{
  "intelligence": {
    "actors": [],
    "counts": {
      "actors": 0,
      "associated_entity_contexts": 1,
      "deduplicated_iocs": 7,
      "direct_entities": 15,
      "direct_relationships": 14,
      "invalid_iocs": 0,
      "iocs": 7,
      "mentioned": 1,
      "mitre_associated": 1,
      "mitre_direct": 0,
      "targets": 0,
      "techniques": 0,
      "unsupported_indicators": 0,
      "vulnerabilities": 0
    },
    "coverage": {
      "associated_repertoire_is_incident_evidence": false,
      "attribution_policy": "explicit-public-relationships-only",
      "descriptions_publicly_exported": false,
      "excluded_context_objects": 89,
      "excluded_graph_objects": 180,
      "graph_complete": true,
      "graph_objects": 15,
      "graph_relationships": 14,
      "mitre_context_complete": true,
      "source_url": "https://asec.ahnlab.com/en/95374/",
      "status_as_of": "2026-10-10T05:24:17+00:00",
      "table_preview_limit": 20
    },
    "direct_entities": [
      {
        "__typename": "Malware",
        "aliases": [
          "CurlyGate",
          "LegionLoader",
          "RobotDropper",
          "win.satacom"
        ],
        "attributes": {
          "is_family": true,
          "malware_types": [
            "bot"
          ]
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": {
          "authorized_members": [],
          "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a",
          "is_inferred": false,
          "name": "Malpedia",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2026-01-18T19:40:13.631Z",
          "created_at": "2026-01-18T23:44:13.829Z",
          "first_seen": "1970-01-01T00:00:00.000Z",
          "last_seen": "5138-11-16T09:46:40.000Z",
          "modified": "2026-10-07T03:23:55.291Z",
          "updated_at": "2026-10-07T03:23:55.291Z"
        },
        "description_available": true,
        "entity_type": "Malware",
        "id": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "is_inferred": false,
        "labels": [
          "botnet_cc",
          "legionloader",
          "satacom"
        ],
        "lang": "en",
        "name": "Satacom",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": null,
            "id": "547826ed-e4eb-4358-84ce-71aed5dd0f34",
            "source_name": "malpedia",
            "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.satacom"
          },
          {
            "external_id": null,
            "id": "0689b334-2fba-488c-9baa-44d7d6511946",
            "source_name": "malpedia",
            "url": "https://securelist.com/satacom-delivers-cryptocurrency-stealing-browser-extension/109807/"
          },
          {
            "external_id": null,
            "id": "70a8b310-5c99-4d9d-919d-345ebb696681",
            "source_name": "malpedia",
            "url": "https://tehtris.com/en/blog/legionloader-exposed/"
          },
          {
            "external_id": null,
            "id": "dcf05b17-f9bc-4f63-9420-75071b057103",
            "source_name": "malpedia",
            "url": "https://trac-labs.com/advancing-through-the-cyberfront-legionloader-commander-6af38ebe39d4"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "malware--543ef2d9-6ae4-5713-872a-2dfc116ca03e",
        "type": "Malware"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.542Z",
          "created_at": "2026-09-26T06:12:20.829Z",
          "modified": "2026-09-26T06:12:48.795Z",
          "updated_at": "2026-09-26T06:12:48.795Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "1718722f-a5a1-469c-901c-4c19b623390b",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "indicator--29bbae8e-bca3-5d3e-910d-87bf210929d5",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.545Z",
          "created_at": "2026-09-26T06:12:24.419Z",
          "modified": "2026-09-26T06:12:50.092Z",
          "updated_at": "2026-09-26T06:12:50.092Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "28b0894d-1147-4bcf-9818-f7c3da13711f",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "indicator--46fd5e05-1175-5764-b050-c3465e360379",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T06:12:15.376Z",
          "updated_at": "2026-09-26T06:12:15.841Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "37426926-1d36-4ce7-8457-25f2d2727ee4",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "file--b4bbc072-48ed-57c6-b66f-675af8076bf5",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.536Z",
