{
	"id": "74760324-027a-490e-bea6-1d5621c066c1",
	"created_at": "2026-04-06T00:14:02.199135Z",
	"updated_at": "2026-04-10T03:37:19.38774Z",
	"deleted_at": null,
	"sha1_hash": "a56835fde62acec7b09d1159b3d167dac51c5fa1",
	"title": "Samurai Panda | Threat Actor Profile | CrowdStrike",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 58210,
	"plain_text": "Samurai Panda | Threat Actor Profile | CrowdStrike\r\nBy AdamM\r\nArchived: 2026-04-02 11:16:52 UTC\r\nThis week we’re back to our old friends with a Chinese nexus. To recount the last few weeks of our adversary\r\nblog posts, we first introduced Anchor Panda, an adversary we attribute to China and associate with the PLAN.\r\nWe then moved on to another Chinese adversary we dubbed Numbered Panda to highlight the issue of community\r\nnaming for adversaries and the lack of a common lexicon for characterizing these attackers.\r\nNext, in an effort to demonstrate it wasn't relegated to China, we exposed Clever Kitten, an actor we track out of\r\nIran who leverages some very distinct TTPs when viewed next to a more visible adversary. This week we will\r\ndiscuss another Chinese nexus adversary we call Samurai Panda.\r\nSamurai Panda is interesting in that their target selection tends to focus on Asia Pacific victims in Japan, the\r\nRepublic of Korea, and other democratic Asian victims. Beginning in 2009, we’ve observed this actor conduct\r\nmore than 40 unique campaigns that we’ve identified in the malware configurations' campaign codes. These codes\r\nare often leveraged in the malware used by coordinated targeted attackers to differentiate victims that were\r\nsuccessfully compromised from different target sets.\r\nWhen conducting programmatic espionage activity, it can presumably become quite confusing if the attacker\r\ntargets a heavy industry company, an avionics program, and seven other unique targets as to which infected host\r\nyou will collect what information from. While investigating these targeted attacks, the campaign key can be\r\nleveraged in much the same way by the investigator to sort out how various malware samples are related, and\r\nperhaps what sectors the various builds were meant for.\r\nSamurai Panda's Installation Process\r\nThe implant delivered by Samurai Panda uses a typical installation process whereby they:\r\n1. leverage a spearphish with an exploit to get control of the execution flow of the targeted application.\r\nThis file “drops” an XOR-encoded payload that unpacks itself and a configuration file.\r\n2. Next, the implant, which can perform in several different modes, typically will install itself as a service and\r\nthen begin beaconing out to an adversary-controlled host.\r\n3. If that command-and-control host is online, the malicious service will download and instantiate a backdoor\r\nthat provides remote access to the attacker, who will see the infected host’s identification information as\r\nwell as the campaign code.\r\nUsing CrowdRE with IDA Pro, you can import the CrowdStrike Intelligence Team's annotations for this malware\r\nand the associated backdoor to leverage the reverse engineering that we have already conducted.