{ "id": "1cf5a88b-b516-4712-a830-d382acc68e0d", "created_at": "2026-04-06T00:17:41.960974Z", "updated_at": "2026-04-10T03:38:18.995871Z", "deleted_at": null, "sha1_hash": "c7c6727548383ee56ae6a039da6a7abc319cbf2d", "title": "MAR-10265965-3.v1 – North Korean Trojan: CROWDEDFLOUNDER | CISA", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 58829, "plain_text": "MAR-10265965-3.v1 – North Korean Trojan: CROWDEDFLOUNDER |\r\nCISA\r\nPublished: 2020-02-14 · Archived: 2026-04-05 16:50:12 UTC\r\nNotification\r\nThis report is provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not\r\nprovide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial\r\nproduct or service referenced in this bulletin or otherwise.\r\nThis document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries\r\nminimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to\r\nstandard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the\r\nTraffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.\r\nSummary\r\nDescription\r\nThis Malware Analysis Report (MAR) is the result of analytic efforts between Department of Homeland Security (DHS), the\r\nFederal Bureau of Investigation (FBI), and the Department of Defense (DoD). Working with U.S. Government partners,\r\nDHS, FBI, and DoD identified Trojan malware variants used by the North Korean government. This malware variant has\r\nbeen identified as CROWDEDFLOUNDER. The U.S. Government refers to malicious cyber activity by the North Korean\r\ngovernment as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https[:]//www[.]us-cert.gov/hiddencobra.\r\nDHS, FBI, and DoD are distributing this MAR to enable network defense and reduce exposure to North Korean government\r\nmalicious cyber activity.\r\nThis MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended\r\nmitigation techniques. Users or administrators should flag activity associated with the malware and report the activity to the\r\nCybersecurity and Infrastructure Security Agency (CISA) or the FBI Cyber Watch (CyWatch), and give the activity the\r\nhighest priority for enhanced mitigation.\r\nThis report analyzes a Themida packed 32-bit Windows executable, which is designed to unpack and execute a Remote\r\nAccess Trojan (RAT) binary in memory. This application is designed to accept arguments during execution or can be\r\ninstalled as a service with command line arguments. It is designed to listen as a proxy for incoming connections containing\r\ncommands or can connect to a remote server to receive commands.\r\nFor a downloadable copy of IOCs, see MAR-10265965-3.v1.stix.\r\nSubmitted Files (1)\r\na2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442 (F2B9D1CB2C4B1CD11A8682755BCC52...)\r\nFindings\r\na2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442\r\nTags\r\ntrojan\r\nDetails\r\nName F2B9D1CB2C4B1CD11A8682755BCC52FA\r\nSize 1658880 bytes\r\nType PE32 executable (GUI) Intel 80386, for MS Windows\r\nMD5 f2b9d1cb2c4b1cd11a8682755bcc52fa\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045c\r\nPage 1 of 4\n\nSHA1 579884fad55207b54e4c2fe2644290211baec8b5\r\nSHA256 a2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442\r\nSHA512 b047a4275f0fa7c0025945800acbffb5be1d327160a135c6ba8ff54352be603cbb47fff71f180ab1a915229778b7a883ed19e1d6a954ab824\r\nssdeep 