af23a40b-6870-5b36-918e-0f351ac8ef08", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "asn : AS210644 (AEZA GROUP LLC, héberge 138.124.113.0/24 (panneau Ghost), contact abuse@aeza.ru)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "asn" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--d9ad877f-ddc8-58d1-9767-18655b507df5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "dns_ns : a.aeza-dns.net / b.aeza-dns.net (Serveurs de noms de 13rzip.ru)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "dns_ns" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0c2c4c6a-4d6f-5178-aec5-9e30ba1ce1c2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incbackend.top", "description": "Ancien emplacement de fuite INC (API get-leaks), tracker ransomware.live, NXDOMAIN en 2026-10, captures Wayback 2023 à 2024", "pattern": "[domain-name:value = 'incbackend.top']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--53f47ff3-7111-5053-b2af-6fa09ae83519", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incapt.blog", "description": "Ancien miroir clair INC (ransomware.live, WatchGuard), NXDOMAIN, captures Wayback 2023 à 2024", "pattern": "[domain-name:value = 'incapt.blog']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--65b2628f-8048-58b3-84b8-363a3653c4be", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incapt.su", "description": "Ancien miroir clair INC (ransomware.live, WatchGuard, Strobes), NXDOMAIN", "pattern": "[domain-name:value = 'incapt.su']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9b036bda-adc4-5c44-8ded-38514933d767", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion", "description": "Emplacement de blog de fuite INC suivi par ransomware.live (non visité)", "pattern": "[domain-name:value = 'incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--11b96274-57b9-5f6e-bfc2-91e6fd7137d5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion", "description": "Emplacement de blog de fuite INC suivi par ransomware.live (non visité)", "pattern": "[domain-name:value = 'incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--db7a4a8a-c62e-53ec-9907-49084a1f840d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion", "description": "Emplacement de blog de fuite INC suivi par ransomware.live (non visité)", "pattern": "[domain-name:value = 'incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--add6444c-c5c9-5f45-80e1-9dc30ecdbf7c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incblog4uttkxd6b4grii6k2qcj2tn5k37seep5xto3dlghyqla7u7qd.onion", "description": "Onion INC saisi par SOCRadarSTRU dans ThreatFox le 2026-10-20", "pattern": "[domain-name:value = 'incblog4uttkxd6b4grii6k2qcj2tn5k37seep5xto3dlghyqla7u7qd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2d510a2e-83d8-5dd0-aa8d-50fcbf1fc7b9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incadmd42ytgp4hwkejirji4m6pcbacazoeic7fc5sd27nr7it5ajyqd.onion", "description": "Onion INC (administration probable) saisi par SOCRadarSTRU dans ThreatFox", "pattern": "[domain-name:value = 'incadmd42ytgp4hwkejirji4m6pcbacazoeic7fc5sd27nr7it5ajyqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--726a8b17-0cfe-5b26-b980-27631ae0b2fc", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "z26qmezqaixjp3k6spvdpool4us6m3ei453f7wgl7gouojmp2ttkdgad.onion", "description": "Onion saisi par SOCRadarSTRU dans ThreatFox, rôle non précisé", "pattern": "[domain-name:value = 'z26qmezqaixjp3k6spvdpool4us6m3ei453f7wgl7gouojmp2ttkdgad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--22cdbb8d-b907-53ea-935d-a34dbd2e6b64", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "karabas.corp", "description": "Domaine interne saisi par SOCRadarSTRU dans ThreatFox le 2026-10-20", "pattern": "[domain-name:value = 'karabas.corp']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3b2121e1-bcaa-595d-837c-13472afaf5fb", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "chat.mondeikin.com", "description": "Domaine saisi par SOCRadarSTRU dans ThreatFox le 2026-10-20", "pattern": "[domain-name:value = 'chat.mondeikin.com']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--022d5e6a-fff8-5699-b75d-36ee9b984458", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "ghost-relay.stk-cdn-07.workers.dev", "description": "Relais Cloudflare Workers saisi par SOCRadarSTRU dans ThreatFox le 2026-10-20", "pattern": "[domain-name:value = 'ghost-relay.stk-cdn-07.workers.dev']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--484597d7-8f2c-5c66-8443-c466adebbc27", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_port : 77.110.109.248:8080 (Shodan InternetDB : port 8080 avec étiquette open-dir (répertoire ouvert), non visité)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_port" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a1cf24e3-7eb2-5262-9652-396d604912e4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_serial : 1e:a7:98:2a:fd:9d:cd:a0:69:19:b1:37:4e:77:99:78:05:ef:b4 (Certificat auto-signé Microsoft Corporation, valide un an à partir de l'heure de compilation, binaire Ghost_monitor_debug.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_serial" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--8082fd72-bbfe-567f-9502-1b7e105a8711", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_sha1 : 64c1a0bd176332aed3e4d5dc4b3c2bca771b681c (Empreinte du faux certificat Microsoft, binaire Ghost_monitor_debug.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_sha1" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6e4d3e46-51a5-5e16-b328-cecbb712036d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_sha1 : 20f2383c7be090a486c1dccba76d3f39e3a4d5fc (Empreinte du faux certificat Microsoft, binaire Ghost_monitor.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_sha1" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--b8433670-ebd2-5fa9-b2db-0186fa7eabe5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_serial : 2b:e7:03:e2:58:e3:db:61:a8:b4:8c:61:33:33:81:6e:a6:f5:1f:f3 (Certificat auto-signé SysTool Software Ltd. (GB, Londres), signature horodatée par DigiCert le 2026-06-27 06:14:17 UTC, binaire Phantom_BackupAgent.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_serial" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--612ef84d-e41e-5fe6-99c5-4ef979b6f80d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_sha1 : 56824506fb968a8a2646e91ef8bba19fd07b796c (Empreinte du certificat SysTool, binaire Phantom_BackupAgent.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_sha1" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--442ca24d-8caf-5af1-a9bd-f43a6f7f6dba", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_serial : 7e:63:40:c7:73:24:fe:2a:c5:90:1f:58:ec:34:9e:cf:6b:af:b3:58 (Certificat auto-signé Microsoft Corporation, valide un an à partir de l'heure de compilation, binaire Ghost_uac_bypass.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_serial" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--867154e0-4eea-5c3c-ba41-e3d5de00fa36", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_sha1 : cb49dd714f9f38d523deb69eacb0712d47f5d139 (Empreinte du faux certificat Microsoft, binaire Ghost_uac_bypass.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_sha1" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--502487aa-41cd-59b0-b542-4fc254f0d458", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_serial : 39:03:95:b6:a6:aa:f9:1c:41:71:81:94:85:f7:b3:2e:ec:8e:ce:bf (Certificat auto-signé Microsoft Corporation, valide un an à partir de l'heure de compilation, binaire Ghost_G00F9FCB5.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_serial" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--df1b9517-f0c5-56c5-beea-315e5a5c2f8a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_sha1 : b1ef52600285b301f350bab45dd4d196ca42ae9e (Empreinte du faux certificat Microsoft, binaire Ghost_G00F9FCB5.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_sha1" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--feefefed-7bdb-5958-a669-5b23311ab461", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_sha1 : 17a92c5decfcbade15137b16b334009b7059c842 (Empreinte du faux certificat Microsoft, binaire Ghost_colorui5_signed.