{
	"id": "e6042ace-0b78-45b4-aefa-fef0c679bb14",
	"created_at": "2026-04-06T00:20:01.203754Z",
	"updated_at": "2026-04-10T03:38:03.272299Z",
	"deleted_at": null,
	"sha1_hash": "7377c4b5a79bf1624d33f437ef6fddbf6364dc95",
	"title": "Ugg Boots 4 Sale: A Tale of Palestinian-Aligned Espionage | Proofpoint US",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1081315,
	"plain_text": "Ugg Boots 4 Sale: A Tale of Palestinian-Aligned Espionage |\r\nProofpoint US\r\nBy February 08, 2022 Konstantin Klinger, Joshua Miller, and Georgi Mladenov\r\nPublished: 2022-02-02 · Archived: 2026-04-05 14:32:47 UTC\r\nKey Takeaways  \r\nTA402, a likely Palestinian-aligned advance persistent threat actor, has recently engaged in campaigns\r\nleveraging a new implant, dubbed by Proofpoint analysts as NimbleMamba. \r\nNimbleMamba is likely a replacement for the group’s previously used LastConn implant.  \r\nThese campaigns have a complex attack chain that leverages geofencing and URL redirects to legitimate sites\r\nin order to bypass detection efforts. \r\nOverview \r\nIn late 2021, Proofpoint analysts identified a complex attack chain targeting Middle Eastern governments, foreign\r\npolicy think tanks, and a state-affiliated airline. Over three months, Proofpoint observed three subtle variations of this\r\nattack chain. Proofpoint attributes these campaigns to TA402, an actor commonly tracked as Molerats and believed to\r\nbe operating in the interest of the Palestinian Territories. Based on Proofpoint’s research, TA402 is a persistent threat\r\nto organizations and governments in the Middle East, routinely updating not only their malware implants, but also\r\ntheir delivery methods. After publication of Proofpoint’s TA402 research in June 2021, TA402 appeared to halt its\r\nactivities for a short period of time, almost certainly to retool. Proofpoint researchers believe they used that time to\r\nupdate their implants and delivery mechanisms, using malware dubbed NimbleMamba and BrittleBush. TA402 also\r\nregularly uses geofencing techniques and varied attack chains which complicate detection efforts for defenders.  \r\nCampaign Details \r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 1 of 13\n\nFigure 1. TA402 attack chain November 2021 to January 2022. \r\nIn the recently observed campaigns, TA402 used spear phishing emails containing links that often lead to malicious\r\nfiles. Proofpoint observed three different URL types in those campaigns. \r\nVariation 1: Actor-Controlled Domain (November 2021) \r\nIn a November 2021 campaign, TA402 masqueraded as the Quora website while using an actor-controlled Gmail\r\naccount with an actor-controlled domain. The malicious URL, such as\r\nhttps[:]//www[.]uggboots4sale[.]com/news15112021.php, in the phishing email was geofenced to the targeted\r\ncountries. If the target's IP address fits into the targeted region, the user would be redirected to the RAR file\r\ndownload containing the latest TA402 implant, NimbleMamba. If outside the target area, the user would be redirected\r\nto a legitimate news site, Figure 2. \r\nFigure 2. Benign redirect to legitimate news site https[:]www[.]emaratalyoum[.]com. \r\nVariation 2: Dropbox URL (December 2021) \r\nIn December 2021, TA402 used multiple phishing pretenses, including clickbait medical lures and ones allegedly\r\nsharing confidential geopolitical information. TA402 continued to use an actor-controlled Gmail account but shifted\r\nto Dropbox URLs to deliver the malicious RAR files containing NimbleMamba. This shift away from actor-controlled domains meant that TA402 could no longer geofence their payloads. Proofpoint discovered that TA402 is\r\nnot only abusing Dropbox services for delivery of NimbleMamba, but also for malware command and control (C2).