24576:darngxIJfX2+8mGrvs5pdUIPv3eAUW/Y8w9ejjERAjYrNFtI937sTR7R5NwrzD:da7gx2B81gdVXvfAnHRFtIl7k7RPwr\r\nEntropy 7.958686\r\nAntivirus\r\nAhnlab Trojan/Win32.Xpacked\r\nAntiy Trojan/Win32.BlueNoroff\r\nAvira TR/Crypt.TPM.Gen\r\nBitDefender Trojan.GenericKD.41987817\r\nClamAV Win.Trojan.Agent-7376505-0\r\nCyren W32/Trojan.SXNN-1599\r\nESET Win32/NukeSped.CL trojan\r\nEmsisoft Trojan.GenericKD.41987817 (B)\r\nIkarus Trojan.Win32.NukeSped\r\nK7 Trojan ( 0040f4ef1 )\r\nMcAfee Trojan-NukeSped.a\r\nMicrosoft Security Essentials Trojan:Win32/Thcsim\r\nNANOAV Trojan.Win32.BlueNoroff.ggbrdv\r\nNetGate Trojan.Win32.Malware\r\nSophos Troj/Agent-BCXR\r\nSymantec Trojan Horse\r\nTrendMicro TROJ_THCSIM.A\r\nTrendMicro House Call TROJ_THCSIM.A\r\nVirusBlokAda BScope.TrojanPSW.Predator\r\nZillya! Trojan.NukeSped.Win32.184\r\nYARA Rules\r\nNo matches found.\r\nssdeep Matches\r\nNo matches found.\r\nPE Metadata\r\nCompile Date 2017-02-20 05:45:37-05:00\r\nImport Hash baa93d47220682c04d92f7797d9224ce\r\nPE Sections\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045c\r\nPage 2 of 4\n\nMD5 Name Raw Size Entropy\r\na7295799f336e3a6e8b61fe4f93e2251 header 4096 0.812374\r\n2db23f163210140d797f67ed1ec1f08e   156160 7.983767\r\nd41d8cd98f00b204e9800998ecf8427e .rsrc 0 0.000000\r\nefcb51d4d8a55d441d194e80899bb2b0 .idata 512 1.308723\r\nd5443c2d2f51ba6c31a5fc9c35af7a2f   512 0.240445\r\n8eea01ecbee2f6234d68b27d4e05585a htusmqub 1497088 7.954958\r\n6b71d93792bb677f0a09dbe70e6df1a2 ijybpcqb 512 3.636986\r\nDescription\r\nThis application is a Themida packed 32-bit Windows executable, which is designed to unpack and execute a RAT binary in\r\nmemory. This application is designed to accept arguments during execution or can be installed as a service with command\r\nline arguments. When executed, the application is designed to open the Windows Firewall on the victim’s machine to allow\r\nfor incoming and outgoing connections from the victim system. The firewall is modified using a \"netsh firewall add\r\nportopening\" command (Figure 2). Static analysis indicates this malware may be utilized to listen as a proxy for incoming\r\nconnections containing commands or can connect to a remote server to receive commands. The following command line\r\narguments are utilized to control the RAT functionality:\r\n--Begin RAT command line arguments--\r\n-p: You can use the -p command line argument to force the malware to listen on a specific port. Example: malware.exe -p\r\n8888\r\n-h: You can use the -h CLI to force the malware to connect to a remote host and port. Example: malware.exe -h\r\n\u003curl_string\u003e:8888\r\nNote: \u003curl_string\u003e can be either a fully qualified domain name or an Internet Protocol (IP) address.\r\n--End RAT command line arguments--\r\nThe RAT uses a rotating exclusive or (XOR) cryptographic algorithm to secure its data transfers and command-and-control\r\n(C2) sessions (Figure 1). The malware is designed to accept instructions from the remote server to perform the following\r\nfunctions:\r\n--Begin functions performed by the malware--\r\nDownload and upload files\r\nExecute secondary payloads\r\nExecute shell commands\r\nTerminate running processes\r\nDelete files\r\nSearch files\r\nSet file attributes\r\nCollect device information from installed storage devices (disk free space and their type)\r\nList running processes information\r\nCollect