{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 1, "deduplicated_iocs": 20, "direct_entities": 47, "direct_relationships": 68, "invalid_iocs": 0, "iocs": 20, "mentioned": 5, "mitre_associated": 1, "mitre_direct": 0, "targets": 2, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 1 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 136, "excluded_graph_objects": 535, "graph_complete": true, "graph_objects": 47, "graph_relationships": 68, "mitre_context_complete": true, "source_url": "https://asec.ahnlab.com/ko/95560/", "status_as_of": "2026-10-10T21:54:35+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:36:09.111Z", "modified": "2026-01-18T14:36:09.339Z", "updated_at": "2026-01-18T14:36:09.339Z" }, "description_available": false, "entity_type": "Region", "id": "0584d53c-836c-41a4-a732-0edcc5dea653", "is_inferred": false, "labels": [], "lang": "en", "name": "Americas", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "location--bce21a59-810c-5c81-863c-23546cb0d6a0", "type": "Region" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.947Z", "created_at": "2026-09-28T14:04:47.650Z", "modified": "2026-09-28T17:13:18.467Z", "updated_at": "2026-09-28T17:13:18.467Z" }, "description_available": false, "entity_type": "Indicator", "id": "084b51b6-f17c-4a41-86b5-650ff584a2b7", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--94325194-f70d-599a-ad86-2251ff8cce0d", "type": "Indicator" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:35.313Z", "updated_at": "2026-09-28T17:09:14.030Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "0a7beb76-4453-41b6-b309-d39e65266fcd", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "hygiene", "iis server", "privilege escalation", "reverse shell", "self-signed", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "45.138.16.187", "id": "e360e92f-af6f-4589-bbd1-f4a5694d28da", "source_name": "Shodan", "url": "https://www.shodan.io/host/45.138.16.187" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "ipv4-addr--9a802bd4-3d8e-5993-992b-920570e645f3", "type": "IPv4Addr" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:50.621Z", "updated_at": "2026-09-28T14:03:51.904Z" }, "description_available": false, "entity_type": "Url", "id": "0baec135-0694-40a7-b710-f18567a36bf5", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "url--0417064a-347b-5e91-98f0-1c21ac362569", "type": "Url" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:53.643Z", "updated_at": "2026-09-28T14:03:54.602Z" }, "description_available": false, "entity_type": "StixFile", "id": "104a0198-6c63-4f6f-bc19-4d472e62c453", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--9d5ff87d-e6ff-5b54-bf25-545900c623a3", "type": "StixFile" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:36.049Z", "updated_at": "2026-09-28T17:10:21.582Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "15bcb34f-d851-4546-8e20-d4fd8cdf38e6", "is_inferred": false, "labels": [ "cve-2019-18935", "database", "godzilla", "iis server", "privilege escalation", "reverse shell", "self-signed", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "2.59.133.147", "id": "3298ae3e-700b-4786-af3f-061984268e8d", "source_name": "Shodan", "url": "https://www.shodan.io/host/2.59.133.147" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "ipv4-addr--c29ea339-851f-5d7c-a849-11b99cb866ee", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.904Z", "created_at": "2026-09-28T14:04:00.226Z", "modified": "2026-09-28T17:11:25.696Z", "updated_at": "2026-09-28T17:11:25.696Z" }, "description_available": true, "entity_type": "Indicator", "id": "16834e2a-7dbd-40b8-b80f-63cdd6a6aca8", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "hygiene", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--5951d231-7dbd-505d-8d42-e2c219f194f4", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:52.321Z", "updated_at": "2026-09-28T14:03:53.064Z" }, "description_available": false, "entity_type": "StixFile", "id": "1de100a3-4ce0-43cf-813c-4896d531ad12", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--c3f28e17-a731-5095-8934-53826d22cb57", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.965Z", "created_at": "2026-09-28T14:05:10.174Z", "modified": "2026-09-28T17:13:29.090Z", "updated_at": "2026-09-28T17:13:29.090Z" }, "description_available": false, "entity_type": "Indicator", "id": "20cabaa0-ef56-49bc-b8d3-6917ee254a78", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--2e088a00-05ee-5855-b785-4276b971cc8d", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:41.739Z", "updated_at": "2026-09-28T14:03:42.227Z" }, "description_available": false, "entity_type": "StixFile", "id": "3378ad6a-f542-463f-a1da-0c0355873e45", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--57877e1a-6f6c-541b-a39a-5f6fd39cee51", "type": "StixFile" }, { "__typename": "Country", "aliases": [ "US", "USA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.034Z", "created_at": "2026-01-18T14:36:25.804Z", "modified": "2026-01-20T20:57:15.092Z", "updated_at": "2026-01-20T20:57:15.092Z" }, "description_available": false, "entity_type": "Country", "id": "3460c7f0-1521-461b-af64-2de060664fb1", "is_inferred": false, "labels": [], "lang": "en", "name": "United States of America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "location--e79b4cf1-a256-5efa-bc74-c94c7c7ffde0", "type": "Country" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:45.744Z", "updated_at": "2026-09-28T14:03:46.476Z" }, "description_available": false, "entity_type": "StixFile", "id": "374d9ae3-cc56-41b9-9d78-8135314acd12", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--c9550741-a4a4-5f60-8e61-b3fc718e4788", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.957Z", "created_at": "2026-09-28T14:05:01.785Z", "modified": "2026-09-28T17:13:21.665Z", "updated_at": "2026-09-28T17:13:21.665Z" }, "description_available": false, "entity_type": "Indicator", "id": "3e34b0b6-81be-4c44-bcf7-54ff72467dc3", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--a74f210c-900e-5b48-b336-61d3b5e37359", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.032Z", "created_at": "2026-01-18T14:36:24.671Z", "modified": "2026-01-18T14:36:24.965Z", "updated_at": "2026-01-18T14:36:24.965Z" }, "description_available": false, "entity_type": "Region", "id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "is_inferred": false, "labels": [], "lang": "en", "name": "Northern America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "location--713e5fdc-da7b-5735-958d-d7dc664efa7f", "type": "Region" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2021-11-03T00:00:00.000Z", "created_at": "2026-01-18T19:52:24.520Z", "modified": "2026-01-19T07:11:35.908Z", "updated_at": "2026-01-19T07:11:35.908Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "453d9070-cd88-4cec-b38d-d819c0e25a45", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2019-18935", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2019-18935", "id": "4c748423-1d46-4c09-95db-47df96b2b241", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18935" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "vulnerability--79778392-1a1a-5402-9ac4-dc601d41b6ed", "type": "Vulnerability" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.915Z", "created_at": "2026-09-28T14:04:01.284Z", "modified": "2026-09-28T17:11:41.613Z", "updated_at": "2026-09-28T17:11:41.613Z" }, "description_available": true, "entity_type": "Indicator", "id": "459002a9-20e9-45dc-996d-e79dd4efb949", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--b64c3223-e367-5eaf-a5a7-32ef34a39227", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:48.047Z", "updated_at": "2026-09-28T14:03:49.131Z" }, "description_available": false, "entity_type": "Url", "id": "459b3e05-c7b7-42bc-ab61-ff1da64a57eb", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "url--a29b13df-6e16-5175-9e77-0b596d4c73af", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.942Z", "created_at": "2026-09-28T14:04:30.942Z", "modified": "2026-09-28T17:13:12.354Z", "updated_at": "2026-09-28T17:13:12.354Z" }, "description_available": false, "entity_type": "Indicator", "id": "4c7a377c-7d79-48f6-befa-a9a5eaee3a59", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--e03b8de5-7e52-5b12-8a04-4577abd445e4", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:29:03.555Z", "created_at": "2026-03-24T16:01:52.483Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-03-24T16:01:53.512Z", "updated_at": "2026-03-24T16:01:53.512Z" }, "description_available": false, "entity_type": "Malware", "id": "4c84102f-e439-4038-9967-14a0c7805586", "is_inferred": false, "labels": [], "lang": "en", "name": "SweetPotato", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "malware--53134c9d-a5cc-599c-88eb-d031df1098be", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.922Z", "created_at": "2026-09-28T14:04:10.372Z", "modified": "2026-09-28T17:11:50.774Z", "updated_at": "2026-09-28T17:11:50.774Z" }, "description_available": false, "entity_type": "Indicator", "id": "4f4926bf-2e1a-4fa4-a37a-8c2cbad4df1b", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--2308e79c-8eae-5259-a87e-3a9f7d566793", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.960Z", "created_at": "2026-09-28T14:05:04.285Z", "modified": "2026-09-28T17:13:23.253Z", "updated_at": "2026-09-28T17:13:23.253Z" }, "description_available": false, "entity_type": "Indicator", "id": "584f7f4a-9d20-491c-989a-1083b4e9a03d", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--a67efb8f-c933-5d23-81e2-a7e887eb4316", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.962Z", "created_at": "2026-09-28T14:05:10.165Z", "modified": "2026-09-28T17:13:27.232Z", "updated_at": "2026-09-28T17:13:27.232Z" }, "description_available": false, "entity_type": "Indicator", "id": "5cbecb2b-ba0b-43a2-8431-2929afea5ffa", