[
 {
  "type": "identity",
  "spec_version": "2.1",
  "id": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0",
  "created": "2026-10-27T00:00:00.000Z",
  "modified": "2026-10-27T00:00:00.000Z",
  "name": "threat-intel-feed",
  "identity_class": "system"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d3cf554a-ff6c-495d-b6db-9ee90fce220b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Remcos ip",
  "pattern": "[ipv4-addr:value = '172.111.150.134']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 83,
  "labels": [
   "Remcos",
   "band:high"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: Spamhaus-DROP,ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e0238d9b-38be-4ceb-85cf-10dc86f28452",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Potassium ip",
  "pattern": "[ipv4-addr:value = '31.56.19.71']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 77,
  "labels": [
   "Potassium",
   "band:high"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: Spamhaus-DROP,ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0e4d3d0d-de71-4de9-b799-925ada243c40",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '037306182584729d733c83c43cb5718835f38c08b1d1fb00067f7a9da07d13f3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4f624ab4-dc0f-4846-b95f-d856a221c3a7",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '0399ca7415747462838370bfa68f475a4bcec07d964e2879cb64570040950fbc']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3c8c001c-d381-4a73-87d6-d0d07aeba4b2",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '04e30db39d13194ddd1d20dcc31779bf3e174d7957931be3aa7cb92f852fa11e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7035982c-712c-44fd-8052-6f50d55f0d20",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '064b6737d8c9abb3546c6c4c929b95aa29f22f5b3f37772950c5b288b5452735']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c7a7d6d0-1081-4677-a95c-b13b53d8f2a9",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '0781523ea1247151d8d5eef4ac1ac5a21b709384fbbc96eb45aaba4df30f2398']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2772eaf9-bc18-4c52-a33f-1cda29184eac",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '0b0ac5a4f89c964e24830af701a2a760db9282a747b051defb8871f2faf96511']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--94714113-faff-46d0-832a-d4756a4c2fd2",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '104cdee7b06c4989aaddedffffe5795b1877d0b5d2b1165cb7a50e96dec293ce']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b15bb07b-9d1e-45f9-832c-3e08f37f285c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '1110ecc48012b50c32ff189ddc8acbe4b9cd118d5ee2991f79cb43ef2968778b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f40a2b5b-ed19-4d42-8e41-1be130ab5483",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AdaptixC2 ip",
  "pattern": "[ipv4-addr:value = '167.99.165.191']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AdaptixC2",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e29112f9-d1d9-4634-8855-a3e9b8eed5ca",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Remcos ip",
  "pattern": "[ipv4-addr:value = '192.169.69.25']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Remcos",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7897682e-303c-40c7-a978-a5464af3e8d2",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '2a21ad53a61241180857ac9d179b577cf4e677f7c0c45873160bd5a1e7b5445c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9b93dccd-4a45-43e8-9865-6a142af78abc",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '2b2db5ba050175472c1ba8c4853b151de3a7ff55f3eeca901802ec75aa73b770']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ee6a05d1-330c-489f-b3f3-73f9b5c24bdd",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '40532a868f16862ebe65bf5359e14be68b1bf2142a573f7cc14ce29babde43d7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--878cb179-6d4d-49b1-aed1-1ccdf036be15",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '46c09f852a7f05361b8758d10aba4426d4eacab74ed6e0ea5fdef20812934133']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--453e1961-a645-4723-9f49-365716cd6755",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "StrelaStealer domain",
  "pattern": "[domain-name:value = 'airport-homes.com']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "StrelaStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f6d908fe-9910-4e40-b69d-8b21c7073c20",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar domain",
  "pattern": "[domain-name:value = 'b.ayu99.pro']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a33e5402-6d46-40d3-91fa-b78d35b69c93",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "StrelaStealer domain",
  "pattern": "[domain-name:value = 'bluedoggdesign.com']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "StrelaStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d73719b9-4068-47b6-88d1-8e09e17409b2",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "StrelaStealer domain",
  "pattern": "[domain-name:value = 'burnoutblog.lieselotmaes.be']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "StrelaStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4e6e4def-c1ab-40b7-976c-860deb317741",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "StrelaStealer domain",
  "pattern": "[domain-name:value = 'catsport.it']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "StrelaStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--63fa1e4b-f0c0-4585-ac83-03fdb70e4371",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "StrelaStealer domain",
  "pattern": "[domain-name:value = 'centrealestetic.com']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "StrelaStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--af4c9ce6-f0b5-45b9-a62b-6346e092c330",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "StrelaStealer domain",
  "pattern": "[domain-name:value = 'clinicadivinoninojesus.org.pe']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "StrelaStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--152200a2-f2cc-4b22-bb6b-c784c371ec41",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "StrelaStealer domain",
  "pattern": "[domain-name:value = 'clinicavetcenter.com.br']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "StrelaStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9bd62f50-4686-48bc-88a3-010482120a81",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "IClickFix domain",
  "pattern": "[domain-name:value = 'codes.caffe-img.com']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "IClickFix",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--313cac99-1299-4f2b-bc77-2d1d3aebd782",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "StrelaStealer domain",
  "pattern": "[domain-name:value = 'constructoraags.com.do']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "StrelaStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2d6f6533-0fca-4085-a0c1-58d1e986f0ae",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "StrelaStealer domain",
  "pattern": "[domain-name:value = 'dbperformance.com']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "StrelaStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bf976806-fcf2-4709-a1b8-f54b57de171a",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "StrelaStealer domain",
  "pattern": "[domain-name:value = 'dec-llc.net']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "StrelaStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bfd59fe3-6088-477f-8ecf-e621892bd6fa",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/b1/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--55420bc4-cae1-4590-89fc-da5bc2c4bc68",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/dmy/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--473e756f-ae31-45e3-b300-09ac074bb22d",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/j/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ee341424-8d53-4997-a933-bd56ee1aa3f2",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/k/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e8b75435-7f0f-4221-b38c-76a39d54f7bc",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/k4/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f87e129e-7446-499f-b48f-aa856228d7cb",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/ov/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--671b228e-09fa-4a18-a675-0caa8fb322cc",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/rk/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2349f2da-8b77-4e0b-977d-f380d680e26c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/rr/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b7043227-6a55-4f8d-8184-6a7b301ffce3",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/s2i/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e0339bb6-08a2-4663-a843-6b787a417fc9",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/sv/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3263601b-7495-4c2f-84b6-9eda2d1e0390",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/t/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--819e074e-2e87-49e2-8ce2-4153fd537d15",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar url",
  "pattern": "[url:value = 'https://a.agia4d.org/u/']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cf13329f-ef67-4525-ae23-94cbe6e530f0",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Jackskid ip",
  "pattern": "[ipv4-addr:value = '104.218.50.244']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "Jackskid",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2c5b638f-38a4-4a78-ab64-95bf003b9834",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Cobalt Strike ip",
  "pattern": "[ipv4-addr:value = '13.60.4.205']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "Cobalt Strike",
   "band:medium"
  ],
  "description": "Commercial post-exploitation C2; precursor to ransomware deployment | ATT&CK T1071.001, T1105, T1059 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e3620e41-7ffe-4d6b-bd4a-7b1401980f5c",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Jackskid ip",
  "pattern": "[ipv4-addr:value = '204.12.218.236']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "Jackskid",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e0f8800f-14af-44c2-bcfb-8357baf4e513",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Cobalt Strike ip",
  "pattern": "[ipv4-addr:value = '39.96.78.162']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "Cobalt Strike",
   "band:medium"
  ],
  "description": "Commercial post-exploitation C2; precursor to ransomware deployment | ATT&CK T1071.001, T1105, T1059 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--67b3ac77-ac0e-42cf-8563-9385fd3ebda2",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Jackskid ip",
  "pattern": "[ipv4-addr:value = '45.59.126.125']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "Jackskid",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1e036d93-a050-4351-b1cf-e1905986221d",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "VShell ip",
  "pattern": "[ipv4-addr:value = '85.137.244.138']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "VShell",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b57c2050-816e-4e66-9f8f-e3a82f8c9e2f",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware ip",
  "pattern": "[ipv4-addr:value = '94.154.43.195']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 71,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: Spamhaus-DROP,ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6536ffab-5108-4c1d-8910-595c5fb27932",
  "created": "2026-10-24T16:31:31.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware ip",
  "pattern": "[ipv4-addr:value = '176.65.139.201']",
  "pattern_type": "stix",
  "valid_from": "2026-10-24T16:31:31.000Z",
  "confidence": 71,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: Spamhaus-DROP,ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cbad79a8-0dd0-43a9-8763-4b95b39f5915",
  "created": "2026-10-22T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Arista VCO exploitation CVE-2026-114625 ip",
  "pattern": "[ipv4-addr:value = '74.82.197.86']",
  "pattern_type": "stix",
  "valid_from": "2026-10-22T00:00:00.000Z",
  "confidence": 90,
  "labels": [
   "Arista VCO exploitation CVE-2026-114625",
   "band:critical"
  ],
  "description": "Listed by Arista Security Advisory 0199 (2026-10-22) as observed conducting attacks on VeloCloud Orchestrator; CVE in CISA KEV 2026-10-23 | ATT&CK T1190 | sources: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--76d627ca-aea5-40bc-a8a6-c2fe835f20c5",
  "created": "2026-10-22T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Arista VCO exploitation CVE-2026-114625 ip",
  "pattern": "[ipv4-addr:value = '38.54.50.151']",
  "pattern_type": "stix",
  "valid_from": "2026-10-22T00:00:00.000Z",
  "confidence": 90,
  "labels": [
   "Arista VCO exploitation CVE-2026-114625",
   "band:critical"
  ],
  "description": "Listed by Arista Security Advisory 0199 (2026-10-22) as observed conducting attacks on VeloCloud Orchestrator; CVE in CISA KEV 2026-10-23 | ATT&CK T1190 | sources: https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f47de66c-f2e4-4411-a4b4-913385870057",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '4725b6bdffee4b81e80bcc9ad5d9bc6e428b558f183ce1848c47f9f9d5129880']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1fb46c8b-6694-49be-90dd-9872f65cf08c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '4f937f9bcfbb1ac38a7c0f791a760425bb555ba8002752b879ddda303c1a425e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e907a6de-5a7a-4333-84dc-7c1af3e5d833",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '4fd0502c48d621cb9fec491391d408e9c19f5643b57b3841c9fa1d488c779d97']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d0395cc3-c7ef-4107-ad2d-1bd55f67de6a",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5255d6b2dce38f3071b208f05584ac400eea2556122a30498fb765cfd15132c5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--09eb68e6-e6dd-4fce-add5-7ccdbe1999da",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5519a1ddb22e037096314252e3309160a5641c2d53f4e2b46c7babaf375482d8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b9b12215-39f4-4e3c-b5e7-891a509d4794",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '653f648ab161ebe5d298d0820d7856bfe227b2a6538f13e9513c098e8b612702']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0163654a-0717-4802-bcb5-cdddce229eb4",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '72838b313d0f54d4f7e8f6d21090220068167a06a81b142d59344e24fc610a32']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f2096a79-d835-4edb-8fa5-b236983ed723",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '72b5c11c3c5f59ee3dda2e4eb1088c898b258023cded09ac4d72c70a15f62ebb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2e4dbb2c-3ada-41d0-bee6-906b56d7a445",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '8024b3be53d2426282bda1c27467fe89f7d20dc220011c88f775fba79daa94d9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5cacbf08-f7c2-4acf-aaa1-2041b5643899",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '8d8dd9808f875b74c2ba8aa735c00e661b2d366f658d4d78a79bbb041b504eb2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3091e415-e508-499a-b479-26b356a66b94",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '986b105de29eeae1fd3269f486d48dda23c48625a61387d0339f5273bf1814a7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4de59e3f-ada3-4ff9-8374-7f8b93b1863a",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a2c27c6df118f787d1af29be50a7d516a459462f2b9cb8bbb1529b9dd2833734']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ce79164d-3910-4251-8be8-5cfb3c63a073",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a2c51dc76bacae802fc27100a6602a1321c37d22ab042f0ac8f1cb95f63d61ca']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--adc97f6e-be25-4088-809a-144c2c313124",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ab7c5462d46c37afe61e289392a5b1dcb6a3fda36aa7d961f42ad53af8cb86e1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--13091c3a-7e35-452e-a17f-0929d8e6c185",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b73dd4473639d26b12eba7c2083620053fc807e41d99f86a48b63c0409b8cbfc']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c1a47904-5423-4338-b6c1-8d67d35c56fb",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c2253ab90914916962727bfcee3fc8fdcfdc4db28f234ae4219935ce572a1547']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--862a48f3-d3e7-4ebd-9d74-03ecef7acf0e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c329670f81998d73507fd0a723b6632290f44ba141454daffa2d1987ed36330e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f7eda9ce-95f7-478a-9215-506a4f036c58",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c3ce73d8dbdb4c9323ed56386f5c0861d69f3ef257f821705b9326ed8058b5e3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--94633a3e-586a-4879-bf6c-37bf1a184fa9",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c635b23625fd562c24d1394e1ef8edd9457e5acdb6f62f5b291f35edfebadd29']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b6e52053-b82b-46e6-985f-d0250d7bef7e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c9ca29788ac0a9d98d01e9560c3d4e077a5d4c8041472cc7391ad9dea88b31c7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bb94db00-f9f0-4034-9ed4-8cb2549a4735",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e834eb87a91ee6a56246c57394b8aa02a4438e84cb5a75b6f3b02b767d9821cf']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--90ae6994-a934-41d0-b810-247886b2e224",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f5ad375b64781cd8eb988650d65fc47622b56668220a4b3224bc06edabf47d5b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--26df05b6-a4c8-4c26-a9b4-e46b9b291fc3",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f83fafd19e41c7d6d97f495ed5aa2ec22e33ab0d4505e799399fff573585636a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1c654bde-7fdf-47c5-bfe7-17507d4a08fe",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fd04629a935eb1408ffd6dc5a1bd91afc60294067d3abbe890058f9b3963762c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0dda6ade-d59b-4a9e-be6e-312f202c7c8b",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '0c32f0e6e9f0b6d683ac33d12cfacd8679a552c1b3be2a22c8d7301626243725']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d74b9ebc-e6e5-4aed-9825-0f3678662efe",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '0e4233ea31ddf9b40c10b7302afa658207caf154d049af282cbf4191cd9e2796']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--577f0083-e1eb-4e60-80eb-7d7f80170b7e",