{
	"id": "0bb1c954-c2ed-4efa-8089-db2f7cea9034",
	"created_at": "2026-04-06T00:08:19.562524Z",
	"updated_at": "2026-04-10T03:38:03.401984Z",
	"deleted_at": null,
	"sha1_hash": "3187eb2e65070bb3462c20efe3468ded7705ebb9",
	"title": "MalSpam Campaigns Download njRAT from Paste Sites",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 3257665,
	"plain_text": "MalSpam Campaigns Download njRAT from Paste Sites\r\nPublished: 2021-03-22 · Archived: 2026-04-05 21:32:05 UTC\r\nHackers have started frequently using legitimate paste sites to host malware. \r\nPhishing emails are usually the initial infection vector wherein the users are tricked into executing the malign\r\ncontent (usually url links) in turn downloading other malicious content from such links . \r\nPaste sites which only support plain text files are very much advantageous for the threat actors to stay undetected,\r\nwherein they can  easily encode (say base64 encoding) a malicious exe and paste them on the site as plain text.\r\nThis blog is all about njRAT that has been found to be hosted on paste.ee site. Paste.ee is a free pastebin where\r\nusers can submit and upload pastes as a plain text. The initial vector information which was found on Twitter is a\r\nvbs zipped file named “Lease Agreement.zip” and the password to open the file is mentioned as “tomorrow’s\r\ndate” which can be seen in the screenshot below. \r\nFigure 1: Initial vector taken from Twitter\r\nThe first submission of the zipped file in VirusTotal being 19/02/2021 (DD/MM/YYYY) and on giving the\r\npassword with the next day’s date which is 20/02/2021 (DD/MM/YYYY) as mentioned in the phishing email\r\nunzips the file, as shown in Figure 2 .\r\nhttps://labs.k7computing.com/?p=21904\r\nPage 1 of 10\n\nFigure 2: Password for unzipping the file\r\nFigure 3: Unzipped file\r\nThe “Lease Agreement.vbs” script file uses “WScript.ScriptFullName” to return the full path to the script\r\ncurrently being executed, with which the vbscript copies the existing file to a new file named D.vbs in the startup\r\nfolder.\r\nFigure 4 : Copies itself to Startup folder\r\nOn execution it connects  to paste.ee from where the next stage of malware will be downloaded.\r\nhttps://labs.k7computing.com/?p=21904\r\nPage 2 of 10\n\nFigure 5: Connection to paste.ee site\r\nThe copied D.vbs script and the contained base64 encoded data is executed with the help of powershell.\r\nFigure 6: D.vbs executed with powershell\r\nFigure 7: Base64 encoded data executed with PowerShell\r\nThe encoded base64 data contains the url from which the njRAT is going to be downloaded. To complicate\r\nidentifying the url, the url is reversed, so that users cannot find the url at first sight. The ones that look like\r\nairplanes in the encoded base64 data as shown in Figure 7 and Figure 8  are simple string replacement for string\r\n‘A’ which can be seen in Figure 8. This base64 encoded data found in Figure 7 and Figure 8 is the reverse of the\r\nexact base64 encoded data found in the url “hxxps[:]//paste[.]ee/bsKo9/0”.\r\nFigure 8: URL from which njRAT is going to be downloaded\r\nThe reversed url’s  base64 encoded data can be seen in Figure 9.