\r\nHow to Detect Samurai Panda\r\nhttp://www.crowdstrike.com/blog/whois-samurai-panda/\r\nPage 1 of 2\n\nHere are some Snort rules that will enable you to detect Samurai Panda activity on your enterprise. These rules\r\ndetect the malware “beaconing” to the command-and-control server, the initial malware check-in, and an attempt\r\nto download a backdoor module.\r\nalert tcp $HOME_NET any -\u003e $EXTERNAL_NET any (msg: \" C2 Heartbeat\"; flow: to_server,established;\r\ncontent: \"POST\"; http_method; content: \"/NfStart.asp?ClientId=\"; http_uri; content: \"\u0026Nick=\"; http_uri; content:\r\n\"\u0026dtime=T:\"; http_uri; content: \"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR\r\n1.1.4322)\"; http_header; classtype: trojan-activity; sid: xxx; rev: 1;)\r\nalert tcp $HOME_NET any -\u003e $EXTERNAL_NET any (msg: \" C2 Communication\"; flow: to_server,established;\r\ncontent: \"POST\"; http_method; content: \"/NfCommand.asp?\"; http_uri; content: \"ClientId=\"; http_uri; content:\r\n\"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)\"; http_header;\r\nclasstype: trojan-activity; sid: xxx; rev: 1;)\r\nalert tcp $HOME_NET any -\u003e $EXTERNAL_NET any (msg: \" Initial Check or Backdoor Download -\r\nMalformed User Agent\"; flow: to_server,established; content: \"User-Agent: Mozilla/5.0 (compatible; MSIE\r\n7.0;Windows NT 5.1)\"; http_header; classtype: trojan-activity; sid: xxx; rev: 1; )\r\nalert tcp $HOME_NET any -\u003e $EXTERNAL_NET any (msg: \" Attempt to download Backdoor Module UA2\";\r\nflow: to_server,established; content: \"POST\"; http_method; content: \"/Nfile.asp\"; http_uri; content: \"User-Agent:\r\nMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\"; http_header; classtype: trojan-activity;\r\nsid: xxx; rev: 1; )\r\nalert tcp $HOME_NET any -\u003e $EXTERNAL_NET any (msg: \" Initial Reachability Check \"; flow: to_server,\r\nestablished; content: \"POST\"; http_method; content: \"TTip.asp\"; http_uri; sid: xxx; rev: 1;)\r\nOther Known China-based Adversaries\r\nAnchor Panda\r\nDeep Panda\r\nGoblin Panda\r\nMustang Panda\r\nCurious about other nation-state adversaries? Visit our threat actor center to learn about the new adversaries\r\nthat the CrowdStrike team discovers. Be sure to follow @CrowdStrike on Twitter as we continue to provide more\r\nintelligence and adversaries over the coming weeks. If you have any questions about these signatures or want to\r\nhear more about Samurai Panda and their tradecraft, please contact: intelligence@crowdstrike.com and inquire\r\nabout our intelligence-as-a-service solutions where we provide additional actionable intelligence feeds such as the\r\nrules included in this post.\r\nSource: http://www.crowdstrike.com/blog/whois-samurai-panda/\r\nhttp://www.crowdstrike.com/blog/whois-samurai-panda/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"references": [
		"http://www.crowdstrike.com/blog/whois-samurai-panda/"
	],
	"report_names": [
		"whois-samurai-panda"
	],
	"threat_actors": [
		{
			"id": "60c270f9-5aa8-41d5-850c-6003135c5815",
			"created_at": "2023-01-06T13:46:38.687298Z",
			"updated_at": "2026-04-10T02:00:03.068415Z",
			"deleted_at": null,
			"main_name": "Clever Kitten",
			"aliases": [
				"Group 41"
			],
			"source_name": "MISPGALAXY:Clever Kitten",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "25bd25be-762c-404c-be9e-b11f074b34dd",