\r\nProofpoint has shared our investigation and analysis with Dropbox prior to publication, and they took the needed\r\nactions for neutralizing the activity within their organization. \r\nVariation 3: WordPress Redirect Actor-Controlled Domain (December 2021/January 2022) \r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 2 of 13\n\nIn their latest campaigns, TA402 continued to use lure content customized for each of their targets but slightly\r\nadjusted their attack chain by inserting an additional actor-controlled WordPress URL. That WordPress site (Figure\r\n3), which impersonates a news aggregator of the legitimate news site from Variation 1, likely redirects to the\r\ndownload site of the malicious RAR files containing NimbleMamba if the visitor is coming from an IP within the\r\ntargeted region. If the source IP address does not align with the target region, the URL will redirect the recipient to a\r\nbenign website, typically an Arabic language news website (Figure 2). \r\nFigure 3. Example WordPress site (https[:]//emaratalyoumcom[.]wordpress[.]com/) impersonating an Arabic\r\nlanguage news aggregator. \r\nThe use of geofenced URLs, Dropbox URLs and then redirect URLs demonstrate TA402’s determination to blend in\r\nwith legitimate email traffic and infect targets with NimbleMamba. \r\nMalware Analysis: NimbleMamba  \r\nEach variant of TA402’s attack chain led to a RAR file containing one or multiple malicious compressed executables.\r\nThese executables include a TA402 implant Proofpoint dubbed NimbleMamba and oftentimes an additional trojan\r\nProofpoint named BrittleBush. NimbleMamba is almost certainly meant to replace LastConn, which\r\nProofpoint reported about in June 2021. LastConn was likely an updated version of the SharpStage\r\nmalware, reported by Cybereason in December 2020. While NimbleMamba and LastConn have some similarities,\r\nsuch as being written in C#, base64 encoding within the C2 framework, and use of the Dropbox API for C2\r\ncommunication, there appears to be little code overlap between the two.  \r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 3 of 13\n\nNimbleMamba uses guardrails to ensure that all infected victims are within TA402’s target region. NimbleMamba\r\nuses the Dropbox API for both command and control as well as exfiltration. The malware also contains multiple\r\ncapabilities designed to complicate both automated and manual analysis. Based on this, Proofpoint assesses\r\nNimbleMamba is actively being developed, is well-maintained, and designed for use in highly targeted intelligence\r\ncollection campaigns.  \r\nFor this malware analysis, Proofpoint researchers analyzed the following two samples: \r\nSHA256 \r\nCompile\r\ntime \r\nActivity  \r\nSample\r\n1 \r\nc61fcd8bed15414529959e8b5484b2c559ac597143c1775b1cec7d493a40369d \r\n2021-11-\r\n07\r\n00:02:28 \r\nUsed in an\r\nemail-based\r\ncampaign\r\nin\r\nNovember\r\n2021 \r\nSample\r\n2 \r\n430c12393a1714e3f5087e1338a3e3846ab62b18d816cc4916749a935f8dab44 \r\n2021-11-\r\n20\r\n23:13:29 \r\nUsed in\r\nemail-based\r\ncampaigns\r\nin\r\nDecember\r\n2021 and\r\nJanuary\r\n2022 \r\nNimbleMamba is written in C# and delivered as an obfuscated .NET executable using third-party obfuscators. Both\r\nsamples analyzed used the SmartAssembly obfuscator. Additionally, the malware does basic virtual machine checks\r\nto avoid detection by looking for common strings that indicate a sample is running in a virtual environment. \r\nGuardrails \r\nNimbleMamba contains multiple guardrails to ensure that the malware only executes on targeted machines. It uses\r\nthe following IP resolving web services to check the user’s IP address and determine if it fits into the target region.