{"uuid": "14b2d2b0-bd5f-4408-ba44-dbc53cd1bcb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2014-6345", "type": "seen", "source": "https://gist.github.com/INFOKOM-KI/b3d6c108fa85f8f8db8dfa6751a589cc", "content": "{\n  \"type\": \"bundle\",\n  \"id\": \"bundle--9a4c7e15-3b28-4f6d-a821-5d9e2c8b4f07\",\n  \"spec_version\": \"2.1\",\n  \"objects\": [\n\n    {\n      \"type\": \"identity\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"identity--b2c3d4e5-2222-4bbb-8ccc-000000000001\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"TangerangKota-CSIRT\",\n      \"identity_class\": \"organization\",\n      \"sectors\": [\"government-local\"],\n      \"description\": \"Computer Security Incident Response Team Pemerintah Kota Tangerang\"\n    },\n\n    {\n      \"type\": \"malware\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"malware--e5f6a7b8-3333-4ccc-9ddd-000000000002\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"M_SNIF~1.EXE\",\n      \"description\": \"Win32 PE32+ console x86-64 malware (8.292.294 bytes). 26/89 VirusTotal engines malicious, reputation -10. Behavior tags: overlay, assembly, peedbg, detect-debug-environment, runtime-modules, 64bits, cve-2014-6345, exploit. Alias: 56dba611b57854bf1ff72ef004f2a0b9.virus. Suspected sniffer/credential stealer (name pattern M_SNIF).\",\n      \"malware_types\": [\"backdoor\", \"credential-stealer\"],\n      \"is_family\": false,\n      \"aliases\": [\"M_SNIF~1.EXE\", \"56dba611b57854bf1ff72ef004f2a0b9.virus\"],\n      \"kill_chain_phases\": [\n        { \"kill_chain_name\": \"mitre-attack\", \"phase_name\": \"command-and-control\" },\n        { \"kill_chain_name\": \"mitre-attack\", \"phase_name\": \"exfiltration\" }\n      ],\n      \"hashes\": {\n        \"SHA-256\": \"2698cc1ab215049e40bc9fd0d88b6006ee7afeb9157357cbf998c7b21ce6e836\",\n        \"MD5\": \"56dba611b57854bf1ff72ef004f2a0b9\",\n        \"SHA-1\": \"c51da726b69c6ec5a169b1a31e3c5425a74470e6\",\n        \"ssdeep\": \"196608:qYpBAm9xDL2Vmd6+DBnNgwQ+dtLkSE27kh0rcL6SAwFSe5Y:L19xDL2Vmd6mNNjhT7/rcOe5\",\n        \"TLSH\": \"T12086335173540DE9F175843BC0028A38D936345B5798868F4BA4DBE2BF5BAB17CBBB80\"\n      }\n    },\n\n    {\n      \"type\": \"malware\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"malware--f6a7b8c9-4444-4ddd-aeee-000000000003\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"hnap\",\n      \"description\": \"Bourne-Again shell script malware (4.492 bytes, hnap.sh). 38/89 VirusTotal engines malicious, reputation -12. Behavior tags: malware, service-scan, sets-process-name, ssh-communication, shell, detect-debug-environment, exploit. Hosted on 45.93.148.2 alongside a BEC phishing campaign (10 malicious email documents).\",\n      \"malware_types\": [\"exploit-kit\", \"remote-access-trojan\"],\n      \"is_family\": false,\n      \"aliases\": [\"hnap.sh\", \"_4cae5e39dfea836a5815b6ca4e1d9c3d3d86574d29b52f1f18036d32e381c1cb.sh\"],\n      \"kill_chain_phases\": [\n        { \"kill_chain_name\": \"mitre-attack\", \"phase_name\": \"execution\" },\n        { \"kill_chain_name\": \"mitre-attack\", \"phase_name\": \"discovery\" }\n      ],\n      \"hashes\": {\n        \"SHA-256\": \"4cae5e39dfea836a5815b6ca4e1d9c3d3d86574d29b52f1f18036d32e381c1cb\",\n        \"MD5\": \"3e6a85ec955e12e088c4cc9f960cf355\",\n        \"SHA-1\": \"8c0fff3bd4e735c8b34e32e3ee20248376f7b8c3\",\n        \"ssdeep\": \"48:vpB8BMV4kRWpBDB1V4NWpBrOBrWV44WpBQBoV4yWpBE0BEEV4E2WpBUBkV4WWpBB:vdC/jzmRKsnEprPoD3b1zW5A7FzRt7\",\n        \"TLSH\": \"T10C91A3E67465D36A2DA0EE7376D7C652B14031AAE4D81C4BE3D5F0E8488CF61F494B82\"\n      }\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--a7b8c9d0-5555-4eee-bfff-000000000004\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"M_SNIF~1.EXE SHA-256\",\n      \"description\": \"SHA-256 of M_SNIF~1.EXE (26/89 VirusTotal malicious)\",\n      \"indicator_types\": [\"malicious-activity\"],\n      \"pattern\": \"[file:hashes.'SHA-256' = '2698cc1ab215049e40bc9fd0d88b6006ee7afeb9157357cbf998c7b21ce6e836']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"valid_until\": \"2027-09-22T00:00:00.000Z\",\n      \"confidence\": 90\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--b8c9d0e1-6666-4fff-c000-000000000005\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"hnap SHA-256\",\n      \"description\": \"SHA-256 of hnap Bash shell script (38/89 VirusTotal malicious)\",\n      \"indicator_types\": [\"malicious-activity\"],\n      \"pattern\": \"[file:hashes.'SHA-256' = '4cae5e39dfea836a5815b6ca4e1d9c3d3d86574d29b52f1f18036d32e381c1cb']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"valid_until\": \"2027-09-22T00:00:00.000Z\",\n      \"confidence\": 90\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--c9d0e1f2-7777-4aaa-d111-000000000006\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"C2 IP 103.46.186.148\",\n      \"description\": \"M_SNIF C2 host. AS150462 PT Air Lintas Komunikasi (ID). 11/89 VT malicious, reputation -5. Bridge IOC with betweenness centrality 0.3313 in the attack graph.\",\n      \"indicator_types\": [\"malicious-activity\", \"command-and-control\"],\n      \"pattern\": \"[ipv4-addr:value = '103.46.186.148']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"confidence\": 80\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--d0e1f2a3-8888-4bbb-e222-000000000007\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"hnap hosting IP 45.93.148.2\",\n      \"description\": \"Hosting infrastructure for hnap malware and BEC phishing campaign. AS174 Cogent Communications (NL).\",\n      \"indicator_types\": [\"malicious-activity\"],\n      \"pattern\": \"[ipv4-addr:value = '45.93.148.2']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"confidence\": 75\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--e1f2a3b4-9999-4ccc-f333-000000000008\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"C2 domain jarnus.xyz\",\n      \"description\": \"M_SNIF C2 domain resolving to 103.46.186.148. 11 VT vendors malicious.\",\n      \"indicator_types\": [\"malicious-activity\", \"command-and-control\"],\n      \"pattern\": \"[domain-name:value = 'jarnus.xyz']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"confidence\": 80\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--f2a3b4c5-aaaa-4ddd-a444-000000000009\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"C2 domain warki.biz.id\",\n      \"description\": \"M_SNIF C2 domain resolving to 103.46.186.148. 11 VT vendors malicious.\",\n      \"indicator_types\": [\"malicious-activity\", \"command-and-control\"],\n      \"pattern\": \"[domain-name:value = 'warki.biz.id']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"confidence\": 80\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--a3b4c5d6-bbbb-4eee-b555-000000000010\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"C2 domain cek.beatryzen.com\",\n      \"description\": \"M_SNIF C2 domain resolving to 103.46.186.148. 11 VT vendors malicious.\",\n      \"indicator_types\": [\"malicious-activity\", \"command-and-control\"],\n      \"pattern\": \"[domain-name:value = 'cek.beatryzen.com']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"confidence\": 75\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--b4c5d6e7-cccc-4fff-c666-000000000011\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"Domain airlink.co.id\",\n      \"description\": \"ISP infrastructure domain (PT Air Lintas Komunikasi) associated with the M_SNIF C2 network.