			"created_at": "2022-10-25T16:07:23.470771Z",
			"updated_at": "2026-04-10T02:00:04.621239Z",
			"deleted_at": null,
			"main_name": "Clever Kitten",
			"aliases": [
				"Group 41"
			],
			"source_name": "ETDA:Clever Kitten",
			"tools": [
				"Acunetix Web Vulnerability Scanner",
				"RC SHELL"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "4fda88fa-7c1f-4e84-b3c8-56f73f21aaf5",
			"created_at": "2022-10-25T16:07:24.147011Z",
			"updated_at": "2026-04-10T02:00:04.881289Z",
			"deleted_at": null,
			"main_name": "Samurai Panda",
			"aliases": [],
			"source_name": "ETDA:Samurai Panda",
			"tools": [
				"Agent.dhwf",
				"Destroy RAT",
				"DestroyRAT",
				"FF-RAT",
				"FormerFirstRAT",
				"Getkys",
				"IsSpace",
				"KABOB",
				"Kaba",
				"Korplug",
				"NfLog RAT",
				"PlugX",
				"Poldat",
				"RedDelta",
				"Sogu",
				"Sykipot",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Wkysol",
				"Xamtrav",
				"Zlib",
				"ffrat"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "64ca1755-3883-4173-8e0a-6e5cf92faafd",
			"created_at": "2022-10-25T15:50:23.636456Z",
			"updated_at": "2026-04-10T02:00:05.389234Z",
			"deleted_at": null,
			"main_name": "Deep Panda",
			"aliases": [
				"Deep Panda",
				"Shell Crew",
				"KungFu Kittens",
				"PinkPanther",
				"Black Vine"
			],
			"source_name": "MITRE:Deep Panda",
			"tools": [
				"Mivast",
				"StreamEx",
				"Sakula",
				"Tasklist",
				"Derusbi"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "0639667a-fb3f-43d9-a38c-6c123fd19c7f",
			"created_at": "2022-10-25T16:07:23.335869Z",
			"updated_at": "2026-04-10T02:00:04.547702Z",
			"deleted_at": null,
			"main_name": "APT 19",
			"aliases": [
				"APT 19",
				"Bronze Firestone",
				"C0d0so0",
				"Checkered Typhoon",
				"Codoso",
				"Deep Panda",
				"G0009",
				"G0073",
				"Operation Kingslayer",
				"Red Pegasus",
				"Sunshop Group",
				"TG-3551"
			],
			"source_name": "ETDA:APT 19",
			"tools": [
				"Agentemis",
				"C0d0so0",
				"Cobalt Strike",
				"CobaltStrike",
				"Derusbi",
				"EmPyre",
				"EmpireProject",
				"Fire Chili",
				"PowerShell Empire",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c5f79f58-db78-4cd7-88cf-c029a2199360",
			"created_at": "2022-10-25T16:07:23.325227Z",
			"updated_at": "2026-04-10T02:00:04.542909Z",
			"deleted_at": null,
			"main_name": "APT 12",
			"aliases": [
				"APT 12",
				"BeeBus",
				"Bronze Globe",
				"CTG-8223",
				"Calc Team",
				"Crimson Iron",
				"DNSCalc",
				"DynCALC",
				"G0005",
				"Group 22",
				"Hexagon Typhoon",
				"Numbered Panda"
			],
			"source_name": "ETDA:APT 12",
			"tools": [
				"AUMLIB",
				"ETUMBOT",
				"Exploz",
				"Graftor",
				"HIGHTIDE",
				"IHEATE",
				"IXESHE",
				"RIPTIDE",
				"RapidStealer",
				"Specfix",
				"THREEBYTE",
				"bbsinfo",
				"mswab",
				"yayih"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "2ac8fb39-1ad4-407c-bf51-249751a575ba",
			"created_at": "2023-01-06T13:46:38.337728Z",
			"updated_at": "2026-04-10T02:00:02.933527Z",
			"deleted_at": null,
			"main_name": "SAMURAI PANDA",
			"aliases": [
				"PLA Navy",
				"Wisp Team"
			],
			"source_name": "MISPGALAXY:SAMURAI PANDA",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c6604303-a1c8-4e59-ba12-5da5c0bc6877",