\r\nThis is done to avoid detection and analysis. \r\napi[.]ipify[.]com (https://www.ipify.org) \r\nmyexternalip[.]com (https://myexternalip.com) \r\nip-api[.]com (https://ip-api.com) \r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 4 of 13\n\napi[.]ipstack[.]com (https://ipstack.com) \r\nIf the machine is unable to connect to those services, the malware will keep calling the addresses in random order,\r\nthus putting the execution in an endless loop in closed network environments. \r\nThe malware will only continue executing if the country of the resolved IP address country code matches one from\r\nthe following table or if the host computer has an Arabic language pack (code “AR”) installed.  \r\nCode  Country \r\nKW  Kuwait \r\nEG  Egypt \r\nIL  Israel \r\nSA  Saudi Arabia \r\nIR  Iran \r\nAE  United Arab Emirates \r\nTN  Tunisia \r\nDZ  Algeria \r\nSY  Syria \r\nQA  Qatar \r\nJO  Jordan \r\nOM  Oman \r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 5 of 13\n\nPS  Palestine \r\nLB  Lebanon \r\nLY  Libya \r\nSS  South Sudan \r\nSSD  Soud Sudan (Alpha-3 code, probably added by accident) \r\nIQ  Iraq \r\nYE  Yemen \r\nMA  Morocco \r\nBH  Bahrain \r\nConfiguration \r\nNimbleMamba’s configuration is retrieved from a paste on the website JustPasteIt. NimbleMamba takes the current\r\ntimestamp from an online real-time service to ensure that the timestamp matches the current time. Some computers\r\nmay have modified time settings and this method ensures that the time is standardized across infections. The obtained\r\ntimestamp is then used to generate a JustPasteIt URL with the algorithm in Figure 4. \r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 6 of 13\n\nFigure 4. Python implementation of NimbleMamba’s JustPasteIt algorithm.  \r\nWhen there is an active paste under the generated URL, it should look like this: \r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 7 of 13\n\nFigure 5. Example of JustePasteIt paste content. \r\nThe data taken from the paste service is split by “#” and then each split by “=” to form the following two key-value\r\npairs. \r\nKey  Value \r\nACSS \r\nIFK641c5_RQj32p_HvJF14U3eu3iQIl1vYncq-5-\r\ng4aMKQAAAAAAAAAAQ6MoiJpHT88KFIEQQ2SH5 \r\nOOOO  40,1ckZnB3a45mMpRTTYplNiNmZ \r\nACSS contains the obfuscated Dropbox account API auth key that is used for C2 communication. The malware then\r\ntakes the external IP address, username and computer name retrieved earlier, writes them as comma-separated strings,\r\nbase64 encodes them with stripped padding bytes and then reverses the string. The resulting string is used as a folder\r\nname that is created on the Dropbox account using their API with the API key deobfuscated (Figure 6) from the\r\nJustPasteIt post.  \r\nFigure 6. Dropbox API key deobfuscation. \r\nFrom there, the malware starts communicating with Dropbox to obtain a RAR file and a decoy file that is\r\nimmediately displayed to the user if present. The decoy file is often an office document or PDF. The RAR file is\r\npassword-protected with a password stored as the second comma-separated value in the OOOO argument from the\r\nJustPasteIt paste and dropped to the folder pointed by the first parameter in OOOO. The downloaded RAR file\r\ncontains two additional executables, an updated sample of NimbleMamba along with an executable that contains a\r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 8 of 13\n\nscreenshot of the functionality. This technique allows for TA402 to serve additional