{ "id": "80ced803-3914-488d-aeeb-253e4e05767d", "created_at": "2026-04-06T00:10:49.950088Z", "updated_at": "2026-04-10T03:36:21.817713Z", "deleted_at": null, "sha1_hash": "2298d37600e023fa53a3204d25d1a0a20c0f78e2", "title": "Oceanlotus.xlsx", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 42766, "plain_text": "Oceanlotus.xlsx\r\nArchived: 2026-04-05 15:50:17 UTC\r\nLast ModifiedMD5Target CountryNetwork ConnectionNotesVersionDeveloperPolicyDownloads On GooglePlayCertificate\r\nSerial NumberCertificate ThumbprintValid FromValid To 2019-11-05 23:47:26f4597d08a3f7eab8f02eaf1ae9064fc0Package\r\nName: com.zimice.browserturbo |2.2malcesshartspurhttps://github.com/malcesshartspur/privacy/blob/master/privacy.md |\r\nmobile_browser@gmail.com4e9041194921640b0c11e9294aaeb366a9bbc7a1988237e57afcce66e08fca5827495964ad6fbeb\r\n06:58 AM 10/17/2019 06:58 AM 10/17/2049 2019-11-05 23:47:262e06bbc26611305b28b40349a600f95cPackage Name:\r\ncom.zimice.browserturbo | 2.2malcesshartspurhttps://github.com/malcesshartspur/privacy/blob/master/privacy.md |\r\nmobile_browser@gmail.com4e9041194921640b0c11e9294aaeb366a9bbc7a1988237e57afcce66e08fca5827495964ad6fbeb\r\n06:58 AM 10/17/2019 06:58 AM 10/17/2049 2019-10-31\r\n21:55:36adf8cb5d14adf28c7ab6598e163de66chttp://pick.georgiatheiss.com/feed/site.rss?t=\u0026c=0\u0026s= |\r\nroll.meorgirilbert.comPackage Name: com.zimice.browserturbo |\r\n2.1malcesshartspurhttps://github.com/malcesshartspur/privacy/blob/master/privacy.md |\r\nmobile_browser@gmail.com4e9041194921640b0c11e9294aaeb366a9bbc7a1988237e57afcce66e08fca5827495964ad6fbeb\r\n06:58 AM 10/17/2019 06:58 AM 10/17/2049 2019-06-28\r\n02:27:00c2b5fa706c1077aeb29cab14c863cc1ahttp://science.tayenthflores.com/feed/site.rss?t=\u0026c=0\u0026s=Package Name:\r\ncom.sumislab.skipper | Child Package: 3285ae59877c6241200f784b62531694 |\r\n15.8.2.0agcondiefounhttps://gist.github.com/agcondiefoun/806b89fbb683f55f3f6cae275f8902cb |\r\nadsgroup@gmail.com6d9dd03511daccf4611b4483392af2310dc06df4f6674c69ae9328960db3844a970119701cb74d9a 07:12\r\nAM 06/06/2019 07:12 AM 06/06/20492019-06-27 20:35:10300ec6bc4d8b00f7f42f0165172b9606Package Name:\r\ncom.physlane.opengl | Child Package:\r\ne648a2cc826707aec33208408b882e311.0.222lijustharmahttps://gist.github.com/lijustharma/1771c2852eb687a1f193ff58a10d5dd2\r\n|\r\nplugin.support@hotmail.com5ee40c1ee8c1e3c9f3d897cdd27c59835b7347b7166f5a52c46eb53f5eb1d813d825cb5a225eabc\r\n07:31 AM 06/06/2019 07:31 AM 06/06/2049 2019-06-27\r\n20:35:100a82e1eb9531c5a3d06dc3b9f6688a31http://heal.lancebarkerwa.com/feed/site.rss?t=\u0026c=0\u0026s= |\r\nhttp://wand.gasharontomholt.com/feed/site.rss?t=\u0026c=0\u0026s= | api.anaehler.comPackage Name: com.physlane.opengl | Child\r\nPackage:\r\ne648a2cc826707aec33208408b882e311.0.222lijustharmahttps://gist.github.com/lijustharma/1771c2852eb687a1f193ff58a10d5dd2\r\n| plugin.support@hotmail.com\r\n5ee40c1ee8c1e3c9f3d897cdd27c59835b7347b7166f5a52c46eb53f5eb1d813d825cb5a225eabc 07:31 AM 06/06/2019 07:31\r\nAM 06/06/2049 2019-06-27 19:34:34b3b3b0ef59ffe5b1a53499b4dd7ec344http://status.elizongham.com/feed/site.rss?