and send information about the victim's system\r\nSecurely download malicious DLLs and inject them into remote processes\r\n--End functions performed by the malware--\r\nThe -h argument is utilized to force the RAT to connect to a C2 server and the CURL library (Version 7.49.1) will be used\r\nfor data transfers. Note: A rotating XOR cipher will be used to secure all C2 traffic sent and received from the external C2\r\nserver. Although the malware appears to expect a numeric IP address with the -h argument, it will also accept a string\r\nUniform Resource Locator (URL) value. If a URL string is provided (i.e. domain.com) the malware will then query this\r\naddress using the Win32 API getaddrinfo(). If this call succeeds, an IP address will be returned and the malware will attempt\r\nto connect to that IP address. If the call to getaddrinfo() fails the malware will hash this domain using the MD5 hashing\r\nalgorithm, resulting in a 16 byte hash value. The malware will then take bytes 4 through 8 of this hash value and XOR them\r\nwith a four byte value. The resultant four byte value will then be treated as a numeric IP address. The malware will then\r\nattempt to connect to this newly generated IP address. Note: all of the command line executables referenced within this\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045c\r\nPage 3 of 4\n\nproduct generate and connect to an IP address generated from the provided URL string if the call to getaddrinfo() against the\r\nprovided URL fails.\r\nScreenshots\r\nFigure 1 - XOR based cipher utilized by RAT to secure traffic between itself and the operator/C2 server.\r\nFigure 2 - Malware loading the command to open the firewall.\r\nFigure 3 - This structure is utilized to parse the proxy port or remote C2 server from the command line arguments.\r\nRecommendations\r\nCISA recommends that users and administrators consider using the following best practices to strengthen the security\r\nposture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators\r\nprior to implementation to avoid unwanted impacts.\r\nMaintain up-to-date antivirus signatures and engines.\r\nKeep operating system patches up-to-date.\r\nDisable File and Printer sharing services. If these services are required, use strong passwords or Active Directory\r\nauthentication.\r\nRestrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local\r\nadministrators group unless required.\r\nEnforce a strong password policy and implement regular password changes.\r\nExercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be\r\nknown.\r\nEnable a personal firewall on agency workstations, configured to deny unsolicited connection requests.\r\nDisable unnecessary services on agency workstations and servers.\r\nScan for and remove suspicious e-mail attachments; ensure the scanned attachment is its \"true file type\" (i.e., the\r\nextension matches the file header).\r\nMonitor users' web browsing habits; restrict access to sites with unfavorable content.\r\nExercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).\r\nScan all software downloaded from the Internet prior to executing.\r\nMaintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).\r\nAdditional information on malware incident prevention and handling can be found in National Institute of Standards and\r\nTechnology (NIST) Special Publication 800-83, \"Guide to Malware Incident Prevention \u0026 Handling for Desktops and\r\nLaptops\".