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '1b37fa166113be6dc2af69d453525ba219b644a14a55bece671c569d7f015457']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3210209a-aae1-4285-9691-bb7ee99533f3",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '22e3e4b6e868874f221acfdfb5cb1fecd5b6371628eaeeee368d11de73825522']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ea73abee-491d-475a-8ae3-8b88c7773614",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '35ac6bdb74d3de6525dea276068900b1f1f6c58c5840bae7d4fb1e21aca2302c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c271901c-e4dc-4006-a2a0-ffbf028bd07d",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '37c3241ef811b90b3afb9062d292cb0645b300842547a6e6bdb834e0b7cd896f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--20a83379-d51b-4e60-a9de-f2587d148738",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '462ae0633aa6d9da3ac7ba770ea311299f42387c8e7fec8378ebe19287bb4013']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--24a6f89e-a18f-4292-9a3a-8688571576a1",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '62f73dee201dfe781335b5e65ee3f082b12ded930f5bf2462505976f1bebfac8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--31c1b9c8-b0a8-4289-9c31-59dc27e6f375",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '64b07b6962b1cf1e450e596e54c4610da4d076d7288f0c22f7b0d427cc7988ab']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d1f0d6a5-68ec-4fd5-8478-103420f0bc72",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '70953d184d44fecda1153b0bfd4e0285b5c09c457829e134fda926fb8ed65dfa']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7e24ac52-ecb7-4251-901c-805f7c7de912",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7bef9a6e154a1bbba7c2edca0df3af39b975f18c3f60af14d1af3c2485e4f688']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--17e888c4-3f0e-4586-b879-abb432cda153",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7cbc06c5a80c45ade7be3d7df9af418314bc08f31dbe8fd6fceabd511f2da2d7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--26dd957b-ac78-4d76-8557-5e627ed14c99",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '834b8103d77ead18306cd01518429da5e6213b49799c7ee5fb07d25a6a0d127b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--76e2f19d-9578-4974-b101-7e00f871068d",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '88bb175f65535bc6e5dd9d7fa334c25184a2819f776fa733db71429504cadf5e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--179577b7-d7ff-4114-abb4-22db6608a35a",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '9439234b48d64eb81fe83549dfd5fac561abe5c04fe83507e5c4a8c9045815a2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2442d7b7-5c9b-4d5d-85f3-a1d2e4f90dc1",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '96a9b993c22610f3c8a5aec3f94996458dba8616d4339514180a75765dd134f5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bb12973a-031b-4829-aa66-2a6231028232",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '96c02b41f12652d1e3fe0202572edf3bdd0cc51a0efd2fe112eac420459fcd05']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4ebd4bb9-706f-4f74-9212-93a63e21a42c",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a443e7b252f7157f369b1faebc37b408687b3a1b2d16df7b4df674051b70449a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0d950675-5159-433a-8c9b-2c8c482bb199",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a9a8e99eb1238a1c7c08d3bd2ba97c7a111cd19c677799fdfc01f1be28b8fab1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7627b036-9535-40e7-809d-af725449b356",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'aca9f1eed727599ad2e32f842d2400ead093ec14d9d7c02ca2acc36916e9e256']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9bedf05d-2ab9-4efb-8f5c-42ac767f4724",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown Loader sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b6ab00c63c4dd5bba9a86dca549059e3cbe3099cbfbb377cc6709532b8cbac1b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "Unknown Loader",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9d96d6dd-f2a3-456e-8e12-4e1c0e014dea",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c39656eaa6b330b21067b2b1fbe45c3c57191f2537e070b0f41ff71da204f14d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bb439a00-c2d6-4189-b7b2-e4192ec8c5cf",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c43452ec0bf8016cd3b01485da7bbdb2c32dfd54123c6600caafab1644949522']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--50b884cf-f96c-4d01-921a-01216a74aeda",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c4c29d9e4a5f14a4730e9f1987058d034f584aaadc46636a4c02d3c67f7143dd']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--93d7128a-4d1d-445d-810d-8b0929045ebe",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c8b5cd6bc6e2fc5bb8754e7ce47300d81b0387e2d24f653a1da20ef8d3ca4c00']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0ac813be-d085-43eb-802c-77ebee0faa68",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c91a8db13c56f1e544314315bd155ef52cdf0de8d821e53c8cd13a4ad8baab4c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7a7a6f42-f9a5-44a0-9c3a-fd9a96b32944",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'cbd02e179fcc6184c8d78af434b63bdefdea2144fdc01f773cb0fcda8f50d53e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--493d3f01-2ba4-4657-8415-72b19265505d",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd2cdeb1ba353fc9790e4b81ff0752786bbd26541fb9ad5ba7028fedec350b30e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--378c179f-7f81-4b1e-8f30-de137e582d76",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'de4a36b45add0a0562eded85f3372e12330607856a21f97043b2852e274132bb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3f06ceef-48a4-419e-ac87-faf7d9672979",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f99df81a7e4db9d649331c054fb5be9a82ac9dcb92b63bc49b7eff3e0b8ca7f6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--491f0c51-dc99-4d1c-af74-8f0206318202",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fc63894e971fb6a7bc22187eda67ded8a6a8a2615fa89f4a6856cf591475d8ac']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a799d2ca-69f5-47d9-974f-4a1f7a8a9f47",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '094072349a313cb7618adb520812ad506fad6f7165d64629aad7cddd61e94e79']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--da2401d3-2ae0-46e2-a245-628030537ca5",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '09f1ab353152727f5c62fe9e4102ea90888edc9b0b6a949691c4ebb2870a66d2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3e0f86e4-269b-4286-a1ab-60df9fd62e9a",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '0d98501ac73fd2c318e0e1a4a223b9e2589f235627e512eac8b88a275315b69a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--855b3e65-6e86-4e17-b194-1208f2b60673",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '0dce904c73f9839313628101eabc6055a8885bc40b7adfd7097ba283ee991df5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0346ae62-af15-424a-bb3e-520a6c759ca9",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '131299a9c31c6b3e8d5c4dc614fc3cf2b31b9f91d78d28f37ece9a206f3469be']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b0e83809-281c-4f5a-a952-4cf1fc65c565",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '132777f3cd54eb2fdea38bd9971c78e5e4215f33fd30496df69301a87e7167d7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7060b3c8-bfd4-48ca-8df1-e53feb7c7efa",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '13de8f6601748c959829a719068482bd80f1d934e1afb1f5dfa32f315ee40592']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5798cb0d-af53-4891-826a-155e760f5cb5",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '18438ce3e58bdbe47c9d7058ce05f456d5792d99926be82eb894fba985c567c8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2d16bcd8-902f-4965-b0a1-434744ebeb06",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '2c4229230fdcb224538828468a8642aaf4429a1591fe83776f8b3aa683d65050']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--47533504-86dc-4fcc-b8a1-1d0048bc849b",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '2de0e353270c3beddc1f38b860c09f86757d9c7006208bbf09a7cc22055442eb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3187766e-0648-4cd8-bd2d-13e5fe25116f",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '330ed0bf38d987d25a0b08b49232c75c2cc410aa5acf3e9ab626299afc663198']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8b6b9996-3ae5-49c4-8bc6-219ce9e1597a",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '357b7dee8a51d5b6dc3031844f715615ca7aa70a16029ff879599237b9963412']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c13e388c-e3ee-4e2b-b312-b0682f87742b",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '41059879a6706f1dacbac7cb1058036809fd166ad317b004c91983358a30a8f5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f3702210-6032-4976-8591-306ec91357de",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '51754c16d7f70607d607d7c1bc6e1ed40ac29538b585784f69ea00b9dabe805f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--32d23260-a3fd-4eb4-a3a8-98e744c7853b",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '533fdbf6b54775472b63e8e67a29d1647c207273b3cb32971f8647c42c6066a7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--261666eb-7e85-4ee0-87b7-c8f38e8913ce",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '53ecffb6be8f8408ae497f78327d871d9a4cc7cb1c94486ac831e3f10a86f55a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--054fc3e2-a5b2-4166-82a7-9125062a93e0",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '547c34416710c1e452c0b98c2aca9ffc47b3d444bbb8d2d06ddcba671eff8e40']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9c35eb9d-b8e8-4c27-acd7-f092eefa1a7e",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '592dfb55a48b2d07789a8966dc64acb3dd10ba836e24f223d9aa354be385160f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6c345f43-0035-4d2c-a53c-893d7733be6c",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '61d1c1ca3ed32698a440f3815606b23283a41a2c282567bfca2ee904b0932c6b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c45ca9b1-9d3c-491f-8238-331efb2200b7",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '70b2276aaa5ff9a8e714d625b9238c5bad790145be09827fb928143810df3bc9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6f548153-4998-4bf8-9a78-bb9dd3090378",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7aa96e6f115552e6cc2ecff9f0d481a50978c41aabcac921e2225e0a24b465c1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1f273207-7ad1-4368-966e-185313c144fd",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '809090a7b325ec8141714d78167260baba7f8100234f7a4bf83df44853902120']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b5af0388-baaf-4e54-a199-66aefbfe0005",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '89ad936935bebd624387c6e79ab5baa37d5dc704fb30267b5cad593daae503e7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b3440440-333c-4cbd-8010-693f31320eb8",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '93c3de8bfbaff071374ed32f128a405df30eebae99c218bf9f390c0e592d75b1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d3fd40c4-69cb-4d3a-a133-a6cbffdb9855",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '941152f445e894e608c631a4c621889761b6589f2bd0c41fde983a27d8f06410']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4682ac7b-cb80-4478-8500-0bb9a7fa66e2",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '9508f0de13635d2da11627c796c88e0d573e028b86640bee5c96d74de1cac385']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8e772546-8e44-4a17-9e08-33e41d17cbe7",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '9c4778a1d51aceecb53e437af6bbbf9c6bcd006a4f04379ffca8c162f33145b7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--791982ac-62cc-43c4-ac8f-e13d162e7baa",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a9c7b69cece1e5999a2302d4152bc038ffe8305e84e3d974ace49132241c3206']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--17f0bffb-67ad-41b5-925d-69a12a46f548",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b6481b7215c6147d72fc83e21fd99de8cd7d166b8245e3b86949ab56cb5ee996']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ec40833c-c221-4a50-87e9-8389445912cf",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bdd43965b662d167774165e895328dbf0183ccd516a1bc1a86d77c4e434333ae']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--77791a16-b28c-46de-8119-d01ab85be7a2",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'cc30e4d19f6c7975ba027b58b79bb58794c0baa7007350e4db5e15408b566f0c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--aa8037ff-f42e-4db8-8f7a-2ee3fd8c522b",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ccbef089901e6b3b0edf2e43c348e6d5364d21f04d5afc060edc7b98379ce991']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7fbb4a94-5967-432a-8ab3-2257065fd4e9",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e59471dbb08a04c5ec6df736f149919cc5333ef19da2b2de298d4f429d0c3612']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b35a4869-ca7c-41a1-9c55-783a7f708764",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e7be02e6806e50293502484c4e53079aaa1570c483a56be7a74406d3a9102951']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--aef54e58-ddfa-49d0-94a6-88416f851f4a",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'eaddd0e6bf1c396859cee853792e6878977c8951829e1c43a66b204cc11a6a47']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5d1e623f-e4f2-4fbd-91dd-57a622d83f7c",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fc6b1d2911bf919d0d6c584e3280599fa0d8eb4c30b82c6effcbc1d2850ea5d5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 74,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--65efc639-c3ad-4493-ad76-beef86f9559e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XWorm md5",
  "pattern": "[file:hashes.'MD5' = '0031aedd5634269d4864d0cd0b49129e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XWorm",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f5b7b413-dbcc-4adc-9c02-0db8165dedab",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '008570228c51d2fb2dc8c70687e029af32c78e6b532d198e28ab23db43aa68b6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0b101acc-bd77-4307-bee8-ac42402daafa",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XoriumStealer md5",
  "pattern": "[file:hashes.'MD5' = '0148354adc7a83110247757cad5ac22c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XoriumStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--985f9285-6be4-4a72-82c4-2fa67d12157e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Creal Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '0292789b7c4266ee24d6966708be72de3f094251']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Creal Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ad9de88f-354b-4565-a85a-67c431b762cf",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '02a1f12230d91486a58e26822dc379347578c620a391a72d9529c42579d55267']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c4c847ed-76d5-4480-ad85-22ff52a294a8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "DarkCloud Stealer md5",
  "pattern": "[file:hashes.'MD5' = '036b38ef35adcff2621ace7cc7ab0cc9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "DarkCloud Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d3452bb3-7798-49fd-9956-c072c3e215d8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XWorm sha256",
  "pattern": "[file:hashes.'SHA-256' = '039f9d8c2121b55e8321c4490678f11322ffedf063c28a97a40ba8c543ddc6a7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XWorm",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a1fba34d-c081-4c72-a40f-41353656a0bc",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "NjRAT md5",
  "pattern": "[file:hashes.'MD5' = '03de5ddcf7e6f7d06ac0b9a0e5aeeb59']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "NjRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--374e2b34-f6da-4e8e-89dd-f67006889809",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Ave Maria md5",
  "pattern": "[file:hashes.'MD5' = '04d1da67e42456491532592ebd80cd27']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Ave Maria",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--45d5b030-8edd-4593-a98c-ff5be7a6a375",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '0556ce63b8627b4319893f967e4fbaf9b0dcf7d14bb84f9b2c6c14245bade4a7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--595e9ced-651f-497c-a17f-7ff14f35acc1",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '06b5f8871907f402c75b27f5d35a78cb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8edeb0bc-fe6f-4c69-a47a-51d8a1d14f3c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '083ed94fb57b485940aaa7e6acad165d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3b94c8d2-f54d-4e0f-b018-61dda6c705ec",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '098fa16bf3a0893a4755464f059c09d5a3f8f3142de109afe338028502b6dfc7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--20000ac0-bd55-4249-aebf-1365d54dcaf0",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '0a847b1fea95c2f75ae3d35ed8cbaad5a4449477']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--da2d176a-e3f6-43f1-ae89-f8d50cd10f42",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '0b11cb7c853b1dbbe9977bb91e9df0f7bcc30e1a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ab30486d-3911-4c16-9050-0b82c7266845",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer md5",
  "pattern": "[file:hashes.'MD5' = '0bc54f9df3205240624b97ce3b8db8e3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d370979d-f2b8-4536-a2a4-edaf31e4e685",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar md5",
  "pattern": "[file:hashes.'MD5' = '0dd8879036c621a4a53245702ce3ecea']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--af6d8a5f-012d-43a7-8269-ae703c8b92e0",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XWorm sha1",
  "pattern": "[file:hashes.'SHA-1' = '0fd04ebcbd548b5697fe782fafb721388409949a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XWorm",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e4d0fdd1-b1a0-4eca-ab09-08c743aa6fec",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha1",
  "pattern": "[file:hashes.'SHA-1' = '1067a478da108296c18a48a52f504d2978633e97']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--acad4b7e-d8e7-46ed-9bd6-fbe4d2075cd5",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha1",
  "pattern": "[file:hashes.'SHA-1' = '10a8ae8f8409ee63ec2f904c6b8c40e0c5337daa']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ba843f1f-22a0-4af4-a535-76532a2c5b8f",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha1",