\r\nt=\u0026c=0\u0026s=Package Name: com.sailmedia.supcodec | Child Package:\r\n8d5c64fdaae76bb74831c0543a7865c31.1.3pesororehttps://gist.github.com/pesorore/c1c98c7641cb1345f689eaf4e04e5415 |\r\ncodec@gmail.com2133f71f0101a8f8c5db07d1230810dd441fc30efa8c9e6af68aa10145ee91930b788f2d12312d6 06:24 AM\r\n06/06/2019 06:24 AM 06/06/2049 2019-06-27 19:08:24af44bb0dd464680395230ade0d6414cdPackage Name:\r\ncom.apkixlab.browsercleaner | 1.2.33.2rhenchesttija |\r\nrhenchesttija@gmail.comhttps://gist.github.com/rhenchesttija/ef404116cda4e7c1bfda5ebf179d4fc0 |\r\nmobile_browser@gmail.comb0e32cf27ae7924826eb11a455924798376e7e56d33c6700a53fceafc2c66a243149a9044161ef4b\r\n07:35 AM 06/06/2019 07:35 AM 06/06/20492019-06-06 00:47:42b4706f171cf98742413d642b6ae728dcPackage Name:\r\ncom.physlane.opengl | 1.0.221lijustharmahttps://gist.github.com/lijustharma/1771c2852eb687a1f193ff58a10d5dd2 |\r\nplugin.support@hotmail.com5ee40c1ee8c1e3c9f3d897cdd27c59835b7347b7166f5a52c46eb53f5eb1d813d825cb5a225eabc\r\n07:31 AM 06/06/2019 07:31 AM 06/06/2049 2019-06-06 00:43:2438a673eeae41439fc9bbe0205fd4a125Package Name:\r\ncom.apkixlab.browsercleaner | 1.2.33.1rhenchesttija |\r\nrhenchesttija@gmail.comhttps://gist.github.com/rhenchesttija/ef404116cda4e7c1bfda5ebf179d4fc0 |\r\nmobile_browser@gmail.comb0e32cf27ae7924826eb11a455924798376e7e56d33c6700a53fceafc2c66a243149a9044161ef4b\r\n07:35 AM 06/06/2019 07:35 AM 06/06/2049 2019-06-06 00:14:1086f529c7afacd7ee0c5e1ef0b7bf240aPackage Name:\r\ncom.sumislab.skipper |15.8.1.1agcondiefounhttps://gist.github.com/agcondiefoun/806b89fbb683f55f3f6cae275f8902cb |\r\nadsgroup@gmail.com6d9dd03511daccf4611b4483392af2310dc06df4f6674c69ae9328960db3844a970119701cb74d9a 07:12\r\nAM 06/06/2019 07:12 AM 06/06/2049 2019-05-28 16:52:1279f06cb9281177a51278b2a33090c867Package Name:\r\ncom.android.play.games | 5.10.9018d47c08706d44038418e66331ab113a0736e3629859670f755cfdb76b 01:21 AM\r\n04/13/2011 01:21 AM 04/03/2051 2019-05-28 16:39:183285ae59877c6241200f784b62531694science.tayenthflores.com |\r\nfp.rentwoylas.comPackage Name: com.android.play.games | Parent Package:\r\nc2b5fa706c1077aeb29cab14c863cc1a5.10.9018d47c08706d44038418e66331ab113a0736e3629859670f755cfdb76b 01:21\r\nAM 04/13/2011 01:21 AM 04/03/2051 2019-05-28 16:21:328d5c64fdaae76bb74831c0543a7865c3Package Name:\r\ncom.android.play.games | Parent Package:\r\nb3b3b0ef59ffe5b1a53499b4dd7ec3445.10.9018d47c08706d44038418e66331ab113a0736e3629859670f755cfdb76b 