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--1a4bbe8f-5bfb-5cbc-a519-2f64065104ec", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.933Z", "created_at": "2026-09-28T14:04:21.275Z", "modified": "2026-09-28T17:12:10.788Z", "updated_at": "2026-09-28T17:12:10.788Z" }, "description_available": false, "entity_type": "Indicator", "id": "5fd268df-bb1f-49af-9c21-a1d0bffc37e3", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--3ee407e9-63f1-5cd8-b74f-261912a222d5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.910Z", "created_at": "2026-09-28T14:04:00.662Z", "modified": "2026-09-28T17:11:41.298Z", "updated_at": "2026-09-28T17:11:41.298Z" }, "description_available": false, "entity_type": "Indicator", "id": "606544f1-119a-452a-9170-e0fca65900e8", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--19cd9adc-0f31-528d-8c0c-a0dfc2bbd2e8", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.949Z", "created_at": "2026-09-28T14:04:47.660Z", "modified": "2026-09-28T17:13:19.946Z", "updated_at": "2026-09-28T17:13:19.946Z" }, "description_available": false, "entity_type": "Indicator", "id": "649c83c4-e081-4c72-a640-e3453e228c58", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--c1179408-db00-57ce-a4aa-591c9286eb7a", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.928Z", "created_at": "2026-09-28T14:04:21.258Z", "modified": "2026-09-28T17:12:14.125Z", "updated_at": "2026-09-28T17:12:14.125Z" }, "description_available": false, "entity_type": "Indicator", "id": "65ab4965-8cf5-4b2e-b419-dc49ed1e3f18", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--1e91425c-cdbb-5e1d-9ec5-a4165448f403", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:58.303Z", "updated_at": "2026-09-28T14:03:59.917Z" }, "description_available": false, "entity_type": "StixFile", "id": "70dd4ae6-e365-49aa-b17c-7288b32357f2", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--0f12cc41-3ba9-5b3c-91db-3415052cdfc5", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:52.664Z", "updated_at": "2026-09-28T14:03:53.517Z" }, "description_available": false, "entity_type": "StixFile", "id": "74a8c684-45be-47ac-a424-baf6fa84f41d", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--559e5002-084f-54c9-b4ce-a3becc6b3813", "type": "StixFile" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:51.825Z", "updated_at": "2026-09-28T14:03:52.816Z" }, "description_available": false, "entity_type": "Url", "id": "8364371c-009e-4b24-84a9-2d73d2599e13", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "url--2a0d5d64-689a-51a1-90c4-40dd5424971e", "type": "Url" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:55.983Z", "updated_at": "2026-09-28T14:03:57.595Z" }, "description_available": false, "entity_type": "StixFile", "id": "91970f97-ae3e-4315-af75-f47c7fec80ad", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--1572270e-6dfa-5775-a9f5-a943b99a3ab1", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.940Z", "created_at": "2026-09-28T14:04:30.830Z", "modified": "2026-09-28T17:13:14.447Z", "updated_at": "2026-09-28T17:13:14.447Z" }, "description_available": false, "entity_type": "Indicator", "id": "94fb90f0-0349-445c-987c-17550d3eeaf3", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--ad038942-fba9-5a20-9b94-f67640598bc3", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:45.925Z", "updated_at": "2026-09-28T14:03:46.479Z" }, "description_available": false, "entity_type": "StixFile", "id": "9b4186d9-2fd6-4995-8550-39f7f550bd2b", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--e8a0e446-69bd-57b8-a65d-5bd7a2d4151f", "type": "StixFile" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:40.124Z", "updated_at": "2026-09-28T17:10:32.900Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "9cfc7d6d-ab0f-4a5a-abdc-af65bd2bbb4e", "is_inferred": false, "labels": [ "cve-2019-18935", "database", "eol-product", "godzilla", "iis server", "privilege escalation", "reverse shell", "self-signed", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "65.98.5.158", "id": "a7dc6ac9-9504-4490-a253-2122d75cf76f", "source_name": "Shodan", "url": "https://www.shodan.io/host/65.98.5.158" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "ipv4-addr--6d0f8391-501f-589f-82be-7525c09ef677", "type": "IPv4Addr" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:48.054Z", "updated_at": "2026-09-28T14:03:49.158Z" }, "description_available": false, "entity_type": "Url", "id": "a6aaa7b5-d965-44fb-b3ff-ed05bfa2982b", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "url--a32fea48-3294-5c68-895c-4ce37c64c9b0", "type": "Url" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:56:12.132Z", "created_at": "2026-02-12T16:56:40.550Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-08-08T12:19:41.361Z", "updated_at": "2026-08-08T12:19:41.361Z" }, "description_available": false, "entity_type": "Malware", "id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "is_inferred": false, "labels": [], "lang": "en", "name": "Godzilla", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "malware--ecfbf2c4-68cf-5f9f-a53d-2a506a38d091", "type": "Malware" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:34.485Z", "updated_at": "2026-09-28T17:09:06.318Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "afce442f-039c-46be-b513-2fb31825b50a", "is_inferred": false, "labels": [ "cve-2019-18935", "database", "eol-product", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "206.82.6.22", "id": "7862e8d1-de4f-4e17-8a9a-f27f359089f8", "source_name": "Shodan", "url": "https://www.shodan.io/host/206.82.6.22" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "ipv4-addr--f20f3c96-de79-55dc-ac24-db5f210701f9", "type": "IPv4Addr" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.951Z", "created_at": "2026-09-28T14:04:53.933Z", "modified": "2026-09-28T17:13:20.304Z", "updated_at": "2026-09-28T17:13:20.304Z" }, "description_available": false, "entity_type": "Indicator", "id": "b4a69bd0-cd2a-48df-9d40-fbbbbf99466e", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--4dc04645-2be5-5cd2-b838-d0f013a8db93", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.945Z", "created_at": "2026-09-28T14:04:40.224Z", "modified": "2026-09-28T17:13:15.318Z", "updated_at": "2026-09-28T17:13:15.318Z" }, "description_available": false, "entity_type": "Indicator", "id": "b5199185-d838-4b3a-8ffb-32580a3d9029", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--1c43cbd7-391f-5922-8e49-6230c849db43", "type": "Indicator" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:49.557Z", "updated_at": "2026-09-28T14:03:51.608Z" }, "description_available": false, "entity_type": "Url", "id": "b57f7af9-e5f3-44d7-b765-8ed4bb55b03f", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "url--ebc7fb2f-4892-5e9c-9e86-0c5a97cb79dd", "type": "Url" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:54.857Z", "updated_at": "2026-09-28T14:03:57.177Z" }, "description_available": false, "entity_type": "StixFile", "id": "c1e34ae6-704d-40f4-90e4-b073f26d280f", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--074be63f-9153-500d-8b03-64dfa0bedc38", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.936Z", "created_at": "2026-09-28T14:04:27.331Z", "modified": "2026-09-28T17:12:24.229Z", "updated_at": "2026-09-28T17:12:24.229Z" }, "description_available": false, "entity_type": "Indicator", "id": "d143c452-bfd8-4c45-b54c-91c943502181", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--b0eb0036-02a9-5c14-a57d-78730abb4074", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:47.314Z", "updated_at": "2026-09-28T14:03:47.951Z" }, "description_available": false, "entity_type": "StixFile", "id": "d77c292e-0ab2-4426-8726-44285e017257", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--b06104fe-9da2-5600-974e-1fc5166b721d", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.919Z", "created_at": "2026-09-28T14:04:10.366Z", "modified": "2026-09-28T17:11:56.156Z", "updated_at": "2026-09-28T17:11:56.156Z" }, "description_available": false, "entity_type": "Indicator", "id": "d9f22a30-2145-4154-bf85-b4c5f9209017", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--e1a79ddc-b5f0-51b8-b1f0-19f59177ad3a", "type": "Indicator" }, { "__typename": "Sector", "aliases": [ "Election", "Government", "Voting" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.392Z", "created_at": "2026-01-18T14:35:09.055Z", "modified": "2026-01-22T08:00:46.641Z", "updated_at": "2026-01-22T08:00:46.641Z" }, "description_available": true, "entity_type": "Sector", "id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "is_inferred": false, "labels": [], "lang": "en", "name": "Government and