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_sha1" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--3b38f393-eadc-5dca-8dad-24e13775fbef", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : 9vrlSsDq1UH/iezZh/nkgSBQjKSqcwWmZpY1lMI1DDw= (Clé publique opérateur de l ESXi INC 86d04474, victime distincte des trois lots)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--bfeaa350-da5b-59ae-baed-31f898480ef3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : 5047zB79intd5vl7oY5i0ofoZFYfuhhqxnNDDvMG5Fw= (Clé publique opérateur du septième build Windows INC c20411a8 (compilé 2026-08-03), marqueur PATCH_CONFIG)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--70f454a7-7342-545a-9dea-5596d8fd9754", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_port : 179.60.149.68:8443 (Port relevé dans la liste publique Maltrail inc_ransomware.txt, non vérifié par l analyse)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_port" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a17efe6d-2059-5950-9ed0-ccae958726df", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_port : 45.227.254.43:8443 (Port relevé dans la liste publique Maltrail inc_ransomware.txt, non vérifié par l analyse)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_port" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--5517097d-d89e-507c-afda-e49eb5fa2eb0", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_port : 45.227.254.43:8899 (Port relevé dans la liste publique Maltrail inc_ransomware.txt, non vérifié par l analyse)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_port" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--3855f9ef-616f-5cc8-89e6-52ec5e50e3b6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_port : 45.227.254.45:8443 (Port relevé dans la liste publique Maltrail inc_ransomware.txt, non vérifié par l analyse)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_port" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--91c630d2-1ad5-595c-a639-8b0fdf2016ba", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_port : 45.227.254.84:8443 (Port relevé dans la liste publique Maltrail inc_ransomware.txt, non vérifié par l analyse)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_port" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--cc7737e6-27d1-52a1-8198-390f21e8ee31", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_port : 77.110.109.248:8443 (Port relevé dans la liste publique Maltrail inc_ransomware.txt, non vérifié par l analyse)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_port" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--11da2ce2-c4ed-546a-bd3a-8a5d4d799396", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_port : 138.124.113.210:22 (Port relevé dans la liste publique Maltrail inc_ransomware.txt, non vérifié par l analyse)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_port" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--87b48c1b-8b14-560c-b475-6202962b1d62", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion", "description": "Note de rançon INC (C++ 2024-02), build 508a644d552f (non visité)", "pattern": "[domain-name:value = 'incpaysp74dphcbjyvg2eepxnl3tkgt5mq5vd4tnjusoissz342bdnad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--90a520f1-36a1-5005-8d0b-a7f5f39065db", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ca3fd9f8-b34e-5940-bc4d-1b7926112e43", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1b96f5a4-b6e8-575c-8142-f71ff5c44548", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a2722c61-968d-5fd5-92c0-3de8d3fd31ae", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9de4ccd2-cc5c-5e85-aff8-10d45e64431a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c2296d24-5812-5773-9a19-788923b5d054", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3c544176-ce94-5e26-90d0-748bbe35131c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c49fd766-f7f2-50b4-812c-2d47745ec343", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d852e4d-94d4-52ac-9416-45ddbaff6faa", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--08924cb2-000b-5250-bc52-a6c9650ef9f0", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--38e08a57-15a6-5a2b-b60b-7bd7713d03b9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--972f486d-9b83-5988-9ad3-389e3c5e93d8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5200c27e-cb1f-5279-93c3-df47b435d746", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ce0d0a51-6481-5df8-8493-1ed1505465c5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion", "description": "Note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f86cec95-efb2-5038-aa64-3dc39ae7cea4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxblog.net", "description": "Miroir cité dans la note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxblog.net']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--03b655b0-d56f-532f-9551-0652293c7d39", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxchat.net", "description": "Miroir cité dans la note de rançon Lynx, build 80908a51e403 (non visité)", "pattern": "[domain-name:value = 'lynxchat.net']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--28375396-c145-5a41-bf74-e4cef2ae6d07", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onion", "description": "Note de rançon Lynx, build ecbfea3e7869 (non visité)", "pattern": "[domain-name:value = 'lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3aff92b8-f453-5659-a022-de17cfce3670", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobi23i75c3znmqqxxyuzqvhxnjsar7actgvc4nqeuhgcn5yvz3zqd.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobi23i75c3znmqqxxyuzqvhxnjsar7actgvc4nqeuhgcn5yvz3zqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ee63a380-4893-543f-b636-88518aa6c31a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobi57mfegeov2naiufkidlkpze263jtbldokimfjqmk2mye6s4yqd.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobi57mfegeov2naiufkidlkpze263jtbldokimfjqmk2mye6s4yqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7840e1c4-9e26-5df7-a3ea-1b87ab83fd8a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3a16b15b-1d32-5224-8d65-662a52499e99", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobi6rlec6f2bgn6rd72xo7hvds4a5ajiu2if4oub2sut7fg3gomqd.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobi6rlec6f2bgn6rd72xo7hvds4a5ajiu2if4oub2sut7fg3gomqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--20f665a2-9f68-5e32-aaf6-21ae871c0cd9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobi6ywgmmvg2gj2yygkb2hxbimaxpqkyk27wti5zjwhfcldhackid.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobi6ywgmmvg2gj2yygkb2hxbimaxpqkyk27wti5zjwhfcldhackid.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b61496-a793-5090-9b6f-bcd8332b5bca", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobi7l3wet3uqn4cagjiessuomv75aw3bvgah4jpj43od7xndb7kad.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobi7l3wet3uqn4cagjiessuomv75aw3bvgah4jpj43od7xndb7kad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ba490ee-1350-555e-949f-8c0c32842090", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobi7sukclb3ygtorysbtrodgdbnrmgbhov45rwzipubbzhiu5jvqd.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobi7sukclb3ygtorysbtrodgdbnrmgbhov45rwzipubbzhiu5jvqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b6e4286c-f643-5b24-84cb-a6dba58415ba", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobi7yuoppj76qnkwiobwfc2qve2xkv2ckvzyyjblwd7ucpptl62ad.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobi7yuoppj76qnkwiobwfc2qve2xkv2ckvzyyjblwd7ucpptl62ad.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--163ba31a-6be2-527b-a984-2b799d3a28d9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobia6mw6ht2wcdjphessyzpy7ph2y4dyqbd74bgobgju4ybytmkqd.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobia6mw6ht2wcdjphessyzpy7ph2y4dyqbd74bgobgju4ybytmkqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--158db7ca-4aa0-5a05-bf23-c39e127c5bc3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobibdvzohujkliofkxiz3ueyedfh6bed2lzjz2z6pafw5jeoptsid.