\r\nhttps://labs.k7computing.com/?p=21904\r\nPage 3 of 10\n\nFigure 9: Base64 encoded data of hxxps[:]//paste[.]ee/r/bsKo9/0\r\nThe encoded base64 part on decoding was found to be the njRAT PE file.\r\nFigure 10: Decoded base64 data is the njRAT executable\r\nThe obtained decoded PE file which is a njRAT executable is a .NET file named juju.exe.\r\nhttps://labs.k7computing.com/?p=21904\r\nPage 4 of 10\n\nFigure 11: njRAT juju.exe file\r\nOnce the njRAT is downloaded and run, it tries to connect with xxxcarldon.duckdns.org. The contacted ip address\r\n192.169.69.26 has been blacklisted by several trusted IP look-ups.\r\nFigure 12: Strings showing the domain xxxcarldon.duckdns.org\r\nnjRAT also known as ‘Bladabindi’ or ‘njw0rm’ is a Remote Access Trojan (RAT) created initially by the\r\nmembers of an underground community named Sparclyheason and this njRAT has been used in carrying out\r\ncampaigns against the Middle East in the past.\r\nhttps://labs.k7computing.com/?p=21904\r\nPage 5 of 10\n\nnjRAT is capable of remotely controlling systems, spying on the victim’s system and collecting all possible\r\nsensitive data like usernames, passwords. Everything happens silently in the background and the user never knows\r\nthat they are being spied.\r\nThis .NET juju.exe RAT on debugging has been found to have several features. Few of the features can be seen in\r\nthe screenshots below\r\nThe usual keylogging feature of the njRAT can be seen in Figure 13 and Figure 14.\r\nFigure 13: Keylogging features\r\nhttps://labs.k7computing.com/?p=21904\r\nPage 6 of 10\n\nFigure 14: Additional Keylogging features\r\nThis RAT does registry modifications like DeleteValueFromRegistry, GetValueFromRegistry,\r\nSaveValueOnRegistry silently without the user’s knowledge.\r\nhttps://labs.k7computing.com/?p=21904\r\nPage 7 of 10\n\nFigure 15: Registry Modifications\r\nVictims’ details such as the victim’s name, user name, OS name, OS version are collected without their\r\nknowledge.\r\nFigure 16: Collected victim’s details\r\nhttps://labs.k7computing.com/?p=21904\r\nPage 8 of 10\n\nOne major feature of this RAT is activating the webcam whose code can be seen from the screenshot below.  It\r\nsearches for a webcam and if it is not found, GetForegroundWindowTitle API,retrieves the currently working\r\nwindow from which the victim can be spied on.\r\nFigure 17: Collected OS Name, OS Version and Webcam details\r\nSelf-delete feature of this RAT deletes applications according to the hacker’s need and this can be seen in the\r\nscreenshot below.\r\nFigure 18: Self-delete feature\r\nThreat actors who have been seen using this njRAT in the past are Aggah, RATicate, Operation Commando,\r\nRevengeHotels, Sphinx, China Based APT 41, RedAlpha, Pakistan based Gorgon group, Transparent Tribe, Iran\r\nhttps://labs.k7computing.com/?p=21904\r\nPage 9 of 10\n\nbased Group5, Gaza based Molerats, Syria based Goldmouse and Pat Bear.\r\nAll of these APT groups’ main intention is to perform information theft and espionage activities.\r\nOut of all these threat actors, Aggah specifically has been seen using paste.ee to host njRAT, NetWire RAT,\r\nRevengeRAT, Agent Tesla. Other malware like vjw0rm, SmokeLoader, Azorult, AsyncRAt have been seen hosted\r\non paste.ee sites in the past by other threat actors.