          "created_at": "2026-09-26T06:12:18.514Z",
          "modified": "2026-09-26T06:12:47.111Z",
          "updated_at": "2026-09-26T06:12:47.111Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "37a953de-ec4a-472a-bbde-4308b48f52a0",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "indicator--c70a4d31-51c4-5e9e-8b07-ec34b79ebfd4",
        "type": "Indicator"
      },
      {
        "__typename": "DomainName",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T06:12:13.342Z",
          "updated_at": "2026-09-26T06:12:13.659Z"
        },
        "description_available": false,
        "entity_type": "Domain-Name",
        "id": "56a6de87-2d63-46ef-a071-e2577915332e",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "domain-name--07fefa79-e983-5168-8883-c0984232f9e8",
        "type": "DomainName"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.547Z",
          "created_at": "2026-09-26T06:12:24.931Z",
          "modified": "2026-09-26T06:12:49.792Z",
          "updated_at": "2026-09-26T06:12:49.792Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "69978aae-7cdd-4850-b108-4e4e77270a4c",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "indicator--c11dc425-d256-5914-b466-3c3d281560df",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T06:12:15.247Z",
          "updated_at": "2026-09-26T06:12:15.380Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "8cc07cb9-e7a5-4a42-b746-851ce63254e0",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "file--f8338ce6-1489-50b8-af70-1e89209aa309",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Domain-Name",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.529Z",
          "created_at": "2026-09-26T06:12:16.993Z",
          "modified": "2026-09-26T06:12:19.306Z",
          "updated_at": "2026-09-26T06:12:19.306Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "a2674859-a083-40e0-87b1-5ac714a78237",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "indicator--51e6e6c1-fe5e-58a1-9a9a-c0fab19adb51",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Domain-Name",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.532Z",
          "created_at": "2026-09-26T06:12:18.429Z",
          "modified": "2026-09-26T06:12:45.913Z",
          "updated_at": "2026-09-26T06:12:45.913Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "b001f687-135a-49ec-9b10-b2a19218614d",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "indicator--d53f1f1b-48ee-590e-a723-db890aeb6a09",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T06:12:14.559Z",
          "updated_at": "2026-09-26T06:12:14.722Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "b27912a0-07c4-494d-83fd-be9f2939851f",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "file--f0fb7bc2-8a83-5f00-a75e-e4703c75a751",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T06:12:14.564Z",
          "updated_at": "2026-09-26T06:12:14.774Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "d98ad2a4-b756-469f-b4f7-c696658811a1",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "file--fe90e4d7-ff8d-537b-a925-e07f97b0f8b8",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T06:12:16.914Z",
          "updated_at": "2026-09-26T06:12:17.416Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "e281ec45-b5ac-41c9-a629-cd5a356592a6",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "file--3272084a-5d3d-547b-b31e-07e00fd495ee",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.539Z",
          "created_at": "2026-09-26T06:12:19.956Z",
          "modified": "2026-09-26T06:12:47.638Z",
          "updated_at": "2026-09-26T06:12:47.638Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "fa1c8cd0-7b34-470d-ad4f-b6cfa0046d60",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "indicator--3d37a4f4-9855-51bf-868b-5fa9ad529127",
        "type": "Indicator"
      },
      {
        "__typename": "DomainName",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T06:12:13.333Z",
          "updated_at": "2026-09-26T06:12:13.658Z"
        },
        "description_available": false,
        "entity_type": "Domain-Name",
        "id": "fd6cab43-26b4-441d-bdbb-40cdd4dbfdcd",
        "is_inferred": false,