payloads to targeted\r\nNimbleMamba victims. \r\nPivoting on the JustPasteIt user “Nefaty Benet” (Researcher Note: This account is likely meant to impersonate the\r\nIsraeli Prime Minister Naftali Bennett) allows us to see that the NimbleMamba campaign likely started in August\r\n2021, two months after Proofpoint’s previous research. This timeframe is consistent with the compile dates of the\r\nNimbleMamba samples identified in VirusTotal. \r\n \r\nFigure 7. Pivot to all pastes created by user “Nefaty Benet.” \r\nFunctionality \r\nNimbleMamba has the traditional capabilities of an intelligence-gathering trojan and is likely designed to be the\r\ninitial access. Functionalities include capturing screenshots and obtaining process information from the computer.\r\nAdditionally, it can detect user interaction, such as looking for mouse movement.  \r\nBrittleBush Trojan \r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 9 of 13\n\nLater versions of the RAR files that deliver NimbleMamba also included a small trojan application Proofpoint\r\ndubbed BrittleBush (2E4671C517040CBD66A1BE0F04FB8F2AF7064FEF2B5EE5E33D1F9D347E4C419F). This\r\ntrojan communicated with easyuploadservice[.]com and received commands as base64 encoded JSON structure.  \r\nFigure 8. BrittleBush JSON structure. \r\nAttribution \r\nProofpoint attributes the campaigns to TA402 based on both technical indicators and victimology. The observed\r\nattack chains mimic historical TA402 campaigns, some of which are discussed in Proofpoint’s June 2021 research.\r\nThe phishing campaigns share thematic elements with historical Molerats campaigns. For example, the December\r\n2021 campaign contained a title bearing significant similarities to a 2015 TA402 campaign reported by Kaspersky. \r\nCampaign  Arabic Title   Translation \r\n2015 Kaspersky\r\nCampaign \r\nمكالمة مسربة بني القائد العام للقوات”\r\n “exe.المسلحة المصرية صدقي صبحي\r\nLeaked conversation with the Egyptian leader of\r\nmilitary forces Sodqi Sobhi[.]exe \r\nDecember 2021\r\nCampaign \r\n لقاء سري بني بن سلمان واردوغان في قطر\r\nSecret meeting between bin Salman and\r\nErdogan in Qatar \r\nThe campaigns observed by Proofpoint likely occurred concurrently to Zscaler’s recently published research on\r\nMolerats activity targeting individuals in Palestine \u0026 Turkey and demonstrate Molerats continued ability to modify\r\ntheir attack chain based on their intelligence targets.  \r\nThe significant technical connections between the DropBox accounts used by the LastConn malware, the account\r\nused to deploy NimbleMamba, and the account used to store intelligence exfiltrated by NimbleMamba indicate that\r\nLastConn and NimbleMamba are almost certainly deployed by the same operators. This was based on the findings\r\nfound during the investigation performed by Dropbox Security Team, which neutralized all the associated accounts. \r\nTechnical intelligence, including analysis of Molerats network activity from TeamCymru, indicates NimbleMamba\r\ndevelopers operate in the interest of the Palestinian Territories. The guardrails employed by NimbleMamba\r\ndemonstrate a clear focus on targeting Arabic speakers along with computers in the Middle East. Proofpoint observed\r\ncampaigns targeting Middle Eastern governments, foreign policy think tanks, and a state-affiliated airline. Proofpoint\r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 10 of 13\n\nassesses TA402 likely operates in support of Palestinian objectives, which is consistent with prior Proofpoint and the\r\nbroader industry’s previously published assessments.  \r\nConclusion \r\nTA402 continues to be an effective threat actor that demonstrates its persistence with its highly targeted campaigns\r\nfocused on the Middle East. Based on the variations between campaigns delivering NimbleMamba, along with the\r\nhistorical pattern of developing new malware post disclosure, Proofpoint judges with moderate confidence that\r\nTA402 will continue to update both their implants and infection chains to complicate defensive efforts.  \r\nIndicators of Compromise (IOCs) \r\nIOC \r\nIOC\r\nType \r\nDescription \r\n430c12393a1714e3f5087e1338a3e3846ab62b18d816cc4916749a935f8dab44  SHA256 \r\nNimbleMamba\r\nSample 1 (Dec\r\n2021 / Jan 2022) \r\nc61fcd8bed15414529959e8b5484b2c559ac597143c1775b1cec7d493a40369d  SHA256 \r\nNimbleMamba\r\nSample 2 (Nov\r\n2021) \r\nuggboots4sale[.]com  Domain \r\nActor-owned\r\ndomain used for\r\nNimbleMamba\r\ndelivery \r\n925aff03ab009c8e7935cfa389fc7a34482184cc310a8d8f88a25d9a89711e86  SHA256 \r\nAdditional\r\nNimbleMamba\r\nSample found\r\nwith retro hunt\r\n(Oct 2021) \r\neasyuploadservice[.]com  Domain  BrittleBush C2  \r\n2e4671c517040cbd66a1be0f04fb8f2af7064fef2b5ee5e33d1f9d347e4c419f  SHA256 \r\nBrittleBush\r\nSample \r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 11 of 13\n\nET Signatures \r\n2035112 TA402/Molerats CnC Checkin \r\n2035113 TA402/Molerats Payload Downloaded \r\n2035120 TA402/Molerats CnC Activity \r\n2035121 TA402/Molerats External IP Lookup Activity \r\n2035122 TA402/Molerats Related Malware Domain in DNS Lookup \r\n2035123 TA402/Molerats Related Malware Domain in DNS Lookup \r\nYARA Signatures \r\nrule Proofpoint_Molerats_TA402_NimbleMamba { \r\n    meta: \r\n        description = \"Detects .NET written NimbleMamba malware used by TA402/Molereats\" \r\n        author = \"Proofpoint Threat Research\" \r\n        disclaimer = \"Yara signature created for hunting purposes - not quality controlled within enterprise\r\nenvironment\" \r\n        hash1 = \"430c12393a1714e3f5087e1338a3e3846ab62b18d816cc4916749a935f8dab44\" \r\n        hash2 = \"c61fcd8bed15414529959e8b5484b2c559ac597143c1775b1cec7d493a40369d\" \r\n    strings: \r\n        $dotnet = \"#Strings\" ascii \r\n        $dropbox = \"dropboxapi.com\" ascii wide \r\n        $justpaste = \"justpaste.it\" wide \r\n        $ip_1 = \"api.ipstack.com\" wide \r\n        $ip_2 = \"myexternalip.com\" wide \r\n        $ip_3 = \"ip-api.com\" wide \r\n        $ip_4 = \"api.ipify.com\" wide \r\n        $vm_1 = \"VMware|VIRTUAL|A M I|Xen\" wide \r\n        $vm_2 = \"Microsoft|VMWare|Virtual\" wide \r\n    condition: \r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 12 of 13\n\nuint16be(0) == 0x4D5A and $dotnet and $dropbox and $justpaste and any of ($ip_*) and any of ($vm_*) \r\n} \r\nSource: https://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nhttps://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage\r\nPage 13 of 13\n\n https://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage   \nFigure 4. Python implementation of NimbleMamba’s JustPasteIt algorithm.\nWhen there is an active paste under the generated URL, it should look like this:\n   Page 7 of 13",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia",
		"ETDA"
	],
	"references": [
		"https://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage"
	],
	"report_names": [
		"ugg-boots-4-sale-tale-palestinian-aligned-espionage"
	],
	"threat_actors": [
		{
			"id": "d90307b6-14a9-4d0b-9156-89e453d6eb13",
			"created_at": "2022-10-25T16:07:23.773944Z",
			"updated_at": "2026-04-10T02:00:04.746188Z",
			"deleted_at": null,
			"main_name": "Lead",
			"aliases": [
				"Casper",
				"TG-3279"
			],
			"source_name": "ETDA:Lead",
			"tools": [
				"Agentemis",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"RbDoor",