\r\nContact Information\r\nDocument FAQ\r\nWhat is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in\r\na timely manner. In most instances this report will provide initial indicators for computer and network defense. To request\r\nadditional analysis, please contact CISA and provide information regarding the level of desired analysis.\r\nWhat is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware\r\nanalysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide\r\ninformation regarding the level of desired analysis.\r\nCan I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to\r\nthis document should be directed to the CISA at 1-844-Say-CISA or contact@mail.cisa.dhs.gov .\r\nCan I submit malware to CISA? Malware samples can be submitted via three methods:\r\nWeb: https://malware.us-cert.gov\r\nE-Mail: submit@malware.us-cert.gov\r\nFTP: ftp.malware.us-cert.gov (anonymous)\r\nCISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software\r\nvulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.us-cert.gov.\r\nSource: https://www.us-cert.gov/ncas/analysis-reports/ar20-045c\r\nhttps://www.us-cert.gov/ncas/analysis-reports/ar20-045c\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia", "ETDA" ], "references": [ "https://www.us-cert.gov/ncas/analysis-reports/ar20-045c" ], "report_names": [ "ar20-045c" ], "threat_actors": [ { "id": "34eea331-d052-4096-ae03-a22f1d090bd4", "created_at": "2025-08-07T02:03:25.073494Z", "updated_at": "2026-04-10T02:00:03.709243Z", "deleted_at": null, "main_name": "NICKEL ACADEMY", "aliases": [ "ATK3 ", "Black Artemis ", "COVELLITE ", "CTG-2460 ", "Citrine Sleet ", "Diamond Sleet ", "Guardians of Peace", "HIDDEN COBRA ", "High Anonymous", "Labyrinth Chollima ", "Lazarus Group ", "NNPT Group", "New Romanic Cyber Army Team", "Temp.Hermit ", "UNC577 ", "Who Am I?", "Whois Team", "ZINC " ], "source_name": "Secureworks:NICKEL ACADEMY", "tools": [ "Destover", "KorHigh", "Volgmer" ], "source_id": "Secureworks", "reports": null }, { "id": "732597b1-40a8-474c-88cc-eb8a421c29f1", "created_at": "2025-08-07T02:03:25.087732Z", "updated_at": "2026-04-10T02:00:03.776007Z", "deleted_at": null, "main_name": "NICKEL GLADSTONE", "aliases": [ "APT38 ", "ATK 117 ", "Alluring Pisces ", "Black Alicanto ", "Bluenoroff ", "CTG-6459 ", "Citrine Sleet ", "HIDDEN COBRA ", "Lazarus Group", "Sapphire Sleet ", "Selective Pisces ", "Stardust Chollima ", "T-APT-15 ", "TA444 ", "TAG-71 " ], "source_name": "Secureworks:NICKEL GLADSTONE", "tools": [ "AlphaNC", "Bankshot", "CCGC_Proxy", "Ratankba", "RustBucket", "SUGARLOADER", "SwiftLoader", "Wcry" ], "source_id": "Secureworks", "reports": null }, { "id": "a2b92056-9378-4749-926b-7e10c4500dac", "created_at": "2023-01-06T13:46:38.430595Z", "updated_at": "2026-04-10T02:00:02.971571Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "Operation DarkSeoul", "Bureau 121", "Group 77", "APT38", "NICKEL GLADSTONE", "G0082", "COPERNICIUM", "Moonstone Sleet", "Operation GhostSecret", "APT 38", "Appleworm", "Unit 121", "ATK3", "G0032", "ATK117", "NewRomanic Cyber Army Team", "Nickel Academy", "Sapphire Sleet", "Lazarus group", "Hastati Group", "Subgroup: Bluenoroff", "Operation Troy", "Black Artemis", "Dark Seoul", "Andariel", "Labyrinth