        "labels": [
          "clickfix",
          "fake captcha",
          "legionloader",
          "spear phishing"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "domain-name--1d62e7a9-4129-5a08-ab12-11737c245846",
        "type": "DomainName"
      }
    ],
    "direct_relationships": [
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.575Z",
          "created_at": "2026-09-26T06:13:33.765Z",
          "modified": "2026-09-26T06:13:34.140Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:13:34.140Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "37a953de-ec4a-472a-bbde-4308b48f52a0",
        "from_id": "37a953de-ec4a-472a-bbde-4308b48f52a0",
        "from_name": null,
        "from_type": "Indicator",
        "id": "011d88ec-92fe-48b5-83a3-c8951e947321",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--df0119f7-b397-5bb5-a7ea-0ac4e393762f",
        "toId": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_id": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_name": "Satacom",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.549Z",
          "created_at": "2026-09-26T06:12:45.910Z",
          "modified": "2026-09-26T06:12:46.664Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:12:46.664Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "69978aae-7cdd-4850-b108-4e4e77270a4c",
        "from_id": "69978aae-7cdd-4850-b108-4e4e77270a4c",
        "from_name": null,
        "from_type": "Indicator",
        "id": "10cb7d22-2c64-4e53-a5a2-8701bcc504c7",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--1c19da87-de20-565a-ac76-bdb1f5d59f41",
        "toId": "e281ec45-b5ac-41c9-a629-cd5a356592a6",
        "to_id": "e281ec45-b5ac-41c9-a629-cd5a356592a6",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.550Z",
          "created_at": "2026-09-26T06:12:45.910Z",
          "modified": "2026-09-26T06:12:46.666Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:12:46.666Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "a2674859-a083-40e0-87b1-5ac714a78237",
        "from_id": "a2674859-a083-40e0-87b1-5ac714a78237",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2f23b5f0-3ef9-437f-b1a2-e52553582d24",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--95b2ebbb-3872-5283-8fe5-8b83930578c7",
        "toId": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_id": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_name": "Satacom",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.543Z",
          "created_at": "2026-09-26T06:12:44.754Z",
          "modified": "2026-09-26T06:12:45.225Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:12:45.225Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "1718722f-a5a1-469c-901c-4c19b623390b",
        "from_id": "1718722f-a5a1-469c-901c-4c19b623390b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "346f0b07-da3b-4436-9f00-95c4702054ac",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--5009546e-0e4b-5d60-8cb3-a4f38ae27f1d",
        "toId": "8cc07cb9-e7a5-4a42-b746-851ce63254e0",
        "to_id": "8cc07cb9-e7a5-4a42-b746-851ce63254e0",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.589Z",
          "created_at": "2026-09-26T06:13:48.695Z",
          "modified": "2026-09-26T06:13:48.941Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:13:48.941Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "fa1c8cd0-7b34-470d-ad4f-b6cfa0046d60",
        "from_id": "fa1c8cd0-7b34-470d-ad4f-b6cfa0046d60",
        "from_name": null,
        "from_type": "Indicator",
        "id": "55963201-f30d-436e-ae72-ef001e525f18",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--a8cc552b-7c50-5e8e-befc-38fecfdf6476",
        "toId": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_id": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_name": "Satacom",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.616Z",
          "created_at": "2026-09-26T06:14:17.550Z",
          "modified": "2026-09-26T06:14:17.901Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:14:17.901Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "28b0894d-1147-4bcf-9818-f7c3da13711f",
        "from_id": "28b0894d-1147-4bcf-9818-f7c3da13711f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "5737483a-f7e7-4ebc-88c4-1a983950d4d3",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--694444b3-abbb-5b30-ad21-4e76cc7f61a8",