				"RibDoor",
				"Winnti",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "0c502f6d-640d-4e69-bfb8-328ba6540d4f",
			"created_at": "2022-10-25T15:50:23.756782Z",
			"updated_at": "2026-04-10T02:00:05.324924Z",
			"deleted_at": null,
			"main_name": "Molerats",
			"aliases": [
				"Molerats",
				"Operation Molerats",
				"Gaza Cybergang"
			],
			"source_name": "MITRE:Molerats",
			"tools": [
				"MoleNet",
				"DustySky",
				"DropBook",
				"SharpStage",
				"PoisonIvy"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "e5cad6bf-fa91-4128-ba0d-2bf3ff3c6c6b",
			"created_at": "2025-08-07T02:03:24.53077Z",
			"updated_at": "2026-04-10T02:00:03.680525Z",
			"deleted_at": null,
			"main_name": "ALUMINUM SARATOGA",
			"aliases": [
				"APT-C-23",
				"Arid Viper",
				"Desert Falcon",
				"Extreme Jackal ",
				"Gaza Cybergang",
				"Molerats ",
				"Operation DustySky ",
				"TA402"
			],
			"source_name": "Secureworks:ALUMINUM SARATOGA",
			"tools": [
				"BlackShades",
				"BrittleBush",
				"DarkComet",
				"LastConn",
				"Micropsia",
				"NimbleMamba",
				"PoisonIvy",
				"QuasarRAT",
				"XtremeRat"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "1162e0d4-b69c-423d-a4da-f3080d1d2b0c",
			"created_at": "2023-01-06T13:46:38.508262Z",
			"updated_at": "2026-04-10T02:00:03.006018Z",
			"deleted_at": null,
			"main_name": "Molerats",
			"aliases": [
				"Gaza Cybergang",
				"Operation Molerats",
				"Extreme Jackal",
				"ALUMINUM SARATOGA",
				"G0021",
				"BLACKSTEM",
				"Gaza Hackers Team",
				"Gaza cybergang"
			],
			"source_name": "MISPGALAXY:Molerats",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "0ad97d64-7970-48ca-83f6-3635c66e315c",
			"created_at": "2023-11-21T02:00:07.400003Z",
			"updated_at": "2026-04-10T02:00:03.479189Z",
			"deleted_at": null,
			"main_name": "TA402",
			"aliases": [],
			"source_name": "MISPGALAXY:TA402",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "847f600c-cf90-44c0-8b39-fb0d5adfcef4",
			"created_at": "2022-10-25T16:07:23.875541Z",
			"updated_at": "2026-04-10T02:00:04.768142Z",
			"deleted_at": null,
			"main_name": "Molerats",
			"aliases": [
				"ATK 89",
				"Aluminum Saratoga",
				"Extreme Jackal",
				"G0021",
				"Gaza Cybergang",
				"Gaza Hackers Team",
				"Molerats",
				"Operation DustySky",
				"Operation DustySky Part 2",
				"Operation Molerats",
				"Operation Moonlight",
				"Operation SneakyPastes",
				"Operation TopHat",
				"TA402",
				"TAG-CT5"
			],
			"source_name": "ETDA:Molerats",
			"tools": [
				"BadPatch",
				"Bladabindi",
				"BrittleBush",
				"Chymine",
				"CinaRAT",
				"Darkmoon",
				"Downeks",
				"DropBook",
				"DustySky",
				"ExtRat",
				"Gen:Trojan.Heur.PT",
				"H-Worm",
				"H-Worm RAT",
				"Houdini",
				"Houdini RAT",
				"Hworm",
				"Iniduoh",
				"IronWind",
				"Jenxcus",
				"JhoneRAT",
				"Jorik",
				"KasperAgent",
				"Kognito",
				"LastConn",
				"Micropsia",
				"MoleNet",
				"Molerat Loader",
				"NeD Worm",
				"NimbleMamba",
				"Njw0rm",
				"Pierogi",
				"Poison Ivy",
				"Quasar RAT",
				"QuasarRAT",
				"SPIVY",
				"Scote",
				"SharpSploit",
				"SharpStage",
				"WSHRAT",
				"WelcomeChat",
				"Xtreme RAT",
				"XtremeRAT",
				"Yggdrasil",
				"dinihou",
				"dunihi",
				"njRAT",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434801,
	"ts_updated_at": 1775792283,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/7377c4b5a79bf1624d33f437ef6fddbf6364dc95.pdf",
		"text": "https://archive.orkl.eu/7377c4b5a79bf1624d33f437ef6fddbf6364dc95.txt",
		"img": "https://archive.orkl.eu/7377c4b5a79bf1624d33f437ef6fddbf6364dc95.jpg"
	}
}