			"created_at": "2023-01-06T13:46:38.312359Z",
			"updated_at": "2026-04-10T02:00:02.923025Z",
			"deleted_at": null,
			"main_name": "APT14",
			"aliases": [
				"ANCHOR PANDA",
				"QAZTeam"
			],
			"source_name": "MISPGALAXY:APT14",
			"tools": [
				"Backdoor.Win32.PoisonIvy",
				"Gen:Trojan.Heur.PT",
				"Torn RAT",
				"Anchor Panda",
				"Gh0st Rat",
				"Gh0stRat, GhostRat",
				"Poison Ivy"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "b69037ec-2605-4de4-bb32-a20d780a8406",
			"created_at": "2023-01-06T13:46:38.790766Z",
			"updated_at": "2026-04-10T02:00:03.101635Z",
			"deleted_at": null,
			"main_name": "MUSTANG PANDA",
			"aliases": [
				"Stately Taurus",
				"LuminousMoth",
				"TANTALUM",
				"Twill Typhoon",
				"TEMP.HEX",
				"Earth Preta",
				"Polaris",
				"BRONZE PRESIDENT",
				"HoneyMyte",
				"Red Lich",
				"TA416"
			],
			"source_name": "MISPGALAXY:MUSTANG PANDA",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d18fe42c-8407-4f96-aee0-a04e6dce219a",
			"created_at": "2023-01-06T13:46:38.275292Z",
			"updated_at": "2026-04-10T02:00:02.907303Z",
			"deleted_at": null,
			"main_name": "APT12",
			"aliases": [
				"Group 22",
				"Calc Team",
				"DNSCalc",
				"IXESHE",
				"Hexagon Typhoon",
				"BeeBus",
				"DynCalc",
				"Crimson Iron",
				"BRONZE GLOBE",
				"NUMBERED PANDA",
				"TG-2754"
			],
			"source_name": "MISPGALAXY:APT12",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "25a38dea-d23b-479b-9548-024e955b8964",
			"created_at": "2022-10-25T16:07:23.305911Z",
			"updated_at": "2026-04-10T02:00:04.533448Z",
			"deleted_at": null,
			"main_name": "Anchor Panda",
			"aliases": [
				"APT 14",
				"Anchor Panda",
				"QAZTeam"
			],
			"source_name": "ETDA:Anchor Panda",
			"tools": [
				"AngryRebel",
				"Chymine",
				"Darkmoon",
				"Farfli",
				"Gen:Trojan.Heur.PT",
				"Gh0st RAT",
				"Ghost RAT",
				"Moudour",
				"Mydoor",
				"PCRat",
				"Poison Ivy",
				"SPIVY",
				"Torn RAT",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "46a151bd-e4c2-46f9-aee9-ee6942b01098",
			"created_at": "2023-01-06T13:46:38.288168Z",
			"updated_at": "2026-04-10T02:00:02.911919Z",
			"deleted_at": null,
			"main_name": "APT19",
			"aliases": [
				"DEEP PANDA",
				"Codoso",
				"KungFu Kittens",
				"Group 13",
				"G0009",
				"G0073",
				"Checkered Typhoon",
				"Black Vine",
				"TEMP.Avengers",
				"PinkPanther",
				"Shell Crew",
				"BRONZE FIRESTONE",
				"Sunshop Group"
			],
			"source_name": "MISPGALAXY:APT19",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "593dd07d-853c-46cd-8117-e24061034bbf",
			"created_at": "2025-08-07T02:03:24.648074Z",
			"updated_at": "2026-04-10T02:00:03.625859Z",
			"deleted_at": null,
			"main_name": "BRONZE OVERBROOK",
			"aliases": [
				"Danti ",
				"DragonOK ",
				"Samurai Panda ",
				"Shallow Taurus ",
				"Temp.DragonOK "
			],
			"source_name": "Secureworks:BRONZE OVERBROOK",
			"tools": [
				"Aveo",
				"DDKONG",
				"Godzilla Webshell",
				"HelloBridge",
				"IsSpace",
				"NFLog Trojan",
				"PLAINTEE",
				"PlugX",
				"Rambo"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "6daadf00-952c-408a-89be-aa490d891743",
			"created_at": "2025-08-07T02:03:24.654882Z",
			"updated_at": "2026-04-10T02:00:03.645565Z",