        "toId": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_id": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_name": "Satacom",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.541Z",
          "created_at": "2026-09-26T06:12:44.754Z",
          "modified": "2026-09-26T06:12:45.224Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:12:45.224Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "fa1c8cd0-7b34-470d-ad4f-b6cfa0046d60",
        "from_id": "fa1c8cd0-7b34-470d-ad4f-b6cfa0046d60",
        "from_name": null,
        "from_type": "Indicator",
        "id": "674edd05-f363-4364-b885-d4819ce5c0d3",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--86f26599-07ab-5c23-b1e0-96e9d9fe4452",
        "toId": "d98ad2a4-b756-469f-b4f7-c696658811a1",
        "to_id": "d98ad2a4-b756-469f-b4f7-c696658811a1",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.538Z",
          "created_at": "2026-09-26T06:12:44.762Z",
          "modified": "2026-09-26T06:12:45.226Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:12:45.226Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "37a953de-ec4a-472a-bbde-4308b48f52a0",
        "from_id": "37a953de-ec4a-472a-bbde-4308b48f52a0",
        "from_name": null,
        "from_type": "Indicator",
        "id": "67fb5999-5af4-4e97-ba80-5b48d886842e",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--3c87539f-003c-57a3-adc5-0b78fae23a82",
        "toId": "b27912a0-07c4-494d-83fd-be9f2939851f",
        "to_id": "b27912a0-07c4-494d-83fd-be9f2939851f",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.628Z",
          "created_at": "2026-09-26T06:14:29.505Z",
          "modified": "2026-09-26T06:14:29.790Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:14:29.790Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "69978aae-7cdd-4850-b108-4e4e77270a4c",
        "from_id": "69978aae-7cdd-4850-b108-4e4e77270a4c",
        "from_name": null,
        "from_type": "Indicator",
        "id": "7214077d-5d46-45d3-87e4-3258e4fdd3db",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--e488122c-2589-5da6-a104-de96997b05b1",
        "toId": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_id": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_name": "Satacom",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.562Z",
          "created_at": "2026-09-26T06:13:15.424Z",
          "modified": "2026-09-26T06:13:15.838Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:13:15.838Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "b001f687-135a-49ec-9b10-b2a19218614d",
        "from_id": "b001f687-135a-49ec-9b10-b2a19218614d",
        "from_name": null,
        "from_type": "Indicator",
        "id": "895f77dc-cb0d-463f-9083-e37f0880d1c0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--fe6b2897-34c8-5101-ae24-98c0807db81e",
        "toId": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_id": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_name": "Satacom",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.546Z",
          "created_at": "2026-09-26T06:12:45.718Z",
          "modified": "2026-09-26T06:12:46.155Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:12:46.155Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "28b0894d-1147-4bcf-9818-f7c3da13711f",
        "from_id": "28b0894d-1147-4bcf-9818-f7c3da13711f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "ba9a9002-d54e-4214-86d3-54935f8acef5",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--fbc56a42-1bc4-5ef6-8ec6-4afa303607c4",
        "toId": "37426926-1d36-4ce7-8457-25f2d2727ee4",
        "to_id": "37426926-1d36-4ce7-8457-25f2d2727ee4",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.535Z",
          "created_at": "2026-09-26T06:12:43.407Z",
          "modified": "2026-09-26T06:12:43.856Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:12:43.856Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "b001f687-135a-49ec-9b10-b2a19218614d",
        "from_id": "b001f687-135a-49ec-9b10-b2a19218614d",
        "from_name": null,
        "from_type": "Indicator",
        "id": "d174862c-3390-4efb-8d67-55f89147ae55",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--12cdd3b4-ceaa-5c10-b40d-68c69b0bbb74",