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobibdvzohujkliofkxiz3ueyedfh6bed2lzjz2z6pafw5jeoptsid.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--149e9e55-d56f-5abc-8dba-a329d0b0a601", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobibjqytwqxjw24zuerqcjyd3hoow6zia7z6kzvwawivamu7nqayd.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobibjqytwqxjw24zuerqcjyd3hoow6zia7z6kzvwawivamu7nqayd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--674e3a84-abb0-5a9a-ad33-1249f2800674", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobicrh73ongfuxjajmlyyhalvkhlcgttxkxaxz3gvsgdcgf76uiqd.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobicrh73ongfuxjajmlyyhalvkhlcgttxkxaxz3gvsgdcgf76uiqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4800f39e-e13b-579f-a86d-02418f562c88", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobidxodgt4jsr3tlmf2rr4okjvvwfp5gh3lrqxnowomcx62ssrhqd.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobidxodgt4jsr3tlmf2rr4okjvvwfp5gh3lrqxnowomcx62ssrhqd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--074f8c6d-0fdf-5cda-9821-2e5289a2c156", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "sinobiea4snfqtkc43paumapo4oi7vxcy5vjzfoalunsnvzehozfhpyd.onion", "description": "Note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'sinobiea4snfqtkc43paumapo4oi7vxcy5vjzfoalunsnvzehozfhpyd.onion']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6c676d89-bcac-5f5f-a243-881ee3f88e93", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "blog.sinobi.us.org", "description": "Miroir cité dans la note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'blog.sinobi.us.org']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--504f0f3d-fcb5-55bb-92bb-099e6eda7e0c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "chat.sinobi.us.org", "description": "Miroir cité dans la note de rançon Sinobi, build d4919a7402d7 (non visité)", "pattern": "[domain-name:value = 'chat.sinobi.us.org']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--54e9ded3-9a0d-5b53-b51f-0af3193a4d44", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxr.blog", "description": "Miroir cité dans la note de rançon Lynx (ELF 2025), build e16ac4475e24 (non visité)", "pattern": "[domain-name:value = 'lynxr.blog']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0af7b90c-4cfd-5974-82ff-50b06642d3de", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "lynxr.help", "description": "Miroir cité dans la note de rançon Lynx (ELF 2025), build e16ac4475e24 (non visité)", "pattern": "[domain-name:value = 'lynxr.help']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--9c73a062-e299-57e2-b489-6d642e4e862c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : zeiy/sLCGyY/W0AdCffsyKj3GuXcIa+ZY7FFXaxmDiQ= (Clé publique d'opérateur patchée, INC, ELF, build c41ab3398692, identifiant 6626886fff06b807bef8daeb, 2024-04-22 15:55:27)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--b46d6813-02a6-5b09-9b87-1dfc5f3b9ac2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : KsFFvIJ0282dwVUpFFLLYgXiX2R+766s6pXcz84uMhI= (Clé publique d'opérateur patchée, INC, PE32, build 81f0cbb2544e, identifiant 67118dee54d7f122013a83c5, 2024-10-17 22:21:34)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--965a5601-febb-557d-a1fb-3f78183fb669", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : s9CMLiszaFyIy4nVlWTbHEmyYAwBTVUP8Pb/7EhT9yA= (Clé publique d'opérateur patchée, INC, PE32, build 1a7c754ae193, identifiant 66845ed83547f22b7c8c2ae9, 2024-07-02 20:11:04)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--9c0f9315-86b4-5194-9d03-9d9a51c7e054", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : JHZNV94StSE9Xrfzig8dK/QcxrLOJGkrCqwJZ7uxa2M= (Clé publique d'opérateur patchée, INC, PE32, build 1a50f5f75256, identifiant 66c59a914b30850609445382, 2024-08-21 07:43:13)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--75b099ca-90cb-5b6c-9354-3685cd310498", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : xpCIljkzZPRelNvkYnPNiKCuajtmLb0iv4CHUJs4dAk= (Clé publique d'opérateur patchée, INC, PE32, build 2f14eaeb439b, identifiant 67184d6654d7f1220165e459, 2024-10-23 01:12:06)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--aa3e3bd8-296c-5c71-bc71-3bf303101136", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : xtEQ4ry0dRpYhr6KrYoWi01z1POuYDAWoaeuHCPlDEU= (Clé publique d'opérateur patchée, INC, PE32, build 7ccea71dcec6, identifiant 66b8d9944b308506090b1a88, 2024-08-11 15:32:36)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--45996def-8eb7-5930-a71d-d1e0a94f16d4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : BlX2iQLQtT8Wv090ToWWt4CKhVoWnmCsgRg6IU7ZYFc= (Clé publique d'opérateur patchée, INC, ELF, build 7d0c735c8b5b, identifiant 66f7edc94b308506094ab4ca, 2024-09-28 11:51:37)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f6cd5f66-bca4-59fe-859d-ab0fe9b93663", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : P6hWYF6pYMiS0O1+HokXRxEqcxDjk3p6T92hJL2BGl0= (Clé publique d'opérateur patchée, INC, PE32, build 7f104a3dfda3, identifiant 66583e83b24e38251bd1e479, 2024-05-30 08:53:23)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--ee58aac9-c8f4-5533-bd5e-110ece15f619", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : OMoS2NFMNY4/Ng4/K1+1pR470XTzWVGB1Bcgxcd6CWs= (Clé publique d'opérateur patchée, INC, PE32, build 9ac550187c7c, identifiant 664425e7b24e38251bc125c7, 2024-05-15 03:03:03)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--7cd9b647-747f-5c61-b183-522acb9ee4f8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : IUuM/8/r5NN3HVwh7ZvwKiovOCLr+R0M2IwlNCciGFQ= (Clé publique d'opérateur patchée, INC, PE32, build 63c0a44479dc, identifiant 6700ba8354d7f12201d6dfc7, 2024-10-05 04:03:15)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--3a3f3615-a189-588b-9d1e-41512a5f4b33", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : iZQVOFj8/NBFpYnFdUHvnUhwl3an2qKVfM5ZwmqktH8= (Clé publique d'opérateur patchée, INC, PE32, build 508a644d552f, identifiant 11661BA5DF6B2B1A, 2024-02-17 13:04:25)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--5b57a0b3-cce9-50e9-b707-6fb4bc8b38cd", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : Zbkm+fzC8NkmPhZOZDsjLL+NCW12+UglT0o90yoSBhs= (Clé publique d'opérateur patchée, INC, PE32, build 834c5f094c4a, identifiant 66fc50b40f2741b9217abd75, 2024-10-01 19:42:44)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a74e6480-ed92-5364-8eb2-fb9d0ec433b1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : genv3WVGHuunYey6FuC2EfZJaqm6CUhuishHHBrFOiE= (Clé publique d'opérateur patchée, INC, PE32, build 463075274e32, identifiant 66b92ced4b308506090cc38f, 2024-08-11 21:28:13)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--656ccbcb-fe72-5d85-b574-9bff6d97b7cc", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : FJLYUHujqF8IdiatdEXgxP2DcTI17d8BtZnpdW5Tax4= (Clé publique d'opérateur patchée, INC, PE32, build a5925db043e3, identifiant 669a82274b30850609840b67, 2024-07-19 15:11:35)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--492aad59-7257-5e2a-8c70-a8da25281ea2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : yZsh3T6RLK6oIM9i4SwivPrTQ/h9K3aQZVC+X6YbLTg= (Clé publique d'opérateur patchée, INC, PE32, build c600e439da89, identifiant 672c9b8838e2eaa58b0321d3, 2024-11-07 10:50:48)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f9124d38-47fc-5b28-ae38-b60c39301ad9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : eDjuaqSx/xvx1Iut6MfRWDvbVNKawgvP404lRVJBg2A= (Clé publique d'opérateur patchée, INC, PE32, build d147b202e98c, identifiant 662cb73c7cc626fa13c9d88c, 2024-04-27 08:28:44)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--c74d4d56-13ea-5b61-82c2-5ed069055561", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : MzZ77cxI3Pdm4PboB2cgMDjhpmUb+lzB80NNtRgMxkU= (Clé publique d'opérateur patchée, INC, PE32, build e17c601551df, identifiant 667681103547f22b7c64f692, 2024-06-22 