  "pattern": "[file:hashes.'SHA-1' = '10ed27c88f960ac9480b2fb1ffcbbfb1c3087fca']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b6744a35-6653-47e2-9f9f-d7d38b25651a",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '1289785cf9c3c945088b6a82632b05503a5b81d3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--065d16ca-1588-4c85-bf96-50ebc364f47b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '1314d78dfd439b1921cc89b8629db1d7ecbcba71']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fcbe505a-fd2c-4e03-8f6a-cecd4a8bdffa",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Creal Stealer md5",
  "pattern": "[file:hashes.'MD5' = '136ca5b8004081447e77bf913217dfe1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Creal Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--54884db8-612b-4b86-893a-10202b4db896",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha256",
  "pattern": "[file:hashes.'SHA-256' = '13e589b57234b7eb7b0023cae55629f474051f3c3aaaa3df65b083f8156cb860']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bc28c75e-b3f6-4506-933f-980c09e22bf5",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha1",
  "pattern": "[file:hashes.'SHA-1' = '156284da99ca58be968df6182122ac0bec5110bd']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--272e2873-55bc-4e56-bd4f-28ee7e5d863f",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "sustes miner sha256",
  "pattern": "[file:hashes.'SHA-256' = '16a9a0455feeaaf9a60b23b7430852f6d31936da8ebb29d54ca3dc4c15b7da42']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "sustes miner",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f75e49ae-f8f1-49e6-b0c2-c386893f4a96",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '16c2b7ceaccbdff9bc022fe30c1172f0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0c369052-a05d-4309-85b9-dfed288b22ee",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha1",
  "pattern": "[file:hashes.'SHA-1' = '1719b5a4d4866733f5ef626331f973b347f8f889']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d8ca700b-abb8-4103-a75e-5ff07c876e3c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '1820f27fc9511d8b92a7d092ec2759f19fd787515e53328e933d6c0b37448daa']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1a430c86-2919-4275-902f-8fdc90d3f1d2",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '1dc731914f3ac373fcb471fdd8c80706197eb057']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--32c6cd38-7250-4a73-af6b-e524e84f850b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar md5",
  "pattern": "[file:hashes.'MD5' = '1e0a432f2447c397a14cc86416216d6c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f1e02806-6342-4789-b2b7-0b1e608f8f9d",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '1e2d6f522510822692f01a572c643ba754533a8a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--40d2d476-c155-4982-9f64-b37591f1bf1a",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer md5",
  "pattern": "[file:hashes.'MD5' = '1e4828f6bbe1cb728a109d9031555f94']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a09e99b2-d1ba-4105-ad6a-699bb3159945",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '1ee28ccf642577f95a294b60c8c8d743']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--529bfa22-f9cf-4720-be33-dfeec0d5cd31",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "DarkCloud Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '2161b49ccea3bee28a5c536ea558cff383b820d7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "DarkCloud Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--11fb06a5-fe6a-4bb0-9dba-19a6212f09e8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '21dd547565cfc9274461d859cecd9a09cf8ac99833ed8c70162eb8868fbaeca5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0519a913-5b80-435a-8e74-996340d573c1",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "WannaCryptor sha1",
  "pattern": "[file:hashes.'SHA-1' = '232544702af339e7232df8cca0baaf23118fb1ba']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "WannaCryptor",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0f2303fb-ad82-4cd8-b32a-f13cb5ec62a4",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '25906e1adb26b9d5307f7ac2bfa41581b7a1fd6bc09fcbe78bb9b196c16a8e74']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f733badd-d3a2-454c-827c-7d4f0e6afad1",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '260ec262e12af92557799c813b24c754']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--dd56b1f5-4573-45c2-8e0c-6c98fc62c504",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '265a7abd48163c1eb565607380533311']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9f1c198f-fed4-4e52-8915-9f53aa8e29d5",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '27068cce237cf5a5422a6a3cef00967b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a5e5ae6f-9df9-4585-bc96-3d42a988c63c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer md5",
  "pattern": "[file:hashes.'MD5' = '271b06381a7bd4485bf8f06492416131']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3f1859e9-0e0e-400c-a93d-68004c542771",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '28db5e5e28e2ac12a72962316a6c4b5a1306ef65']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--774561a6-9bed-4674-9f0b-384eb3d8aaa8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar md5",
  "pattern": "[file:hashes.'MD5' = '2967ab38b22612606eaf7c33c649a8ad']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--de1f58ac-b593-4fc2-aee4-ad3cd46e3a37",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '2984e535f3d41342a0f27e3370a77df67b08088f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1c140348-2ba4-4ce6-8efd-1220956b70b5",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar md5",
  "pattern": "[file:hashes.'MD5' = '2a6849dd74f57baf74a319bee652180f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--249d67d7-cf61-4a9f-9a09-3eb4ffd35c5d",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Creal Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '2b3e98e8d9e5a0a1d8eae8c9deb76d2a197db326']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Creal Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5deb8d5e-8ef4-48ca-9acb-3a9c12b14cbd",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "QuiteRAT md5",
  "pattern": "[file:hashes.'MD5' = '2cdc0d58d6ec369ce905667a63a2e6c0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "QuiteRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--346d2bea-edb6-4e1f-aacf-5afaa481229b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '2d043ab3a957e4b2b7dd820561c88278b97200c00e9820727725f7e9007d1dc8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7548f9ca-1e05-484f-91dc-3cbbfb33b8f8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Agent Tesla md5",
  "pattern": "[file:hashes.'MD5' = '2e7344abd237c4bca3f0b3670194544a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Agent Tesla",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b62ef43a-a0a8-4a5c-b485-cf0264047280",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha256",
  "pattern": "[file:hashes.'SHA-256' = '2f4df752b979c6c1784add5410ea5115e5b8d93c4250d21c07aa480175b70ccb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6d918a14-c483-4059-a38b-d5630c1722d5",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XWorm md5",
  "pattern": "[file:hashes.'MD5' = '2f92334f08ed9dd7345a40dd0968073f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XWorm",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b8b3cf2a-07b5-4ea9-a7d9-80c34e0d26b5",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "ValleyRAT sha256",
  "pattern": "[file:hashes.'SHA-256' = '2fa2dbb71878f4f3fbc3527ee3ac2a66b3322ea4f31baccc2f27c60e30e1a1ba']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "ValleyRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--40e880ed-2a2f-4b42-bfa9-5d5fe422633f",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '30acc43b2d30e67eeb859288ba1e9bda7215c7a4292ec82c36241913c4c77be2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1cc58a3e-dc5e-4aa0-a9e3-39ff6b50772c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar md5",
  "pattern": "[file:hashes.'MD5' = '31eb16dd4d90cca749b2c140512b20c6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ec9c6824-8e78-4d43-a5a4-2696bec6aaca",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '321193e391ee46587818fadbf5b9ebbb9f4ce91d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d8542c46-c0c2-4f7d-85c0-c4276fd7374b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "DCRat sha1",
  "pattern": "[file:hashes.'SHA-1' = '3258ee916c68f848cc8d1e33b08414fade48934f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "DCRat",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e0329cf8-f436-4571-a741-f29d5b719d54",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha1",
  "pattern": "[file:hashes.'SHA-1' = '327a6321814963da87875ffa1006df9bc1a71092']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4c8680fb-760c-4ec9-a79c-614e400efa92",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XWorm sha256",
  "pattern": "[file:hashes.'SHA-256' = '32ce7696a243d77a4ee9d927e306e93629651d251a697ff58dc28f8c3dfdede0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XWorm",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--14630006-2e78-4144-b0fa-240d0845af92",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha256",
  "pattern": "[file:hashes.'SHA-256' = '34e5887dd33383ebaefa05e6237615463987affd4af6846163fba94221b0b435']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4832ae56-7a08-4d0e-b7c6-354869af26e3",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '34fcca4aa1359e2f2105078916b16b88816e1a8e087b90cf4c3c8a2e91633711']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f7de73bc-db61-426e-b427-e17d69da8482",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Ave Maria sha256",
  "pattern": "[file:hashes.'SHA-256' = '35c765aad263ef95c6d95afd5754a6e2f6a4aa6c17ce0d17447c88ad95b23c9f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Ave Maria",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a8dfb24b-4070-4e5f-ace5-ea6c433c60c3",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '35cd86db50543b14538ff0af75b7fac611dd3fce5d7e67c004091ece874c69f1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a9af6069-3268-4e27-b068-de49094299e4",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '361bd7099675c603b2ae6c76ea233d2298052306b7141f11e9f5d815ccf18473']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--360b8aec-28a6-4fb4-9333-9b4846651efa",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '362af7e9723b78d599d930b940a351a9e5448a4b9744755733e48a2f6b2db326']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9970f492-0716-4681-93ab-9c2a8531b6a7",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha256",
  "pattern": "[file:hashes.'SHA-256' = '37d8f382d2ad47808926b24d3e89485d8a3293e07ae8969486b435410bb0c71c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1e4f23d7-4984-4843-bac6-4401e1f20bb1",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '3a977b684e1aefa0cd5aaa48a9b737151ca52593']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ce360969-5d31-4bb7-b84e-8808b88ec743",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '3ad1782ec14c097d032b7820b29230dbb54fb3971cd7af23bf6ac938a41b0a60']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--251228a6-f708-4f24-8baa-27b1a49f1518",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '3b70dd19631f486d7ae69cd0f22434ae']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4ad60a76-147f-4e79-8bd6-f3206b9e4026",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha256",
  "pattern": "[file:hashes.'SHA-256' = '3c217eeecaa616ad300b86fe00f2ddebeb05cba3dfb4c33f3c716f0f162c282c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c4acfede-4d27-4540-91be-c173b4a079e8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar md5",
  "pattern": "[file:hashes.'MD5' = '3c5c2be6260ce57553e30f84179ca578']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c0f6cca8-d552-4f26-a445-e7c82b6a6199",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Ave Maria sha1",
  "pattern": "[file:hashes.'SHA-1' = '3d9efecc00ccffb4e94dcb1da29a6a06bfdac376']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Ave Maria",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4b97dbf1-049f-488b-8d2f-4f1be0cb7c5a",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '3db513bd416fabdd1c9029375bbc3fdd309d272d1a997b749875a64e69ded52b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7c03be61-e281-46d9-8979-e2f234244b1e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "CrossRAT md5",
  "pattern": "[file:hashes.'MD5' = '3fc6c54e9c7d097540d57d1844caa079']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "CrossRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2538471a-7a14-4069-8d7a-b511757ba799",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '3fd62e332ea45003f8f05c8649f229bec4c6a0fa55b8dbaaad431c4ea5bf599e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bdbd71af-7f01-4150-9395-3772186b173c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '3ffd047bf21cdd0072ef8a4078466e7bc94474105c05110d204f97063dc8a96e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--45c5fc83-f71c-451b-8b40-69f9a00ee27c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Borat RAT sha1",
  "pattern": "[file:hashes.'SHA-1' = '402a0187fb10bd0785b14d5a40259a9620060d9f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Borat RAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f5e17077-8eab-4cb4-9fe4-7f10c694b5d3",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '4035342a19488ae0e051f038ff6ef8a0afd3019c2fa8b80b1921f3e091504440']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--360f9358-ddce-4bd4-a4de-b1572d4e4b93",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '43a01bae6c2c99da412eb9b2e907a3f7bdbe22a34bae060e4abb317a85b6ccb2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2c1bf4fb-5887-419c-89c5-7fcd3cc654a9",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '45135badd376eebdaf3f426d8d32bb63abc08e8950c900aaa35aebad6ec0eca7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--249e5f70-7ed4-4b30-9861-fab318563d87",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "ValleyRAT sha1",
  "pattern": "[file:hashes.'SHA-1' = '45ce5fa1f74b15c4e90df7a0d2dd2a1c72c490a7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "ValleyRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4eaa3e1c-be33-48a8-8bdb-5771f189eafb",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XoriumStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '45e45318297d97a274aed36d97a2a6563ed1540e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XoriumStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0f94a806-70b1-4082-89ae-2202479c8565",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XWorm sha256",
  "pattern": "[file:hashes.'SHA-256' = '48855cab73433732c13c75330290b0f690e4c76d1740c8de691bef2138a6f213']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XWorm",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d2aae8e8-7a42-421c-9d30-cb0457fa42ad",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '49818c65eaad6ee5093f2b3253b2511e0733ac9800ec0b7033210e2ac462037d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7631de4b-7b76-408b-b8ec-f560c1aab380",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '4995f4a3be1680bfb34c079b229a84a3a999a86379d8bace89d460bd05d9c58a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--32f69ce6-79c7-4a7c-b5ef-485cd5cfa7f6",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Creal Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '499f83166c24bf307105138a0030681179911afab628568feab8ba6f3525ebe2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Creal Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--460d9dd4-3cc6-4ca7-8070-c0903e0de835",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '49f32f172524c3c2d1d1c83565face39a1d4664a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b9b79a6a-2bba-43ef-9983-cd4549e02d33",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '4d99b89777a1c888a7d1089fb21d6bf9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b7290e21-8989-4d03-ac8f-b7afb206ac8b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '53bf22c4519282706701be4394ec3a289800944b8ae59c3afca7d22ae400eb62']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--28f0da1b-28b8-44e3-93ba-f975161fb730",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '53f4ad260d9524764564b244f78766ae5817db2a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--43e95af1-0642-477f-bae7-fd4664dd6d86",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '542733a3f9a77939acc7c9756e01b57ea4e7d075508750ae2f7138bc5d558880']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cfae5254-66a2-44b4-8482-f4689e251e8b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '54cd4a919663f089dadd9e8359ce44bb44d75b2914445ac2a128d046dae03e56']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--12dfd09e-e551-41b2-9bed-466e1599da42",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '55b353ea605c440446ce15ace5f68c893b435af869b4581cc34a2edc4d3b308d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--31b81336-d5a9-447e-8059-3436d713b586",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '56047cbe27a63d0cea335992c8111c06a8b2d1124c02c7e984bc2d0996732f08']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--45a96889-6ce6-43cb-98fc-11c3658a3ae1",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '57259bc7c9d8c86369eaf0698644d60d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ad7b450b-7798-4ba2-95bb-2a308169ea68",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Creal Stealer md5",
  "pattern": "[file:hashes.'MD5' = '59a454d7c3ef657af228ef59e3c862d3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Creal Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2ec8790e-50af-4637-8c69-e76dfb3f33e8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '5a5e1df0f1349391ffdbf1aebe4c79760e0a9990']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bdbd78fc-328c-414d-ada6-3c663c1edb25",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '5b278d50e2ef267e1eca51a949367ef3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--327e4cf5-665c-4b52-8b25-2a20149f3bfa",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '5b914b0ef5c13a8bab22ff4cc555cb36']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--80c1cdf4-b65c-41d5-9964-4fbbd28028e1",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Stealc sha1",