        "toId": "56a6de87-2d63-46ef-a071-e2577915332e",
        "to_id": "56a6de87-2d63-46ef-a071-e2577915332e",
        "to_name": null,
        "to_type": "DomainName"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.531Z",
          "created_at": "2026-09-26T06:12:43.318Z",
          "modified": "2026-09-26T06:12:43.855Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:12:43.855Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "a2674859-a083-40e0-87b1-5ac714a78237",
        "from_id": "a2674859-a083-40e0-87b1-5ac714a78237",
        "from_name": null,
        "from_type": "Indicator",
        "id": "de03e8cf-d3a6-4725-b8af-bbde1dabaca0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--e611cd24-a5a2-5ea1-9552-32df3e3e133e",
        "toId": "fd6cab43-26b4-441d-bdbb-40cdd4dbfdcd",
        "to_id": "fd6cab43-26b4-441d-bdbb-40cdd4dbfdcd",
        "to_name": null,
        "to_type": "DomainName"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:34.602Z",
          "created_at": "2026-09-26T06:14:04.326Z",
          "modified": "2026-09-26T06:14:04.936Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:14:04.936Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "1718722f-a5a1-469c-901c-4c19b623390b",
        "from_id": "1718722f-a5a1-469c-901c-4c19b623390b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "f6f78207-4b7f-40ba-9814-ee4b710a7de5",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "standard_id": "relationship--e9176d68-696b-5245-ac9d-d3d16c556838",
        "toId": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_id": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "to_name": "Satacom",
        "to_type": "Malware"
      }
    ],
    "iocs": [
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "dallasbackstage[.]com",
        "description_available": false,
        "object_id": "a2674859-a083-40e0-87b1-5ac714a78237",
        "object_ids": [
          "a2674859-a083-40e0-87b1-5ac714a78237",
          "fd6cab43-26b4-441d-bdbb-40cdd4dbfdcd"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "a2674859-a083-40e0-87b1-5ac714a78237",
            "valid_from": "2026-09-11T13:15:36.000Z",
            "valid_until": "2026-12-23T04:10:44.260Z",
            "validity_status": "active",
            "value": "dallasbackstage.com"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet DomainName explicitement associé au rapport source.",
            "object_id": "fd6cab43-26b4-441d-bdbb-40cdd4dbfdcd",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "dallasbackstage.com"
          }
        ],
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "type": "domain",
        "valid_from": "2026-09-11T13:15:36.000Z",
        "valid_until": "2026-12-23T04:10:44.260Z",
        "validity_status": "active",
        "value": "dallasbackstage.com"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "gemscocl[.]com",
        "description_available": false,
        "object_id": "b001f687-135a-49ec-9b10-b2a19218614d",
        "object_ids": [
          "56a6de87-2d63-46ef-a071-e2577915332e",
          "b001f687-135a-49ec-9b10-b2a19218614d"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "b001f687-135a-49ec-9b10-b2a19218614d",
            "valid_from": "2026-09-11T13:15:36.000Z",
            "valid_until": "2026-12-23T04:10:44.260Z",
            "validity_status": "active",
            "value": "gemscocl.com"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet DomainName explicitement associé au rapport source.",
            "object_id": "56a6de87-2d63-46ef-a071-e2577915332e",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "gemscocl.com"
          }
        ],
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "type": "domain",
        "valid_from": "2026-09-11T13:15:36.000Z",
        "valid_until": "2026-12-23T04:10:44.260Z",
        "validity_status": "active",
        "value": "gemscocl.com"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "0128a4b78aab83796042118ecb3e46e0",
        "description_available": false,
        "object_id": "37a953de-ec4a-472a-bbde-4308b48f52a0",
        "object_ids": [
          "37a953de-ec4a-472a-bbde-4308b48f52a0",
          "b27912a0-07c4-494d-83fd-be9f2939851f"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "37a953de-ec4a-472a-bbde-4308b48f52a0",
            "valid_from": "2026-09-11T13:15:36.000Z",