\",\n      \"indicator_types\": [\"anomalous-activity\"],\n      \"pattern\": \"[domain-name:value = 'airlink.co.id']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"confidence\": 60\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--c5d6e7f8-dddd-4aaa-d777-000000000012\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"C2 domain tokoanto.jarnus.xyz\",\n      \"description\": \"Subdomain of jarnus.xyz. 11 VT vendors malicious.\",\n      \"indicator_types\": [\"malicious-activity\", \"command-and-control\"],\n      \"pattern\": \"[domain-name:value = 'tokoanto.jarnus.xyz']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"confidence\": 80\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--d6e7f8a9-eeee-4bbb-e888-000000000013\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"C2 domain wbb.jarnus.xyz\",\n      \"description\": \"Subdomain of jarnus.xyz. 11 VT vendors malicious.\",\n      \"indicator_types\": [\"malicious-activity\", \"command-and-control\"],\n      \"pattern\": \"[domain-name:value = 'wbb.jarnus.xyz']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"confidence\": 80\n    },\n\n    {\n      \"type\": \"indicator\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"indicator--e7f8a9b0-ffff-4ccc-f999-000000000014\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"C2 domain outlet.warki.biz.id\",\n      \"description\": \"Subdomain of warki.biz.id. 11 VT vendors malicious.\",\n      \"indicator_types\": [\"malicious-activity\", \"command-and-control\"],\n      \"pattern\": \"[domain-name:value = 'outlet.warki.biz.id']\",\n      \"pattern_type\": \"stix\",\n      \"pattern_version\": \"2.1\",\n      \"valid_from\": \"2026-09-22T08:45:00.000Z\",\n      \"confidence\": 80\n    },\n\n    {\n      \"type\": \"infrastructure\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"infrastructure--f8a9b0c1-1111-4222-8333-000000000015\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"M_SNIF C2 Infrastructure\",\n      \"description\": \"Command-and-control infrastructure: IP 103.46.186.148 (AS150462 PT Air Lintas Komunikasi, ID) with domain fronting via jarnus.xyz, warki.biz.id, cek.beatryzen.com and subdomains.\",\n      \"infrastructure_types\": [\"command-and-control\"],\n      \"first_seen\": \"2024-07-21T23:56:19.000Z\",\n      \"aliases\": [\"IDNIC-AIRLINK-ID\", \"103.46.186.0/23\"]\n    },\n\n    {\n      \"type\": \"infrastructure\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"infrastructure--a9b0c1d2-2222-4333-8444-000000000016\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"hnap Hosting Infrastructure\",\n      \"description\": \"Hosting infrastructure for hnap malware and BEC phishing campaign. IP 45.93.148.2 (AS174 Cogent Communications, NL). 10 malicious email documents reference this host.\",\n      \"infrastructure_types\": [\"command-and-control\"],\n      \"first_seen\": \"2024-03-01T01:16:48.000Z\"\n    },\n\n    {\n      \"type\": \"attack-pattern\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"attack-pattern--b1c2d3e4-3333-4444-8555-000000000017\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"Exploit Public-Facing Application\",\n      \"external_references\": [{\"source_name\": \"mitre-attack\", \"external_id\": \"T1190\", \"url\": \"https://attack.mitre.org/techniques/T1190\"}]\n    },\n\n    {\n      \"type\": \"attack-pattern\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"attack-pattern--c2d3e4f5-4444-4555-8666-000000000018\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"Web Shell\",\n      \"external_references\": [{\"source_name\": \"mitre-attack\", \"external_id\": \"T1505.003\", \"url\": \"https://attack.mitre.org/techniques/T1505/003\"}]\n    },\n\n    {\n      \"type\": \"attack-pattern\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"attack-pattern--d3e4f5a6-5555-4666-8777-000000000019\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"Unix Shell\",\n      \"external_references\": [{\"source_name\": \"mitre-attack\", \"external_id\": \"T1059.004\", \"url\": \"https://attack.mitre.org/techniques/T1059/004\"}]\n    },\n\n    {\n      \"type\": \"attack-pattern\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"attack-pattern--e4f5a6b7-6666-4777-8888-000000000020\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"Application Layer Protocol\",\n      \"external_references\": [{\"source_name\": \"mitre-attack\", \"external_id\": \"T1071\", \"url\": \"https://attack.mitre.org/techniques/T1071\"}]\n    },\n\n    {\n      \"type\": \"attack-pattern\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"attack-pattern--f5a6b7c8-7777-4888-8999-000000000021\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"Obfuscated Files or Information\",\n      \"external_references\": [{\"source_name\": \"mitre-attack\", \"external_id\": \"T1027\", \"url\": \"https://attack.mitre.org/techniques/T1027\"}]\n    },\n\n    {\n      \"type\": \"attack-pattern\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"attack-pattern--a6b7c8d9-8888-4999-8aaa-000000000022\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"Network Service Scanning\",\n      \"external_references\": [{\"source_name\": \"mitre-attack\", \"external_id\": \"T1046\", \"url\": \"https://attack.mitre.org/techniques/T1046\"}]\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r1a11111-1111-4111-8111-000000000023\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"indicates\",\n      \"source_ref\": \"indicator--a7b8c9d0-5555-4eee-bfff-000000000004\",\n      \"target_ref\": \"malware--e5f6a7b8-3333-4ccc-9ddd-000000000002\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r2a22222-2222-4222-8222-000000000024\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"indicates\",\n      \"source_ref\": \"indicator--b8c9d0e1-6666-4fff-c000-000000000005\",\n      \"target_ref\": \"malware--f6a7b8c9-4444-4ddd-aeee-000000000003\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r3a33333-3333-4333-8333-000000000025\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"communicates-with\",\n      \"source_ref\": \"malware--e5f6a7b8-3333-4ccc-9ddd-000000000002\",\n      \"target_ref\": \"infrastructure--f8a9b0c1-1111-4222-8333-000000000015\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r4a44444-4444-4444-8444-000000000026\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"communicates-with\",\n      \"source_ref\": \"malware--f6a7b8c9-4444-4ddd-aeee-000000000003\",\n      \"target_ref\": \"infrastructure--a9b0c1d2-2222-4333-8444-000000000016\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r5a55555-5555-4555-8555-000000000027\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"indicates\",\n      \"source_ref\": \"indicator--c9d0e1f2-7777-4aaa-d111-000000000006\",\n      \"target_ref\": \"infrastructure--f8a9b0c1-1111-4222-8333-000000000015\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r6a66666-6666-4666-8666-000000000028\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"indicates\",\n      \"source_ref\": \"indicator--d0e1f2a3-8888-4bbb-e222-000000000007\",\n      \"target_ref\": \"infrastructure--a9b0c1d2-2222-4333-8444-000000000016\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r7a77777-7777-4777-8777-000000000029\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"resolves-to\",\n      \"source_ref\": \"indicator--e1f2a3b4-9999-4ccc-f333-000000000008\",\n      \"target_ref\": \"indicator--c9d0e1f2-7777-4aaa-d111-000000000006\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r8a88888-8888-4888-8888-000000000030\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"resolves-to\",\n      \"source_ref\": \"indicator--f2a3b4c5-aaaa-4ddd-a444-000000000009\",\n      \"target_ref\": \"indicator--c9d0e1f2-7777-4aaa-d111-000000000006\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r9a99999-9999-4999-8999-000000000031\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"resolves-to\",\n      \"source_ref\": \"indicator--a3b4c5d6-bbbb-4eee-b555-000000000010\",\n      \"target_ref\": \"indicator--c9d0e1f2-7777-4aaa-d111-000000000006\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r10aaaa-aaaa-4aaa-8aaa-000000000032\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"uses\",\n      \"source_ref\": \"malware--f6a7b8c9-4444-4ddd-aeee-000000000003\",\n      \"target_ref\": \"attack-pattern--d3e4f5a6-5555-4666-8777-000000000019\",\n      \"description\": \"hnap executes as a Unix shell script\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r11bbbb-bbbb-4bbb-8bbb-000000000033\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"uses\",\n      \"source_ref\": \"malware--f6a7b8c9-4444-4ddd-aeee-000000000003\",\n      \"target_ref\": \"attack-pattern--a6b7c8d9-8888-4999-8aaa-000000000022\",\n      \"description\": \"hnap performs network service scanning (tag: service-scan)\"\n    },\n\n    {\n      \"type\": \"relationship\", \"spec_version\": \"2.1\",\n      \"id\": \"relationship--r12cccc-cccc-4ccc-8ccc-000000000034\",\n      \"created\": \"2026-09-22T08:45:00.000Z\", \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"relationship_type\": \"uses\",\n      \"source_ref\": \"malware--e5f6a7b8-3333-4ccc-9ddd-000000000002\",\n      \"target_ref\": \"attack-pattern--f5a6b7c8-7777-4888-8999-000000000021\",\n      \"description\": \"M_SNIF~1.EXE uses obfuscated/packed files (tags: overlay, assembly)\"\n    },\n\n    {\n      \"type\": \"report\",\n      \"spec_version\": \"2.1\",\n      \"id\": \"report--b0c1d2e3-3333-4444-8555-000000000017\",\n      \"created\": \"2026-09-22T08:45:00.000Z\",\n      \"modified\": \"2026-09-22T08:45:00.000Z\",\n      \"name\": \"RapidAPI IOC Analysis: 3 Malware + 24 Attacker IPs - TangerangKota\",\n      \"description\": \"Analysis of 24 attacker IPs via RapidAPI IOC Search: 3 primary malware (Client.exe 60/89, hnap 38/89, M_SNIF~1.EXE 26/89), 26 referrer files, 2 new C2 infrastructures. VirusTotal verdicts verified by direct query.\",\n      \"report_types\": [\"malware\", \"threat-report\"],\n      \"published\": \"2026-09-22T08:45:00.000Z\",\n      \"object_refs\": [\n        \"malware--e5f6a7b8-3333-4ccc-9ddd-000000000002\",\n        \"malware--f6a7b8c9-4444-4ddd-aeee-000000000003\",\n        \"indicator--a7b8c9d0-5555-4eee-bfff-000000000004\",\n        \"indicator--b8c9d0e1-6666-4fff-c000-000000000005\",\n        \"indicator--c9d0e1f2-7777-4aaa-d111-000000000006\",\n        \"indicator--d0e1f2a3-8888-4bbb-e222-000000000007\",\n        \"indicator--e1f2a3b4-9999-4ccc-f333-000000000008\",\n        \"indicator--f2a3b4c5-aaaa-4ddd-a444-000000000009\",\n        \"indicator--a3b4c5d6-bbbb-4eee-b555-000000000010\",\n        \"indicator--b4c5d6e7-cccc-4fff-c666-000000000011\",\n        \"infrastructure--f8a9b0c1-1111-4222-8333-000000000015\",\n        \"infrastructure--a9b0c1d2-2222-4333-8444-000000000016\"\n      ]\n    }\n\n  ]\n}", "creation_timestamp": "2026-09-22T09:22:01.705789Z"}