administrations", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "identity--9d697b63-6ae0-5ddb-ae26-e3d6e03302e1", "type": "Sector" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-28T14:03:42.954Z", "updated_at": "2026-09-28T14:03:45.749Z" }, "description_available": false, "entity_type": "StixFile", "id": "e365272b-8431-4b08-965b-44ee3a5c7c08", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "file--1ba58721-b1e1-59fc-9596-e32c35c9a272", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.924Z", "created_at": "2026-09-28T14:04:14.694Z", "modified": "2026-09-28T17:12:04.401Z", "updated_at": "2026-09-28T17:12:04.401Z" }, "description_available": false, "entity_type": "Indicator", "id": "e5e8a598-f242-475b-a6b3-660e79da4a1f", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--e500d7ff-7c57-554f-b940-aff1aa88959d", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.954Z", "created_at": "2026-09-28T14:05:01.784Z", "modified": "2026-09-28T17:13:22.633Z", "updated_at": "2026-09-28T17:13:22.633Z" }, "description_available": false, "entity_type": "Indicator", "id": "ff97301c-2c40-4ca5-8914-baeb6e7e69cb", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "indicator--bd8b7e2c-a14b-5062-83a7-5675876188dd", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.956Z", "created_at": "2026-09-28T14:09:55.121Z", "modified": "2026-09-28T14:09:56.661Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:56.661Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ff97301c-2c40-4ca5-8914-baeb6e7e69cb", "from_id": "ff97301c-2c40-4ca5-8914-baeb6e7e69cb", "from_name": null, "from_type": "Indicator", "id": "0a8751c1-af97-43cb-a8e0-432e0326cf18", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--d45f10d2-2d22-5b3c-916b-b53d396d0a7f", "toId": "74a8c684-45be-47ac-a424-baf6fa84f41d", "to_id": "74a8c684-45be-47ac-a424-baf6fa84f41d", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.155Z", "created_at": "2026-09-28T14:26:56.340Z", "modified": "2026-09-28T14:26:57.374Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:26:57.374Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5199185-d838-4b3a-8ffb-32580a3d9029", "from_id": "b5199185-d838-4b3a-8ffb-32580a3d9029", "from_name": null, "from_type": "Indicator", "id": "0ed704b3-c4d3-4e62-b87a-aec4f6b15dab", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--49c9ed11-aa25-5734-ab10-c7571c953a4f", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.968Z", "created_at": "2026-09-28T14:10:08.142Z", "modified": "2026-09-28T14:10:10.552Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:10:10.552Z" }, "description_available": false, "entity_type": "indicates", "fromId": "16834e2a-7dbd-40b8-b80f-63cdd6a6aca8", "from_id": "16834e2a-7dbd-40b8-b80f-63cdd6a6aca8", "from_name": null, "from_type": "Indicator", "id": "12ad949e-e005-4789-a370-28b7b280d92b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--6eea05bf-350b-51db-9bdb-64064e82fef7", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.923Z", "created_at": "2026-09-28T14:09:37.454Z", "modified": "2026-09-28T14:09:38.800Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:38.800Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4f4926bf-2e1a-4fa4-a37a-8c2cbad4df1b", "from_id": "4f4926bf-2e1a-4fa4-a37a-8c2cbad4df1b", "from_name": null, "from_type": "Indicator", "id": "17ca2d23-8987-497e-93bc-69cace995c37", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--57c06393-75af-52e6-89f2-204bf180b2ae", "toId": "3378ad6a-f542-463f-a1da-0c0355873e45", "to_id": "3378ad6a-f542-463f-a1da-0c0355873e45", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.229Z", "created_at": "2026-09-28T14:34:59.194Z", "modified": "2026-09-28T14:35:20.970Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:35:20.970Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3e34b0b6-81be-4c44-bcf7-54ff72467dc3", "from_id": "3e34b0b6-81be-4c44-bcf7-54ff72467dc3", "from_name": null, "from_type": "Indicator", "id": "1b24f3cd-9f4f-48ca-b7fc-a8d62a80a024", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--70c5f8f5-e349-50eb-b20a-1c479bb77f12", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.931Z", "created_at": "2026-09-28T14:09:42.871Z", "modified": "2026-09-28T14:09:43.672Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:43.672Z" }, "description_available": false, "entity_type": "based-on", "fromId": "65ab4965-8cf5-4b2e-b419-dc49ed1e3f18", "from_id": "65ab4965-8cf5-4b2e-b419-dc49ed1e3f18", "from_name": null, "from_type": "Indicator", "id": "2012bf63-f7cc-4f13-a483-bba46ed0e31f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--e4ce5c0c-765f-5408-9541-3a2a165d5de2", "toId": "374d9ae3-cc56-41b9-9d78-8135314acd12", "to_id": "374d9ae3-cc56-41b9-9d78-8135314acd12", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.201Z", "created_at": "2026-09-28T14:30:31.241Z", "modified": "2026-09-28T14:30:33.441Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:30:33.441Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b4a69bd0-cd2a-48df-9d40-fbbbbf99466e", "from_id": "b4a69bd0-cd2a-48df-9d40-fbbbbf99466e", "from_name": null, "from_type": "Indicator", "id": "20c7525e-336c-4d00-846a-b211f96b7319", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--cf673f23-d8ab-5a9d-9baa-b74a715d00cc", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.241Z", "created_at": "2026-09-28T14:36:41.222Z", "modified": "2026-09-28T14:36:42.565Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:36:42.565Z" }, "description_available": false, "entity_type": "indicates", "fromId": "584f7f4a-9d20-491c-989a-1083b4e9a03d", "from_id": "584f7f4a-9d20-491c-989a-1083b4e9a03d", "from_name": null, "from_type": "Indicator", "id": "2137b1e4-f5bd-4682-802c-445729cf45e3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--89aaf68d-dc13-5c7a-ac2f-6da4d078dbfd", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.911Z", "created_at": "2026-09-28T14:09:35.853Z", "modified": "2026-09-28T14:09:36.681Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:36.681Z" }, "description_available": false, "entity_type": "based-on", "fromId": "606544f1-119a-452a-9170-e0fca65900e8", "from_id": "606544f1-119a-452a-9170-e0fca65900e8", "from_name": null, "from_type": "Indicator", "id": "23963d0a-8a77-4e1a-b608-1756fa73afd4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--15cc6a25-679f-5b46-b2ff-8ff93ba1b96a", "toId": "afce442f-039c-46be-b513-2fb31825b50a", "to_id": "afce442f-039c-46be-b513-2fb31825b50a", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.061Z", "created_at": "2026-09-28T14:17:53.863Z", "modified": "2026-09-28T14:17:54.459Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:17:54.459Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e5e8a598-f242-475b-a6b3-660e79da4a1f", "from_id": "e5e8a598-f242-475b-a6b3-660e79da4a1f", "from_name": null, "from_type": "Indicator", "id": "23d21d11-1e48-4779-b887-56325e9fb733", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--4066d941-890e-54ed-8f59-a0b6d0895e22", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.178Z", "created_at": "2026-09-28T14:29:36.657Z", "modified": "2026-09-28T14:29:38.267Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:29:38.267Z" }, "description_available": false, "entity_type": "indicates", "fromId": "649c83c4-e081-4c72-a640-e3453e228c58", "from_id": "649c83c4-e081-4c72-a640-e3453e228c58", "from_name": null, "from_type": "Indicator", "id": "25f49740-ae91-4176-94c5-76a32acb9cfc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--9c3e7927-482f-545f-a8ba-292128284ba3", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.267Z", "created_at": "2026-09-28T14:38:44.441Z", "modified": "2026-09-28T14:38:44.960Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:38:44.960Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20cabaa0-ef56-49bc-b8d3-6917ee254a78", "from_id": "20cabaa0-ef56-49bc-b8d3-6917ee254a78", "from_name": null, "from_type": "Indicator", "id": "2b7be694-0cc8-4646-bd09-f5c7e4afb435", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--2f77c7f9-10f0-513a-9623-bed39ff95776", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:29:03.614Z", "created_at": "2026-03-24T16:03:54.269Z", "modified": "2026-03-24T16:03:54.733Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-24T16:03:54.733Z" }, "description_available": false, "entity_type": "targets", "fromId": "4c84102f-e439-4038-9967-14a0c7805586", "from_id": "4c84102f-e439-4038-9967-14a0c7805586", "from_name": "SweetPotato", "from_type": "Malware", "id": "2cc2826c-3924-4a2b-9f3e-04d1d5d76acf", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--a6010bc2-ef26-5941-ac9e-b85306580f05", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.253Z", "created_at": "2026-09-28T14:37:33.533Z", "modified": "2026-09-28T14:37:34.232Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:37:34.232Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5cbecb2b-ba0b-43a2-8431-2929afea5ffa", "from_id": "5cbecb2b-ba0b-43a2-8431-2929afea5ffa", "from_name": null, "from_type": "Indicator", "id": "37ce3817-3a9e-4b02-ba2e-daabe5a1feed", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--e9c9bb4d-368c-5c4e-aa70-1ab40579d25d", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.217Z", "created_at": "2026-09-28T14:31:30.260Z", "modified": "2026-09-28T14:31:32.993Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:31:32.993Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ff97301c-2c40-4ca5-8914-baeb6e7e69cb", "from_id": "ff97301c-2c40-4ca5-8914-baeb6e7e69cb", "from_name": null, "from_type": "Indicator", "id": "3a8b8f19-dca0-486c-9917-eb13bf5e2ce9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--f9f6c41f-e9c4-5388-ad11-96bba0323328", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.073Z", "created_at": "2026-09-28T14:18:44.054Z", "modified": "2026-09-28T14:18:45.913Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:18:45.913Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65ab4965-8cf5-4b2e-b419-dc49ed1e3f18", "from_id": "65ab4965-8cf5-4b2e-b419-dc49ed1e3f18", "from_name": null, "from_type": "Indicator", "id": "434b11a8-08c4-4dce-8680-0c46dae70bea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--d3b1eb1e-ff50-5187-86ad-18f171796729", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.032Z", "created_at": "2026-01-18T14:38:39.061Z", "modified": "2026-01-18T14:38:39.335Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:39.335Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "from_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "from_name": "Northern