            "valid_until": "2027-06-29T00:25:20.557Z",
            "validity_status": "active",
            "value": "0128a4b78aab83796042118ecb3e46e0"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "b27912a0-07c4-494d-83fd-be9f2939851f",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "0128a4b78aab83796042118ecb3e46e0"
          }
        ],
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "type": "md5",
        "valid_from": "2026-09-11T13:15:36.000Z",
        "valid_until": "2027-06-29T00:25:20.557Z",
        "validity_status": "active",
        "value": "0128a4b78aab83796042118ecb3e46e0"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "27745ec8bde201e771e3f4069e887cad",
        "description_available": false,
        "object_id": "fa1c8cd0-7b34-470d-ad4f-b6cfa0046d60",
        "object_ids": [
          "d98ad2a4-b756-469f-b4f7-c696658811a1",
          "fa1c8cd0-7b34-470d-ad4f-b6cfa0046d60"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "fa1c8cd0-7b34-470d-ad4f-b6cfa0046d60",
            "valid_from": "2026-09-11T13:15:36.000Z",
            "valid_until": "2027-06-29T00:25:20.557Z",
            "validity_status": "active",
            "value": "27745ec8bde201e771e3f4069e887cad"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "d98ad2a4-b756-469f-b4f7-c696658811a1",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "27745ec8bde201e771e3f4069e887cad"
          }
        ],
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "type": "md5",
        "valid_from": "2026-09-11T13:15:36.000Z",
        "valid_until": "2027-06-29T00:25:20.557Z",
        "validity_status": "active",
        "value": "27745ec8bde201e771e3f4069e887cad"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "685b6822b0c66f4f18496eb6ce24f984",
        "description_available": false,
        "object_id": "1718722f-a5a1-469c-901c-4c19b623390b",
        "object_ids": [
          "1718722f-a5a1-469c-901c-4c19b623390b",
          "8cc07cb9-e7a5-4a42-b746-851ce63254e0"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "1718722f-a5a1-469c-901c-4c19b623390b",
            "valid_from": "2026-09-11T13:15:36.000Z",
            "valid_until": "2027-06-29T00:25:20.557Z",
            "validity_status": "active",
            "value": "685b6822b0c66f4f18496eb6ce24f984"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "8cc07cb9-e7a5-4a42-b746-851ce63254e0",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "685b6822b0c66f4f18496eb6ce24f984"
          }
        ],
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "type": "md5",
        "valid_from": "2026-09-11T13:15:36.000Z",
        "valid_until": "2027-06-29T00:25:20.557Z",
        "validity_status": "active",
        "value": "685b6822b0c66f4f18496eb6ce24f984"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "8467ca57bdf6e6e94ca4e1484628b1aa",
        "description_available": false,
        "object_id": "28b0894d-1147-4bcf-9818-f7c3da13711f",
        "object_ids": [
          "28b0894d-1147-4bcf-9818-f7c3da13711f",
          "37426926-1d36-4ce7-8457-25f2d2727ee4"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "28b0894d-1147-4bcf-9818-f7c3da13711f",
            "valid_from": "2026-09-11T13:15:36.000Z",
            "valid_until": "2027-06-29T00:25:20.557Z",
            "validity_status": "active",
            "value": "8467ca57bdf6e6e94ca4e1484628b1aa"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "37426926-1d36-4ce7-8457-25f2d2727ee4",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "8467ca57bdf6e6e94ca4e1484628b1aa"
          }
        ],
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "type": "md5",
        "valid_from": "2026-09-11T13:15:36.000Z",
        "valid_until": "2027-06-29T00:25:20.557Z",
        "validity_status": "active",
        "value": "8467ca57bdf6e6e94ca4e1484628b1aa"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "c4debc1b25ab67f094676ddc3195fa41",
        "description_available": false,
        "object_id": "69978aae-7cdd-4850-b108-4e4e77270a4c",
        "object_ids": [
          "69978aae-7cdd-4850-b108-4e4e77270a4c",
          "e281ec45-b5ac-41c9-a629-cd5a356592a6"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "69978aae-7cdd-4850-b108-4e4e77270a4c",
            "valid_from": "2026-09-11T13:15:36.000Z",
            "valid_until": "2027-06-29T00:25:20.557Z",