  "pattern": "[file:hashes.'SHA-1' = '5bcee2e27ed48fed733580f4c6a7b8fde4bd6976']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Stealc",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--22dc39c7-f95e-4764-a463-741eee099d44",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '5c26fed20a08e585ab96d8c366efcc7527ebb27b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--46bdc73b-64b8-40ee-8962-4d9157811ff0",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '5c5eff7c0edc489cd5fe4dbd65f1f8b57f1c80d0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--aafc915a-ca85-445e-8da5-df36183987e7",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '5c7ed1354c3f1ec551f9410861a24f2268ecde4b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d5e2bcb4-2d1a-40e7-a996-d58e73d47049",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "DarkCloud Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '5e4e9ba71438f89d11ccd7318fc5bb2f45999c18b08fe62d987dcc045acbc4e8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "DarkCloud Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--87c43c3b-3902-471f-b469-663ced689444",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '5e7f3ab5ae0f96024e8afe8c162f2c332d9fffd73e79df3c499f4c61d3a6cbdf']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e1ec52ac-7669-44c3-93f3-734ae9524ef0",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '5e96e2e490793e0082d916fd4f90d58c0d6f0ecec7759a50df0134d55c77daa3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--45c5deda-ce48-422b-99e6-22fd5d8a66e1",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '5edcbff61370b9841d735b412357908c2e11fa3d8f7d07409b74b9d2ae75c664']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--feada72b-b3ed-4f77-bc39-85bdc33fb330",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Agent Tesla sha1",
  "pattern": "[file:hashes.'SHA-1' = '5f72d137077f11f995340a121dfc01096593a860']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Agent Tesla",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3c59cc42-1330-4217-8870-6902415b8281",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "DCRat sha256",
  "pattern": "[file:hashes.'SHA-256' = '5f77dfc31954090d2000f37ebf018b09b43683ad32fa5309a617e8db964420bb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "DCRat",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c719054f-f60d-42c8-8cb1-3107ab2c41c0",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '60dd0860198f2c135f30fb4bfa67c7ff6d7f2668cdc6410ef7bc6d6126b722d5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3ff3719d-11a5-42f8-b3c8-392f6f6e6a35",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer md5",
  "pattern": "[file:hashes.'MD5' = '61b01167226eb75d51eb796aa0f0c0b7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d9607247-d9e9-4ac6-8903-3537a17752b1",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "QuiteRAT sha256",
  "pattern": "[file:hashes.'SHA-256' = '63568c8e9b95017606e3cf77596ca4ff84443df283284fb70322c02b3a2552e0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "QuiteRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3c0cef51-91eb-4c96-a468-9e0dd778a8e4",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer md5",
  "pattern": "[file:hashes.'MD5' = '6374bf4e0fa793540fe67605070e9f78']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8eec4c18-3a42-43cc-93f7-4698012750e8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '656d3c7bd19a04b1cc3df880052f0286']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3b40b1c3-02e0-4b7e-ac07-5f9a4faa21c7",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "ValleyRAT md5",
  "pattern": "[file:hashes.'MD5' = '65a4e9ddebc81853ae1fcbbfbe9c8b4c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "ValleyRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7da021f7-81ed-4260-a290-abb982626756",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '65ab06cc6e081403598226ea207f44e500ce0851']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e7ca9594-c21b-4c84-b33e-0ee5258d8e36",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '663336e13d7eb7a78f60455690d215889f23554abe17646d9f925f7f9bf75c38']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ec48c05c-3908-4553-9f39-33cb5a2f0565",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '663a801abd340e2e6fc06d27eaf54ffd']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b0dc4a40-da52-433c-b583-2bb9636d9f43",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '67c293c019963db821699a4ad104f3fa']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d54ec54e-6e33-4754-b603-f4d9b7722274",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '69807cd69ab51f1540c2a242d6e956808cade445ef784d567af71d381490c5e3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9f2f456a-8386-4dc7-b4f2-446a6a0a043c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '6a8c7a90866593c9e511654b8f9cb89af119cb6b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--03971fb8-b95d-4f0b-997d-1827b2b1d8d9",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook md5",
  "pattern": "[file:hashes.'MD5' = '6c3dc88ac8f59f05f65a2efa59d5382a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f5ef11bf-0f13-4a3e-b746-27fdc8f08779",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha256",
  "pattern": "[file:hashes.'SHA-256' = '6ce1361c8184bc6d53a7546036d612998853504082f58aa902cdac3661791c19']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5185ec54-d5bb-442d-aaed-6b32b4c48295",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Venus Stealer md5",
  "pattern": "[file:hashes.'MD5' = '6d856db6a5f9268b99615c90216dd4bc']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Venus Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5787e032-e0db-4f30-8ca2-9a5bcf99ecdf",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha256",
  "pattern": "[file:hashes.'SHA-256' = '6e66bbe59140b869589b5a13c258fddd59fac37e7987927a73abae79fb05f655']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ed7eed2b-ba35-4540-90b5-35194177401e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '715b68c1b36b3e60b3f2e31d3f38713e22aed87987a8a5b1fee33e8bd990b786']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--485377ef-6f52-4f2d-960a-1f6fedff1186",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "DCRat md5",
  "pattern": "[file:hashes.'MD5' = '721ff5f2ca5de5408ce87d8a913d6018']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "DCRat",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--766e5564-9664-48d9-80f4-3356bff56404",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Coinminer md5",
  "pattern": "[file:hashes.'MD5' = '728f11f55fe5a95968072216ba949a41']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Coinminer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5a450e3a-adcc-4c3b-a799-b4a76a79f7e5",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Akira Stealer md5",
  "pattern": "[file:hashes.'MD5' = '73e53595593b6b687f041c8e107f4165']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Akira Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3a28cad3-e699-4992-bd53-e9c7066747a4",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '742f798e2c3a07175a45dd5f9ebb1056e284726da9f4fad598618db527693fa9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--abc83236-fc2a-4847-a3de-aef02f7aeb01",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '74a140fa0454186b1415dc5d4d688ec3da0ac3f06ec768008e98c39494960789']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c9f7926c-8551-43c3-904a-8a0f5e567d97",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha1",
  "pattern": "[file:hashes.'SHA-1' = '76a9a7b0532f3a77383b54fc02ba837e1d2fac00']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7f4f86e4-408b-46fd-b7c6-0f5cd020ff5e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '76ab10b921d84eb8fbfc01466e4c52c7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9fc86347-f326-4b33-af18-cbda777c656e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "sustes miner sha1",
  "pattern": "[file:hashes.'SHA-1' = '79260de86069abd690122f8ba28de2a10ecddb91']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "sustes miner",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--726c3aa6-646d-4c70-b969-0a84f3cd9241",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Creal Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '798b20c7740b0652d10babb2a042362d59901c46']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Creal Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cf08b7c9-8b56-41ab-a6c2-959eebbf3760",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XWorm sha1",
  "pattern": "[file:hashes.'SHA-1' = '7c674c7c8fe892847b0f616af6560453f3f6851a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XWorm",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--af27a270-7b97-4e0a-b63e-9b4d7e65c4e0",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '7d09bd11d6f19b74baa76c6ade71a49a1ddf632e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5ec19a8c-e1b3-432c-ade2-060329b196fb",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Ave Maria md5",
  "pattern": "[file:hashes.'MD5' = '7d3addbda92f07804a8b40d308b2ad89']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Ave Maria",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ab9ece59-0397-4c53-a306-3aed1291782f",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '7da82eff0fd27597fe5a9a13114dede5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f9b04798-0e5a-483b-94ee-ce78a938df95",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '7f329e5e3e3eb4c14c857164d726281929f5cd2aef8a01de28e8b4eac138c558']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7628b864-da93-4bfd-bb8a-860ece2f14fe",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XWorm sha1",
  "pattern": "[file:hashes.'SHA-1' = '7f38d460a63f0007ec025baa743c717733516c8b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XWorm",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a5cab236-9023-44c4-a193-7d6849f5ad8e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Venus Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '810cf6e942a9246f8b9306391960db5176c2d7195346a3da018309a3b705e7df']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Venus Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ff76055c-d5a2-4c65-abd7-6d7cca95a923",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '818b52bf681e2eec7804925ceb3e379b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f7e2f959-2a9c-4fd8-b1af-b54e72471d22",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Ave Maria sha256",
  "pattern": "[file:hashes.'SHA-256' = '81c92a9a346f7db12a0fef04bf0f05d30a6b0e85e73b2b61ef8cc1c8e04e77e2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Ave Maria",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2380d2cb-131d-4bd4-a87e-6d1178e15722",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '84fd8c79325d027dc97e8f82068ff7f59e41300e03277500e368c6f1545229c2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f0519c55-ebf4-49bd-b0ea-1586e9632af2",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '856246ff041038ad79d876744d507fa1a9953410']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cc0c8723-f567-4ca2-8b11-accdf9d6db25",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Agent Tesla sha256",
  "pattern": "[file:hashes.'SHA-256' = '86f0d9e69171fdf591af6df81030e4debb2710a2b8e59807862f50f27d79531b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Agent Tesla",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--23deb940-b6e7-49e5-a6af-c1934d5efa2f",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar md5",
  "pattern": "[file:hashes.'MD5' = '87b61121454fe8a8c45a6ad0cc49888c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9171680f-f42f-4508-a73f-d305aa3e5171",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook md5",
  "pattern": "[file:hashes.'MD5' = '8814a6ec0fc6443f24acaaa9abde07f5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3d5dfb18-8bf5-4536-8665-7e4754340642",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Stealc sha1",
  "pattern": "[file:hashes.'SHA-1' = '88e307318d02ec40845f4a3652e1f7bf1126508a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Stealc",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4125af19-a44f-405f-8e3a-b8d8806a2fed",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '891531a751dea7dcacb16f7df4df20734469202f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ac0af2eb-f4b1-443f-b823-9837d8738c52",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '8b26e3333f4781741834e6325c6a5312a3ae02db7b6faca4d0edda19d37fa259']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4f46936c-9882-47e6-aed1-7b5c689f6103",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '8b55896ab6aa2d3d8971db7212a88695d68d0ab1ec4593afd8f786f6d3572d0b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8f8a26a3-cba3-4590-9d9e-820404e2b52d",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '8b6534676f149554c824eca498597c97ef3c62a9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b8cd66c1-c5a9-4329-af72-78eca90f07f1",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '8c051943113a4b2bd0592e04f5cc45c43fe5cd89abaa7a463f14939abc145669']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--56c13f9f-4067-4dc1-bd44-eddf9f7f0373",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '8c3f97e9cbdd0253e11766c558b1c445df98b584']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9f758cd2-fbfa-4bdd-9e74-4c2111951b96",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Agent Tesla sha256",
  "pattern": "[file:hashes.'SHA-256' = '8f151b1483d17650fef6a0b07c95711a229d7b7cc5fe4e5c6c02c06bcd7b476b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Agent Tesla",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3b51fc26-bccd-4900-ad7c-9df328fa5f3c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "ValleyRAT md5",
  "pattern": "[file:hashes.'MD5' = '929e22e5a2d5e5d851a193ef1f5e8b36']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "ValleyRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c00dd234-fef7-4bb2-8f33-f3e4c3729691",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Agent Tesla sha1",
  "pattern": "[file:hashes.'SHA-1' = '9314cf9c099571791f494c788c50eb506989d583']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Agent Tesla",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b4588549-1009-4734-a0be-ec71431629d6",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = '93a0391e367a592f7e784cdf0e64430c78e68d0a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--34fd72a3-f474-487d-8f09-964ee6ca4f0b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '93cb479a937306a8f6c1ed3e15a7095b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--52d2aa09-25fd-4225-9d0c-ed986fb29926",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '95291c58a13eb929ead5750351e85772']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--dddfc41d-c32f-4514-bae5-15e812a2d7cf",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '965746db162d04837da30254e20451f985efb1aff56b724baaa770b7f3de76a5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ddcc46cf-7fc6-4297-bccc-d25d6744ca92",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "ValleyRAT sha1",
  "pattern": "[file:hashes.'SHA-1' = '969fbd0492dda3d4093e321cb65b985e753dd42d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "ValleyRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5bea4c4b-db75-4521-bdb0-b7efd8dbfb57",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = '99970ca956fad38c25e4d9be1d8a8fd7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ef45e8c0-058f-4042-ac44-aa1b6c18e63e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha1",
  "pattern": "[file:hashes.'SHA-1' = '9a32c2a532e57d33b6581e46a763e55909a5819e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--131bd0bd-04d8-46aa-b20a-51b3a1dd2ccf",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '9b45feabd5916159759b378d762573a3891a4984ef22e339e578c38d13ea405a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f4ac2d36-9cc2-4517-9f62-ead5bfc60059",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "WannaCryptor md5",
  "pattern": "[file:hashes.'MD5' = '9b5192da4ae51215174e2c3773785dd7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "WannaCryptor",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--899e6fa8-d2cc-4b9b-9ac2-09616953e91c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "GoGoogle sha256",
  "pattern": "[file:hashes.'SHA-256' = '9d0f757af542331cd7208026383fa2fcc8ddbf2ada37592910b96195c4a2f1c3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "GoGoogle",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--500ce3ee-180d-4e44-a938-3c8b4b215906",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha256",
  "pattern": "[file:hashes.'SHA-256' = '9e1ac023ecc1341354d5ccfcceba31901d71a389198fcf32e18598459f5e328a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--15d19d1f-ba87-41e8-98d5-41b3c530b5a9",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a06e9538a70c46f3426def34771d549539d7d75baaa17c4b087e5c691cb1b1ef']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b5bf7b48-24b2-4997-8ece-9fbf58e943c8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = 'a2c3a596af57f1180298e432ce6a44cb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d138d8cb-d205-460a-bfac-6aaccd51f75c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a2fb6777eeb5551a1d23f3ba8a0ef00ca62638f8742d4d227798cdf7a8bcaa12']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2a9e76bc-fc1a-447f-ba95-74c8a360181b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a30d635253a77444c38cf25d439bb96cd913fd16b9d1d40898cb9014f4f43831']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f67e2549-32db-4266-bdf4-f8c89aaa1f27",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'a3d8e347bf97daf0873d995639975e3acd2c58ff']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ddc0e23c-3b89-48da-b410-8ae66a03f2a4",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'a4406f90f5383de624655e053a6995d97f1d8079']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ae8e073f-0aff-4122-ae9d-9a3b53189dcf",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a4570d921d16de9467dfa9c41c5960b846d0186b55af2b01f7ecb743e3f351a1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f97106c6-6278-4f0d-aa2f-18ddd4f39e5b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a58b658154b0594c45020581213f384a7c5e2c50a2f411ceff1fc20def1af634']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9135d3b5-6fd2-4c07-ab29-ec2a395f466c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a5f097f9701d8e7e4d9c88631c119ea4aed931e4344288c8de4f4db2564debc9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--846eab41-7944-44fd-97e9-f6b9f4c45b1d",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'a64a1fa683cbe2ba48afd9502e1b7342d3ae4037']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--64862e29-eedb-412f-bd12-9a4c720d648a",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'aa839b6fc9904b75bd5028732bca7ba54c07c3cb470076a0db89c501d279ab69']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--381233ae-ca6b-49ee-9671-bb7347c41c05",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Venus Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'aa9b0055b80b765ef528b35471389c86af708dc7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Venus Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b4bbf776-0964-4c8c-9c21-24580b39e2a4",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Stealc md5",