\r\nConclusion\r\nThreat actors, of late, have started favouring paste sites to host their malware as they support only plain text files,\r\nwhich helps the threat actors to easily evade detection from AV vendors. Moreover, if the malware is encoded as a\r\ntext and hosted on sites like paste.ee, threat actors know that these sites being legitimate cannot be taken down\r\nthat easily.\r\nWe at K7 Labs keep monitoring such malware procatively, even if it is hosted on legitimate sites and add detection\r\nat the earliest for the same to keep our users protected. Users are advised to install and use a reputable security\r\nproduct like K7 Total Security and keep it updated to stay safe from the latest threats.\r\nIndicators Of Compromise (IOCs)\r\nMD5 File Name K7 Detection Name\r\n3FF8E653F245FBFA137BB714F096ADF8 Lease Agreement.vbs Trojan ( 0001140e1 )\r\n036AD2F24390FD4A7654A922E05D0295 juju.exe Trojan ( 700000121 )\r\nMITRE ATT\u0026CK\r\nTactics Techniques\r\nExecution PowerShell\r\nScripting\r\nPersistence Registry Run Keys/Startup Folder\r\nDefensive Evasion Scripting\r\nSource: https://labs.k7computing.com/?p=21904\r\nhttps://labs.k7computing.com/?p=21904\r\nPage 10 of 10",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://labs.k7computing.com/?p=21904"
	],
	"report_names": [
		"?p=21904"
	],
	"threat_actors": [
		{
			"id": "414d7c65-5872-4e56-8a7d-49a2aeef1632",
			"created_at": "2025-08-07T02:03:24.7983Z",
			"updated_at": "2026-04-10T02:00:03.76109Z",
			"deleted_at": null,
			"main_name": "COPPER FIELDSTONE",
			"aliases": [
				"APT36 ",
				"Earth Karkaddan ",
				"Gorgon Group ",
				"Green Havildar ",
				"Mythic Leopard ",
				"Operation C-Major ",
				"Operation Transparent Tribe ",
				"Pasty Draco ",
				"ProjectM ",
				"Storm-0156 "
			],
			"source_name": "Secureworks:COPPER FIELDSTONE",
			"tools": [
				"CapraRAT",
				"Crimson RAT",
				"DarkComet",
				"ElizaRAT",
				"LuminosityLink",
				"ObliqueRAT",
				"Peppy",
				"njRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "9aa9b489-a297-4dbd-8601-8fc0370201a6",
			"created_at": "2022-10-25T16:07:23.696796Z",
			"updated_at": "2026-04-10T02:00:04.71508Z",
			"deleted_at": null,
			"main_name": "Group5",
			"aliases": [
				"G0043"
			],
			"source_name": "ETDA:Group5",
			"tools": [
				"Atros2.CKPN",
				"Bladabindi",
				"DroidJack",
				"Jorik",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"Zurten",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "bfae615f-cb9c-479c-b97d-ba282c322db3",
			"created_at": "2022-10-25T16:07:24.123308Z",
			"updated_at": "2026-04-10T02:00:04.874176Z",
			"deleted_at": null,
			"main_name": "RevengeHotels",
			"aliases": [],
			"source_name": "ETDA:RevengeHotels",
			"tools": [
				"888 RAT",
				"Atros2.CKPN",
				"Bladabindi",
				"Jorik",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"Zurten",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "cf0704ab-99e4-44d7-96d9-3cba91339229",
			"created_at": "2022-10-25T15:50:23.485375Z",
			"updated_at": "2026-04-10T02:00:05.332806Z",
			"deleted_at": null,