            "validity_status": "active",
            "value": "c4debc1b25ab67f094676ddc3195fa41"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "e281ec45-b5ac-41c9-a629-cd5a356592a6",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "c4debc1b25ab67f094676ddc3195fa41"
          }
        ],
        "source_url": "https://asec.ahnlab.com/en/95374/",
        "type": "md5",
        "valid_from": "2026-09-11T13:15:36.000Z",
        "valid_until": "2027-06-29T00:25:20.557Z",
        "validity_status": "active",
        "value": "c4debc1b25ab67f094676ddc3195fa41"
      }
    ],
    "mentioned": [
      {
        "confidence": 50,
        "evidence_id": "14a090be-d76e-41ef-a350-8eff19cf890c",
        "name": "Satacom",
        "role": "mentionné",
        "type": "Malware"
      }
    ],
    "mitre": {
      "associated_repertoire": [
        {
          "complete": true,
          "relationships": [
            {
              "__typename": "StixCoreRelationship",
              "authorized_members": [],
              "confidence": 50,
              "created_by": null,
              "dates": {
                "created": "2026-01-19T20:06:18.207Z",
                "created_at": "2026-03-17T19:39:45.330Z",
                "modified": "2026-03-17T19:39:45.620Z",
                "start_time": "1970-01-01T00:00:00.000Z",
                "stop_time": "5138-11-16T09:46:40.000Z",
                "updated_at": "2026-03-17T19:39:45.620Z"
              },
              "description_available": false,
              "entity_type": "uses",
              "fromId": "14a090be-d76e-41ef-a350-8eff19cf890c",
              "from_id": "14a090be-d76e-41ef-a350-8eff19cf890c",
              "from_name": "Satacom",
              "from_type": "Malware",
              "id": "7bd62dfe-9130-4597-9c62-627cd5d24120",
              "is_inferred": false,
              "objectMarking": [
                {
                  "definition": "TLP:CLEAR",
                  "definition_type": "TLP"
                }
              ],
              "objectOrganization": [],
              "references": [],
              "relationship_type": "uses",
              "restrict_access": false,
              "revoked": false,
              "scope": "entity-context",
              "source_url": "https://asec.ahnlab.com/en/95374/",
              "standard_id": "relationship--5b94075b-ecc4-5b50-843f-5da4d66236ef",
              "toId": "ea4de683-0cad-4497-a044-65b61045d534",
              "to_id": "ea4de683-0cad-4497-a044-65b61045d534",
              "to_name": "T1574.002",
              "to_type": "AttackPattern"
            }
          ],
          "scope": "entity-context",
          "techniques": [
            {
              "aliases": [],
              "attributes": {
                "x_mitre_id": "T1574.002"
              },
              "authorized_members": [],
              "confidence": 50,
              "created": "2026-01-18T18:28:11.149Z",
              "created_by": null,
              "dates": {
                "created": "2026-01-18T18:28:11.149Z",
                "created_at": "2026-01-21T11:31:18.951Z",
                "modified": "2026-01-21T11:31:19.843Z",
                "updated_at": "2026-01-21T11:31:19.843Z"
              },
              "description_available": false,
              "evidence_ids": [
                "7bd62dfe-9130-4597-9c62-627cd5d24120",
                "ea4de683-0cad-4497-a044-65b61045d534"
              ],
              "external_id": "T1574.002",
              "id": "ea4de683-0cad-4497-a044-65b61045d534",
              "is_inferred": false,
              "kill_chain_phases": [],
              "labels": [],
              "lang": "en",
              "mitre_id": "T1574.002",
              "modified": "2026-01-21T11:31:19.843Z",
              "name": "T1574.002",
              "objectMarking": [
                {
                  "definition": "TLP:CLEAR",
                  "definition_type": "TLP"
                }
              ],
              "objectOrganization": [],
              "references": [
                {
                  "external_id": "T1574.002",
                  "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955",
                  "source_name": "mitre-attack",
                  "url": "https://attack.mitre.org/techniques/T1574/002"