01:21\r\nAM 04/13/2011 01:21 AM 04/03/2051 2019-05-05 19:47:142fd6685b7290f8d0e9e92765aee6c173Package Name:\r\nhttps://drive.google.com/file/d/1m0Qg8e1Len1My6ssDy6F0oQ7JdkJUkuu/view\r\nPage 1 of 3\n\ncom.islanden.jjkdom.android |111.0Mr. Bean |\r\nungererik6@gmail.comhttps://gist.github.com/ungererik6/ef5ed9c4491c5cb916d880aea6addcf2 |\r\nsupport@opengl.com78c064f88c626ab1251ecf388252187a163803b9c68dd8f8 05:09 PM 04/18/2019 05:09 PM 08/19/3018\r\n2019-04-19 03:17:36e74769976896b117e91496773121a8c0Package Name: com.islanden.jjkdom.android |106.0Mr. Bean |\r\nungererik6@gmail.comhttps://gist.github.com/ungererik6/ef5ed9c4491c5cb916d880aea6addcf2 |\r\nsupport@opengl.com78c064f88c626ab1251ecf388252187a163803b9c68dd8f8 05:09 PM 04/18/2019 05:09 PM\r\n08/19/30182019-01-08 22:19:3664f33a5da90b97acad4ef5a7c32eef96http://cloud.anofrio.com/feed/site.rss?\r\nt=\u0026c=0\u0026s=Package Name: com.usatv.skipperads | 2.27c0ef746b420bd98f0e77efb386ecc78f4e57fcc1c903145 09:19 PM\r\n01/08/2019 09:19 PM 12/15/2117 2018-12-25\r\n20:16:10bcba585660c99ca503172c489ded39d8http://cloud.anofrio.com/feed/site.rss?t=\u0026c=0\u0026s=Package Name:\r\nnet.vilakeyice.openglplugin | 1.1.325Mr. Bean |\r\nungererik6@gmail.com93c6c9ce3f8ba9eee4649b70cb9521cd7c56ef4d18c9cc21c8717d33839705361055f946deee4c7f\r\n12:06 PM 07/31/2018 12:06 PM 07/31/2048 2018-12-25 19:51:40d43f40097cde6372cbd460dbc5a5dbdfPackage Name:\r\ncom.perilab.scanbrowser | 0.5.3David Holt |\r\nfriersonrichordj@gmail.come4b7fbfd9d7cefe7ff4538fdf2b5549b487c65192bfb1e066c410507766a7ba71ff5da21dd4969ef\r\n11:33 AM 07/31/2018 11:33 AM 07/31/2048 2018-12-25\r\n19:47:48bb862105894116c20594466ce0379dc3http://cloud.anofrio.com/feed/site.rss?t=\u0026c=0\u0026s=Package Name:\r\ncom.kwilab.codeclib | 1.2Joise |\r\nJoisehong@gmail.comhttps://gist.github.com/Joisehong/998c92223fd872b151e26bc6ba001f36 |\r\ncodecteam@gmail.com4fd095ca229e564764ef0a0c1d1b43699209333fd9eb06ba271fb0713d849b9024f7c2edbfd70662\r\n08:50 AM 07/16/2018 08:50 AM 07/16/2048 2018-12-25\r\n19:47:4843c029819346974a13375d9d3e1e4a37http://cloud.anofrio.com/feed/site.rss?t=\u0026c=0\u0026s=Package Name:\r\ncom.kwilab.codeclib | 1.2Joise |\r\nJoisehong@gmail.comhttps://gist.github.com/Joisehong/998c92223fd872b151e26bc6ba001f36 |\r\ncodecteam@gmail.com4fd095ca229e564764ef0a0c1d1b43699209333fd9eb06ba271fb0713d849b9024f7c2edbfd70662\r\n08:50 AM 07/16/2018 08:50 AM 07/16/2048 2018-12-25\r\n19:36:229d21582cd55e149a2345f65f6275ad0ahttp://cloud.anofrio.com/feed/site.rss?t=\u0026c=0\u0026s=Package Name:\r\ncom.unianin.adsskipper | 2.1m.sawtell |\r\nmelaniesawtell@Gmail.comhttps://gist.github.com/melaniesawtell/8fb50aba8666ced471fcf67797fa53af |\r\nskipper.help@gmail.com9c3b0a7f093122c9ad1a5dd913aee2ca52cbdef2b9a33c13ddc20e3829482cb9e8976cc4d8805805\r\n11:44 