America", "from_type": "Region", "id": "4a3ffcd5-bd03-47c6-a71d-4c47c1151811", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--35fa17bc-cd76-5e88-b582-d1c577aa86ba", "toId": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_name": "Americas", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.997Z", "created_at": "2026-09-28T14:10:59.488Z", "modified": "2026-09-28T14:11:01.196Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:11:01.196Z" }, "description_available": false, "entity_type": "indicates", "fromId": "606544f1-119a-452a-9170-e0fca65900e8", "from_id": "606544f1-119a-452a-9170-e0fca65900e8", "from_name": null, "from_type": "Indicator", "id": "53857b36-1bdd-48fa-9b0f-da9a019ed7a0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--7f411830-4439-5b50-a65a-875cff4157c8", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.217Z", "created_at": "2026-09-28T14:32:06.972Z", "modified": "2026-09-28T14:32:08.696Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:32:08.696Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ff97301c-2c40-4ca5-8914-baeb6e7e69cb", "from_id": "ff97301c-2c40-4ca5-8914-baeb6e7e69cb", "from_name": null, "from_type": "Indicator", "id": "5708069e-7c82-422a-be4a-2543126ef737", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--c2b87b44-f17e-55fe-ad29-9e954527a979", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.921Z", "created_at": "2026-09-28T14:09:37.468Z", "modified": "2026-09-28T14:09:39.468Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:39.468Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d9f22a30-2145-4154-bf85-b4c5f9209017", "from_id": "d9f22a30-2145-4154-bf85-b4c5f9209017", "from_name": null, "from_type": "Indicator", "id": "58511fda-0692-4983-88c1-b5414f8a0750", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--580e6037-e698-5ea3-8587-2bce33cc88b1", "toId": "9cfc7d6d-ab0f-4a5a-abdc-af65bd2bbb4e", "to_id": "9cfc7d6d-ab0f-4a5a-abdc-af65bd2bbb4e", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.129Z", "created_at": "2026-09-28T14:23:39.003Z", "modified": "2026-09-28T14:23:41.693Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:23:41.693Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94fb90f0-0349-445c-987c-17550d3eeaf3", "from_id": "94fb90f0-0349-445c-987c-17550d3eeaf3", "from_name": null, "from_type": "Indicator", "id": "66ce18f0-9578-4765-bc7f-05978236ebcb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--5451fd1f-dec1-51f5-95b7-7e61df568a72", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.959Z", "created_at": "2026-09-28T14:09:55.121Z", "modified": "2026-09-28T14:09:56.662Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:56.662Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3e34b0b6-81be-4c44-bcf7-54ff72467dc3", "from_id": "3e34b0b6-81be-4c44-bcf7-54ff72467dc3", "from_name": null, "from_type": "Indicator", "id": "6d8dde40-d5e4-4fc8-bebf-0bb409d540cb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--36f4e0c6-543c-5cfa-b350-10d0f2ec18a6", "toId": "104a0198-6c63-4f6f-bc19-4d472e62c453", "to_id": "104a0198-6c63-4f6f-bc19-4d472e62c453", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.061Z", "created_at": "2026-09-28T14:18:09.952Z", "modified": "2026-09-28T14:18:11.590Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:18:11.590Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e5e8a598-f242-475b-a6b3-660e79da4a1f", "from_id": "e5e8a598-f242-475b-a6b3-660e79da4a1f", "from_name": null, "from_type": "Indicator", "id": "6de2225b-0fb5-4f17-9d12-ddd3023caf3f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--02c35b02-ec37-59a0-b251-f2f13f8c8b1e", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.048Z", "created_at": "2026-09-28T14:17:23.134Z", "modified": "2026-09-28T14:17:23.534Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:17:23.534Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4f4926bf-2e1a-4fa4-a37a-8c2cbad4df1b", "from_id": "4f4926bf-2e1a-4fa4-a37a-8c2cbad4df1b", "from_name": null, "from_type": "Indicator", "id": "6ea809ac-b82b-4459-af35-f57310ca38db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--dedbf313-3e91-5d18-9792-1694d90e25cd", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.091Z", "created_at": "2026-09-28T14:20:43.601Z", "modified": "2026-09-28T14:20:45.272Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:20:45.272Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5fd268df-bb1f-49af-9c21-a1d0bffc37e3", "from_id": "5fd268df-bb1f-49af-9c21-a1d0bffc37e3", "from_name": null, "from_type": "Indicator", "id": "7120f9aa-6609-413a-b5c1-a5ffdd72a522", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--f4d456f5-9d76-5bf4-bbbd-ec4c69ddeaa4", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.948Z", "created_at": "2026-09-28T14:09:51.319Z", "modified": "2026-09-28T14:09:52.120Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:52.120Z" }, "description_available": false, "entity_type": "based-on", "fromId": "084b51b6-f17c-4a41-86b5-650ff584a2b7", "from_id": "084b51b6-f17c-4a41-86b5-650ff584a2b7", "from_name": null, "from_type": "Indicator", "id": "7127ded4-d4f3-483e-9fa6-fbe0e78dbc29", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--0b764b87-5e7a-5f00-bb97-0c8a1a6186ea", "toId": "0baec135-0694-40a7-b710-f18567a36bf5", "to_id": "0baec135-0694-40a7-b710-f18567a36bf5", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.229Z", "created_at": "2026-09-28T14:33:52.372Z", "modified": "2026-09-28T14:33:58.723Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:33:58.723Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3e34b0b6-81be-4c44-bcf7-54ff72467dc3", "from_id": "3e34b0b6-81be-4c44-bcf7-54ff72467dc3", "from_name": null, "from_type": "Indicator", "id": "73fe20f0-8bc9-456a-9828-39a394b66a5b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--ae5889bb-a6a3-5b9b-898c-a6143cfaaa7d", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.143Z", "created_at": "2026-09-28T14:24:49.334Z", "modified": "2026-09-28T14:24:51.021Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:24:51.021Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4c7a377c-7d79-48f6-befa-a9a5eaee3a59", "from_id": "4c7a377c-7d79-48f6-befa-a9a5eaee3a59", "from_name": null, "from_type": "Indicator", "id": "761befe5-03aa-482c-a3ff-efcc09b89a32", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--7b1eba0b-cba4-5644-8996-d9b81e90b95b", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.964Z", "created_at": "2026-09-28T14:09:57.554Z", "modified": "2026-09-28T14:10:02.935Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:10:02.935Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5cbecb2b-ba0b-43a2-8431-2929afea5ffa", "from_id": "5cbecb2b-ba0b-43a2-8431-2929afea5ffa", "from_name": null, "from_type": "Indicator", "id": "7dec67fd-cdae-48a2-a67a-66ac30f83644", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--5c68258e-e461-5bee-910e-f202c8432eb4", "toId": "91970f97-ae3e-4315-af75-f47c7fec80ad", "to_id": "91970f97-ae3e-4315-af75-f47c7fec80ad", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.143Z", "created_at": "2026-09-28T14:24:55.946Z", "modified": "2026-09-28T14:25:00.218Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:25:00.218Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4c7a377c-7d79-48f6-befa-a9a5eaee3a59", "from_id": "4c7a377c-7d79-48f6-befa-a9a5eaee3a59", "from_name": null, "from_type": "Indicator", "id": "82b41523-4ce1-40a3-98d3-690f0042efb2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--45da7b7a-84eb-50c0-93c1-81c1c1696224", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.918Z", "created_at": "2026-09-28T14:09:37.459Z", "modified": "2026-09-28T14:09:39.467Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:39.467Z" }, "description_available": false, "entity_type": "based-on", "fromId": "459002a9-20e9-45dc-996d-e79dd4efb949", "from_id": "459002a9-20e9-45dc-996d-e79dd4efb949", "from_name": null, "from_type": "Indicator", "id": "82b47984-b3df-4931-a55f-1d331c604ceb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--d979f104-39e7-5bd7-8b59-719895fcd708", "toId": "15bcb34f-d851-4546-8e20-d4fd8cdf38e6", "to_id": "15bcb34f-d851-4546-8e20-d4fd8cdf38e6", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.907Z", "created_at": "2026-09-28T14:09:35.732Z", "modified": "2026-09-28T14:09:36.678Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:36.678Z" }, "description_available": false, "entity_type": "based-on", "fromId": "16834e2a-7dbd-40b8-b80f-63cdd6a6aca8", "from_id": "16834e2a-7dbd-40b8-b80f-63cdd6a6aca8", "from_name": null, "from_type": "Indicator", "id": "83a2f2c0-a81e-4100-983f-da4a860d8250", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--dedabed7-6900-5983-a2cd-2baac3bdde36", "toId": "0a7beb76-4453-41b6-b309-d39e65266fcd", "to_id": "0a7beb76-4453-41b6-b309-d39e65266fcd", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:31:56.633Z", "created_at": "2026-04-21T19:49:35.198Z", "modified": "2026-04-21T19:49:36.740Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-21T19:49:36.740Z" }, "description_available": false, "entity_type": "targets", "fromId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "from_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "from_name": "Godzilla", "from_type": "Malware", "id": "841dceb3-d4d6-40fb-9745-731b2c959d1e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--8c308db9-9218-58ec-8dd8-b2d280acd0c9", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.048Z", "created_at": "2026-09-28T14:17:07.263Z", "modified": "2026-09-28T14:17:10.459Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:17:10.459Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4f4926bf-2e1a-4fa4-a37a-8c2cbad4df1b", "from_id": "4f4926bf-2e1a-4fa4-a37a-8c2cbad4df1b", "from_name": null, "from_type": "Indicator", "id": "8e29ea8e-ae40-436e-9a41-0c19a54a6035", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--32f942c2-d994-5830-84e8-a2e85a9f0d2e", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.200Z", "created_at": "2026-09-28T14:30:26.575Z", "modified": "2026-09-28T14:30:28.528Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:30:28.528Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b4a69bd0-cd2a-48df-9d40-fbbbbf99466e", "from_id": "b4a69bd0-cd2a-48df-9d40-fbbbbf99466e", "from_name": null, "from_type": "Indicator