			"main_name": "Group5",
			"aliases": [
				"Group5"
			],
			"source_name": "MITRE:Group5",
			"tools": [
				"njRAT",
				"NanoCore"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "fce5181c-7aab-400f-bd03-9db9e791da04",
			"created_at": "2022-10-25T15:50:23.759799Z",
			"updated_at": "2026-04-10T02:00:05.3002Z",
			"deleted_at": null,
			"main_name": "Transparent Tribe",
			"aliases": [
				"Transparent Tribe",
				"COPPER FIELDSTONE",
				"APT36",
				"Mythic Leopard",
				"ProjectM"
			],
			"source_name": "MITRE:Transparent Tribe",
			"tools": [
				"DarkComet",
				"ObliqueRAT",
				"njRAT",
				"Peppy"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "094d8210-4c64-4457-ad97-a94fc7af7630",
			"created_at": "2023-01-06T13:46:38.98103Z",
			"updated_at": "2026-04-10T02:00:03.170376Z",
			"deleted_at": null,
			"main_name": "Group5",
			"aliases": [
				"G0043"
			],
			"source_name": "MISPGALAXY:Group5",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "0c502f6d-640d-4e69-bfb8-328ba6540d4f",
			"created_at": "2022-10-25T15:50:23.756782Z",
			"updated_at": "2026-04-10T02:00:05.324924Z",
			"deleted_at": null,
			"main_name": "Molerats",
			"aliases": [
				"Molerats",
				"Operation Molerats",
				"Gaza Cybergang"
			],
			"source_name": "MITRE:Molerats",
			"tools": [
				"MoleNet",
				"DustySky",
				"DropBook",
				"SharpStage",
				"PoisonIvy"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "0d07b30c-4393-4071-82fb-22f51f7749e0",
			"created_at": "2022-10-25T16:07:24.097096Z",
			"updated_at": "2026-04-10T02:00:04.865146Z",
			"deleted_at": null,
			"main_name": "RATicate",
			"aliases": [],
			"source_name": "ETDA:RATicate",
			"tools": [
				"AgenTesla",
				"Agent Tesla",
				"AgentTesla",
				"BetaBot",
				"BlackRAT",
				"BlackRemote",
				"Bladabindi",
				"CloudEyE",
				"ForeIT",
				"Formbook",
				"GuLoader",
				"Jorik",
				"Loki",
				"Loki.Rat",
				"LokiBot",
				"LokiPWS",
				"NSIS",
				"Negasteal",
				"NetWeird",
				"NetWire",
				"NetWire RAT",
				"NetWire RC",
				"NetWired RC",
				"Neurevt",
				"Nullsoft Scriptable Install System",
				"Origin Logger",
				"Recam",
				"Remcos",
				"RemcosRAT",
				"Remvio",
				"Socmer",
				"ZPAQ",
				"njRAT",
				"vbdropper",
				"win.xloader"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "31a4f4ad-1aa7-48c2-8b16-58d48879644c",
			"created_at": "2024-02-06T02:00:04.13577Z",
			"updated_at": "2026-04-10T02:00:03.576453Z",
			"deleted_at": null,
			"main_name": "RevengeHotels",
			"aliases": [],
			"source_name": "MISPGALAXY:RevengeHotels",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c2cc9aa5-1853-4de1-8849-cb3f28c7728e",
			"created_at": "2022-10-25T16:07:24.256045Z",
			"updated_at": "2026-04-10T02:00:04.912815Z",
			"deleted_at": null,
			"main_name": "Goldmouse",
			"aliases": [
				"APT-C-27",
				"ATK 80",
				"Golden Rat",
				"Goldmouse"
			],
			"source_name": "ETDA:Goldmouse",
			"tools": [
				"Bladabindi",
				"GoldenRAT",
				"Jorik",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "2c385a7d-0217-46d8-a451-29ac6fe58aaf",
			"created_at": "2023-01-06T13:46:38.937468Z",
			"updated_at": "2026-04-10T02:00:03.151838Z",