07:45:20)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--97c5502e-92dc-59f5-bb08-35e97a5207b4", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : FPqOmFtiew6mV7F/ZNVxuhziURPNdl1WaTEEJve/R3c= (Clé publique d'opérateur patchée, INC, PE32, build ee1d8ac9fef1, identifiant 66639c343547f22b7c402e22, 2024-06-07 23:48:04)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--62850b6b-0502-595a-9682-04d269195247", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : dNy3AAgv/95DvVwJ7cshMn7GTWv92d00aSluw0Ob+UY= (Clé publique d'opérateur patchée, INC, PE32, build 02f451f99b24, identifiant 6705ae3654d7f12201f62bf4, 2024-10-08 22:12:06)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--17c27a6e-7a07-5257-b86f-9bf2cb62c6cd", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : 4rde0gbI4V70bsN85wlu6lIZbGVyrlT/bbErFVIOu1U= (Clé publique d'opérateur patchée, INC (2023), PE32, build 05e4f234a0f1, identifiant absent, 2023-12-20 21:05:16)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--9574bc6c-ec15-5b80-835b-bdcfd5f689c3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : WXJUAcfCAeEU4utoXyBIdQMus6wnVRbbHgm8ivzRxSQ= (Clé publique d'opérateur patchée, INC (2023), PE32, build 11cfd8e84704, identifiant absent, 2023-09-21 20:43:06)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--02b120a9-c3dc-577a-bb5f-43a8213bb1ba", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : ZFRBKXpfmCT7grusQz7fFOdhUNexDQVqD0CDN77vN30= (Clé publique d'opérateur patchée, INC, PE32, build 36e3c83e50a1, identifiant E4FFEDDCC3F66618, 2024-02-17 13:04:25)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--8efc7a3f-157b-55a6-b421-e76d5f272fe2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : cRtBSsZ18yBwTWtW5IYJG8pfGWJ5KazQF9vivSa1mBA= (Clé publique d'opérateur patchée, INC, PE32, build 02472036db9e, identifiant 665af7f73547f22b7c347ef4, 2024-06-01 10:29:11)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--76045da2-e01c-57a1-bce5-14ffb8c3311c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : sHMAKbOQGRNSXZsTmncjXJTD9HadRuFuD5YErXXIDkg= (Clé publique d'opérateur patchée, Lynx, PE32, build 80908a51e403, identifiant 677d82cf05a779c3d3a87924, 2025-01-07 19:38:55)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--bd5bbc74-2f3e-51ca-9826-e4d64ec070f6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : c2/yPJmKhfiTyqn7joIg7AF4gutJ/a4915mgP3gN3x4= (Clé publique d'opérateur patchée, Lynx, PE32, build f71fc818362b, identifiant 6786db0705a779c3d3d61d44, 2025-01-14 21:45:43)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--25968e0e-d6fc-5c1b-b0f0-faf7c9e87c0c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : j+efTsPyp+/4l403WU6a6802IFn9X4AFxT3PRVpbHHE= (Clé publique d'opérateur patchée, Lynx, PE32, build ecbfea3e7869, identifiant 66c5a9d8a3128b5353455a6d, 2024-08-21 08:48:24)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--1f23b234-8ad1-5c36-bd65-c9f949b88e7c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : 0z56r3x02/bBAS9bQ1lJTEg0D7JXNnNYT0k7JOPl1i8= (Clé publique d'opérateur patchée, Lynx, PE32, build 97c8f54d70e3, identifiant 6727b256dab69e0ba2bec3bf, 2024-11-03 17:26:46)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--7fc0d529-b8b9-5e20-8599-446c5fd4be92", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : wJt2NajJhzpJGePjSbwFP14v+ogYh1z8xsugCPDgLHg= (Clé publique d'opérateur patchée, Lynx, PE32, build 85699c7180ad, identifiant 66fa5d1dc8dfe0f7020081e2, 2024-09-30 08:11:09)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--897e2f05-938f-50f4-a666-e733d2ed5696", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : 4l3pNCk2vjKL0zeNAnHFmK/qVW6W/0DP98OjTzy7Bxs= (Clé publique d'opérateur patchée, Lynx, PE32, build 5da4f51e3ced, identifiant 679f9d3b861630bc779d7d50, 2025-02-02 16:28:43)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--bb12b797-68af-5462-8ec2-6fd43c821ef5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : +qrWzPSeyfg0fUhcs1w8DcC5lkZneDFhRjMszivJ0mI= (Clé publique d'opérateur patchée, Lynx, PE32, build 589ff3a57413, identifiant 67137ec4cbfc63d2fb1962ab, 2024-10-19 09:41:24)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--760a9e95-724c-566a-8384-139f6f3c8195", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : 8SPEMzUSI5vf/cJjobbBepBaX7XT6QT1J8MnZ+IEG3g= (Clé publique d'opérateur patchée, Lynx, PE32, build 571f5de9dd0d, identifiant 66b33295a3128b53533bd263, 2024-08-07 08:38:45)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--940d40af-4a57-5394-9f18-fcc50722af8e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : bZEE0sSuXjc03WNaKu1bYbAbEuSuKA0BT5osCBg+GRQ= (Clé publique d'opérateur patchée, Lynx, PE32, build 468e3c2cb5b0, identifiant 6725beb1dab69e0ba2baffa4, 2024-11-02 05:54:57)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--c80a7f50-db88-5fb9-80f3-c126de9feec5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : WW0Ad4rDGce5YujLMSwBy06euCFvP7loXVUyP9TomFk= (Clé publique d'opérateur patchée, Lynx, PE32, build 432f549e9a2a, identifiant 6733466fdab69e0ba2d7c366, 2024-11-12 12:13:35)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--cab209a7-9ec6-5b01-8bd0-9e639bf45e25", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : ME05Zrv1YkuAHQBY0eDz7kMTFvxiKFgwjLF5Msaqzmo= (Clé publique d'opérateur patchée, Lynx, PE32, build 3e68e5742f99, identifiant 675a173be42beed9ed74f041, 2024-12-11 22:50:35)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--3c8672a5-ede6-5bf6-85c7-59677d6cf773", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : 47qM2VV2WYXdWNxwhKNfcMsopMxv3Mj+BNWhp9F6wi8= (Clé publique d'opérateur patchée, Lynx, PE32, build 31de5a766dca, identifiant 6715d3a5cbfc63d2fb1cf841, 2024-10-21 04:08:05)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--369870cf-bfb4-50ce-9e53-7e1b9f617421", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : Gq70ERycjoW7SmLxAcnbWs+sCiFoaw+RMQ2VG3EvFho= (Clé publique d'opérateur patchée, Lynx, PE32, build 0315dbb793f8, identifiant 67af691361c2d9c619f08a76, 2025-02-14 16:02:27)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--44c34420-abfc-5764-bd93-3479d63cbd26", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : yaVe52xy7Nb9pwpTgCgjh2nXnOIyf4TueAtBQotJRD8= (Clé publique d'opérateur patchée, INC, ELF, build 6cd349eda0fa, identifiant 6876011bc7b82dfe0b05a1eb, 2025-07-15 07:19:55)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--133e3628-b1b3-546b-b54e-47d646ee493a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : oeav7EaggRpkQ/LtZUiJMeFUvfThUOsyqVzgvDVg5gU= (Clé publique d'opérateur patchée, INC, PE64, build c3d8c86844d7, identifiant 6884d426c7b82dfe0b16837a, 2025-07-26 13:12:06)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--09c320b6-7935-5388-b6dc-980686205d1b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : mBYBztJiFJd3dgzdjooBOrhInFpOKmmGYCWXcUPoB1g= (Clé publique d'opérateur patchée, Déchiffreur INC 2.0, PE32, build 0a9a454966b1, identifiant absent, 2024-01-01 15:28:03)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--c92c3f58-bf83-50de-a922-3c1d218bd733", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : TDMDkBr38kQtRSshHvyf3zD7rr9e1AnDLOYDAVPP+BM= (Clé publique d'opérateur patchée, Lynx, ELF, build e16ac4475e24, identifiant 6859d4e1e2d7f43c8f08c1a1, 2025-06-23 22:27:45)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--35aa4fe6-c046-5929-a9a8-4069f9f24b8f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "build_path : E:\\Lynx\\Release\\Lynx.pdb (Chemin PDB des builds Lynx d'août 2024 (5501edf70e6b))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "build_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--fc519a64-0730-5a36-9967-e5ff1772c228", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "build_path : E:\\windows\\source\\inc-2.0\\Release\\INC Decryptor.pdb (Chemin PDB d'un déchiffreur INC 2.0 (0a9a454966b1, compilé 2024-01-01))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "build_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--e92db8b7-ed7a-5bd0-8b97-66105c036aaa", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : chacha20_tunnel_v3_ (Prefixe de derivation de cle de l'agent ELF vmware-usbarbitrator (tunnel