			"deleted_at": null,
			"main_name": "BRONZE PRESIDENT",
			"aliases": [
				"Earth Preta ",
				"HoneyMyte ",
				"Mustang Panda ",
				"Red Delta ",
				"Red Lich ",
				"Stately Taurus ",
				"TA416 ",
				"Temp.Hex ",
				"Twill Typhoon "
			],
			"source_name": "Secureworks:BRONZE PRESIDENT",
			"tools": [
				"BlueShell",
				"China Chopper",
				"Claimloader",
				"Cobalt Strike",
				"HIUPAN",
				"ORat",
				"PTSOCKET",
				"PUBLOAD",
				"PlugX",
				"RCSession",
				"TONESHELL",
				"TinyNote"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "f2ce5b52-a220-4b94-ab66-4b81f3fed05d",
			"created_at": "2025-08-07T02:03:24.595597Z",
			"updated_at": "2026-04-10T02:00:03.740023Z",
			"deleted_at": null,
			"main_name": "BRONZE FIRESTONE",
			"aliases": [
				"APT19 ",
				"C0d0s0",
				"Checkered Typhoon ",
				"Chlorine ",
				"Deep Panda ",
				"Pupa ",
				"TG-3551 "
			],
			"source_name": "Secureworks:BRONZE FIRESTONE",
			"tools": [
				"9002",
				"Alice's Rabbit Hole",
				"Cobalt Strike",
				"Derusbi",
				"PlugX",
				"PoisonIvy",
				"PowerShell Empire",
				"Trojan Briba",
				"Zuguo"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "6a660ea2-1118-404a-9f8f-f0d6a1e9f184",
			"created_at": "2022-10-25T15:50:23.685924Z",
			"updated_at": "2026-04-10T02:00:05.364493Z",
			"deleted_at": null,
			"main_name": "APT12",
			"aliases": [
				"APT12",
				"IXESHE",
				"DynCalc",
				"Numbered Panda",
				"DNSCALC"
			],
			"source_name": "MITRE:APT12",
			"tools": [
				"Ixeshe",
				"RIPTIDE",
				"HTRAN"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "7d553b83-a7b2-431f-9bc9-08da59f3c4ea",
			"created_at": "2023-01-06T13:46:39.444946Z",
			"updated_at": "2026-04-10T02:00:03.331753Z",
			"deleted_at": null,
			"main_name": "GOBLIN PANDA",
			"aliases": [
				"Conimes",
				"Cycldek"
			],
			"source_name": "MISPGALAXY:GOBLIN PANDA",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "9baa7519-772a-4862-b412-6f0463691b89",
			"created_at": "2022-10-25T15:50:23.354429Z",
			"updated_at": "2026-04-10T02:00:05.310361Z",
			"deleted_at": null,
			"main_name": "Mustang Panda",
			"aliases": [
				"Mustang Panda",
				"TA416",
				"RedDelta",
				"BRONZE PRESIDENT",
				"STATELY TAURUS",
				"FIREANT",
				"CAMARO DRAGON",
				"EARTH PRETA",
				"HIVE0154",
				"TWILL TYPHOON",
				"TANTALUM",
				"LUMINOUS MOTH",
				"UNC6384",
				"TEMP.Hex",
				"Red Lich"
			],
			"source_name": "MITRE:Mustang Panda",
			"tools": [
				"CANONSTAGER",
				"STATICPLUGIN",
				"ShadowPad",
				"TONESHELL",
				"Cobalt Strike",
				"HIUPAN",
				"Impacket",
				"SplatCloak",
				"PAKLOG",
				"Wevtutil",
				"AdFind",
				"CLAIMLOADER",
				"Mimikatz",
				"PUBLOAD",
				"StarProxy",
				"CorKLOG",
				"RCSession",
				"NBTscan",
				"PoisonIvy",
				"SplatDropper",
				"China Chopper",
				"PlugX"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "dc0eb4da-1f8c-4f2a-9530-62b0efbb1c35",
			"created_at": "2025-08-07T02:03:24.608888Z",
			"updated_at": "2026-04-10T02:00:03.749632Z",
			"deleted_at": null,
			"main_name": "BRONZE GLOBE",
			"aliases": [
				"APT12 ",
				"CTG-8223 ",
				"DyncCalc ",
				"Numbered Panda ",
				"PortCalc"
			],
			"source_name": "Secureworks:BRONZE GLOBE",
			"tools": [
				"Badpuck",
				"BeepService",