			"deleted_at": null,
			"main_name": "APT-C-27",
			"aliases": [
				"Golden RAT",
				"ATK80",
				"GoldMouse"
			],
			"source_name": "MISPGALAXY:APT-C-27",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "b0d34dd6-ee90-483b-bb6c-441332274160",
			"created_at": "2022-10-25T16:07:23.296754Z",
			"updated_at": "2026-04-10T02:00:04.526403Z",
			"deleted_at": null,
			"main_name": "Aggah",
			"aliases": [
				"Operation Red Deer",
				"Operation Roma225"
			],
			"source_name": "ETDA:Aggah",
			"tools": [
				"AgenTesla",
				"Agent Tesla",
				"AgentTesla",
				"Aggah",
				"Atros2.CKPN",
				"Bladabindi",
				"Jorik",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"Negasteal",
				"Origin Logger",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"Warzone",
				"Warzone RAT",
				"ZPAQ",
				"Zurten",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "9381a9dc-8d8e-453a-9fe5-301136ff0f83",
			"created_at": "2023-01-06T13:46:38.775762Z",
			"updated_at": "2026-04-10T02:00:03.096032Z",
			"deleted_at": null,
			"main_name": "RedAlpha",
			"aliases": [
				"DeepCliff",
				"Red Dev 3"
			],
			"source_name": "MISPGALAXY:RedAlpha",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "0769c188-62ce-44ee-8e9d-1067f3d3c083",
			"created_at": "2022-10-25T16:07:24.259063Z",
			"updated_at": "2026-04-10T02:00:04.913621Z",
			"deleted_at": null,
			"main_name": "Pat Bear",
			"aliases": [
				"APT-C-37",
				"Pat Bear",
				"Racquet Bear"
			],
			"source_name": "ETDA:Pat Bear",
			"tools": [
				"Bladabindi",
				"CypherRat",
				"DroidJack",
				"H-Worm",
				"H-Worm RAT",
				"Houdini",
				"Houdini RAT",
				"Hworm",
				"Iniduoh",
				"Jenxcus",
				"Jorik",
				"Kognito",
				"Njw0rm",
				"SSLove RAT",
				"SpyNote",
				"SpyNote RAT",
				"WSHRAT",
				"dinihou",
				"dunihi",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "e90ec9cb-9959-455d-b558-4bafef64d645",
			"created_at": "2022-10-25T16:07:24.222081Z",
			"updated_at": "2026-04-10T02:00:04.903184Z",
			"deleted_at": null,
			"main_name": "Sphinx",
			"aliases": [
				"APT-C-15"
			],
			"source_name": "ETDA:Sphinx",
			"tools": [
				"AnubisSpy",
				"Backdoor.Oldrea",
				"Bladabindi",
				"Fertger",
				"Havex",
				"Havex RAT",
				"Jorik",
				"Oldrea",
				"PEACEPIPE",
				"njRAT",
				"yellowalbatross"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "18278778-fa63-4a9a-8988-4d266b8c5c1a",
			"created_at": "2023-01-06T13:46:38.769816Z",
			"updated_at": "2026-04-10T02:00:03.094179Z",
			"deleted_at": null,
			"main_name": "The Gorgon Group",
			"aliases": [
				"Gorgon Group",
				"Subaat",
				"ATK92",
				"G0078",
				"Pasty Gemini"
			],
			"source_name": "MISPGALAXY:The Gorgon Group",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "97fdaf9f-cae1-4ccc-abe2-76e5cbc0febd",
			"created_at": "2022-10-25T15:50:23.296989Z",
			"updated_at": "2026-04-10T02:00:05.347085Z",
			"deleted_at": null,
			"main_name": "Gorgon Group",
			"aliases": [
				"Gorgon Group"
			],
			"source_name": "MITRE:Gorgon Group",
			"tools": [
				"NanoCore",
				"QuasarRAT",
				"Remcos",
				"njRAT"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "c7d9878a-e691-4c6f-81ae-84fb115a1345",