  "pattern": "[file:hashes.'MD5' = 'abc580ad3860919a5b2cdd8d9f48cbaa']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Stealc",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6ceacab6-b05b-4424-8167-e2f7f7a02b80",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = 'ac0b7b0b6a9a103909c8c1946191dd1b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3d433640-3b22-4fcb-a6ec-7b1399e95fde",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook md5",
  "pattern": "[file:hashes.'MD5' = 'aca797c1589207329745b4dfbd073867']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--51679631-83a9-4fb5-8e11-896de10a2a2a",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'afde306da1d4c36f2d8554220e940e87471722814d82f7f1945175b05022c414']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7b08443a-b790-4d4e-a880-72b639455cf1",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b0410122cb5fce54d513daf2c47d92dede85002ce91cde0def0e8ef2326bb3a9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9199499f-8e2d-40ff-83c7-22d009be4246",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b07be9fafa514017fed65eaf98777f08082945918c8b61bce65317bde64c1d35']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a276796d-61d9-41ac-95c8-28da53c978f7",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer md5",
  "pattern": "[file:hashes.'MD5' = 'b1893e0e81ede37f465bde7c1734c7ef']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5e02e6aa-15f3-4a21-aa15-b067c755cb2b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Borat RAT md5",
  "pattern": "[file:hashes.'MD5' = 'b1b3a3cc832353b96c533242a40ff068']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Borat RAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9521b34e-65e2-47eb-8c25-68dc8391d9a4",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "WannaCryptor sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b315e3f72edd41f1f82b109b5261ebdb1c2ed1e9bf0266f5604708896b5fa827']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "WannaCryptor",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4ea8bce2-bb86-4df1-a57c-189132233a71",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b6b141c545531fe2244b8a5c082003bad2e58ec5d6634f256b05c90185e1c9d6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c9950fe0-7ba0-4c5b-ae9d-39f4153dae3c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Creal Stealer md5",
  "pattern": "[file:hashes.'MD5' = 'b6f286a411282fcc40ab3fdc612ce2bf']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Creal Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3127d959-7f1a-4ce3-82fc-330ce15c7296",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b73692124e1ef01b0bfe3cc1b97d2f083ab6f0c151f565c53d23de34e9d49360']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d515ee88-95aa-4e8d-a86b-d80581b39313",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Borat RAT sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b987078108b91e260b96c7a773659dc9710c830ae3ac7c99121392cbb618aa0a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Borat RAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ff5a4121-b23f-4d3c-8e2c-9681fcbce3a8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XWorm md5",
  "pattern": "[file:hashes.'MD5' = 'b98a6d046dc70849eb6dffd1708a1ea7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XWorm",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6035e494-7423-436c-ac94-1b718a033804",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b98c2c21644fa52e66c33fc9f73c7322bc548d0c5a5eb49f5a74a39d35862304']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ceea05eb-59b5-472a-9763-b8dbb6ae535b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Stealc sha256",
  "pattern": "[file:hashes.'SHA-256' = 'baaadd859d1ab4142442003a80681dfa8ac306038de626f383e0110fd656c3b4']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Stealc",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--76b05d8d-e038-4433-b988-6290c89e50a5",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bb0bc290151a1ef77e991824eddd79bc30ceb724b6882d3f263814ebeff89baa']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4bb893f5-7a0b-4f86-a781-922ef7fa0c62",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Akira Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bc16bad32a7a6e531e830e873c9de503d8b87dd5015c184566b6dccf1285d8da']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Akira Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--33987084-7932-4e1d-a929-6b8f9ae20242",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha1",
  "pattern": "[file:hashes.'SHA-1' = 'bc3557166bba48bd3c1fa83f17b4fda0f7bd5338']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e9163e22-8751-41b3-95a2-1943ecb95c73",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bcde87c5f2a105e71331779753946c6e5092d71884ffcd52f3305d107cfbd8b6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--20c7b60e-3fb8-4ff1-afab-39c7ec3620fe",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha256",
  "pattern": "[file:hashes.'SHA-256' = 'be24b9eb3fcfb9671aeaacbb24a4f413daf9abd24b41a9ee390caeec74200af6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f09c6825-b3dd-4f4c-b3ae-d3678295ac06",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bffab69295213a1ac943cc603bdbaa23498140ce27051bce2539cba10168cb67']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0119bb1d-c176-4e2d-b897-dacd55b45241",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Ave Maria sha1",
  "pattern": "[file:hashes.'SHA-1' = 'c053dbadf8bf7d296d5b8395c76918d7af82c4c3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Ave Maria",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--564dd89b-df96-4431-a5dc-0ae83d8d5f76",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c16930da2da93b3ca3e35f4083e7706885b7def4929d4adb731333950c811fb8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1fda1b64-655b-497c-8f9b-8df44700da99",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'c1c33d9fd8d9f13383c96d00ca28bf97c7088399']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ecc14cfb-24aa-4834-bbd5-f84c891e8289",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar md5",
  "pattern": "[file:hashes.'MD5' = 'c1e13835f0520c2e9cfd3c2cdb68eecb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a7e84948-936f-4f63-bb55-9557c8c9d475",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c20dda695e95db0ffef059d1995e8d62613de1909d1dccd6f72ad9f9ceda2c14']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--644dd5a0-b176-4e57-8f4e-2dc0f5a7fdf5",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'c20f694d32f72115447ac4cf60d0c18ae5cc0cbe']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--faf4fb40-dcf6-4d35-805e-0a6502423dad",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Coinminer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c23e5ff7f6a526af814bbd789e197d13130aae0e96c474acdab60bd16fe6b3f1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Coinminer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--208655eb-acef-49fc-8226-6aea0bd824a0",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'c329d8543f1aaa4ee155e62da2924c3f5bd236e3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a089cfac-3b27-4cbb-9121-85bdc9ef55f0",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c55ee0c81e39e105f035665be039efd99a4b78d53eb188d8858b512e590e6c9e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d1f55d96-d7bd-4f92-a18e-e6567d35e4b4",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XoriumStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c5bc91579693cc41036d835ce4e754f941310cebb73b69628300315df39c2489']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "XoriumStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e3938ec2-c2d4-4ce2-8b75-a1570ccca1d0",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'c6112e2079816e06c22eab24d555db8f88f02310']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--080d397a-53ed-45c5-8e34-a18942f604de",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Agent Tesla md5",
  "pattern": "[file:hashes.'MD5' = 'c695ae78073e735f93f211fa7212fcda']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Agent Tesla",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--822e6ee4-caf5-440e-b3ef-558cabb600be",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Akira Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'c74a200094d791db8677749580fd7c0654922f8e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Akira Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cb92b289-f9a3-46d7-9ea8-8085091304eb",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c80c89d500bdca3d2451481e1fd11c415e821fc93d5b6dda7d084a421857cde6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8246c28e-02c8-452a-9f57-bfb9d3d6249d",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'c996c9421803c3cec691023ff72d0cfac604fd9f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8bb7aafd-b0c6-4e95-9d15-91fd30fd0844",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'ca74c58aee1dddd51fcd6bfe909e28237c19749f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5dde061d-6bac-407f-a532-f04b70d33775",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'cb1ffc9b0542b48bb8716592fd5f11b4f4db876b36989966fc364460d4ff55eb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--475a727e-3a86-46c5-848c-cfc4ded05099",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Creal Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'cbaba548a82efa8f454110a3ccfa084de17504ea5f0abc9e48fda756377982aa']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Creal Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--03e42f44-e696-465a-94f4-33f9e6d46a96",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "GoGoogle sha1",
  "pattern": "[file:hashes.'SHA-1' = 'cbaf112e891d636c47846b7513bf0192bf33d693']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "GoGoogle",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--77ee34eb-f9b1-4bfb-8bdd-318aadecc42e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha1",
  "pattern": "[file:hashes.'SHA-1' = 'ccb4038d2a6413d588c2075a40044dcdf25283b7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--49e16121-4dbc-4f01-a66c-f71386645270",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'cccbeea38669c1a1e9f34ffe141e442bdcb75768']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2fe24596-c2f3-4e5a-8fc0-c047a066fcf5",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'ccdd4a4218ec06bc360fe533c598c3d57dc3e270']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--15143de5-a794-4be4-9aee-79f09dffb755",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = 'cef73982d032d87a0b12cf449dcba627']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d7d43d3c-e2d6-4217-a622-ce0d20f2cea0",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook md5",
  "pattern": "[file:hashes.'MD5' = 'd13920711e72a1af4b1b1707f324f284']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--32736840-1ef6-414b-9feb-68485a4d4964",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "sustes miner md5",
  "pattern": "[file:hashes.'MD5' = 'd2af54541c6c68efe93d8bd398c00750']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "sustes miner",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0c41db86-4cbe-4b2b-a16c-5cf5e90ea1a7",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'd2b8b5b5974e8595a8b588f55d4e393e5595ee2d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3fec63a6-4b3b-44d5-96f4-62347f9f1360",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Stealc md5",
  "pattern": "[file:hashes.'MD5' = 'd2e3dcdcc038fff84849a359b18281d1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Stealc",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--77e8da4b-8068-436b-8a05-e6e74cf25d8c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd98684d84b676fbd89c39f01152c14ed7171065e59d1a231a15a077715859842']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--73eca126-0d57-48cf-b310-5e74715e746e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha1",
  "pattern": "[file:hashes.'SHA-1' = 'dd16728a3edd65970e6d49a623679f5b440624dc']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--943de953-43b6-41fc-893e-cbb20c38f6c3",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer md5",
  "pattern": "[file:hashes.'MD5' = 'dd2edb8c8c896ccfa5783d56aafa5339']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--734d0553-1948-49e8-98bd-f6a42fcde1e7",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'deb10b2a3c921bb2e0cd7a2180f96a6f0cdb1cb830e55b885b53df4d3118d8f2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--42570426-4de3-4ced-afe6-ff120e5af8d9",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "QuiteRAT sha1",
  "pattern": "[file:hashes.'SHA-1' = 'df39ebf4fd0c2e18551eb60beb85c167d14918d7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "QuiteRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d7ec7c99-558c-4565-8ea8-22196dc6eb2e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha1",
  "pattern": "[file:hashes.'SHA-1' = 'dfa868f7e442a22df937bfe18fb5524e5962d591']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9fcf1faa-c7a7-4b43-a9f7-91deb59fe0fd",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Coinminer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'e0685cab7cec838cc8542fb49a9833ef1735af39']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Coinminer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--456e4624-dbd9-484c-a5ba-0b5b975f093a",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = 'e2348850acff1cfee14eef492900b85b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--77942996-e309-4e71-a92f-4b2b4b4fc188",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e2d207bb898dc8f240b16e115b031c7ce37313c4ac3ccf51f5e5833349fba771']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e3d784f2-55b6-46e9-a398-a0e95387fdbd",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha1",
  "pattern": "[file:hashes.'SHA-1' = 'e3604f005b288e09ea7b93b87a8384591f494083']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--896869a1-c148-4e0e-a0ac-ec80865e3c65",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e42de348c01da6a95b259804866e362d74fc0ea918f5a83362cb60e483d86afe']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e096b732-d06a-453e-9c8e-15c2ac72eea3",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'e4db785e8eed21c8cda9ebf584b0cc0d1e768632']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8f0f797e-1bf3-494b-9d18-fa70b2eec736",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer sha1",
  "pattern": "[file:hashes.'SHA-1' = 'e72eb36c889a7c513db7403e9171bd20c40f15c6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d629c4aa-16ff-42fc-a074-098ad8c196f7",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e74cc1f2b364ec9f422fb8aa698efcf6a9bedb7039b68887f9ef3f44717fcb62']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--03f489cf-819a-45e0-9cde-4945e9466cae",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha1",
  "pattern": "[file:hashes.'SHA-1' = 'e7b1c7f0957b9b79c96547bf66d4391c046d04f6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--08e947b3-4f58-485b-acf1-d1d30207dc5b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = 'e7d834edf5487f8f3e8dfa36a6e0eb71']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fc1bf60e-ae8a-4a56-a029-ab8a9bf0ffeb",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = 'ea228be0de1a3540ff4de647e1969a9e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f47ee51f-c316-48ac-8442-c6e104a80454",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'eb35ff6265f6adbe244afbbbe17b8e6461c072c7200c7e4037a5c6b0ba2ae7b3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--42f2480c-179e-4d2e-8486-4ee743aca733",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'eb7f8af5756675f45d3f7e1775a967f18006799d061984a2d648ffea0fd13a36']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4a33d3b1-8233-4fea-92fd-d649b362a372",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Remus sha256",
  "pattern": "[file:hashes.'SHA-256' = 'eef6f4a9d8f79e847e786fbb90991939552d2d9acc57877d9cca1f54951734fa']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Remus",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9957f0c8-40f1-4097-adbe-a19b9356ac0d",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f00d7365fab7c0eb084761800596681461dd94332a8fe03cde998513435e5b71']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4d0ff7da-c208-41ad-bd98-f4b27a37c15b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Creal Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f10f34932dd7eb3f2385cf172e36cb103e8a508919021c8921ec7a3dcc56d8d5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Creal Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f46dda89-607c-4d6a-a256-2fc06dcebb95",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook md5",
  "pattern": "[file:hashes.'MD5' = 'f2379462544963a698f51b2866ac8455']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0b7a7edf-10a2-4820-bcd1-c6d567a2c3fe",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer md5",
  "pattern": "[file:hashes.'MD5' = 'f3a52ef1e498c22c5212864cc2e7852e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f9869f02-caf5-458d-b7ad-c76ccccb1389",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = 'f3b8a57474a6f9b81703542c512e9912']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e08e74c9-1147-4cc9-affb-7dbcf3a0b40b",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f3f6cd8ce11e151cfbada843611d0ab5fe00c62b66ea3300d12716b21889cbe5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3b65d945-6c55-4e54-b26c-c62a1f559616",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer md5",