Chollima", "Operation AppleJeus", "COVELLITE", "Citrine Sleet", "DEV-0139", "DEV-1222", "Hidden Cobra", "Bluenoroff", "Stardust Chollima", "Whois Hacking Team", "Diamond Sleet", "TA404", "BeagleBoyz", "APT-C-26" ], "source_name": "MISPGALAXY:Lazarus Group", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "32a223a8-3c79-4146-87c5-8557d38662ae", "created_at": "2022-10-25T15:50:23.703698Z", "updated_at": "2026-04-10T02:00:05.261989Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "Lazarus Group", "Labyrinth Chollima", "HIDDEN COBRA", "Guardians of Peace", "NICKEL ACADEMY", "Diamond Sleet" ], "source_name": "MITRE:Lazarus Group", "tools": [ "RawDisk", "Proxysvc", "BADCALL", "FALLCHILL", "WannaCry", "MagicRAT", "HOPLIGHT", "TYPEFRAME", "Dtrack", "HotCroissant", "HARDRAIN", "Dacls", "KEYMARBLE", "TAINTEDSCRIBE", "AuditCred", "netsh", "ECCENTRICBANDWAGON", "AppleJeus", "BLINDINGCAN", "ThreatNeedle", "Volgmer", "Cryptoistic", "RATANKBA", "Bankshot" ], "source_id": "MITRE", "reports": null }, { "id": "f426f0a0-faef-4c0e-bcf8-88974116c9d0", "created_at": "2022-10-25T15:50:23.240383Z", "updated_at": "2026-04-10T02:00:05.299433Z", "deleted_at": null, "main_name": "APT38", "aliases": [ "APT38", "NICKEL GLADSTONE", "BeagleBoyz", "Bluenoroff", "Stardust Chollima", "Sapphire Sleet", "COPERNICIUM" ], "source_name": "MITRE:APT38", "tools": [ "ECCENTRICBANDWAGON", "HOPLIGHT", "Mimikatz", "KillDisk", "DarkComet" ], "source_id": "MITRE", "reports": null }, { "id": "1bdb91cf-f1a6-4bed-8cfa-c7ea1b635ebd", "created_at": "2022-10-25T16:07:23.766784Z", "updated_at": "2026-04-10T02:00:04.7432Z", "deleted_at": null, "main_name": "Bluenoroff", "aliases": [ "APT 38", "ATK 117", "Alluring Pisces", "Black Alicanto", "Bluenoroff", "CTG-6459", "Copernicium", "G0082", "Nickel Gladstone", "Sapphire Sleet", "Selective Pisces", "Stardust Chollima", "T-APT-15", "TA444", "TAG-71", "TEMP.Hermit" ], "source_name": "ETDA:Bluenoroff", "tools": [], "source_id": "ETDA", "reports": null }, { "id": "f32df445-9fb4-4234-99e0-3561f6498e4e", "created_at": "2022-10-25T16:07:23.756373Z", "updated_at": "2026-04-10T02:00:04.739611Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "APT-C-26", "ATK 3", "Appleworm", "Citrine Sleet", "DEV-0139", "Diamond Sleet", "G0032", "Gleaming Pisces", "Gods Apostles", "Gods Disciples", "Group 77", "Guardians of Peace", "Hastati Group", "Hidden Cobra", "ITG03", "Jade Sleet", "Labyrinth Chollima", "Lazarus Group", "NewRomanic Cyber Army Team", "Operation 99", "Operation AppleJeus", "Operation AppleJeus sequel", "Operation Blockbuster: Breach of Sony Pictures Entertainment", "Operation CryptoCore", "Operation Dream Job", "Operation Dream Magic", "Operation Flame", "Operation GhostSecret", "Operation In(ter)caption", "Operation LolZarus", "Operation Marstech Mayhem", "Operation No Pineapple!", "Operation North Star", "Operation Phantom Circuit", "Operation Sharpshooter", "Operation SyncHole", "Operation Ten Days of Rain / DarkSeoul", "Operation Troy", "SectorA01", "Slow Pisces", "TA404", "TraderTraitor", "UNC2970", "UNC4034", "UNC4736", "UNC4899", "UNC577", "Whois Hacking Team" ], "source_name": "ETDA:Lazarus Group", "tools": [ "3CX Backdoor", "3Rat Client", "3proxy", "AIRDRY", "ARTFULPIE", "ATMDtrack", "AlphaNC", "Alreay", "Andaratm", "AngryRebel", "AppleJeus", "Aryan", "AuditCred", "BADCALL", "BISTROMATH", "BLINDINGCAN", "BTC