			"created_at": "2022-10-25T16:07:23.359506Z",
			"updated_at": "2026-04-10T02:00:04.556639Z",
			"deleted_at": null,
			"main_name": "APT 41",
			"aliases": [
				"BrazenBamboo",
				"Bronze Atlas",
				"Double Dragon",
				"Earth Baku",
				"G0096",
				"Grayfly",
				"Operation ColunmTK",
				"Operation CuckooBees",
				"Operation ShadowHammer",
				"Red Kelpie",
				"SparklingGoblin",
				"TA415",
				"TG-2633"
			],
			"source_name": "ETDA:APT 41",
			"tools": [
				"9002 RAT",
				"ADORE.XSEC",
				"ASPXSpy",
				"ASPXTool",
				"AceHash",
				"Agent.dhwf",
				"Agentemis",
				"AndroidControl",
				"AngryRebel",
				"AntSword",
				"BLUEBEAM",
				"Barlaiy",
				"BlackCoffee",
				"Bladabindi",
				"BleDoor",
				"CCleaner Backdoor",
				"CHINACHOPPER",
				"COLDJAVA",
				"China Chopper",
				"ChyNode",
				"Cobalt Strike",
				"CobaltStrike",
				"Crackshot",
				"CrossWalk",
				"CurveLast",
				"CurveLoad",
				"DAYJOB",
				"DBoxAgent",
				"DEADEYE",
				"DEADEYE.APPEND",
				"DEADEYE.EMBED",
				"DEPLOYLOG",
				"DIRTCLEANER",
				"DUSTTRAP",
				"Derusbi",
				"Destroy RAT",
				"DestroyRAT",
				"DodgeBox",
				"DragonEgg",
				"ELFSHELF",
				"EasyNight",
				"Farfli",
				"FunnySwitch",
				"Gh0st RAT",
				"Ghost RAT",
				"HDD Rootkit",
				"HDRoot",
				"HKDOOR",
				"HOMEUNIX",
				"HUI Loader",
				"HidraQ",
				"HighNoon",
				"HighNote",
				"Homux",
				"Hydraq",
				"Jorik",
				"Jumpall",
				"KEYPLUG",
				"Kaba",
				"Korplug",
				"LATELUNCH",
				"LOLBAS",
				"LOLBins",
				"LightSpy",
				"Living off the Land",
				"Lowkey",
				"McRAT",
				"MdmBot",
				"MessageTap",
				"Meterpreter",
				"Mimikatz",
				"MoonBounce",
				"MoonWalk",
				"Motnug",
				"Moudour",
				"Mydoor",
				"NTDSDump",
				"PACMAN",
				"PCRat",
				"PINEGROVE",
				"PNGRAT",
				"POISONPLUG",
				"POISONPLUG.SHADOW",
				"POTROAST",
				"PRIVATELOG",
				"PipeMon",
				"PlugX",
				"PortReuse",
				"ProxIP",
				"ROCKBOOT",
				"RbDoor",
				"RedDelta",
				"RedXOR",
				"RibDoor",
				"Roarur",
				"RouterGod",
				"SAGEHIRE",
				"SPARKLOG",
				"SQLULDR2",
				"STASHLOG",
				"SWEETCANDLE",
				"ScrambleCross",
				"Sensocode",
				"SerialVlogger",
				"ShadowHammer",
				"ShadowPad Winnti",
				"SinoChopper",
				"Skip-2.0",
				"SneakCross",
				"Sogu",
				"Speculoos",
				"Spyder",
				"StealthReacher",
				"StealthVector",
				"TERA",
				"TIDYELF",
				"TIGERPLUG",
				"TOMMYGUN",
				"TVT",
				"Thoper",
				"Voldemort",
				"WIDETONE",
				"WINNKIT",
				"WINTERLOVE",
				"Winnti",
				"WyrmSpy",
				"X-Door",
				"XDOOR",
				"XMRig",
				"XShellGhost",
				"Xamtrav",
				"ZXShell",
				"ZoxPNG",
				"certutil",
				"certutil.exe",
				"cobeacon",
				"gresim",
				"njRAT",
				"pwdump",
				"xDll"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "cc8271a3-471f-4b8c-9da6-7d50f8ccabaa",
			"created_at": "2022-10-25T16:07:24.107066Z",
			"updated_at": "2026-04-10T02:00:04.868213Z",
			"deleted_at": null,
			"main_name": "RedAlpha",
			"aliases": [
				"DeepCliff",
				"Red Dev 3"
			],
			"source_name": "ETDA:RedAlpha",
			"tools": [
				"AngryRebel",
				"Bladabindi",
				"FF-RAT",
				"Farfli",