AM 07/31/2018 11:44 AM 07/31/2048 2018-08-11 20:32:50fa2882442e49c6cb72514c84da361f56Package Name:\r\ncom.unianin.adsskipper | Child Package: 65d399e6a77acf7e63ba771877f96f8e2.0m.sawtell |\r\nmelaniesawtell@Gmail.comhttps://gist.github.com/melaniesawtell/8fb50aba8666ced471fcf67797fa53af |\r\nskipper.help@gmail.com9c3b0a7f093122c9ad1a5dd913aee2ca52cbdef2b9a33c13ddc20e3829482cb9e8976cc4d8805805\r\n11:44 AM 07/31/2018 11:44 AM 07/31/2048 2018-08-11 20:32:50ec4253e927309034d85abf8c81b6ace8Package Name:\r\ncom.unianin.adsskipper | Child Package: 65d399e6a77acf7e63ba771877f96f8e2.0m.sawtell |\r\nmelaniesawtell@Gmail.comhttps://gist.github.com/melaniesawtell/8fb50aba8666ced471fcf67797fa53af |\r\nskipper.help@gmail.com9c3b0a7f093122c9ad1a5dd913aee2ca52cbdef2b9a33c13ddc20e3829482cb9e8976cc4d8805805\r\n11:44 AM 07/31/2018 11:44 AM 07/31/2048 2018-08-11 20:32:50d196dbe65b87283c28c70f9ebf17936cPackage Name:\r\ncom.unianin.adsskipper | Child Package: 65d399e6a77acf7e63ba771877f96f8e2.0m.sawtell |\r\nmelaniesawtell@Gmail.comhttps://gist.github.com/melaniesawtell/8fb50aba8666ced471fcf67797fa53af |\r\nskipper.help@gmail.com9c3b0a7f093122c9ad1a5dd913aee2ca52cbdef2b9a33c13ddc20e3829482cb9e8976cc4d8805805\r\n11:44 AM 07/31/2018 11:44 AM 07/31/2048 2018-08-19\r\n21:36:34850e3a1489c9099933afe8449c63c564us.jaxonsorensen.clubPackage Name: com.linevialab.ffont | Child Package:\r\n872a3dd2cd5e01633b57fa5b9ac4648d1.1.2wojnerkorenj |\r\naf8fb74295857785371fdd04455c2083d962aaa6945377fd7f94891c2924a298da16c90a30c20a3d 10:09 AM 08/25/2017\r\n10:09 AM 08/25/2047 2018-08-19 21:27:228bc7c78611a34c3ca39b07d82d3dcabfus.jaxonsorensen.clubPackage Name:\r\ncom.islab.litebrowser | 1.0.1.2pettittkeithce |\r\npettittkeithce@gmail.comc6d0f445bab10fb81acc78e2bfd5146c0a54950c8cb2aba21a1e511092a9d1ac476b5b997a2ef855\r\n04:45 AM 02/02/2018 04:45 AM 02/02/20482018-08-17\r\n06:10:380f29e11e0489f0917b7c9cafcea24e0aus.jaxonsorensen.club | staff.kristianfiedler.clubPackage Name:\r\ncom.zonjob.browsercleaner | Child Package: 53fefacecd7cdea5a44335b15222a4f31.1.2DANIEL_V |\r\nmayveveriman@gmail.comf34559158b9e20332f20c8c1dd4808cc290bcfc5894538085a2ecaab 09:18 AM 06/12/2009 09:18\r\nAM 06/02/2049 2018-08-16 20:03:0453fefacecd7cdea5a44335b15222a4f3us.jaxonsorensen.club |\r\nstaff.kristianfiedler.clubPackage Name: com.android.process.gpsp | Parent Package:\r\n0f29e11e0489f0917b7c9cafcea24e0a10.2.98d47c08706d44038418e66331ab113a0736e3629859670f755cfdb76b 01:21 AM\r\n04/13/2011 01:21 AM 04/03/2051 2018-08-16 16:40:02788aa74b4fe4ee45ebc0e28231ecd815us.jaxonsorensen.clubPackage\r\nName: com.android.process.gpsp | Parent Package:\r\nfb1945c0135eff80b8de2e80e16117b610.2.98d47c08706d44038418e66331ab113a0736e3629859670f755cfdb76b 01:21 AM\r\n04/13/2011 01:21 AM 