ChaCha20))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6990a0e5-08d6-52c3-81d6-3bb6b429ab0a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "psk_ascii : f191074b103901bb58a4ca37494e4cf6 (Constante ASCII de 32 octets de l'agent ELF a tunnel ChaCha20 : secret de poignee de main et element de la cle (cle statique, identique pour toutes les instances))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "psk_ascii" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--09c9cde0-7c9e-52f6-80fe-69315751daa2", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "key_fingerprint_sha256 : 258945f672ad7ea45d5ca5c7686a5448ffc40fbbc4df3a607e2e54958246cdf6 (SHA-256 de la cle ChaCha20 statique SHA-256(prefixe||constante) de l'agent ELF, la cle n'est pas reproduite)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "key_fingerprint_sha256" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--ed38f090-f113-5024-9479-6a6c1f0597e5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "protocol_marker : CC20 (Octets echanges apres la reponse au defi dans la poignee de main du tunnel ELF (client et serveur))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "protocol_marker" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--0383194a-54c9-5aa4-a0c3-ff01c112d8c5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_port : 77.110.109.248:443 (Serveur de rappel code en dur de l'agent ELF vmware-usbarbitrator (tunnel ChaCha20))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_port" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--41c241f1-5c0b-565e-add8-1d7710134e37", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "default_value : esxi (Nom d'hote par defaut de l'identification de l'agent ELF vmware-usbarbitrator)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "default_value" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--e864670c-4f22-5fd9-99e1-819158ec719a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "default_value : root (Nom d'utilisateur par defaut de l'identification de l'agent ELF vmware-usbarbitrator)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "default_value" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--097305b6-4269-5734-ba89-9606b5444494", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "export : AroBuq (Export de Ghost_AetherPulse.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "export" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--d72f6165-e8b6-51c4-ae8b-65722bc57c9f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "export : BxgWzt (Export de Ghost_AetherPulse.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "export" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--07b3a939-9ec1-5e76-871f-8e04545d5cb3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "export : DomDraw (Export de Ghost_AetherPulse.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "export" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--16ec1fe4-4b5b-5604-9bab-4ab327e79000", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : AetherPulse.dll (Nom de module recherche dans la liste des modules du PEB par Ghost_AetherPulse.dll)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--253be8b0-a771-58b5-88d2-fadd3b0b7b2d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "141.98.83.180", "description": "Serveur de livraison et de rappel RevSocks de septembre 2026 : injecteurs inject_explorer et inject_system (URL XOR 0xcb) et agent 90fe2b57 (rappel 443)", "pattern": "[ipv4-addr:value = '141.98.83.180']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a31b01c4-0602-59af-8cfa-5b90311ef54f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_port : 141.98.83.180:443 (Rappel de l agent RevSocks v4 90fe2b57 et hote du telechargement agent_sc.enc des injecteurs de septembre)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_port" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--80fcee79-2354-5779-9bbe-e0ed585d5a1b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "https://141.98.83.180:443/dl/fc971225a48ff03d1596fe0b6cb180af/agent_sc.enc", "description": "Charge des injecteurs RevSocks inject_explorer et inject_system (URL masquee par XOR 0xcb dans le binaire)", "pattern": "[url:value = 'https://141.98.83.180:443/dl/fc971225a48ff03d1596fe0b6cb180af/agent_sc.enc']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f1cdc334-7516-513b-a906-a799189c99c1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "dl_token : fc971225a48ff03d1596fe0b6cb180af (Jeton du chemin /dl/ des injecteurs de septembre, differente du jeton de juillet)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "dl_token" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--7296cd70-721f-5bd8-98eb-9683b29589b0", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "xor_key_sha256 : aa34aa798ca25952ae9c3e8508bb0cc3aec19f391364226fe021de043f54fb9f (Cle XOR de 32 octets de agent_sc.enc des injecteurs de septembre (prefixe 7ba522d8), cle non reproduite)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "xor_key_sha256" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--45c1cb33-dba0-5ff1-9470-1ca4e9161fe3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "xor_key_sha256 : edcdea8974f2e54d61f4406787633f9c094f8f3daf536c11cfd4098bf19c6be2 (Cle XOR de 32 octets de agent_sc.enc des injecteurs de juillet (prefixe 52ade221), cle non reproduite)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "xor_key_sha256" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--7224d31b-c88a-52ea-a869-66e014a60038", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "xor_key_sha256 : d07725f4fc61c452e1ad5edab662b604ef66bb43da55ecf69673ac485addac04 (Cle XOR de 32 octets de RevSocks_loader_v2 (prefixe deadbeef), cle non reproduite)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "xor_key_sha256" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--219bcb84-2cbe-5d25-9faa-a2cfd9d62772", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : chacha20_tunnel_v4_ (Prefixe de cle de la version 4 des agents RevSocks (stocke XOR 0x5a))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--fa37c361-eaed-5a3a-b5f6-755869d2103c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : CHANGE_THIS_SECRET_KEY_32_CHAR (Gabarit de secret non patche des agents v4 d91e304a et 4bb02658 (stocke XOR 0x5a))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f30a844d-963b-5395-bcc7-236e4dc728a6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : CHANGEME_IP (Gabarit d adresse non patche des agents v4 d91e304a et 4bb02658 (stocke XOR 0x5a))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a4319dd3-802c-52f5-924c-e55746404fe6", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "url_path : /tunnel/%s (Chemin de la variante HTTP des agents RevSocks derriere cdn.system-strategy.org (session de 32 hex))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "url_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--362029f1-0e2c-59ba-abbd-f7fbc85f9f96", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file : C:\\cf_debug.txt (Journal de la version de mise au point RevSocks_cf_debug, ecrit le secret en clair)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--0fde3258-a200-5739-ac7f-236ca3dcb5e7", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "user_agent : Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 (Injecteurs RevSocks de septembre)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "user_agent" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--573a324a-3938-5fac-9f40-26637003c2a7", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "process_target : WmiPrvSE.exe;spoolsv.exe;SearchIndexer.exe (Processus cibles des injecteurs SYSTEM)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "process_target" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--4d53a58a-62e0-5dfb-aed6-5aee90c7333e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "process_check : VBoxService.exe;vmtoolsd.exe (Processus de virtualisation recherches par les agents