				"FormerFirstRAT",
				"Gh0st RAT",
				"Ghost RAT",
				"Jorik",
				"Moudour",
				"Mydoor",
				"NetHelp Infostealer",
				"NetHelp Striker",
				"PCRat",
				"RedAlpha",
				"ffrat",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "e5cad6bf-fa91-4128-ba0d-2bf3ff3c6c6b",
			"created_at": "2025-08-07T02:03:24.53077Z",
			"updated_at": "2026-04-10T02:00:03.680525Z",
			"deleted_at": null,
			"main_name": "ALUMINUM SARATOGA",
			"aliases": [
				"APT-C-23",
				"Arid Viper",
				"Desert Falcon",
				"Extreme Jackal ",
				"Gaza Cybergang",
				"Molerats ",
				"Operation DustySky ",
				"TA402"
			],
			"source_name": "Secureworks:ALUMINUM SARATOGA",
			"tools": [
				"BlackShades",
				"BrittleBush",
				"DarkComet",
				"LastConn",
				"Micropsia",
				"NimbleMamba",
				"PoisonIvy",
				"QuasarRAT",
				"XtremeRat"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "1162e0d4-b69c-423d-a4da-f3080d1d2b0c",
			"created_at": "2023-01-06T13:46:38.508262Z",
			"updated_at": "2026-04-10T02:00:03.006018Z",
			"deleted_at": null,
			"main_name": "Molerats",
			"aliases": [
				"Gaza Cybergang",
				"Operation Molerats",
				"Extreme Jackal",
				"ALUMINUM SARATOGA",
				"G0021",
				"BLACKSTEM",
				"Gaza Hackers Team",
				"Gaza cybergang"
			],
			"source_name": "MISPGALAXY:Molerats",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "28851008-77b4-47eb-abcd-1bb5b3f19fc2",
			"created_at": "2023-06-20T02:02:10.254614Z",
			"updated_at": "2026-04-10T02:00:03.365336Z",
			"deleted_at": null,
			"main_name": "Hagga",
			"aliases": [
				"TH-157",
				"Aggah"
			],
			"source_name": "MISPGALAXY:Hagga",
			"tools": [
				"Agent Tesla"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "6c4e4b91-1f98-49e2-90e6-435cea8d3d53",
			"created_at": "2022-10-25T16:07:23.693797Z",
			"updated_at": "2026-04-10T02:00:04.711987Z",
			"deleted_at": null,
			"main_name": "Gorgon Group",
			"aliases": [
				"ATK 92",
				"G0078",
				"Pasty Draco",
				"Subaat",
				"TAG-CR5"
			],
			"source_name": "ETDA:Gorgon Group",
			"tools": [
				"AgenTesla",
				"Agent Tesla",
				"AgentTesla",
				"Atros2.CKPN",
				"Bladabindi",
				"CinaRAT",
				"Crimson RAT",
				"ForeIT",
				"Jorik",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Loki",
				"Loki.Rat",
				"LokiBot",
				"LokiPWS",
				"MSIL",
				"MSIL/Crimson",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"Negasteal",
				"NetWeird",
				"NetWire",
				"NetWire RAT",
				"NetWire RC",
				"NetWired RC",
				"Origin Logger",
				"Quasar RAT",
				"QuasarRAT",
				"Recam",
				"Remcos",
				"RemcosRAT",
				"Remvio",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"SEEDOOR",
				"Scarimson",
				"Socmer",
				"Yggdrasil",
				"ZPAQ",
				"Zurten",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "abb24b7b-6baa-4070-9a2b-aa59091097d1",
			"created_at": "2022-10-25T16:07:24.339942Z",
			"updated_at": "2026-04-10T02:00:04.944806Z",
			"deleted_at": null,
			"main_name": "Transparent Tribe",
			"aliases": [
				"APT 36",
				"APT-C-56",
				"Copper Fieldstone",
				"Earth Karkaddan",
				"G0134",
				"Green Havildar",
				"Mythic Leopard",
				"Opaque Draco",
				"Operation C-Major",