  "pattern": "[file:hashes.'MD5' = 'f401a4fcf6ea4c330f18e1625dad626d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8c3c6be1-b248-4459-a9d3-bf7153995f4c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Stealc sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f59012e49f2e8fd657a11cf2008fe74ca289d189552e29cdc3d1078956ad0d31']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Stealc",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4c43c0e2-feeb-4c21-9968-f63d7d4f398c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "GoGoogle md5",
  "pattern": "[file:hashes.'MD5' = 'f70d1bc5756a31c39525a6a09f0831a8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "GoGoogle",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--499d787c-5372-47e7-abdc-fc1488475848",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f771de533aa21c387af6525c1b01415cbb43d83c85f80bb8b085fd90f5e20b41']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7159303f-4af0-453b-9531-c6c2a09a0506",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "NjRAT sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f7ac32e29cd35525d7639ac3d65e0cdc5a64f8b09bf5fa09fa61d9ea79354d67']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "NjRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3cb665da-430c-4bc3-8e35-eaceae39cdb8",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "RN Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f7c2945f90cf39e61ba243d34ae2897ba4ae4e4936216c381509df60b2689059']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "RN Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d466ca7a-a368-4bdc-9eab-6eb7ba62edad",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "NjRAT sha1",
  "pattern": "[file:hashes.'SHA-1' = 'f853e90473a161d69c7c513b0b23494bb20a6b54']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "NjRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0baff959-0a76-4d4b-a9fe-e5695d3111ee",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "ValleyRAT sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f942bf7c88e04cf158a6541a5ba60ee856ef34144a00f1c4fadbbde650845672']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "ValleyRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f37bce84-2696-4d3c-8144-1267daef01bc",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Vidar sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fa43e663995e393a5a66f63c1e9c4b700f5c1812aa91b992a4c48d9f748e12b8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Vidar",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--056b726c-27e9-415f-99db-ded13d991a26",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook md5",
  "pattern": "[file:hashes.'MD5' = 'fba75622058932bf7fe54c64ed225e29']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--614a7e5e-e6f9-4c20-a00c-c7be9586271f",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fbc618d078f85b856cb7e416a182b9030934f84de5cf16d24d7ece3d90287028']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3687ff5d-33f9-4e60-8f92-7ef6d19da757",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fbc75155387ce42a79b72b9ecb67a01085e4f8c832f8e03fac4df9a7ca174b3d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2f3e17b6-6026-45a6-9330-dd3e54f0cf09",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "CrossRAT sha1",
  "pattern": "[file:hashes.'SHA-1' = 'fcdb7c110beef4d2632ef116b73c197783b4148c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "CrossRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--43b38aec-3bf8-4858-9afb-71442af5ca9e",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fd6e37f983791d813f5f99343ee64435cedb8388152361a8ce3c7f7521c1d78e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c0c50d9a-f693-449e-913a-4e5ce6f270c2",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fdc398f55cc3c5cd02bf4f31f0cf287f96fde32aa370117dd40aa9017c4cc3f5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d0ddff47-cd9e-41af-8e51-93e6a45828bb",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fe97bff58e46446147f1a746d9f6b4e457d0e27c2b56eaa122184d43b0eb4d53']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--19f51bb8-329c-4c15-a8fd-ce40fd0c6a7d",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Raven Stealer md5",
  "pattern": "[file:hashes.'MD5' = 'ff18066fdde626ad255898a8500c9d51']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "Raven Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ac4e06dd-e10a-41d2-bb40-cf55f653ec84",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ff345e0772b3f3168bd1385216cc532fa14eea39f7eb8b2bf0180ca1fa000fe7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 71,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e5bf51bc-c951-4e6f-882c-26da6a705aae",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '15d84ebf5f6290c6172c02a7fb91a8d9e1747e05177cd3944a5a583ad8b7d2c7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d7c033a7-8d26-466c-a803-f5164baa36ba",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '1dfb43ea5771e8b518757c954fb5818a4d4a30042aa022bb1ce8ef3a837a79fb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d09a21db-19c5-4f35-b017-bc5c48bba733",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '2ae65ee16977d3d76213551b84a3e6af09b93d0c76860a26a2b4cb1ec420c244']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e487f07e-caa4-415a-9fa5-2da588c71270",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '6939099198eedc6eccf8b4e796a89a6d4b847c8b4518d335e3f15497af1474d6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f7322051-e874-478a-abb7-64facb95d95d",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a17082e99972f4dee162fb08bea1ab1cc761577861f5250b20b81806fc105700']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--620ca50c-f001-4985-8158-82a3e47af084",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a3b6302b489c7eb8df3e0ba02d0e34a9f064421a703f381ad2adadae06d898bc']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--670a727c-96d3-4312-a6ef-8facd9d7bfd4",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Formbook sha256",
  "pattern": "[file:hashes.'SHA-256' = 'affae61bc8ca3c1e089ae6a3220fb7c633f9e5af791c6d70c6c1c4191f230684']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Formbook",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--11373967-a4e3-48cc-96d4-0f7e1dcdf277",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c0b488bbda0c5a3e49449a98ac64bdf6b4757748f60f569cde4c10759a6f34b6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--49a749fa-d340-4cb6-8bc0-2846f27ce4bc",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AsyncRAT sha256",
  "pattern": "[file:hashes.'SHA-256' = 'cbd25e49ec37d2ccddbc4990fdc5355af5f2ca0be97cbffaa7c7674422809bad']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "AsyncRAT",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4cfff0ee-fe32-4dc6-9600-f5bd30b64c65",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd23c6c86d0e1a1d88833a8e924a2295a0cc40f9bc22e88d2adff529f76d6051a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a3f13ac5-7ec9-46ef-bc85-98bf125a6138",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd4d7fafe1b7ba39d17f3e449e88f97dd37ebd701b83010cb6652d778ef8d7fda']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5845f196-66e3-4325-9671-69ae99f725ed",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XOR DDoS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e38a00e0062998fbdb647b1ce8c87bae6e05a3b1dabeb237ee574332f43e19ec']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "XOR DDoS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2f0212bf-d9e5-4d26-8783-28d24a2bfb2c",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ec199aaa3e8c3c872a26b3b2ded9b57b17e33f3973f710aff8e805a88c36a55c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--52e51cb9-f080-4ef3-8c72-a605f689c7c2",
  "created": "2026-10-27T03:12:48.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f3c5fa3fb2a25c719d71eee6f7af40e41478d9a31686c439b5535bdf4addb80f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-27T03:12:48.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7d38e806-56fc-4c9d-8ca9-e3fbb166a91a",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XWorm sha256",
  "pattern": "[file:hashes.'SHA-256' = '0641ec66f2738f661e74fdd5a11949b9e80e45764d8292d5927b4f2fc1843a00']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "XWorm",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1edea1f9-c32b-4f51-a710-28940672ef75",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '0d7b1f4e62a20a241f588ae137b3827e202d9fe10283230823d985544daab88c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6578d3ec-7dc9-4b29-9fe7-a35219026c58",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '190ed66b12d54b358dc45f82d48e880be82bb2e7fcb5d9ef9b478b5ae1ddaca2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c37ec04b-a682-4965-bda5-b5e90a7f20c5",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '1c9c070c278bb724ef711f34ccf494128d230c3f9ed8772164e6d7b8de2066f4']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b2b04c78-2cff-4764-af68-d91f3257cb38",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '1e4e1ee9dbf92860cdec84b0170228a0cea1f276e98133b243b077319a8eb8cf']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--09f30520-6dcd-4a74-94c2-f0935bd240ec",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '29c6d88082c0e10395e60189768bb9b2cfac68d0e37aeba7a2e042e4e64aec4b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9decaca7-0bbf-49ed-94cd-84c2b632d2ca",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '5b2e4c5b7fae354be03b326c607e41c3b7fe9a1d729fcfab5c7b4b64026ee795']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8f909a21-8096-45f1-8b4e-161da2691e57",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '666e8727826b4df74ff25caf368a41581d956f5942fab50d8c64b055f2f6a8e5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--246996ed-d6a8-4224-9d6a-5633be0497e7",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '6d9fe873ebfc1428ad99eeab96d2cd9d6ede832bb9dc7f1fc0eaa2bcf84a2e07']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--df02728c-71e9-4bba-b106-fa2510dca36e",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "DCRat sha256",
  "pattern": "[file:hashes.'SHA-256' = '7428bbccd4dcc416487e477b2a7055757502529bc5ee6fa855ea6d99be0490ac']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "DCRat",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7122ed52-648a-4f60-9c47-f7ec45d1822a",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '79da353594d81d29c74225f64df9807d37e0576ffe86b690901ad4ce4095b714']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--04ecdffb-dd52-4d98-b30b-c311551dd0af",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '9202745a156efd0b7c5a5053d72e4ac5765e6e18bd0d4318dffdc320a0a0fae2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e09602e9-fc2a-46b7-a144-4ff10c92376b",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b92f00eeb9d90ccbc2862c8f92f71958afcfd2b5deb17ee1192e175c1c2508c6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--02e37f52-bd5e-44e6-b6b2-23ed76b2a7c1",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c18781474938f8a30e11078654eb744f40d7c49dbd500a13739fcb5e97befb4b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--44009d50-c0d2-4c7e-81b1-d7de56da39aa",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ce8d44990d8752f456bdca07bd95150c72087fe2b1813e04292d2a31b2a7e996']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f0d3d7ea-0c21-4be9-8daf-7fddded3fc7d",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd167eeaf74ea51be6a478eba0e42c3485b8b6600f6a0bd4ff77106930dbd0bc5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--48c83e1e-d261-4287-aff8-aa292ea44e1e",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e5d63eaaacec14120593cbfefe46ad6e3f5db07bee43a5e60796ae145991cd46']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--979562af-b265-40fd-9de0-f4ffd7a5ab95",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e94edc0f0ae04c514d3fd35eea66262440f6a626ebd2a49fa28a10f2e43f6759']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5ee4a5fd-e4de-47fc-85a3-bc084debe103",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'eb48967f0df9cf5c4865901a51ecb135e0743e7e92907fffcb20075293739523']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5458821e-dc4f-4553-ba0d-f65bd2b4b042",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'faca0783fd2d9ffd496855e577eda91a5c9d1635e7849bcc833ca47aa17274e6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1fc6041d-3c27-46f0-af0e-fc24b62cc6d8",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fca027a07a53aadeda8236ad2cab85d4374a4c09537ca1473e62fc12061e0c19']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--45f084f1-d5ab-42d4-8b7d-b015146ba076",
  "created": "2026-10-26T23:24:55.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fdae1297014671ba62d8ffe8c3ee13dc6a8234eb1c3a7d0f9ee0a7f19d190a06']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T23:24:55.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0190ae18-6e0f-4747-974a-750acebb505d",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '0df9702efed752e824e600287187540fd1cbc50e52eb3b1c4cc06126446a27d1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--675b0119-c360-47ec-997b-3c94d78d7789",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Remcos sha256",
  "pattern": "[file:hashes.'SHA-256' = '49bcc0a6fa25f1d01ff245484042523430a1341b16417f343520f06a43a7f238']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "Remcos",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4ed46e7b-661f-4f90-a561-ccb9cfbb807c",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '5fbe2d464ee5f0391f98907cf43a4e37fd37aaace7e3a24e898c7945bdfcb0e7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--99d71dd2-8a37-49db-b243-bc9e4847d08b",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '6446789645919a0aa36e6711dd5cf187e9b1db367ce883efcae0ad812f73053a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6981f57a-3a35-4836-b3fd-9f5cf60d2880",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '87717b022f21e66c4467beda7d640736b386e23ecf5ef900d4587b6467bfd145']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3b0c0582-2a6e-4011-8c43-57522c027140",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '87dfbd100d6e06d26c9843d74344ea31ebf8785a2a161f2af4c9bf0c2d648e56']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cdae6ea2-434e-4653-92e1-3204a83279d0",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '97f99f1c138606ae7f1ebb2a73ad1ae6111927c894a4295f40fa1d22ac47770b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2160346c-8838-4868-b4ea-c1495037633b",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '99476d2fd1013e6902eb0c79e9ae873e8715887b958b3221daccee8919d468e9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a43fbc82-2f67-413b-96eb-b4a7345bc094",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--24f234eb-9a12-44c1-8940-8087c9f7cfe4",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b5fcabc415d29d82f33c62bf760ea0ae63ff062e9c2b18f82435750831493623']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--17311698-68a5-431a-8f66-f6d8fe59d34c",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bc0f6af5d830155321cfd1b228eb092fb9162d495ab1fd2e6e7ffc09ef973ae9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2346232b-ce63-4963-a01a-dbe54e5a1e6c",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Lumma Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd3d8c0efa4c20e55e07a3266db9f8b433e65443496bd078bf333bf0d0c2a9d20']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "Lumma Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2c1b74e5-3a49-4962-af97-97465a7f1a99",
  "created": "2026-10-26T21:22:53.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'de705c8a97be69dc824f406561d77bb28f15b23f3e650edc64db8eba6f99cc82']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T21:22:53.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ca0951a7-4af7-4d16-861e-be6dd18bf40f",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '0d71f57e0da7bb32157be51b9e96e242b2ae82030d133e9ac75b4dce6ce1c96d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3b480847-e742-45fb-91c5-45f10750ddde",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '181ec92cc09b00bf5d00f9a7f0da8dc1844358232664ad5456f210d591bd8f55']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--89c511f0-41d1-4f54-88fd-13d670e302a9",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '1f098cf367885640acf96e8ecbfa805029802f1549634f01e795bc87aed11ced']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6f45af30-0e9f-44f2-bfe5-4cef2af5a9a4",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '30b8d7d6c3f3f9ff3c30cda762b7abfbeabfea45ae3f63686a2738accf1c69cc']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b49d7be3-78a3-4c22-acd5-b02d34db60bc",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '57edbacc6785bde555d8455f39bae5d1426467a4617c63b3f04d88c1fd4f44b4']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ebf64c07-9561-49f6-9632-b2409e3dce28",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5b89ab64a71c9e9f8a89abc0ac14d04671d27083c9192cbb96960292e9157f28']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--40816b61-da4e-437d-be9b-b851b59794d4",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5bc631967a0e38092471618bec2655b473da3b9448281dc7f944880fe50bde99']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bd18f7d9-07e7-4cbb-a416-0035963d5960",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '61645f048795c29bb3b8e342487a75087e73945f43faf7d260d29750976860b2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--501674db-fb3c-48bc-aa6d-06e3aaf3bb72",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '62e7e94733ab0e1a581419037c148e75a5458eb236414a469869d8c365d78a61']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8eed3ff7-bccb-42d4-9922-4a60e166c3cf",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '6e5819301e93c5011f823a7467c9abeacd4ed481181de64877edb05d7f2075c3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bdecf8b1-3006-4b8f-8b51-8e6f42a1adf1",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "XOR DDoS sha256",