", "id": "9057c601-b430-49c7-9dca-6224cbf5d0d9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--dd63d724-4ddc-5f62-9911-af7302ca4e18", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.946Z", "created_at": "2026-09-28T14:09:50.997Z", "modified": "2026-09-28T14:09:51.955Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:51.955Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b5199185-d838-4b3a-8ffb-32580a3d9029", "from_id": "b5199185-d838-4b3a-8ffb-32580a3d9029", "from_name": null, "from_type": "Indicator", "id": "912e9594-7beb-42da-9b91-a532f9a0bd2a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--75a74f71-1635-54c8-8a36-b88d4f111fcf", "toId": "b57f7af9-e5f3-44d7-b765-8ed4bb55b03f", "to_id": "b57f7af9-e5f3-44d7-b765-8ed4bb55b03f", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.128Z", "created_at": "2026-09-28T14:23:43.989Z", "modified": "2026-09-28T14:23:44.310Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:23:44.310Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94fb90f0-0349-445c-987c-17550d3eeaf3", "from_id": "94fb90f0-0349-445c-987c-17550d3eeaf3", "from_name": null, "from_type": "Indicator", "id": "97dd647f-9f2e-4abf-9c01-5d559857652d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--a1552808-fc3e-53f1-a53a-19ce1601cdde", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.935Z", "created_at": "2026-09-28T14:09:42.879Z", "modified": "2026-09-28T14:09:43.674Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:43.674Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5fd268df-bb1f-49af-9c21-a1d0bffc37e3", "from_id": "5fd268df-bb1f-49af-9c21-a1d0bffc37e3", "from_name": null, "from_type": "Indicator", "id": "9a50b33c-510c-4662-ae9e-4eb1f6a956a6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--6fdd43fe-3803-5146-b6b7-cb394e1fa41a", "toId": "9b4186d9-2fd6-4995-8550-39f7f550bd2b", "to_id": "9b4186d9-2fd6-4995-8550-39f7f550bd2b", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.961Z", "created_at": "2026-09-28T14:09:57.061Z", "modified": "2026-09-28T14:09:58.918Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:58.918Z" }, "description_available": false, "entity_type": "based-on", "fromId": "584f7f4a-9d20-491c-989a-1083b4e9a03d", "from_id": "584f7f4a-9d20-491c-989a-1083b4e9a03d", "from_name": null, "from_type": "Indicator", "id": "9a80bfd8-15ef-4ed4-91d1-c8cdce46ac55", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--dc6002cc-3cdc-51a0-a812-47640bcd8fc9", "toId": "c1e34ae6-704d-40f4-90e4-b073f26d280f", "to_id": "c1e34ae6-704d-40f4-90e4-b073f26d280f", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.241Z", "created_at": "2026-09-28T14:36:36.685Z", "modified": "2026-09-28T14:36:37.905Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:36:37.905Z" }, "description_available": false, "entity_type": "indicates", "fromId": "584f7f4a-9d20-491c-989a-1083b4e9a03d", "from_id": "584f7f4a-9d20-491c-989a-1083b4e9a03d", "from_name": null, "from_type": "Indicator", "id": "a1ac39ac-0b49-4ee3-9cac-70bc777aefc7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--8769e794-94a0-5b5e-bf1b-35edb1764bd2", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.113Z", "created_at": "2026-09-28T14:23:03.870Z", "modified": "2026-09-28T14:23:04.551Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:23:04.551Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d143c452-bfd8-4c45-b54c-91c943502181", "from_id": "d143c452-bfd8-4c45-b54c-91c943502181", "from_name": null, "from_type": "Indicator", "id": "a2499dc8-6df1-4dec-8508-7a48b102cbd1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--bd7dafd2-f232-5928-97c7-78457ad018d7", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.166Z", "created_at": "2026-09-28T14:27:40.980Z", "modified": "2026-09-28T14:27:41.524Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:27:41.524Z" }, "description_available": false, "entity_type": "indicates", "fromId": "084b51b6-f17c-4a41-86b5-650ff584a2b7", "from_id": "084b51b6-f17c-4a41-86b5-650ff584a2b7", "from_name": null, "from_type": "Indicator", "id": "a4b3b24c-38d1-4388-b8fb-3bc62e340547", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--26b06512-1713-505a-9354-bea8b87c9da1", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.953Z", "created_at": "2026-09-28T14:09:54.708Z", "modified": "2026-09-28T14:09:55.969Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:55.969Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b4a69bd0-cd2a-48df-9d40-fbbbbf99466e", "from_id": "b4a69bd0-cd2a-48df-9d40-fbbbbf99466e", "from_name": null, "from_type": "Indicator", "id": "a65cddfd-ecfa-47a6-832b-02bdf349af57", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--e09e7241-d325-57ca-aeaf-f2edb9b01342", "toId": "1de100a3-4ce0-43cf-813c-4896d531ad12", "to_id": "1de100a3-4ce0-43cf-813c-4896d531ad12", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.943Z", "created_at": "2026-09-28T14:09:47.599Z", "modified": "2026-09-28T14:09:49.081Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:49.081Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4c7a377c-7d79-48f6-befa-a9a5eaee3a59", "from_id": "4c7a377c-7d79-48f6-befa-a9a5eaee3a59", "from_name": null, "from_type": "Indicator", "id": "a8e1c7ef-f900-4846-9eaf-9a2a537812e4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--2ff0036f-8248-5038-93cc-b2e58a1aa4a5", "toId": "459b3e05-c7b7-42bc-ab61-ff1da64a57eb", "to_id": "459b3e05-c7b7-42bc-ab61-ff1da64a57eb", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.969Z", "created_at": "2026-09-28T14:10:11.489Z", "modified": "2026-09-28T14:10:13.979Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:10:13.979Z" }, "description_available": false, "entity_type": "indicates", "fromId": "16834e2a-7dbd-40b8-b80f-63cdd6a6aca8", "from_id": "16834e2a-7dbd-40b8-b80f-63cdd6a6aca8", "from_name": null, "from_type": "Indicator", "id": "bae8ec9e-4437-4277-8cff-67ccdc75b12a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--0a25a7ae-78d2-57c2-91d2-517311ff85ae", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.267Z", "created_at": "2026-09-28T14:38:29.737Z", "modified": "2026-09-28T14:38:32.879Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:38:32.879Z" }, "description_available": false, "entity_type": "indicates", "fromId": "20cabaa0-ef56-49bc-b8d3-6917ee254a78", "from_id": "20cabaa0-ef56-49bc-b8d3-6917ee254a78", "from_name": null, "from_type": "Indicator", "id": "bb75b0d3-91dd-4516-a504-4532df059d2f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--043194fc-1ef8-5847-aa75-aea3786e56a2", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.073Z", "created_at": "2026-09-28T14:18:47.070Z", "modified": "2026-09-28T14:18:47.798Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:18:47.798Z" }, "description_available": false, "entity_type": "indicates", "fromId": "65ab4965-8cf5-4b2e-b419-dc49ed1e3f18", "from_id": "65ab4965-8cf5-4b2e-b419-dc49ed1e3f18", "from_name": null, "from_type": "Indicator", "id": "be628c14-c12f-483b-9796-c65be5e5d6b4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--490f3f4c-35d0-580b-b9c6-4620b2ffaba3", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.966Z", "created_at": "2026-09-28T14:09:57.560Z", "modified": "2026-09-28T14:10:02.934Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:10:02.934Z" }, "description_available": false, "entity_type": "based-on", "fromId": "20cabaa0-ef56-49bc-b8d3-6917ee254a78", "from_id": "20cabaa0-ef56-49bc-b8d3-6917ee254a78", "from_name": null, "from_type": "Indicator", "id": "c9a05886-d062-4e07-9da2-b0277a4789df", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--1a15fd60-e5af-54e9-b440-e1fda4231874", "toId": "70dd4ae6-e365-49aa-b17c-7288b32357f2", "to_id": "70dd4ae6-e365-49aa-b17c-7288b32357f2", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.090Z", "created_at": "2026-09-28T14:22:11.805Z", "modified": "2026-09-28T14:22:13.887Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:22:13.887Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5fd268df-bb1f-49af-9c21-a1d0bffc37e3", "from_id": "5fd268df-bb1f-49af-9c21-a1d0bffc37e3", "from_name": null, "from_type": "Indicator", "id": "cb6f1532-bacb-4b4a-af30-bba6210acc87", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--da77a0ac-56b1-53b8-944f-362b6149d0d6", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.179Z", "created_at": "2026-09-28T14:29:48.000Z", "modified": "2026-09-28T14:29:49.164Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:29:49.164Z" }, "description_available": false, "entity_type": "indicates", "fromId": "649c83c4-e081-4c72-a640-e3453e228c58", "from_id": "649c83c4-e081-4c72-a640-e3453e228c58", "from_name": null, "from_type": "Indicator", "id": "cc9267a0-1c16-46e3-a2f0-b51f832a1233", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--ca8a9dce-f105-5db2-8a1d-77d0e94c6448", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.941Z", "created_at": "2026-09-28T14:09:47.599Z", "modified": "2026-09-28T14:09:49.080Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:49.080Z" }, "description_available": false, "entity_type": "based-on", "fromId": "94fb90f0-0349-445c-987c-17550d3eeaf3", "from_id": "94fb90f0-0349-445c-987c-17550d3eeaf3", "from_name": null, "from_type": "Indicator", "id": "ce331088-9cd1-4250-ab8b-3b934528912a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--fc519d33-2f24-57ee-8c6f-5ce145035eb8", "toId": "a6aaa7b5-d965-44fb-b3ff-ed05bfa2982b", "to_id": "a6aaa7b5-d965-44fb-b3ff-ed05bfa2982b", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.022Z", "created_at": "2026-09-28T14:13:12.482Z", "modified": "2026-09-28T14:13:20.083Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:13:20.083Z" }, "description_available": false, "entity_type": "indicates", "fromId": "459002a9-20e9-45dc-996d-e79dd4efb949", "from_id": "459002a9-20e9-45dc-996d-e79dd4efb949", "from_name": null