				"Operation Honey Trap",
				"Operation Transparent Tribe",
				"ProjectM",
				"STEPPY-KAVACH",
				"Storm-0156",
				"TEMP.Lapis",
				"Transparent Tribe"
			],
			"source_name": "ETDA:Transparent Tribe",
			"tools": [
				"Amphibeon",
				"Android RAT",
				"Bezigate",
				"Bladabindi",
				"Bozok",
				"Bozok RAT",
				"BreachRAT",
				"Breut",
				"CapraRAT",
				"CinaRAT",
				"Crimson RAT",
				"DarkComet",
				"DarkKomet",
				"ElizaRAT",
				"FYNLOS",
				"Fynloski",
				"Jorik",
				"Krademok",
				"Limepad",
				"Luminosity RAT",
				"LuminosityLink",
				"MSIL",
				"MSIL/Crimson",
				"Mobzsar",
				"MumbaiDown",
				"Oblique RAT",
				"ObliqueRAT",
				"Peppy RAT",
				"Peppy Trojan",
				"Quasar RAT",
				"QuasarRAT",
				"SEEDOOR",
				"Scarimson",
				"SilentCMD",
				"Stealth Mango",
				"UPDATESEE",
				"USBWorm",
				"Waizsar RAT",
				"Yggdrasil",
				"beendoor",
				"klovbot",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c68fa27f-e8d9-4932-856b-467ccfe39997",
			"created_at": "2023-01-06T13:46:38.450585Z",
			"updated_at": "2026-04-10T02:00:02.980334Z",
			"deleted_at": null,
			"main_name": "Operation C-Major",
			"aliases": [
				"APT36",
				"APT 36",
				"TMP.Lapis",
				"COPPER FIELDSTONE",
				"Storm-0156",
				"Transparent Tribe",
				"ProjectM",
				"Green Havildar",
				"Earth Karkaddan",
				"C-Major",
				"Mythic Leopard"
			],
			"source_name": "MISPGALAXY:Operation C-Major",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "847f600c-cf90-44c0-8b39-fb0d5adfcef4",
			"created_at": "2022-10-25T16:07:23.875541Z",
			"updated_at": "2026-04-10T02:00:04.768142Z",
			"deleted_at": null,
			"main_name": "Molerats",
			"aliases": [
				"ATK 89",
				"Aluminum Saratoga",
				"Extreme Jackal",
				"G0021",
				"Gaza Cybergang",
				"Gaza Hackers Team",
				"Molerats",
				"Operation DustySky",
				"Operation DustySky Part 2",
				"Operation Molerats",
				"Operation Moonlight",
				"Operation SneakyPastes",
				"Operation TopHat",
				"TA402",
				"TAG-CT5"
			],
			"source_name": "ETDA:Molerats",
			"tools": [
				"BadPatch",
				"Bladabindi",
				"BrittleBush",
				"Chymine",
				"CinaRAT",
				"Darkmoon",
				"Downeks",
				"DropBook",
				"DustySky",
				"ExtRat",
				"Gen:Trojan.Heur.PT",
				"H-Worm",
				"H-Worm RAT",
				"Houdini",
				"Houdini RAT",
				"Hworm",
				"Iniduoh",
				"IronWind",
				"Jenxcus",
				"JhoneRAT",
				"Jorik",
				"KasperAgent",
				"Kognito",
				"LastConn",
				"Micropsia",
				"MoleNet",
				"Molerat Loader",
				"NeD Worm",
				"NimbleMamba",
				"Njw0rm",
				"Pierogi",
				"Poison Ivy",
				"Quasar RAT",
				"QuasarRAT",
				"SPIVY",
				"Scote",
				"SharpSploit",
				"SharpStage",
				"WSHRAT",
				"WelcomeChat",
				"Xtreme RAT",
				"XtremeRAT",
				"Yggdrasil",
				"dinihou",
				"dunihi",
				"njRAT",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434099,
	"ts_updated_at": 1775792283,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3187eb2e65070bb3462c20efe3468ded7705ebb9.pdf",
		"text": "https://archive.orkl.eu/3187eb2e65070bb3462c20efe3468ded7705ebb9.txt",
		"img": "https://archive.orkl.eu/3187eb2e65070bb3462c20efe3468ded7705ebb9.jpg"
	}
}