Changer", "BUFFETLINE", "BanSwift", "Bankshot", "Bitrep", "Bitsran", "BlindToad", "Bookcode", "BootWreck", "BottomLoader", "Brambul", "BravoNC", "Breut", "COLDCAT", "COPPERHEDGE", "CROWDEDFLOUNDER", "Castov", "CheeseTray", "CleanToad", "ClientTraficForwarder", "CollectionRAT", "Concealment Troy", "Contopee", "CookieTime", "Cyruslish", "DAVESHELL", "DBLL Dropper", "DLRAT", "DRATzarus", "DRATzarus RAT", "Dacls", "Dacls RAT", "DarkComet", "DarkKomet", "DeltaCharlie", "DeltaNC", "Dembr", "Destover", "DoublePulsar", "Dozer", "Dtrack", "Duuzer", "DyePack", "ECCENTRICBANDWAGON", "ELECTRICFISH", "Escad", "EternalBlue", "FALLCHILL", "FYNLOS", "FallChill RAT", "Farfli", "Fimlis", "FoggyBrass", "FudModule", "Fynloski", "Gh0st RAT", "Ghost RAT", "Gopuram", "HARDRAIN", "HIDDEN COBRA RAT/Worm", "HLOADER", "HOOKSHOT", "HOPLIGHT", "HOTCROISSANT", "HOTWAX", "HTTP Troy", "Hawup", "Hawup RAT", "Hermes", "HotCroissant", "HotelAlfa", "Hotwax", "HtDnDownLoader", "Http Dr0pper", "ICONICSTEALER", "Joanap", "Jokra", "KANDYKORN", "KEYMARBLE", "Kaos", "KillDisk", "KillMBR", "Koredos", "Krademok", "LIGHTSHIFT", "LIGHTSHOW", "LOLBAS", "LOLBins", "Lazarus", "LightlessCan", "Living off the Land", "MATA", "MBRkiller", "MagicRAT", "Manuscrypt", "Mimail", "Mimikatz", "Moudour", "Mydoom", "Mydoor", "Mytob", "NACHOCHEESE", "NachoCheese", "NestEgg", "NickelLoader", "NineRAT", "Novarg", "NukeSped", "OpBlockBuster", "PCRat", "PEBBLEDASH", "PLANKWALK", "POOLRAT", "PSLogger", "PhanDoor", "Plink", "PondRAT", "PowerBrace", "PowerRatankba", "PowerShell RAT", "PowerSpritz", "PowerTask", "Preft", "ProcDump", "Proxysvc", "PuTTY Link", "QUICKRIDE", "QUICKRIDE.POWER", "Quickcafe", "QuiteRAT", "R-C1", "ROptimizer", "Ratabanka", "RatabankaPOS", "Ratankba", "RatankbaPOS", "RawDisk", "RedShawl", "Rifdoor", "Rising Sun", "Romeo-CoreOne", "RomeoAlfa", "RomeoBravo", "RomeoCharlie", "RomeoCore", "RomeoDelta", "RomeoEcho", "RomeoFoxtrot", "RomeoGolf", "RomeoHotel", "RomeoMike", "RomeoNovember", "RomeoWhiskey", "Romeos", "RustBucket", "SHADYCAT", "SHARPKNOT", "SIGFLIP", "SIMPLESEA", "SLICKSHOES", "SORRYBRUTE", "SUDDENICON", "SUGARLOADER", "SheepRAT", "SierraAlfa", "SierraBravo", "SierraCharlie", "SierraJuliett-MikeOne", "SierraJuliett-MikeTwo", "SimpleTea", "SimplexTea", "SmallTiger", "Stunnel", "TAINTEDSCRIBE", "TAXHAUL", "TFlower", "TOUCHKEY", "TOUCHMOVE", "TOUCHSHIFT", "TOUCHSHOT", "TWOPENCE", "TYPEFRAME", "Tdrop", "Tdrop2", "ThreatNeedle", "Tiger RAT", "TigerRAT", "Trojan Manuscript", "Troy", "TroyRAT", "VEILEDSIGNAL", "VHD", "VHD Ransomware", "VIVACIOUSGIFT", "VSingle", "ValeforBeta", "Volgmer", "Vyveva", "W1_RAT", "Wana Decrypt0r", "WanaCry", "WanaCrypt", "WanaCrypt0r", "WannaCry", "WannaCrypt", "WannaCryptor", "WbBot", "Wcry", "Win32/KillDisk.NBB", "Win32/KillDisk.NBC", "Win32/KillDisk.NBD", "Win32/KillDisk.NBH", "Win32/KillDisk.NBI", "WinorDLL64", "Winsec", "WolfRAT", "Wormhole", "YamaBot", "Yort", "ZetaNile", "concealment_troy", "http_troy", "httpdr0pper", "httpdropper", "klovbot", "sRDI" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434661, "ts_updated_at": 1775792298, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/c7c6727548383ee56ae6a039da6a7abc319cbf2d.pdf", "text": "https://archive.orkl.eu/c7c6727548383ee56ae6a039da6a7abc319cbf2d.txt", "img": "https://archive.orkl.eu/c7c6727548383ee56ae6a039da6a7abc319cbf2d.jpg" } }