v4)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "process_check" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--991cfeb1-ee18-5efc-bbc9-c97e7fbdaa9a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : tjCShFODz0YforRLcNTbLGIwGsEkdxSVfZ4XZ0eWHQk= (Clé publique opérateur du chiffreur Lynx PE 32 bits emballé dans l extracteur IExpress 4fbbf0d94f, identifiant 6723491ddab69e0ba2b5ead7)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--d7bfc24f-680c-517b-bcc3-20dfb5c07fed", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "inc_id : 6723491ddab69e0ba2b5ead7 (Identifiant patché du chiffreur Lynx de l extracteur IExpress, horodatage 2024-10-31 09:08:45 UTC)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "inc_id" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--111a1ac9-1bb6-5cad-82dc-9cb72b46070b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "x25519_pubkey : Il2uG3L5S9oCrKxvozNzWSynv8ZWxN09+9w8aLpAhBE= (Clé publique opérateur du chiffreur Sinobi d4919a7402)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "x25519_pubkey" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a07679ff-7016-5fd8-8c08-5f0150247b10", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "inc_id : 68676f1e88b6823fa29f32cb (Identifiant patché du chiffreur Sinobi, horodatage 2025-07-04 06:05:18 UTC)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "inc_id" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--518f2f38-e52c-5ca2-8e52-49930ca66c43", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : WinRaR Setup Wizard (Titre IExpress du paquet Lynx qui imite l installateur WinRAR 7.13)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--004e51a5-1d10-5d8e-9054-21694c39e83f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : LYNX ENCRYPTED YOUR FILES!! (Message de fin de l extracteur IExpress Lynx)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--4a6a504c-c5ad-5798-9102-dc07811ba62e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "benign_decoy : 5906db91965e359f0577b7fae847d6ab4901e791da0ba5fb4dee8079284cda30 (Installateur WinRAR 7.13 authentique et signé, lancé comme leurre par l extracteur Lynx : ne pas bloquer)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "benign_decoy" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--91fc1936-c7ef-5175-8cbc-04bb02602446", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "pdb_path : D:\\编译大灰狼\\大灰狼\\PcServer\\Release\\PCS.pdb (Chemin de débogage de l outil d administration à distance de l archive protégée)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "pdb_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--d67670b9-7bf8-5bdc-8d6c-4e804d98daf9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "pdb_path : D:\\编译大灰狼\\大灰狼\\Release\\Main.pdb (Chemin de débogage du PE embarqué)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "pdb_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--3f48ae83-a65f-5065-acef-85a86a972a49", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_serial : 3C16154E4D7DE3DCE12A0030A213491F (Certificat EV SSL.com au nom de une société tierce, signe db15f45f, valide 2024-09-05 à 2025-09-14 : à signaler à l autorité de certification)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_serial" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6b7f3c10-5766-5aaf-889a-17f4e1840b6b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_sha1 : 8ECFB3A1CD45308C84C219A28D202290E0AF5575 (Certificat de signature une société tierce)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_sha1" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--2ae06cd3-0726-5ccd-bced-bcdf1443e36b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_sha256 : 7A79024EF245EC0FC73482BF140C2B2D755F174E3749FEBE5EE73A462A84C5AA (Certificat de signature une société tierce)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_sha256" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--c97ab5cb-bdf0-5764-b229-a683804cfe8b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "word_docid : {C29A4996-9E26-47DC-AA2E-5A0B40D72E47} (Identifiant de document du modèle Word piégé 0a27d422)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "word_docid" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--063d6e18-3b90-5f3b-bbd0-b5a4027ce18b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "word_docid : {BA009202-CA7D-4A83-936C-FB72440526CF} (Identifiant de document du modèle Word vide 6fc6b7a6)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "word_docid" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a7bd7bc1-72e2-5a8f-b277-bffd2fa38b3b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "word_rsid : 00E92A0A (rsidRoot du modèle Word piégé)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "word_rsid" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f0a64cc1-db89-570e-bedf-4288ab3e8634", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "word_rsid : 00757113 (rsidRoot du modèle Word vide)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "word_rsid" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--0a48e932-e76f-5207-ad8f-8ca2605a95d5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "vba_reference : C:\\Windows\\SysWOW64\\stdole2.tlb (Référence du projet VBA : Office 16.0 32 bits sur Windows 64 bits)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "vba_reference" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--abd465c7-3de6-5aef-8364-71f4822550f0", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "path : /opt/c2/ghost-api-tg/builds/G7CDD6836/loader_go/main.go (Chemin de compilation du chargeur Ghost_OneDriveSync (service de generation ghost-api-tg))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--89c1d397-d7b2-50d2-8fdf-fff83664ef18", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "path : /opt/c2/go-dump-clean/cmd/dump/main.go (Chemin de compilation de Ghost_sysconfig)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--2cfa9f71-4087-5542-b229-1fb6bf983174", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "path : /root/chat/BackupConsole/cli-v4.0/source/main.go (Chemin de compilation de BackupConsole CLI)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--268eb40d-b289-5366-9870-1e8db05e3d7b", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "path : /root/chat/BackupConsole/gui-v3.2/source/main.go (Chemin de compilation de BackupConsole GUI)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--5acba8cc-a603-5d41-8485-c83e5e5208c1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "path : /root/backupagent/restic/cmd/restic/ (Chemin de compilation de Phantom_BackupAgent (restic recompile))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--eaf3aa8b-7c0a-56e4-b0d9-044bc7c29695", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "url_path : /api/v2/tool (Route de l'API C2 interrogee par Ghost_dloader)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "url_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--e4c8f8a7-7594-5e46-972f-627c19cee308", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : Usage: loader.exe -i [-debug] (Message d'usage de Ghost_dloader (masque dans le binaire))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--070ef657-02c1-57c1-aba4-b3867830e666", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : [+] LSASS forked! Clone PID: %d (Message de Ghost_dump_ppl (masque dans le binaire))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--fde341ac-dafd-5556-b5e2-6dfb450427e8", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : Ghost: BackupAgent PID %d launched (Journal de BackupConsole en mode ghostSend)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--9a245003-0ce8-5faa-b2f6-406ac4a41943", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : SysToolUpdate (Nom de la tache planifiee supprimee par le nettoyage de BackupConsole)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--5ea18f51-b88f-5435-87e4-baa681078687", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : OneDrivesync.log (Journal de Ghost_OneDriveSync sous LOCALAPPDATA)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--13b23dcd-4196-52f6-bb80-bf086ae706f9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : Enterprise backup management console (Description de BackupConsole)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6fbf0b86-3460-5311-b8d5-dc7df0eaf297", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "imphash : 8b5f2735b1cfe398cc284ca2ad67b5b6 (Imphash de l implant G7CDD6836 extrait du blob Donut (WINHTTP, Secur32, CRYPT32, WS2_32))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "imphash" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--02c10fb0-6f01-5efe-a2fe-a4db36ab045a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cert_cn : Microsoft Device Synchronization Service (Nom commun du faux certificat Authenticode auto-signé (émetteur Microsoft Corporation) de l implant extrait, validité 2026-07-23 06:01:45 à 2027-07-23 06:01:45 UTC)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cert_cn" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--97c594db-d839-57ec-b49c-fe10a4417524", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "hex_pattern : 39 32 3B 39 32 3B 68 6A 05 2E 2F 34 34 3F 36 05 2C 6E 05 (Prefixe de derivation de cle v4 encode par XOR 0x5a, present dans les 4 agents v4 (x64 et x86, avec ou sans TLS))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "hex_pattern" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--e30d55b0-ff15-561c-b091-0c95baefe19a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "tcp_handshake : 32 octets serveur, puis 32 octets client + CC20 (43 43 32 30), puis CC20 serveur (Poignee de main applicative des agents RevSocks v3 et v4, en clair pour v3, a l interieur de TLS pour les builds TLS)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "tcp_handshake" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--86756bc2-2264-5425-9007-6a74dfcd1c2d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "network_behaviour : TCP 443 vers une adresse IPv4 nue (Les agents v4 se connectent a une adresse litterale (141.98.83.180 pour 90fe2b57, 77.110.109.248 pour 9113fcdd), reessai toutes les 5 s en cas d echec, TCP keepalive de 10 s)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "network_behaviour" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--da8b809c-d034-52ad-9a12-c5dcd5c24dc3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "network_behaviour : delai de reception 360 s (L agent ferme la connexion et se reconnecte s il ne recoit aucun enregistrement pendant 6 minutes ; le serveur doit donc envoyer un ping (type 6) plus souvent)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "network_behaviour" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--0453854a-2ced-5361-9082-4c2963204707", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "network_behaviour : identification toutes les 40 a 50 minutes (Type 9 : nom d hote, octet nul, nom d utilisateur, declenche par un ping serveur (agent 90fe2b57 seulement))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "network_behaviour" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--9c444a5a-c802-5764-8745-d72ba220e8be", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file_ext : .lynx (Extension des fichiers chiffres par le chiffreur Lynx emballe dans l extracteur IExpress 4fbbf0d94f)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file_ext" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f79fd322-00db-58cd-b84d-b6d9255abf7a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "filename : README.txt (Note de rancon du chiffreur Lynx ecrite dans chaque repertoire)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "filename" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--e5bfdbe6-5d57-56bf-a25a-a5fa87540373", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "filename : background-image.jpg (Image de fond d ecran deposee par le chiffreur Lynx)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "filename" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--3151b263-3558-5113-820e-93bdf76597ec", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cmdline : --mode fast|medium|slow|entire (Arguments du chiffreur Lynx (5 %, 15 % par defaut, 25 %, 100 % du fichier))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cmdline" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--1cc52a9e-294a-5373-9169-57f1a7425213", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "cmdline : --stop-processes --kill --safe-mode --load-drives --encrypt-network (Arguments du chiffreur Lynx pour arreter les processus, entrer en mode sans echec, monter les volumes caches et chiffrer les partages)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "cmdline" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--e3c08a70-df96-5277-99df-7482571665f5", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "dir_exclusion : microsoft sql server;mongodb;postgresql;windows;program files;program files (x86);$RECYCLE.BIN;appdata (Repertoires ignores par le chiffreur Lynx)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "dir_exclusion" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--b44c66dc-dd02-55f1-8864-80ccd17f3754", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "process_substring : sql;veeam;backup;exchange;java;notepad (Sous-chaines de processus et services arretes par le chiffreur Lynx)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "process_substring" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6fd26c40-0968-5067-871e-44fbf5961c99", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file_ext : .INC (Extension ajoutee par le chiffreur INC ELF C++ c41ab339 (extension patchee dans le trailer))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file_ext" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f845b8d9-b834-58fa-b02b-15b4a3bc5f66", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "file_trailer : 80 octets (cle publique ephemere 32 + extension 32 + mode + taille de bloc 1000000 + 5 + nombre de blocs) (Trailer ajoute a la fin des fichiers par le chiffreur INC ELF C++)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "file_trailer" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--e9add0b9-5951-572a-b6e1-038e12d74d02", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "crypto_scheme : X25519 ephemere par fichier + hachage SHA-2 + AES-128-CTR (Schema de chiffrement par fichier du chiffreur INC ELF C++, aleatoire depuis /dev/urandom, blocs de 1 000 000 octets, mode 1 = un bloc sur six)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "crypto_scheme" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--30c126f6-c96e-5858-b98f-2dcc56ad1617", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "filename : printmon_debug.txt (Journal du moniteur d impression Ghost_monitor_debug.dll dans C:\\Users\\Public)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "filename" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--6a88317f-d391-5217-b49c-83663b8cfd7a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ja3s : ec74a5c51106f0419184d0dd08fb05bc (Empreinte TLS serveur commune a 141.98.83.180:443 et 89.185.83.8:443 (Triage, 2026-10-20) ; non unique, pile nginx courante)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ja3s" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a13ade7f-35a4-5de1-8920-edd4860111c0", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ja3 : 72a589da586844d7f0818ce684948eea (Empreinte TLS client des injecteurs inject_explorer et inject_system et de Ghost_loader (pile WinHTTP par defaut) ; non unique)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ja3" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--f72d3df9-7cb8-5ed4-a010-0d68a2627beb", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ja3 : c12f54a3f91dc7bafd92cb59fe009a35 (Empreinte TLS client de l agent RevSocks v4 90fe2b57 (Triage, 2026-10-20))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ja3" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--7d32665b-2a72-5f20-a879-efda3100922a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : nginx/1.24.0 (Ubuntu) (En-tete Server du frontal api.system-strategy.org sur 89.185.83.8 ; reponses HTTP 502 de 568 octets a toutes les requetes de Ghost_loader le 2026-10-20 12:41 UTC (service en amont indisponible))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--9944f2ad-60b8-5f1c-8599-e00064b7351d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "ip_reputation : 141.98.83.180 (Presente dans une liste de blocage (flux Binary Defense, OTX 2025-01-23) et dans une liste honeypot de force brute SSH et RDP (OTX, creee 2026-06-28), donc signalee avant l usage RevSocks de septembre 2026)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "ip_reputation" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--42194c13-16b6-5744-ae7a-b059b2ac1e01", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "device_path : \\\\.