				"Etumbot",
				"Gh0st RAT",
				"Ixeshe",
				"Mswab",
				"RAdmin",
				"Seatran",
				"SvcInstaller",
				"Ziyang"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "2ee03999-5432-4a65-a850-c543b4fefc3d",
			"created_at": "2022-10-25T16:07:23.882813Z",
			"updated_at": "2026-04-10T02:00:04.776949Z",
			"deleted_at": null,
			"main_name": "Mustang Panda",
			"aliases": [
				"Bronze President",
				"Camaro Dragon",
				"Earth Preta",
				"G0129",
				"Hive0154",
				"HoneyMyte",
				"Mustang Panda",
				"Operation SMUGX",
				"Operation SmugX",
				"PKPLUG",
				"Red Lich",
				"Stately Taurus",
				"TEMP.Hex",
				"Twill Typhoon"
			],
			"source_name": "ETDA:Mustang Panda",
			"tools": [
				"9002 RAT",
				"AdFind",
				"Agent.dhwf",
				"Agentemis",
				"CHINACHOPPER",
				"China Chopper",
				"Chymine",
				"ClaimLoader",
				"Cobalt Strike",
				"CobaltStrike",
				"DCSync",
				"DOPLUGS",
				"Darkmoon",
				"Destroy RAT",
				"DestroyRAT",
				"Farseer",
				"Gen:Trojan.Heur.PT",
				"HOMEUNIX",
				"Hdump",
				"HenBox",
				"HidraQ",
				"Hodur",
				"Homux",
				"HopperTick",
				"Hydraq",
				"Impacket",
				"Kaba",
				"Korplug",
				"LadonGo",
				"MQsTTang",
				"McRAT",
				"MdmBot",
				"Mimikatz",
				"NBTscan",
				"NetSess",
				"Netview",
				"Orat",
				"POISONPLUG.SHADOW",
				"PUBLOAD",
				"PVE Find AD Users",
				"PlugX",
				"Poison Ivy",
				"PowerView",
				"QMAGENT",
				"RCSession",
				"RedDelta",
				"Roarur",
				"SPIVY",
				"ShadowPad Winnti",
				"SinoChopper",
				"Sogu",
				"TIGERPLUG",
				"TONEINS",
				"TONESHELL",
				"TVT",
				"TeamViewer",
				"Thoper",
				"TinyNote",
				"WispRider",
				"WmiExec",
				"XShellGhost",
				"Xamtrav",
				"Zupdax",
				"cobeacon",
				"nbtscan",
				"nmap",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "2c7ecb0e-337c-478f-95d4-7dbe9ba44c39",
			"created_at": "2022-10-25T16:07:23.690871Z",
			"updated_at": "2026-04-10T02:00:04.709966Z",
			"deleted_at": null,
			"main_name": "Goblin Panda",
			"aliases": [
				"1937CN",
				"Conimes",
				"Cycldek",
				"Goblin Panda"
			],
			"source_name": "ETDA:Goblin Panda",
			"tools": [
				"8.t Dropper",
				"8.t RTF exploit builder",
				"8t_dropper",
				"Agent.dhwf",
				"BackDoor-FBZT!52D84425CDF2",
				"BlueCore",
				"BrowsingHistoryView",
				"ChromePass",
				"CoreLoader",
				"Custom HDoor",
				"Destroy RAT",
				"DestroyRAT",
				"DropPhone",
				"FoundCore",
				"HDoor",
				"HTTPTunnel",
				"JsonCookies",
				"Kaba",
				"Korplug",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"NBTscan",
				"NewCore RAT",
				"PlugX",
				"ProcDump",
				"PsExec",
				"QCRat",
				"RainyDay",
				"RedCore",
				"RedDelta",
				"RoyalRoad",
				"Sisfader",
				"Sisfader RAT",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Trojan.Win32.Staser.ytq",
				"USBCulprit",
				"Win32/Zegost.BW",
				"Xamtrav",
				"ZeGhost",
				"nbtscan"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434442,
	"ts_updated_at": 1775792239,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/a56835fde62acec7b09d1159b3d167dac51c5fa1.pdf",
		"text": "https://archive.orkl.eu/a56835fde62acec7b09d1159b3d167dac51c5fa1.txt",
		"img": "https://archive.orkl.eu/a56835fde62acec7b09d1159b3d167dac51c5fa1.jpg"
	}
}