04/03/20512018-08-16\r\n14:40:04f2a12276f4835d1ef44b30618717df22VNus.jaxonsorensen.clubPackage Name: com.codedexon.churchaddress |\r\nhttps://drive.google.com/file/d/1m0Qg8e1Len1My6ssDy6F0oQ7JdkJUkuu/view\r\nPage 2 of 3\n\n1.0.4Francisco Turner｜nihing19@gmail.comf95163e339bdf3866139915001e6b4005aa77e52497290871b86d991 04:12\r\nAM 05/18/2010 04:12 AM 05/08/2050 2018-08-16 13:08:00fb1945c0135eff80b8de2e80e16117b6VNus.jaxonsorensen.club\r\n| staff.kristianfiedler.clubPackage Name: com.codedexon.prayerbook | Child Package:\r\n788aa74b4fe4ee45ebc0e28231ecd8151.0.3Francisco Turner｜\r\nnihing19@gmail.comhttp://francisc0turn3r.blogspot.com/2017/05/prayer-books-privacy-policy.html |\r\nnihing19@gmail.comf95163e339bdf3866139915001e6b4005aa77e52497290871b86d991 04:12 AM 05/18/2010 04:12 AM\r\n05/08/20502018-08-15 19:40:16872a3dd2cd5e01633b57fa5b9ac4648dus.jaxonsorensen.clubPackage Name:\r\ncom.android.process.gpsp | Parent Package: 783944ce0900c903565618ca4afcc29e、\r\n850e3a1489c9099933afe8449c63c56410.2.98d47c08706d44038418e66331ab113a0736e3629859670f755cfdb76b 01:21\r\nAM 04/13/2011 01:21 AM 04/03/2051 2018-08-11 20:50:52d924211bef188ce4c19400eccb6754daPackage Name:\r\nnet.vilakeyice.openglplugin | 1.0.211Mr. Bean |\r\nungererik6@gmail.com93c6c9ce3f8ba9eee4649b70cb9521cd7c56ef4d18c9cc21c8717d33839705361055f946deee4c7f\r\n12:06 PM 07/31/2018 12:06 PM 07/31/2048 2018-08-11 20:41:0889759622e51b1edb4a8cfee3ad9ef314Package Name:\r\ncom.perilab.scanbrowser | Child Package: 65d399e6a77acf7e63ba771877f96f8e0.5.2David Holt |\r\nfriersonrichordj@gmail.come4b7fbfd9d7cefe7ff4538fdf2b5549b487c65192bfb1e066c410507766a7ba71ff5da21dd4969ef\r\n11:33 AM 07/31/2018 11:33 AM 07/31/2048 2018-07-31 05:07:167285f44fa75c3c7a27bbb4870fc0cdcaPackage Name:\r\nnet.vilakeyice.openglplugin |1.0.110Mr. Bean |\r\nungererik6@gmail.com93c6c9ce3f8ba9eee4649b70cb9521cd7c56ef4d18c9cc21c8717d33839705361055f946deee4c7f\r\n12:06 PM 07/31/2018 12:06 PM 07/31/2048 2018-07-31 04:44:56a330456d7ca25c88060dc158049f3298Package Name:\r\ncom.unianin.adsskipper | 1.0m.sawtell |\r\nmelaniesawtell@Gmail.comhttps://gist.github.com/melaniesawtell/8fb50aba8666ced471fcf67797fa53af |\r\nskipper.help@gmail.com9c3b0a7f093122c9ad1a5dd913aee2ca52cbdef2b9a33c13ddc20e3829482cb9e8976cc4d8805805\r\n11:44 AM 07/31/2018 11:44 AM 07/31/2048 2018-07-27\r\n13:39:42bbd61723e40695b3ac74547004fb9fb8VNus.jaxonsorensen.club | staff.kristianfiedler.clubPackage Name:\r\ncom.techiholding.app.babycare | Child Package: dbb2f1cf41392e83b8cf64d9e2e78b201.0.5Justin Games |\r\njstnmireles@gmail.comhttps://justinles.blogspot.com/2017/05/babycares-privacy-policy.html |\r\njstnmireles@gmail.comd86300d682f5b908d5f0167bd5611a065efa71b5eee526ecc8a37a95 09:44 AM 10/06/2010 09:44 AM\r\n09/26/2050 2018-07-27 