, "from_type": "Indicator", "id": "d3e7133e-ec0d-4acf-aaee-8801e96bc92c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--0bcb8e20-2d1d-5604-aec6-979887f3f06e", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.927Z", "created_at": "2026-09-28T14:09:42.884Z", "modified": "2026-09-28T14:09:43.678Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:43.678Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e5e8a598-f242-475b-a6b3-660e79da4a1f", "from_id": "e5e8a598-f242-475b-a6b3-660e79da4a1f", "from_name": null, "from_type": "Indicator", "id": "d422e643-9a56-4ffd-a8be-77646eb62376", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--fb09ac35-a8bc-5fe3-8cfa-1a6cfc7d9931", "toId": "e365272b-8431-4b08-965b-44ee3a5c7c08", "to_id": "e365272b-8431-4b08-965b-44ee3a5c7c08", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:56:12.202Z", "created_at": "2026-02-12T16:57:15.744Z", "modified": "2026-02-12T16:57:16.116Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-12T16:57:16.116Z" }, "description_available": false, "entity_type": "targets", "fromId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "from_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "from_name": "Godzilla", "from_type": "Malware", "id": "d4d32b44-6134-4b68-9a4e-b0f38f0b59d2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--41cc9587-191f-5982-b3d4-891cf9eb31f6", "toId": "3460c7f0-1521-461b-af64-2de060664fb1", "to_id": "3460c7f0-1521-461b-af64-2de060664fb1", "to_name": "United States of America", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.022Z", "created_at": "2026-09-28T14:13:59.796Z", "modified": "2026-09-28T14:14:04.353Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:14:04.353Z" }, "description_available": false, "entity_type": "indicates", "fromId": "459002a9-20e9-45dc-996d-e79dd4efb949", "from_id": "459002a9-20e9-45dc-996d-e79dd4efb949", "from_name": null, "from_type": "Indicator", "id": "d788f3c9-2fa7-486e-a1ed-a8199198a6f4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--5546f869-81ee-5e8f-ac85-a86e5edd3fab", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.889Z", "created_at": "2026-09-28T14:09:15.960Z", "modified": "2026-09-28T14:09:16.812Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:16.812Z" }, "description_available": false, "entity_type": "targets", "fromId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "from_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "from_name": "Godzilla", "from_type": "Malware", "id": "d972e5d3-80e9-4f64-acea-02b31e2b31b2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--e8ce36cb-87f8-5199-bc21-ff3ae0970af4", "toId": "453d9070-cd88-4cec-b38d-d819c0e25a45", "to_id": "453d9070-cd88-4cec-b38d-d819c0e25a45", "to_name": "CVE-2019-18935", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:38:41.111Z", "modified": "2026-01-18T14:38:41.841Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:41.841Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3460c7f0-1521-461b-af64-2de060664fb1", "from_id": "3460c7f0-1521-461b-af64-2de060664fb1", "from_name": "United States of America", "from_type": "Country", "id": "daee60ed-495b-4626-8967-6a667c789917", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--98d1ce2f-0759-5c90-a6e9-100a3a2299a7", "toId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_name": "Northern America", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.114Z", "created_at": "2026-09-28T14:23:16.833Z", "modified": "2026-09-28T14:23:19.310Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:23:19.310Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d143c452-bfd8-4c45-b54c-91c943502181", "from_id": "d143c452-bfd8-4c45-b54c-91c943502181", "from_name": null, "from_type": "Indicator", "id": "e43bfa65-28ba-429e-8e40-48f3ba0a7c0b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--5268a146-c5c9-59d9-920d-5b1264f38164", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.155Z", "created_at": "2026-09-28T14:26:48.193Z", "modified": "2026-09-28T14:26:50.825Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:26:50.825Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b5199185-d838-4b3a-8ffb-32580a3d9029", "from_id": "b5199185-d838-4b3a-8ffb-32580a3d9029", "from_name": null, "from_type": "Indicator", "id": "e5ad091c-2e94-46e9-a6f4-9cdd332339a2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--b8c13526-a69f-5eab-8a41-d5e651159743", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.034Z", "created_at": "2026-09-28T14:16:18.552Z", "modified": "2026-09-28T14:16:20.182Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:16:20.182Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d9f22a30-2145-4154-bf85-b4c5f9209017", "from_id": "d9f22a30-2145-4154-bf85-b4c5f9209017", "from_name": null, "from_type": "Indicator", "id": "e6972d55-b4ae-4442-be84-45e6021cdefb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--21cf175b-342b-5d99-ba20-ec1c02c5547f", "toId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "to_name": "Godzilla", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.253Z", "created_at": "2026-09-28T14:37:52.497Z", "modified": "2026-09-28T14:37:53.489Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:37:53.489Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5cbecb2b-ba0b-43a2-8431-2929afea5ffa", "from_id": "5cbecb2b-ba0b-43a2-8431-2929afea5ffa", "from_name": null, "from_type": "Indicator", "id": "ec99b254-0024-4cb5-91b4-9853355d5697", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--f08049bd-49e5-5b0c-bbbc-805efa2ef0ac", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.887Z", "created_at": "2026-09-28T14:05:50.295Z", "modified": "2026-09-28T14:05:53.178Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:05:53.178Z" }, "description_available": false, "entity_type": "targets", "fromId": "4c84102f-e439-4038-9967-14a0c7805586", "from_id": "4c84102f-e439-4038-9967-14a0c7805586", "from_name": "SweetPotato", "from_type": "Malware", "id": "f20c3de5-1fe4-4397-8efe-ebcef28f140b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--b65413ef-d10e-59f9-a8dd-aaaaa2e8cc4f", "toId": "3460c7f0-1521-461b-af64-2de060664fb1", "to_id": "3460c7f0-1521-461b-af64-2de060664fb1", "to_name": "United States of America", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.998Z", "created_at": "2026-09-28T14:11:02.108Z", "modified": "2026-09-28T14:11:02.769Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:11:02.769Z" }, "description_available": false, "entity_type": "indicates", "fromId": "606544f1-119a-452a-9170-e0fca65900e8", "from_id": "606544f1-119a-452a-9170-e0fca65900e8", "from_name": null, "from_type": "Indicator", "id": "f39f64dd-ce64-4233-9029-e2a79accbd0c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--70de12b6-c8e6-590e-af0c-2f93ae76a8d9", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.035Z", "created_at": "2026-09-28T14:16:16.356Z", "modified": "2026-09-28T14:16:17.059Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:16:17.059Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d9f22a30-2145-4154-bf85-b4c5f9209017", "from_id": "d9f22a30-2145-4154-bf85-b4c5f9209017", "from_name": null, "from_type": "Indicator", "id": "f5e7a492-83a4-414d-8985-ebb8eb74daf9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--ca53cb8f-83a9-5320-b1c8-499900e56963", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.938Z", "created_at": "2026-09-28T14:09:47.593Z", "modified": "2026-09-28T14:09:48.982Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:48.982Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d143c452-bfd8-4c45-b54c-91c943502181", "from_id": "d143c452-bfd8-4c45-b54c-91c943502181", "from_name": null, "from_type": "Indicator", "id": "f7469c53-7821-4c68-bae5-5e6784846826", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--e900f436-a1db-5411-a3c8-7103b941128c", "toId": "d77c292e-0ab2-4426-8726-44285e017257", "to_id": "d77c292e-0ab2-4426-8726-44285e017257", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.950Z", "created_at": "2026-09-28T14:09:51.326Z", "modified": "2026-09-28T14:09:53.019Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:53.019Z" }, "description_available": false, "entity_type": "based-on", "fromId": "649c83c4-e081-4c72-a640-e3453e228c58", "from_id": "649c83c4-e081-4c72-a640-e3453e228c58", "from_name": null, "from_type": "Indicator", "id": "fa8dd61b-1ce8-4604-b899-0454df356b5b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--0dd4850a-7c0a-5214-9e6b-dc9885aedc91", "toId": "8364371c-009e-4b24-84a9-2d73d2599e13", "to_id": "8364371c-009e-4b24-84a9-2d73d2599e13", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:00.889Z", "created_at": "2026-09-28T14:09:23.528Z", "modified": "2026-09-28T14:09:24.344Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:09:24.344Z" }, "description_available": false, "entity_type": "targets", "fromId": "4c84102f-e439-4038-9967-14a0c7805586", "from_id": "4c84102f-e439-4038-9967-14a0c7805586", "from_name": "SweetPotato", "from_type": "Malware", "id": "fb015052-d412-4a69-a8f3-9a77b183a9a2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--495f1710-4ec3-5c22-bf9a-586c7ccf5f0c", "toId": "453d9070-cd88-4cec-b38d-d819c0e25a45", "to_id": "453d9070-cd88-4cec-b38d-d819c0e25a45", "to_name": "CVE-2019-18935", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T13:53:01.167Z", "created_at": "2026-09-28T14:27:45.288Z", "modified": "2026-09-28T14:27:45.980Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-28T14:27:45.980Z" }, "description_available": false, "entity_type": "indicates", "fromId": "084b51b6-f17c-4a41-86b5-650ff584a2b7", "from_id": "084b51b6-f17c-4a41-86b5-650ff584a2b7", "from_name": null, "from_type": "Indicator", "id": "fde76a80-9f8f-4e42-b708-12a4045c6061", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--d3de4d05-58d6-553a-a56c-b0af9b9007c1", "toId": "4c84102f-e439-4038-9967-14a0c7805586", "to_id": "4c84102f-e439-4038-9967-14a0c7805586", "to_name": "SweetPotato", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "2[.]59[.]133[.]147", "description_available": true, "object_id": "459002a9-20e9-45dc-996d-e79dd4efb949", "object_ids": [ "15bcb34f-d851-4546-8e20-d4fd8cdf38e6", "459002a9-20e9-45dc-996d-e79dd4efb949" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "459002a9-20e9-45dc-996d-e79dd4efb949", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "2.59.133.147" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "15bcb34f-d851-4546-8e20-d4fd8cdf38e6", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "2.59.133.147" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "ipv4", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "2.59.133.147" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "206[.]82[.]6[.]22", "description_available": false, "object_id": "606544f1-119a-452a-9170-e0fca65900e8", "object_ids": [ "606544f1-119a-452a-9170-e0fca65900e8", "afce442f-039c-46be-b513-2fb31825b50a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "606544f1-119a-452a-9170-e0fca65900e8", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2026-10-18T12:48:08.434Z", "validity_status": "active", "value": "206.82.6.22" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "afce442f-039c-46be-b513-2fb31825b50a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "206.82.6.22" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "ipv4", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2026-10-18T12:48:08.434Z", "validity_status": "active", "value": "206.82.6.22" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "45[.]138[.]16[.]187", "description_available": true, "object_id": "16834e2a-7dbd-40b8-b80f-63cdd6a6aca8", "object_ids": [ "0a7beb76-4453-41b6-b309-d39e65266fcd", "16834e2a-7dbd-40b8-b80f-63cdd6a6aca8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "16834e2a-7dbd-40b8-b80f-63cdd6a6aca8", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "45.138.16.187" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "0a7beb76-4453-41b6-b309-d39e65266fcd", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "45.138.16.187" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "ipv4", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "45.138.16.187" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "65[.]98[.]5[.]158", "description_available": false, "object_id": "d9f22a30-2145-4154-bf85-b4c5f9209017", "object_ids": [ "9cfc7d6d-ab0f-4a5a-abdc-af65bd2bbb4e", "d9f22a30-2145-4154-bf85-b4c5f9209017" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d9f22a30-2145-4154-bf85-b4c5f9209017", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2026-10-18T12:48:08.434Z", "validity_status": "active", "value": "65.98.5.158" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "9cfc7d6d-ab0f-4a5a-abdc-af65bd2bbb4e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "65.98.5.158" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "ipv4", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2026-10-18T12:48:08.434Z", "validity_status": "active", "value": "65.98.5.158" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "0a4be0b6c650ffdcd1c22db56f1c4aec", "description_available": false, "object_id": "4f4926bf-2e1a-4fa4-a37a-8c2cbad4df1b", "object_ids": [ "3378ad6a-f542-463f-a1da-0c0355873e45", "4f4926bf-2e1a-4fa4-a37a-8c2cbad4df1b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4f4926bf-2e1a-4fa4-a37a-8c2cbad4df1b", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "0a4be0b6c650ffdcd1c22db56f1c4aec" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "3378ad6a-f542-463f-a1da-0c0355873e45", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "0a4be0b6c650ffdcd1c22db56f1c4aec" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "md5", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "0a4be0b6c650ffdcd1c22db56f1c4aec" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "10f705728d228ad949b7894c1a85a2b1", "description_available": false, "object_id": "e5e8a598-f242-475b-a6b3-660e79da4a1f", "object_ids": [ "e365272b-8431-4b08-965b-44ee3a5c7c08", "e5e8a598-f242-475b-a6b3-660e79da4a1f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e5e8a598-f242-475b-a6b3-660e79da4a1f", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "10f705728d228ad949b7894c1a85a2b1" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "e365272b-8431-4b08-965b-44ee3a5c7c08", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "10f705728d228ad949b7894c1a85a2b1" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "md5", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "10f705728d228ad949b7894c1a85a2b1" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "177e34d9174766a1d187a0c82de4c02f", "description_available": false, "object_id": "65ab4965-8cf5-4b2e-b419-dc49ed1e3f18", "object_ids": [ "374d9ae3-cc56-41b9-9d78-8135314acd12", "65ab4965-8cf5-4b2e-b419-dc49ed1e3f18" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "65ab4965-8cf5-4b2e-b419-dc49ed1e3f18", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "177e34d9174766a1d187a0c82de4c02f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "374d9ae3-cc56-41b9-9d78-8135314acd12", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "177e34d9174766a1d187a0c82de4c02f" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "md5", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "177e34d9174766a1d187a0c82de4c02f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "18fb4e070653fc9791e0e408d8cb1c8e", "description_available": false, "object_id": "5fd268df-bb1f-49af-9c21-a1d0bffc37e3", "object_ids": [ "5fd268df-bb1f-49af-9c21-a1d0bffc37e3", "9b4186d9-2fd6-4995-8550-39f7f550bd2b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5fd268df-bb1f-49af-9c21-a1d0bffc37e3", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "18fb4e070653fc9791e0e408d8cb1c8e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "9b4186d9-2fd6-4995-8550-39f7f550bd2b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "18fb4e070653fc9791e0e408d8cb1c8e" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "md5", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "18fb4e070653fc9791e0e408d8cb1c8e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "1dbfda02d74b6a7586c4430175204c28", "description_available": false, "object_id": "d143c452-bfd8-4c45-b54c-91c943502181", "object_ids": [ "d143c452-bfd8-4c45-b54c-91c943502181", "d77c292e-0ab2-4426-8726-44285e017257" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d143c452-bfd8-4c45-b54c-91c943502181", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "1dbfda02d74b6a7586c4430175204c28" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d77c292e-0ab2-4426-8726-44285e017257", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "1dbfda02d74b6a7586c4430175204c28" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "md5", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "1dbfda02d74b6a7586c4430175204c28" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "972f86b4b06af1033063a2c3f114c56b400a917f", "description_available": false, "object_id": "b4a69bd0-cd2a-48df-9d40-fbbbbf99466e", "object_ids": [ "1de100a3-4ce0-43cf-813c-4896d531ad12", "b4a69bd0-cd2a-48df-9d40-fbbbbf99466e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b4a69bd0-cd2a-48df-9d40-fbbbbf99466e", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "972f86b4b06af1033063a2c3f114c56b400a917f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "1de100a3-4ce0-43cf-813c-4896d531ad12", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "972f86b4b06af1033063a2c3f114c56b400a917f" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "sha1", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "972f86b4b06af1033063a2c3f114c56b400a917f" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e23046d6f69b3732c2b92b437503470eec287a1e", "description_available": false, "object_id": "ff97301c-2c40-4ca5-8914-baeb6e7e69cb", "object_ids": [ "74a8c684-45be-47ac-a424-baf6fa84f41d", "ff97301c-2c40-4ca5-8914-baeb6e7e69cb" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ff97301c-2c40-4ca5-8914-baeb6e7e69cb", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "e23046d6f69b3732c2b92b437503470eec287a1e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "74a8c684-45be-47ac-a424-baf6fa84f41d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e23046d6f69b3732c2b92b437503470eec287a1e" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "sha1", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "e23046d6f69b3732c2b92b437503470eec287a1e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "fe619d4c633f9a1e35209b27d8ceb51b867b6a9e", "description_available": false, "object_id": "3e34b0b6-81be-4c44-bcf7-54ff72467dc3", "object_ids": [ "104a0198-6c63-4f6f-bc19-4d472e62c453", "3e34b0b6-81be-4c44-bcf7-54ff72467dc3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "3e34b0b6-81be-4c44-bcf7-54ff72467dc3", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "fe619d4c633f9a1e35209b27d8ceb51b867b6a9e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "104a0198-6c63-4f6f-bc19-4d472e62c453", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "fe619d4c633f9a1e35209b27d8ceb51b867b6a9e" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "sha1", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "fe619d4c633f9a1e35209b27d8ceb51b867b6a9e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "944062c5c1bfcb1124475212127d4e45fe4b86e32f0c90f56841f8cd2e166ee7", "description_available": false, "object_id": "584f7f4a-9d20-491c-989a-1083b4e9a03d", "object_ids": [ "584f7f4a-9d20-491c-989a-1083b4e9a03d", "c1e34ae6-704d-40f4-90e4-b073f26d280f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "584f7f4a-9d20-491c-989a-1083b4e9a03d", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "944062c5c1bfcb1124475212127d4e45fe4b86e32f0c90f56841f8cd2e166ee7" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c1e34ae6-704d-40f4-90e4-b073f26d280f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "944062c5c1bfcb1124475212127d4e45fe4b86e32f0c90f56841f8cd2e166ee7" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "sha256", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "944062c5c1bfcb1124475212127d4e45fe4b86e32f0c90f56841f8cd2e166ee7" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ee3bd4920e01fdee051e32aa25f180bf0c34f5779bdfc8756958aa5e2867704b", "description_available": false, "object_id": "5cbecb2b-ba0b-43a2-8431-2929afea5ffa", "object_ids": [ "5cbecb2b-ba0b-43a2-8431-2929afea5ffa", "91970f97-ae3e-4315-af75-f47c7fec80ad" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5cbecb2b-ba0b-43a2-8431-2929afea5ffa", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "ee3bd4920e01fdee051e32aa25f180bf0c34f5779bdfc8756958aa5e2867704b" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "91970f97-ae3e-4315-af75-f47c7fec80ad", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ee3bd4920e01fdee051e32aa25f180bf0c34f5779bdfc8756958aa5e2867704b" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "sha256", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "ee3bd4920e01fdee051e32aa25f180bf0c34f5779bdfc8756958aa5e2867704b" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ef30642c62856ccfd1dbac5ba97259e8d0a4ac61cb4c0efbaa563dc5164bb898", "description_available": false, "object_id": "20cabaa0-ef56-49bc-b8d3-6917ee254a78", "object_ids": [ "20cabaa0-ef56-49bc-b8d3-6917ee254a78", "70dd4ae6-e365-49aa-b17c-7288b32357f2" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "20cabaa0-ef56-49bc-b8d3-6917ee254a78", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "ef30642c62856ccfd1dbac5ba97259e8d0a4ac61cb4c0efbaa563dc5164bb898" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "70dd4ae6-e365-49aa-b17c-7288b32357f2", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ef30642c62856ccfd1dbac5ba97259e8d0a4ac61cb4c0efbaa563dc5164bb898" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "sha256", "valid_from": "2026-09-28T07:13:29.000Z", "valid_until": "2027-07-15T18:23:13.557Z", "validity_status": "active", "value": "ef30642c62856ccfd1dbac5ba97259e8d0a4ac61cb4c0efbaa563dc5164bb898" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//2[.]59[.]133[.]147[:]31338/ins[.]txt", "description_available": false, "object_id": "94fb90f0-0349-445c-987c-17550d3eeaf3", "object_ids": [ "94fb90f0-0349-445c-987c-17550d3eeaf3", "a6aaa7b5-d965-44fb-b3ff-ed05bfa2982b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "94fb90f0-0349-445c-987c-17550d3eeaf3", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "http://2.59.133.147:31338/ins.txt" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "a6aaa7b5-d965-44fb-b3ff-ed05bfa2982b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://2.59.133.147:31338/ins.txt" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "url", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "http://2.59.133.147:31338/ins.txt" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//2[.]59[.]133[.]147[:]31338/sm[.]json", "description_available": false, "object_id": "4c7a377c-7d79-48f6-befa-a9a5eaee3a59", "object_ids": [ "459b3e05-c7b7-42bc-ab61-ff1da64a57eb", "4c7a377c-7d79-48f6-befa-a9a5eaee3a59" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4c7a377c-7d79-48f6-befa-a9a5eaee3a59", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "http://2.59.133.147:31338/sm.json" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "459b3e05-c7b7-42bc-ab61-ff1da64a57eb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://2.59.133.147:31338/sm.json" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "url", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "http://2.59.133.147:31338/sm.json" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//206[.]82[.]6[.]22/", "description_available": false, "object_id": "b5199185-d838-4b3a-8ffb-32580a3d9029", "object_ids": [ "b5199185-d838-4b3a-8ffb-32580a3d9029", "b57f7af9-e5f3-44d7-b765-8ed4bb55b03f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b5199185-d838-4b3a-8ffb-32580a3d9029", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "http://206.82.6.22/" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "b57f7af9-e5f3-44d7-b765-8ed4bb55b03f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://206.82.6.22/" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "url", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "http://206.82.6.22/" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//45[.]138[.]16[.]187[:]31337/bb[.]json", "description_available": false, "object_id": "084b51b6-f17c-4a41-86b5-650ff584a2b7", "object_ids": [ "084b51b6-f17c-4a41-86b5-650ff584a2b7", "0baec135-0694-40a7-b710-f18567a36bf5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "084b51b6-f17c-4a41-86b5-650ff584a2b7", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "http://45.138.16.187:31337/bb.json" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "0baec135-0694-40a7-b710-f18567a36bf5", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://45.138.16.187:31337/bb.json" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "url", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "http://45.138.16.187:31337/bb.json" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "hxxp[:]//45[.]138[.]16[.]187[:]31337/cofuz[.]json", "description_available": false, "object_id": "649c83c4-e081-4c72-a640-e3453e228c58", "object_ids": [ "649c83c4-e081-4c72-a640-e3453e228c58", "8364371c-009e-4b24-84a9-2d73d2599e13" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "649c83c4-e081-4c72-a640-e3453e228c58", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "http://45.138.16.187:31337/cofuz.json" }, { "classification": "observable", "confidence": null, "context": "Objet Url explicitement associé au rapport source.", "object_id": "8364371c-009e-4b24-84a9-2d73d2599e13", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "http://45.138.16.187:31337/cofuz.json" } ], "source_url": "https://asec.ahnlab.com/ko/95560/", "type": "url", "valid_from": "2026-09-28T13:34:48.000Z", "valid_until": "2026-10-18T19:09:27.434Z", "validity_status": "active", "value": "http://45.138.16.187:31337/cofuz.json" } ], "mentioned": [ { "confidence": 50, "evidence_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "name": "Godzilla", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "4c84102f-e439-4038-9967-14a0c7805586", "name": "SweetPotato", "role": "mentionné", "type": "Malware" }, { "confidence": 100, "evidence_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "name": "Americas", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "name": "Northern America", "role": "mentionné", "type": "Region" }, { "confidence": 80, "evidence_id": "453d9070-cd88-4cec-b38d-d819c0e25a45", "name": "CVE-2019-18935", "role": "mentionné", "type": "Vulnerability" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-03-18T09:15:29.272Z", "created_at": "2026-04-24T17:14:27.833Z", "modified": "2026-04-24T17:14:28.082Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-24T17:14:28.082Z" }, "description_available": false, "entity_type": "uses", "fromId": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "from_id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "from_name": "Godzilla", "from_type": "Malware", "id": "8aafbdc3-3cbc-4ca6-b82c-90d50dc94ae1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/ko/95560/", "standard_id": "relationship--1fecedc8-16a2-5768-beb7-3ce656bbd128", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "8aafbdc3-3cbc-4ca6-b82c-90d50dc94ae1", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "8aafbdc3-3cbc-4ca6-b82c-90d50dc94ae1" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://asec.ahnlab.com/ko/95560/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "name": "Godzilla", "type": "Malware" } ] } ], "via_entity": { "id": "ac16be6d-3241-4a3a-860c-6a64398f3e48", "name": "Godzilla", "type": "Malware" } } ], "direct_techniques": [], "official_catalog": { "complete": true, "fetched_at": "2026-10-10T21:54:37Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-28T07:13:28.683Z", "created_at": "2026-09-28T16:39:01.883Z", "modified": "2026-09-28T17:11:01.642Z", "published": "2026-09-28T07:13:28.683Z", "updated_at": "2026-09-28T17:11:01.642Z" }, "description_available": true, "id": "6bc9358b-67c9-4430-98cb-b9b27c3e08f5", "is_inferred": false, "labels": [ "cve-2019-18935", "godzilla", "iis server", "privilege escalation", "reverse shell", "sweetpotato", "telerik ui", "web shell", "wordpress scanner" ], "lang": "en", "name": "Telerik UI Exploitation Leads to Webshell Install and Scanner Execution", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-28T07:13:28.683Z", "references": [ { "external_id": null, "id": "7d36e6c3-37f2-41df-aedf-76e2a765cca3", "source_name": "alien-vault", "url": "https://asec.ahnlab.com/ko/95560/" }, { "external_id": "6aba1398c736673eae22c865", "id": "c38d1f80-8781-4bc7-8119-b5a3410c7b59", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aba1398c736673eae22c865" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://asec.ahnlab.com/ko/95560/" }, "targets": [ { "confidence": 50, "evidence_id": "841dceb3-d4d6-40fb-9745-731b2c959d1e", "name": "Government and administrations", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "f20c3de5-1fe4-4397-8efe-ebcef28f140b", "name": "United States of America", "role": "cible déclarée (relation targets)", "type": "Country" } ], "techniques": [], "vulnerabilities": [ "CVE-2019-18935" ] }, "report_id": "6bc9358b-67c9-4430-98cb-b9b27c3e08f5", "schema_version": 1, "selected_date": "2026-09-28", "source_url": "https://asec.ahnlab.com/ko/95560/" }