                }
              ],
              "relationship_ids": [
                "7bd62dfe-9130-4597-9c62-627cd5d24120"
              ],
              "restrict_access": false,
              "revoked": false,
              "scope": "entity-context",
              "source_url": "https://asec.ahnlab.com/en/95374/",
              "tactics": [],
              "url": "https://attack.mitre.org/techniques/T1574/002/",
              "via_entities": [
                {
                  "id": "14a090be-d76e-41ef-a350-8eff19cf890c",
                  "name": "Satacom",
                  "type": "Malware"
                }
              ]
            }
          ],
          "via_entity": {
            "id": "14a090be-d76e-41ef-a350-8eff19cf890c",
            "name": "Satacom",
            "type": "Malware"
          }
        }
      ],
      "direct_techniques": [],
      "official_catalog": {
        "complete": true,
        "fetched_at": "2026-10-10T05:24:19Z",
        "schema_version": 1,
        "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730",
        "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json",
        "techniques": [
          {
            "attack_version": "2.1",
            "canonical_url": "https://attack.mitre.org/techniques/T1574/002/",
            "created": "2020-03-13T19:41:37.908Z",
            "deprecated": false,
            "matched": true,
            "mitre_id": "T1574.002",
            "modified": "2026-04-15T22:56:43.434Z",
            "official_name": "DLL Side-Loading",
            "official_status": "revoked",
            "official_tactics": [
              {
                "mitre_id": "TA0002",
                "name": "Execution",
                "shortname": "execution"
              },
              {
                "mitre_id": "TA0005",
                "name": "Stealth",
                "shortname": "stealth"
              }
            ],
            "replacements": [
              {
                "canonical_url": "https://attack.mitre.org/techniques/T1574/001/",
                "mitre_id": "T1574.001",
                "official_name": "DLL",
                "official_status": "active",
                "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2",
                "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34"
              }
            ],
            "revoked": true,
            "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b"
          }
        ]
      }
    },
    "report_metadata": {
      "authorized_members": [],
      "confidence": 50,
      "created_by": null,
      "dates": {
        "created": "2026-09-11T13:15:36.133Z",
        "created_at": "2026-09-26T06:14:47.056Z",
        "modified": "2026-09-26T06:14:48.040Z",
        "published": "2026-09-11T13:15:36.133Z",
        "updated_at": "2026-09-26T06:14:48.040Z"
      },
      "description_available": true,
      "id": "8893aa5e-fd75-46e1-b5b6-d4033d732bff",
      "is_inferred": false,
      "labels": [
        "clickfix",
        "fake captcha",
        "legionloader",
        "spear phishing"
      ],
      "lang": "en",
      "name": "Beware of the LegionLoader malware being distributed via the ClickFix method",
      "objectMarking": [
        {
          "definition": "TLP:CLEAR",
          "definition_type": "TLP"
        }
      ],
      "objectOrganization": [],
      "published": "2026-09-11T13:15:36.133Z",
      "references": [
        {
          "external_id": null,
          "id": "89e1ca9f-4f7f-4d54-a866-9e64138e9f94",
          "source_name": "alien-vault",
          "url": "https://asec.ahnlab.com/en/95374/"
        },
        {
          "external_id": "6aa3fef84a7f54f4ae325151",
          "id": "a1128301-e683-4742-a9c5-f80878c67afa",
          "source_name": "alien-vault",
          "url": "https://otx.alienvault.com/pulse/6aa3fef84a7f54f4ae325151"
        }
      ],
      "report_types": [
        "threat-report"
      ],
      "restrict_access": false,
      "source_url": "https://asec.ahnlab.com/en/95374/"
    },
    "targets": [],
    "techniques": [],
    "vulnerabilities": []
  },
  "report_id": "8893aa5e-fd75-46e1-b5b6-d4033d732bff",
  "schema_version": 1,
  "selected_date": "2026-09-11",
  "source_url": "https://asec.ahnlab.com/en/95374/"
}