09:40:16dbb2f1cf41392e83b8cf64d9e2e78b20us.jaxonsorensen.club |\r\nstaff.kristianfiedler.clubPackage Name: com.android.process.gpsp | Parent Package:\r\nbbd61723e40695b3ac74547004fb9fb8、787050c8ce3e6c6185e33c5733e00831、\r\nb25b42655cae572914348d4eda4459c210.2.98d47c08706d44038418e66331ab113a0736e3629859670f755cfdb76b 01:21\r\nAM 04/13/2011 01:21 AM 04/03/2051 2018-02-08 20:45:329959d9cf928c131f0e0bde5cf576e8adlog.osloger.biz |\r\nfile.log4jv.info | news.sqllitlever.infoPackage Name: com.zotdexon.tubefloating | Child Package:\r\n4d27992a446f4c19bde2668c4ecc87121.1.0Melinda_ Cline |\r\nmayielaycia@gmail.comhttp://tubefloating.000webhostapp.com/policies.txt62531f00175896fdd2e76db0387207b523c4b5240854438eb1dd2c5e7e8eb9\r\n08:32 AM 01/12/2018 08:32 AM 01/12/2048 2018-02-05\r\n02:46:04044b5e6ce1c7c13e818866e62f262d4clog.osloger.bizPackage Name: com.islab.litebrowser | Child Package:\r\ncf8e6e88193ef2ddbe6caa6a0f8125651.0.1.1pettittkeithce |\r\npettittkeithce@gmail.comc6d0f445bab10fb81acc78e2bfd5146c0a54950c8cb2aba21a1e511092a9d1ac476b5b997a2ef855\r\n04:45 AM 02/02/2018 04:45 AM 02/02/2048 2017-08-28\r\n21:43:184b62def32f85704281abde42fd17a35clog.osloger.bizPackage Name: com.islab.adsblockbrowser | Child Package:\r\ncf8e6e88193ef2ddbe6caa6a0f8125651.0.1.1pettittkeithce |\r\npettittkeithce@gmail.com652814b6eaa41031140432554b3eef5b090732df3d50afe3ed441f095040c73aec628362370c510c\r\n09:36 AM 08/25/2017 09:36 AM 08/25/2047 2017-08-28 21:45:183be5367b542dd333b3241f52d3ede8f2log.osloger.biz |\r\nfile.log4jv.infoPackage Name: com.linevialab.ffont | Child Package: cf8e6e88193ef2ddbe6caa6a0f8125651.1.1wojnerkorenj\r\n| af8fb74295857785371fdd04455c2083d962aaa6945377fd7f94891c2924a298da16c90a30c20a3d 10:09 AM 08/25/2017\r\n10:09 AM 08/25/2047 2017-08-25 05:41:38a18691a92412ad8adaf3c0786f9598ccPackage Name:\r\ncom.islab.adsblockbrowser | 1.0.0.1pettittkeithce |\r\npettittkeithce@gmail.com652814b6eaa41031140432554b3eef5b090732df3d50afe3ed441f095040c73aec628362370c510c\r\n09:36 AM 08/25/2017 09:36 AM 08/25/2047\r\nSource: https://drive.google.com/file/d/1m0Qg8e1Len1My6ssDy6F0oQ7JdkJUkuu/view\r\nhttps://drive.google.com/file/d/1m0Qg8e1Len1My6ssDy6F0oQ7JdkJUkuu/view\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://drive.google.com/file/d/1m0Qg8e1Len1My6ssDy6F0oQ7JdkJUkuu/view" ], "report_names": [ "view" ], "threat_actors": [ { "id": "af509bbb-8d18-4903-a9bd-9e94099c6b30", "created_at": "2023-01-06T13:46:38.585525Z", "updated_at": "2026-04-10T02:00:03.030833Z", "deleted_at": null, "main_name": "APT32", "aliases": [ "OceanLotus", "ATK17", "G0050", "APT-C-00", "APT-32", "Canvas Cyclone", "SeaLotus", "Ocean Buffalo", "OceanLotus Group", "Cobalt Kitty", "Sea Lotus", "APT 32", "POND LOACH", "TIN WOODLAWN", "Ocean