  "pattern": "[file:hashes.'SHA-256' = '6f45c6d9c70d97f695cb7bbef362812a17f8ed4d37dafc342c26c86ed9b43638']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "XOR DDoS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bf5b4393-b3a0-46a4-a505-efae00f2c0bc",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7081fbbbab2ddbe83329fc1525894e07b8b97c2cd554a60c3bc17ff61712efb6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--41b6f9d8-9524-4bcb-8cfd-f2377ebe6cda",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '91b970b36849d391ea346ca9b41886f440ded1b10edbd1256dfb822c73e96852']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f6d7204f-7251-4700-a62f-54bc830736d5",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a184be7ca91dc0ad712b8b9509babeb7e8a79d984d009ff3b018212fd97ddc47']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ea5c50ef-9870-4607-a189-9ff80c48f799",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'acc4cd59c090aeefb19581c8141a8dafdf374e9c7cb721137fec23781f11333d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c3604369-ae4a-4a46-9a73-183894236514",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b6d6276ea9547df63984829b991e4d412d256c123d92f9eb9981f50679d69b5c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d7bd081e-ea58-4225-8649-3d9ffe0f65b1",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bdf266cabca5eae6bcaa98efb155a5c7eab04f1bb8227b63d589f4895507d47f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e864ba14-bf3a-498d-90c7-89dd4643536e",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'cb1d103cbdf37ec599f8f58b3a1bbc7268bb42e79c6b76eabdb69b0aa12c9cb1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--eecf4caf-baf7-4797-98da-02b47493b033",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd8250fc6d2cf5f9ccc259fe62fff2266c9ead401e60e3eb8dfd5fc6240389b2e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--77e2cf60-1b1a-4e93-bf2f-b7ffaa16c213",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'db300c47835860f1fece9e56c17e95e5dedd9fed53857ac738adb2081e36be08']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--329ae999-153f-49a0-bf83-bfa9310871fc",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'db4a69989fd4f49fc42dbd7dfcc79537f25e4d63805d09ba73686b7cfb901af5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f35275e8-870f-49e6-b101-a7676e980038",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'dce923fee86495f12e1aecaa17009915e7a408b7b5ebfb38bad3a39994e5aa8a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a3bebea5-f467-4985-9899-7f1e9052c46e",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f07db9850af3d6f01010d9ec954be41694b9b2102bd77a5b01111f7e74146c18']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6a0e294d-5228-4fa6-b59b-9b3ccf2cd63c",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f07f6f5f19c960fb6d7e0617624cc2d309ac80875bd26987d2c309c434e181f7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8159873f-5686-4a21-9fae-8246219225fb",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f14c77daae60d14e9ec2830245cc70f99ba1ef5bc559e330ca1c2064900684a0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--754f3446-0fc3-438f-bfa6-e056e7c4f85f",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fbcd498a82a05ca491003e7975f349b8fab1d89786f280dd55b78f833632eb83']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bfa7b317-07ac-4f0c-af7c-46e4e5e6abc1",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '15b854997d58ba90b3243525171dc45136dfc06cc88d37f16cd21acc441700bd']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--03b8dff3-ed30-4733-9525-8985beccdf8e",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '1ad3481cd203237e06f089e10887b3b49e52b550ff73af58c9cbce34de887136']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a550ae07-1c2c-486a-9510-5f854231cffc",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '28fa49e6176856c0b9e753b351d99b1e6421f8fe7d6d9eaed13064481e51ecac']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b865d00f-05af-4383-9db7-ea596279df27",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '29675762fc30b9226091259c8aece4fe87c92d45b586547b9010fc34abcf9510']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--663a4523-13dd-49a6-a500-ce7e40a86fa1",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '329c8b6856e6fa18f51f5af2d512b5d3264e01c1664abac21a4d3f21fff5f36b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--21b2db00-6ef2-43da-b953-eac556cb04ca",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '32edf70e9f0998c25ad5328dcab6f171b072e3f411c848735278db1f358fbbec']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6d30944f-3a33-4c25-b3f1-f2227618cfd0",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '4da3af4b73a357e13d2927ba2d3660213130330685d9c729c3490357466c5251']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2d6f17df-d0d6-4749-a67d-4b617740fb42",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '617e42d2497608afcf89dff337724eef62ce045ff792b325ffc9f9475eb00eec']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--af7e1c8b-27d6-4f12-8d96-46b4baf01af7",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7bf616b51a46a38a4982163bf24d504b726fcca85c01b15564a93a785d6fc700']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--57e9e324-86ae-4374-a0b4-00296694233c",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7cf705ee69cfcce908351c67b3d12afca1a572895849f94cb6b0a5adc776ebe0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7be760d7-7162-4348-bd94-48c42076230d",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '9eb052edaf2d307bb328388eaed113b428ce630029973135c7e373052280ad0f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--698887c2-e6ec-4e46-be37-affd15d83d63",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a353259c6d0e27e373c3d87327844b0603fcdaa1401cf2d54fb13607f6f0251f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ca052b5a-f702-4ac2-8eea-11b6841af475",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b286cc046d47c8ffcd1b3f65ba72976109c62d9712713c5c113b7058d78095b2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8c803137-9961-4788-a7cd-5faf436f9bab",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c868633faa9c3660d25a33f8bd6e82b58a85b3a6bd32d42818f7954ba1c3563b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9735fee1-5a0a-45c7-8c5a-3a580b1cb254",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd09f2364141538cf25cbf5c325e06b65d7364421d9645cd1ad13cc2831088f11']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1d5e1f5c-6377-42ad-a3e1-b98161f49f10",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'dabf7acb9a07eaad5b219eca0517fd7af44389a1cff035829c80d49879fca68d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6308d12c-4a02-4d97-8782-7d3fb7c9b31b",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'de773f73bac24590b3a0562f46fc8d20f9b6b19552ff001ae1270ac326167b86']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--56a090f6-9f43-4973-846b-07bee526f62a",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e066d79efdc2c9976e0ebe0a059e427bd11111eec3a808d14ca091c882bb15c6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--19dec02d-227c-46a6-81fc-adcfc824f67c",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e2a4cd045bb08009800f6714ed05c31ff903069352a8a14755fe538ebd10e425']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--718d7ce9-bb5f-48b7-8012-b27105ea2106",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f48664d3f2b359c75bf2241aaeaca7d4ffd885997a37a31fdce7b1f8e1fdd24c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7c275922-5c05-457c-9c73-0a78d6445165",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f6bd3c78f0e3dca137bd07a17802e9493cc1b031e169458ffa5be2f84f5778ed']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ae295935-67b0-4ec1-ba44-30981a1f2196",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f8f468faf39ff9f7d54c09d8bf9ff163038d86e0e3c015bdc53df30ac01fab33']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fa606b77-208f-4edb-a843-424a043edb62",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fb0165fd3ff83a047565f5f304316826ccb8bfd403c6fedad75b1c28d6efa0de']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bece792c-771a-462c-bdb8-ba5bb057e6bb",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fb9ec9d47f76639ad6b417e5d021ce95e7af58346ba9e3010f27e33e9183cf7d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--24e78f1c-1c79-404f-8b63-4bc913df0a24",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '07445494a699ee31363563df1f6254f5458b3a8343cc4d3af84c466bd6e55d10']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--608f44e9-f7c2-4c93-befb-2a5246620bc8",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '10e3bf8023104b11cbea9955d76570092e8c9fe14e86ed17b32786f3dc9da716']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--446a8db4-ddc2-4c47-b1af-c148774e486d",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '16c4c2947ed6644acaf5a09814fd314c480b32dae0182f18830b93a88ec49b45']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1538f674-2fa2-4a6d-98a4-4ce916c12702",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '20b5c7608afa69688499cf3a6e44afa43a8d2938705db49beb2d4c995a3587e8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9909b09b-055c-4519-b5ed-3b0786c0edd3",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '23ac9467216e33bf50c7f58e99613f0b36e6fe1d50853071fba3dc2c2535f5b2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d6641254-6c11-40ff-a2a3-7e73d30365a0",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '24eb1426b0bedf3235a02301675b56dbe42b70e18788e4a02c4d6bf50305e8f2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6584ee47-3130-4e6c-8b6e-807268082a29",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '362f9a4a4e8d309d4cf0b647ef011d8d9c087742037030e9e9da472956e9de40']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6e3d4a2e-ce95-4464-b839-77140e3dd39d",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '37e916a94348781f75e03035716479f2a0ab59b7d9eda03b5dcd4621ff1768bc']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--66eb9140-508b-4e67-ab3e-70b2ba940d31",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '3875e700f4fb720e6548aebe75be6df32352efe1ec0a6e8d5d036c40d3855167']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8ff56ac3-9094-4f94-9dd9-432caaa98cf2",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '3afb2ce6f50ccf2e3631061f542abe3a722f4c2a0a4b7ae6d1d8ca5b779589ae']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8c69f048-2933-4201-b396-08887a59be6e",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '4b107d24922a8c683f59847ff501875ead51cbe376fa8a128e5fb629084504b5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fecdfb46-136b-4d2c-bd08-4152c7f2012f",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '524fe38abc8ab665daf0a10cf988ee83bdb30f7b86197a5bb86aa34b46a6bde3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c7d9ebc3-972f-4974-87e6-d5108c86e349",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '52ab2b45dd2d4186b061c4d98f6b03d8ce29104bf569cc501a2e95f92c514c30']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cc86c42f-b5ee-4e9f-ad25-4bbc879e9ad0",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '5a5bc9be71220c0ed97ec594a797830807f960f4a53afbe7b624add7ae78947b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f3252281-b345-4faa-a429-1a489f9e011c",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5c534ee65ea69cbf26620827250c49b22cf1f63b350c194081e70bd8e24f2fb1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--687e9d0f-a890-4099-b3ee-e4dc530b55b4",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5e4235062ce6bc98dab85cdeb2391a2c0874260ad8c8fbee7e7bf21bfcb07c1a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f6b5fc63-e54d-4383-8040-933c47850f19",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '6076e4498d2871564a36f0d89d5e563838ac599ffd1e99a79106fdaf8659abf7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e23a5dd4-7a43-40ee-8691-39b25bce1e06",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '6dbfd3046564c7bdefd0fe13191ae125c60d16f004a5b13dd09bb652fdea631a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2c07ec08-749f-4729-8978-57e0647d4bbc",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7cbe8cbad067284f941244eef738cd505831efa6d88505c5dd334296c31266df']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c1c1ac9a-f6eb-4889-bb8e-e6c6f2cf892e",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7e10d48ea6f15c2e87b7f25de736fdaf6c934dd470c82e221c5c0b8d01f45e40']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--41458b5b-f251-4201-b588-6267f987eaa5",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '7fa5131bc2a628f06499dfc8728f29f590abbbb2ebda3175b726fcccd6fab4c6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ff4781f6-9b05-4e50-a313-bc4a9ca78c05",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a29706981632741bfb2aee0177576897ccf0a0e6061a7d573930a3e6f733bb9e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6acf97b4-4aac-473c-bbad-890797dd1284",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b143a651b27791f58aa3fed1b83f9ad1e918bbe0f65336ba883da13dd87d9ca2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c93b18c0-a455-4563-a463-c53cabd1c691",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ba307082825c7b5d06f4378a8b5d32eb8df098a240f3a0f700cf2c949afd1dd9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--08409a5b-fa3b-4332-98fc-ba2c4412dd30",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd7dbb4da0df3c6919a05ec0b591595476e91f2e63a5bd72fde7699f18b296129']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7929dfa3-39bd-47e8-99be-f7323f25b38d",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e0600aab9ed876b64029e08605357c8508a96c08695327d6b5816da8f4cd559a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9099c892-cef0-4cba-99a6-c8d731ffb69f",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e3a36c00ee6af14239e54418dcbdd265f874660c8cd878b233128e4d0df48987']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--420cf6a1-4294-4aa4-8531-3091ead2d233",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f67b70eda8428152b6b5ca93092fe7f5d62c73ce49f36a3aac8c9ce33ff30e7b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e4eb465f-c172-452a-a532-8e4b52b1c207",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fc36342dde6078108387be4993d022877f1e285b48f8e2716323d163716a3f87']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b2fb5e7a-b95c-4544-9d39-8a17f2498152",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '00522dcddb240e0a77614b5490245710ff53734e9f918c3f134a2ed47387db45']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4d720587-4a79-41da-bbc4-f92f64dacb3a",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '23148a6861ae7d575a031d5c39e22b635d2cb82f84505f8833be005cd18a0894']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4f6e2198-0542-421c-809a-1daf42b6b873",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '2812cedf3f4a6754316b83cb8b9ece98070784a0848f56582f2c928ee13e8fb1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--623473ad-c5ef-4e16-9fb8-37ae3b2f6987",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '31d6f56dbdf84ce4803b8a5d9c5fb904a2f677f3f7fb0b2a66f322706c31f88f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8c952f12-aae3-450d-94f2-14fae21079cf",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '3447a73a770e2cb9a47db2b8488e81f4677152c576e655265aea113730c926f2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fe3d9bc5-5aa7-4420-8e2b-9b9964e657ea",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '441206a3f1648a44d56735cc2ee8054da50cf279a8924bc985ccbd9fe3a57c92']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1866d01e-a8ef-4aaf-a773-c6ee3fa91834",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '493ef64b29017cc6ed3468991f75d3214c4acc63984171154a88882a4972003f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--97d85d15-a192-46f4-a5ad-077b868ebf88",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '4c2cfc403ddb295f4ac6177ad4a0be834bdcde5123c1d0a8d3dbdc553c56bedd']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f49edfca-81c3-47c6-8989-2a75ee4762fc",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5b0ce896f1c2da584b089da607f409cc537cd6a70b0ad4ced9baadb5a591c160']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9f817c91-cd72-4cc0-9c7e-f6803c5e3577",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5c7ef4d50a42260d9c72be5b7db1527e1c103bcdd3569ebc4cd056f6e97eee7f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ffdb5d00-b348-4ec4-a71b-f0c197613cd5",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5efc7daeaf2173451cc9d4de68b1fce1ac8c11724e8cf677ae8bc7deeddd3cb6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--97f75bb4-dcef-4898-8a70-a660c35d2169",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '658b825805a79f32c7d0fc4df92d3a6ccf36abd456b107a7a25e0d7c52fdb2c4']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ae3d1b2b-f9c4-4355-8851-cd7cda749825",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '66c2f6e23c9508b6ed678672ccad376aa98ed1d084ec6c39c6fffbd4ffea28b6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--aba0cdbd-6c8f-4467-b53e-8641fadc3a49",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '78924ae85998d13693f09ccd164e9436483029a4fa028a5574973342dd473715']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--df13cc24-6d99-4a89-9f24-4a160afdf40d",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7b0543c8f05b3925ce1e46d8e6540b640691c61bb2e0db9418bae560e3902b2b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0681d958-b4a5-4bfb-ae83-1fd195e9526e",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '92a9e10a08d4306262ab6b791a52f8fe70c9bd82de7121dcbdf2cb98d23fe6dd']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5a2ded36-7aad-407e-9419-fa66a899e6c3",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '99a9006e489ece97c7c36db82fc239182b8ecaefcd002af520e7d2e4451c4543']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7ee11d3e-de11-4ce3-975a-961b2f51269b",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a8d6cdc8df9e87456d974acbf3c7219805fb00da345aadf1cb92cd52ee44a009']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a5693d7c-63ff-48ca-bf85-4a1ff37218d0",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ab7f331aface4ca23e2eaffe9e20d362c3763662966bae052f664994a803b40f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2e2c0413-e5e9-4403-a372-47ad6b9747c1",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b0d56c7af84fd5088659543f257a7ea07986cc79b5a3686270075c69a64e917c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9814ebbc-f5aa-4188-9361-b0edd66d2208",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bbf850935f1166f85ea8d6833bb3fe0519e50b7ef22868c4697f9bbc6383e9a5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a6bc5f3d-e30c-49d5-89a1-ee726618235f",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c60743f1b5204b82702f6d0144593444897a0fabd32de2410aa9363eeb3fd204']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--153cc1eb-0ee5-49cb-b02b-bf6fb72871a5",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd3e6debeeda599bc6c243935cc432f6eef52fec0491f8f9f330a70994fc64ee1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--928a59da-ff80-4eac-a61f-90b3ab36a1b0",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd8c23da86a1fc4213579efe78732d5c98250a895a564bf6fb39f02a4832650c0