\\DBUtil_2_3 (Chemin device du pilote BYOVD Dell DBUtil_2_3.sys (CVE-2021-21551) ouvert par Ghost_dump_ppl pour elevation de handle noyau (Method 4))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "device_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--c367e67b-0857-5b58-8d7b-1c55256519e3", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "filename : DBUtil_2_3.Sys (Nom du pilote Dell DBUtil_2_3.sys (CVE-2021-21551) embarque dans Ghost_dump_ppl et pose sur le disque avant chargement)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "filename" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--51b2f458-b085-5a54-a750-88405d9e6a14", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "pdb_path : c:\\data\\work\\tools\\_efitools\\trunk\\ringzeroaccesslibrary\\win\\kernelmodedriver\\objfre_wlh_amd64\\amd64\\DBUtilDrv2_64.pdb (Chemin PDB du pilote embarque dans Ghost_dump_ppl ; confirme que le pilote est une compilation du kit Dell DBUtil v2)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "pdb_path" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--d027d0f2-6692-5688-abb9-3702f9f55d69", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "user_agent : Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (User-Agent HTTP fixe utilise par Ghost_dump_ppl pour l envoi du dump LSASS (60 octets exacts ; garble-masked dans le binaire 609aa250))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "user_agent" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--963ba521-2528-5a9e-a3f1-171b2dc3ba6c", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : [*] Enabling SeDebugPrivilege... (Message de log de Ghost_dump_ppl (garble-masked) : activation du privilege SeDebugPrivilege avant l acces LSASS)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--4d2a587a-ace6-504b-a65c-2e727db1fb99", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : [*] Finding LSASS PID... (Message de log de Ghost_dump_ppl : recherche du PID de lsass.exe)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--347980e6-cb47-5a28-894c-47b5344d1509", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : [*] Method 3: Handle duplication... (Message de log de Ghost_dump_ppl (label numerote confirme dans le binaire) : tentative de duplication de handle)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--145fba36-50e9-5202-9257-b1392179a2b7", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : [*] Method 4: BYOVD driver + kernel handle upgrade... (Message de log de Ghost_dump_ppl (label numerote confirme dans le binaire) : tentative BYOVD via DBUtil_2_3.sys)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--8bbbc73d-91d0-5f8a-97f7-881883f25115", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : server returned: %d (Message de log de Ghost_dump_ppl : code de retour HTTP du recepteur ; indication que la destination est passee en argument a l execution)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b484b567-282f-51e4-bec5-f96871391ae0", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "mondeikin.com", "description": "Domaine parent de chat.mondeikin.com ; enregistre 2026-07-15 chez NiceNIC ; serveurs de noms NS1/NS2.ERANS.RU", "pattern": "[domain-name:value = 'mondeikin.com']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--143143bb-78ba-5cbd-9e75-6fc684e13dd1", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "23.132.164.199", "description": "Resolution de mondeikin.com et chat.mondeikin.com au 2026-10-24 ; TENGIG-NET (Netiface America AS401626) ; hebergement partage probable", "pattern": "[ipv4-addr:value = '23.132.164.199']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--74cfe166-eae8-50ec-b111-7f2d5d2ed2f9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : NS1.ERANS.RU (Serveur de noms de mondeikin.com)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--cf87dc3b-9467-582f-bfae-b855965a937f", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : RealtekAudioSvc (Nom de tache planifiee de svc.py d'apres l'article SOCRadar (non observe dans les echantillons))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--135a7efc-f496-5f4b-9a30-f04171f8b412", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : /assets/js/analytics.js (Chemin de chargeur deguise cite par l'article SOCRadar (non observe dans les echantillons))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--b0f601ba-4286-5eee-bff8-e43c0121f6f9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : 9cd108bf26 (Valeur aleatoire de 5 octets des identifiants ObjectId de l'instance INC actuelle (kits de 2026-09-30 et 97 publications du blog de fuite du 2026-08-02 au 2026-10-21))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--b9a2a6e6-b1da-53ee-ab0a-92a856bab5a9", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : C:\\Windows\\Temp\\pn_done.txt (Fichier marqueur de la charge de l'exploit CVE-2025-62215)", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "note", "spec_version": "2.1", "id": "note--25a17dda-dfa2-5a2d-8667-2568c5858f3d", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "content": "string : C:\\Windows\\Temp\\s.dat (Ruche SAM enregistree par reg save (avec se.dat pour SECURITY et sy.dat pour SYSTEM))", "object_refs": [ "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f" ], "labels": [ "string" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a0c6b99e-e52b-5e70-8bda-93b34cbd7b04", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "update.system-strategy.org", "description": "Sous-domaine vu par VirusTotal et resolu vers Cloudflare le 2026-10-20", "pattern": "[domain-name:value = 'update.system-strategy.org']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4e961b3d-e520-57c5-a24a-d6889d0a99da", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "api-hcaptcha.com", "description": "Domaine cree le 2026-03-20 et heberge sur 91.199.163.67 ; imite un service de captcha (hypothese de leurre)", "pattern": "[domain-name:value = 'api-hcaptcha.com']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1848495e-9eed-5aab-8df0-0453488a7e25", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "https://api.system-strategy.org:8443/api/v2/update", "description": "Point d'acces du plus ancien implant relie (compile le 2026-05-02) d'apres VirusTotal", "pattern": "[url:value = 'https://api.system-strategy.org:8443/api/v2/update']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7651be6d-5777-59c3-a7bc-5c3a01e7363e", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "http://77.110.109.248:8443/agent_sc.enc", "description": "Charge recuperee par trois chargeurs compiles le 2026-05-15 d'apres VirusTotal", "pattern": "[url:value = 'http://77.110.109.248:8443/agent_sc.enc']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--812b503a-dedc-5425-aa3f-dde7833d0a5a", "created": "2026-10-23T12:00:00.000Z", "modified": "2026-10-23T12:00:00.000Z", "name": "https://api.system-strategy.org/api/v3/5347872286bc", "description": "Second chemin de l'implant Ghost HTTPS G6B77FE12 (cinq POST par execution Triage)", "pattern": "[url:value = 'https://api.system-strategy.org/api/v3/5347872286bc']", "pattern_type": "stix", "valid_from": "2026-10-23T12:00:00.000Z", "indicator_types": [ "malicious-activity" ], "created_by_ref": "identity--57cd746d-aed7-5f5e-8dba-c342d77e9a4f", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] } ] }