Lotus" ], "source_name": "MISPGALAXY:APT32", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "870f6f62-84f5-48ca-a18e-cf2902cd6924", "created_at": "2022-10-25T15:50:23.303818Z", "updated_at": "2026-04-10T02:00:05.301184Z", "deleted_at": null, "main_name": "APT32", "aliases": [ "APT32", "SeaLotus", "OceanLotus", "APT-C-00", "Canvas Cyclone" ], "source_name": "MITRE:APT32", "tools": [ "Mimikatz", "ipconfig", "Kerrdown", "Cobalt Strike", "SOUNDBITE", "OSX_OCEANLOTUS.D", "KOMPROGO", "netsh", "RotaJakiro", "PHOREAL", "Arp", "Denis", "Goopy" ], "source_id": "MITRE", "reports": null }, { "id": "75108fc1-7f6a-450e-b024-10284f3f62bb", "created_at": "2024-11-01T02:00:52.756877Z", "updated_at": "2026-04-10T02:00:05.273746Z", "deleted_at": null, "main_name": "Play", "aliases": null, "source_name": "MITRE:Play", "tools": [ "Nltest", "AdFind", "PsExec", "Wevtutil", "Cobalt Strike", "Playcrypt", "Mimikatz" ], "source_id": "MITRE", "reports": null }, { "id": "5da6b5fd-1955-412a-81aa-069fb50b6e31", "created_at": "2025-08-07T02:03:25.116085Z", "updated_at": "2026-04-10T02:00:03.668978Z", "deleted_at": null, "main_name": "TIN WOODLAWN", "aliases": [ "APT32 ", "Cobalt Kitty", "OceanLotus", "WOODLAWN " ], "source_name": "Secureworks:TIN WOODLAWN", "tools": [ "Cobalt Strike", "Denis", "Goopy", "JEShell", "KerrDown", "Mimikatz", "Ratsnif", "Remy", "Rizzo", "RolandRAT" ], "source_id": "Secureworks", "reports": null }, { "id": "2439ad53-39cc-4fff-8fdf-4028d65803c0", "created_at": "2022-10-25T16:07:23.353204Z", "updated_at": "2026-04-10T02:00:04.55407Z", "deleted_at": null, "main_name": "APT 32", "aliases": [ "APT 32", "APT-C-00", "APT-LY-100", "ATK 17", "G0050", "Lotus Bane", "Ocean Buffalo", "OceanLotus", "Operation Cobalt Kitty", "Operation PhantomLance", "Pond Loach", "SeaLotus", "SectorF01", "Tin Woodlawn" ], "source_name": "ETDA:APT 32", "tools": [ "Agentemis", "Android.Backdoor.736.origin", "AtNow", "Backdoor.MacOS.OCEANLOTUS.F", "BadCake", "CACTUSTORCH", "CamCapture Plugin", "CinaRAT", "Cobalt Strike", "CobaltStrike", "Cuegoe", "DKMC", "Denis", "Goopy", "HiddenLotus", "KOMPROGO", "KerrDown", "METALJACK", "MSFvenom", "Mimikatz", "Nishang", "OSX_OCEANLOTUS.D", "OceanLotus", "PHOREAL", "PWNDROID1", "PhantomLance", "PowerSploit", "Quasar RAT", "QuasarRAT", "RatSnif", "Remy", "Remy RAT", "Rizzo", "Roland", "Roland RAT", "SOUNDBITE", "Salgorea", "Splinter RAT", "Terracotta VPN", "Yggdrasil", "cobeacon", "denesRAT", "fingerprintjs2" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434249, "ts_updated_at": 1775792181, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/2298d37600e023fa53a3204d25d1a0a20c0f78e2.pdf", "text": "https://archive.orkl.eu/2298d37600e023fa53a3204d25d1a0a20c0f78e2.txt", "img": "https://archive.orkl.eu/2298d37600e023fa53a3204d25d1a0a20c0f78e2.jpg" } }