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2a11057e-6ace-453a-a447-24f056574f06",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f1f9fdf4403a58ca0c78a126f1a0496afc0f374d85958766f3d7a1629227ce60']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2f208308-64cb-49bd-bbc5-7be2e3a8cef2",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f8d259a67c531f90e13d58397c153a5fb112d0e9c19c3909258a2c461fe6bb95']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--22cc56b9-ccd0-4d6c-8714-88709436887f",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '1087483ba137024a97d09e162497a7fe1e4a5c8fe5b9abefdd804bda35ccfb40']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6de63aa0-1fee-4ddf-b943-537d0eb839f4",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '11a120766b864e5d64e69243a772a9f02404127d454acc18b3da8d71d7c80432']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3ac7612e-61c6-4cbb-b3be-7070b8f3833d",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '15b316d0d5385147d5b85e5b940d8e6bf664c9cfe2bc32546e8b79b782bdc230']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9583a001-bc0a-4f5e-9a42-4405fe368bf9",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '15c28338b6bc3ade51a5054d532cab12300a162e88d61ed7e31319ba4d9bf160']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6c7a15af-3052-4eb6-b5a5-b5271709fdbf",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '1844cb426938fc15bb8eb809026c05a0f9dcedfe64aca3e8b06263e49c415e98']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--171be639-68ea-45f8-84dd-05f657ad8b5d",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '1fd739c3a4848b32822198f2e58455de330bda07d18d1e4cb254f249c46dd435']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ab083647-a503-4a74-aafa-75436f42a2fa",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '357f7d54a164eb9abf535ea8d72f2dbdf7db3b85d636f67397a05ba5f80765eb']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a77345a7-3c30-44f4-b1f7-ea8bc928ff0b",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '4b512c8b390f88652a197a988384aaad4fde84300e41a3954829df0fa9cc926d']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--47471e4e-345c-4c4d-bbd2-38b60c883e51",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5a7c5be18ab40eb69629b25353db969fb0d7c1a90a8aadc5c23d8c8b0bb3b3ff']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--eecd2aa6-40dc-41e5-9ede-005f794a773a",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5d212b5c62ac9032859e57365ecdc73dad35fc0fcb17392978d953bb4545a002']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--428db617-1a8c-48a4-8b53-fe57691168cf",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '71d4699009430a0c83d4cb0f263e338b55004e65eb8aa1c3a507e9ef2d1407f5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d1bfb656-7d25-485e-b077-ac17ebb96ca3",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7b8d265de467110c38da240fc9953d272047acfb657815ba6c3dd38e927beaa8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--77c49cfd-6cfc-4de5-823d-0e610546b505",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '8ff75b74ad851d689abdfc97b13f0a233633beb3cb279f1f8fc2a439f86861a8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6c2c4e75-22e4-435e-b057-ca2c9b31e7c3",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '90c43e333232ae0c7ad931f3dfb3458a932e457f96b46acef1afce7d460909a1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--aaf9f504-487f-4712-a6b5-72908b950193",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '9af500ff2d42427c53ed1c8578da4276b4bc9a6c7b707224e1a0460852e954fa']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d4381b37-536e-4b9e-bdce-7d9bd290a3eb",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '9eb8ff1ac59a84b216204502ee462631d5eb3e48555f72c5a5836281d1abb1a9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9a98ab2f-4f1f-4362-b0cc-62e1f394dfc6",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a4a924b5800e42d757d7bb02ab0798f1ec6c7914027f2791051f10b71cc36aac']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--26028b15-5d9f-47b5-b825-f7e8037ceb05",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b4106b26d139e920021a5c5da4845177de1512884c3f6e095905897ed15304ec']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b6926275-11bf-4275-8395-3a0184c50dd6",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bcc01c9ddf5541c2552fdd52ebc0b831329f53bc8a186fc867e34a1dc67e766e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8976f865-731a-45fc-bd2e-a1a4a3bfea48",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'be0e9d85166bc87a99896e580128b0112bbe2ecde436505b8696764334d1822a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c80fe37a-7026-401a-a88d-9699552d2a23",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ce3774683464464b759c275e77a45b1cd2a45e91dc0f8b9acadfb44e6def8304']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7aaecb6a-6afb-4fb2-90e3-193ac62d45cf",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ce8ba4e0c9bcd47063f3019393b1bd83f795766895b22ba868b2b858f65b2894']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8a3439c8-9916-4639-9f05-789402e7b297",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd4a66d1e776e3d0c3dfb29e293790ca00e8c4819703807108d933a66b0372a9c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--150006b8-156d-41fb-9604-f07ace775e90",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e3be112566a17c4f37cc8cbbce8af9a975525c1d7ecd6932c7f9060ceb046a01']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c9799f6b-ae75-491c-bf73-cf944fdbcd34",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e72370934733632938d79935f5f7f3e8079bbf068ac675c06f304f7a4ddb24a3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ab5217a2-d191-4d09-b501-d9496623628a",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f7c636bf524e0337fdf57cf8da0a8bede5c041775543a91b180b320d53e94e98']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--21aa9f10-ad53-41b8-8151-1b6bbeee8f08",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f8a63bc1edb0a345ee29f55f93fd948dc3665e8e04540b5ea523ad9910d95844']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--89faf5a1-0681-4eb7-a137-e351a5d2daa4",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'fece4bae779013e7eaf4318452c4fc7e23926f939c63febbfe774d110fc81952']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1a80fb50-0dc7-4b03-a3b9-6908d4691395",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '0181cad18706699a580bdc030b44ddf4c9da6ea180b1f02217595ad50a13649e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0041f152-7309-4fb0-8ba5-2c1ef445423e",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '054e9f8e29c25fa2e0715932e581ca1f1797376c4cc8526f933ec4a84b264445']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bef2ddbd-ba93-47c0-a4a2-c895704357cc",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '055681d35d9033885b79d8f1b5e2a5b84802467d7f13aa2841c4274d6c781db5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--baf33711-8ba9-4405-8f91-64cc0b62feb0",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '05b9730ddf48a48932316f4bb6c8b7b12cb76f2543dd1771f20efaa1739f7472']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cb0c4a1b-65d6-422a-bd2a-4041e4c36964",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '0bb8d03bbb250b63f0f8d7b16e258cd87aac7a2b4a683393940e4ad806f9c87b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--164e7573-f44e-421b-9363-67e7e6a7261b",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '15abce52aaa4a15777d4634cc6bc0f5d5e4c6adeb6a791dc021f85d7597cff34']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7cab003e-d04f-40da-a173-8ab981ab7bee",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '196aac46c392e8b80fee334d4e04ef457e08ca0f85dfc5f0111b829b0036b9ef']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--43beb307-b1e8-4777-a36b-ffc7b7455426",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '21c719875be1dca7563f6f4f2d631e1dd2e0dd358e4eb278c5355d1eddf73b75']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fea47ad3-a673-494c-bbd3-d1fff7604f6f",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '25b38b9ad5ac434a4fdb226611ad7f039869d0b09ef8f66f30c9ce35d2bcd6db']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--632c71c9-4c9c-4e72-908a-dad3dad702ac",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '2ad56ae396285cce5df417b26a2b0d5680e4167f23deff2f056e822d863c43ac']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5a6c2d1f-5ff3-44f3-b701-ffd1a843c84b",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '32621b6bf9adc3a187bdd1a4be7aeebc105f10e0a787ac9b23b5406275380912']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2f809d9b-7564-4138-a972-1aa85915a69b",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '32f53b8ea81af7492d5e316584e50709e3530697937a67387312d21b1b0371c0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--43bc69b0-a883-4636-9793-36ca731bdaab",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '4d163744e5bc83e937a466c9055eb9f151f67a878db9fd69c35c47a6ca58f66f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--91989bf0-2d09-414f-8cfa-b854a3e607af",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5a3f4beadc4dc3081d511b291dc98ddfaf43ea47f3bcff8edec43c4d53109413']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--36e4916b-4317-48ea-ad79-ed4c8a207be0",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '687ca028c454da88ddacc25254c9dd02bad7e44350092949341773863d52027f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--452fead7-978f-4595-9a09-b0b634df0653",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7577630eefaf720f51b313b250709cb3c31781a5c00445ac1b2f8f1dc0436806']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fe5ca7fe-1058-44f0-bf9b-f049dab2a289",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '767602240f255c7c08ede0cc694d7f25944c57f7ad57dad4ec69af4e3173ddf4']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--38dffe40-70fc-40c6-9514-987fc5d30b0d",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '774e5e3cd2bfe07f086220fcf57f674d766d5c58e602531d9be66aff46372c00']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3b647f92-e611-4d8c-b78d-0345efd7ac24",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '88d8ca279abbd57914e441081bd5635df6c6b78ac5bbcaa024d90329821a0ebd']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d0eeb71c-8e5d-4b38-b016-74249a7ea40d",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '93c96340199326dfebd1188f123844a42d213410df37c9b0b208c6a6da2a29a2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--60cd178d-92f5-4562-b235-24efdd44b512",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a09ec666e7d36d2ee57f9b8bbf5ec56601ac3fcfdd77d2675cf1bbdb2e87a4ee']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--008ea129-bc03-4b22-9828-c1ff1c6d212a",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a297ae33a57a557183fceac371d9878f95003a1380a27bdbed2f43b4b8874346']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--57455df8-3dc6-40f2-bdb3-e1e5f7f57b4f",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c4fd956a4527d9a984278ac3277380e304c877d953282408258622375ebcfbbd']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--20e67032-fd28-41cb-874f-3f87299df202",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c8271020640de1a9d187036fa2aa57214644a3942446acff0a62da41c6db16cc']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7822921c-0702-4844-8acd-9612b085836b",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd1566a855b9427fcde43c18c1e9d8371dc0093afcd13ef637895af1e4e2bd002']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0c58685f-3ce7-4dc5-803a-e20b0eaebd6a",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'eb20b842c2f285a10fec04e064f06553902e70ce42aeb1653a802cb4563f9d80']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d3f43d47-31fa-4f68-a1ae-082699310a03",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ef85166c806e2685a5a0e56d77c574ef21af6adbeb9d8067ac82de287897a960']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--deb8e281-d3c6-4620-9732-8f0a6358485e",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f4f4945f40c04c43463d9502cd6efbd291e79c0038d88a93957261a7d68356c5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--61da382a-7ae7-494a-92b8-fc19150c159b",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '074a569d024a213dd4d139b7ccb93672d8daa40c546bdc7fbc782c732c6c78e3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--04feb6c3-d929-4118-bce5-e6b42091d555",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '1231f13c1b77f1d94b2dd175d41aa9d98273e332bcf4b8a70e34bb20a1d03d00']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--da88660b-d6d8-434b-b6ec-4a1a42b28584",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '12e194238e89e11b3a44065852848baf6d680fb01beb75cbdbfb0c5a6aae9d96']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7d8c29a3-b0ef-433d-a4b2-f176ceb64031",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '153ed75bd5b22ca3ebfc455589e0d930651f92f7961476e5275b33f0160592db']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--270fb71b-4466-4411-b541-546776c8f6e3",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '1b6f2f6abe8d1a333cf5ea0afcc98bc572ac2c50176f044d7bd5ea928af2ed30']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4a05103d-3abc-42b4-a862-82c7154ad46c",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '2d6f9f1288e65bba7117be32c7e6972281200f1d75a648ee0a842fc79725ddb1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9afbe2ce-a125-4d64-bbc4-f1ba38360cd2",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '2eaa5d9397598138206c4264723babd12b590769bd259c31e41a901ae8018d27']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6b751cfb-79df-422a-812d-a0f2a23edd6c",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '33fd0bdf49d78ea01743ef2685bbce2b88f49d9ab6b26f7c1cfc330f5dfed03b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6e0c4381-32ba-4357-b823-aadb55f86339",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '37eb44f7067138300caa9331fb93e1a99b86015333d2f9af396f2934849cd534']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--96012c50-94a9-4eec-93f1-a416f73f896a",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '3a7acae2c7f773ea79076025cf3748d4ed767804264f08f49722119e99b2c477']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a6b9c125-b400-4a1e-8cb4-e1b3f31b6a5b",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '3e09d56000216c730f880258f97f9d2bb0222ad59444c8bb00c2170f65c98e69']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e4efbcbe-73aa-4bb4-88f6-509b5cb267de",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '40fa3d1532ecfd655f99d4b295cf29a947578cbf248b3f3bd4cac3e91e3a98f8']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--5536f379-fdd8-427b-a04b-92aa13a9dd4b",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '49dd0daa9195e74d63a7b8e3e78e5cd311751fac80eb80134ce333635592e345']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e59e9e1d-4ef6-47ab-aa5d-91b43b4a308b",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '508f43a94c093913dc73dbf9bffd15d6a63e0e1ed52374352284fc969ca7d75c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--028a937c-bb37-4c68-ad1e-bccf3ae0f670",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '527e27952bdf48a919586aa6bf526f1db9a1a411f8679e99c673c2a0cb3cc09b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--289e27b0-9197-47bd-913f-e681466f88f5",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '558418b71b0d5055c320734a026194df1d95eee4f4658bd168f3f2cf08b6c838']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f58947ec-e76e-4771-9237-34282ac2f780",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '58e5551e0a8b9c27b2cdf57d083792b5aac6d85a65a059e30443c44622762fff']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9fcd15ff-e6df-4f0c-b3e7-ffb57850854c",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '590c035b4167db406823c6e5dedbe666db73ab5d68e957eb40e061bc0e71ce2f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a50818a7-bd96-44bd-99b5-9b677f9fc1e0",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '5da379a6d60194aed042de555d7556b72477040e31d3033e5fafd46286915d25']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cf04e997-4cc1-4494-8943-adbd596535bb",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '6a5462a64b4f0b00bd7f33c6fa76bb84995cf7b62fabb6d9a3c2e21dd763bcf4']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f5ef10f0-4534-4d48-b244-6769f7444b49",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '6a7572a816528ae751c0c0aa4c083fa5850541936f6648da3b68de2cdadbf890']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cb37a87a-e24d-42d3-a81b-6ef0dacf4db0",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '6ff7fa4ce31d824adffe3641d7a754e081b9bbe67059c2f84db7270299d1ac0e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e1702958-d1b5-42ae-9879-2b0d95c05643",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '7ab66b7edf262874d7e897267ba69a9ea30197737c5df9c70f3ed15ccadf90ff']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b1f374fd-21b2-4414-b8d9-3e6d8f761753",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '92be3f4aa18c01d31c68120317c9cf8774380d983d3b562afea3c8ca918b5e29']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2083393d-6bb3-4059-bddc-ac1af8508ab9",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '938dcbc77a364aba7b1898e6b4549ae7b79c080388488c8b7484814905e26f34']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4ae6cc22-ad3b-44e5-beb2-9c78660ac6ed",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = '95305675b9535f24f9885974688b9c5430bcbbefe48db689c6dcf163dd2ec25f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f2cbb046-9191-4d0a-939c-7c3e87e8f2d7",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'aa9b946c3d8bef248e531acf80571ebe2bd06821b80cd5ceb1632384fab50bd3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e007f51f-22f5-4d59-9a92-a8ca8ca83825",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b18c6c27a9df3521a6d85f68de971e33ba386dcb80364fd50f7402087476284a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fe342ca5-35bb-45f8-958b-a7a7d1b81a25",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b408ea5bc79226e62d41738c46a1d3343b5eb8383ffe2fd109f6665ad86cac92']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--764a2f1e-89b4-4605-bfa0-f8911bca8d96",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'cabdbbf4d1031d1bf42dc587173fedebe0bfd07f093ceaa05d87557bd1a2a62c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--948ae525-deeb-4485-aa53-7248cb614181",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'cb01c2973a9a95fe148c0b675efcaa9bd696f5309ef9bfd8affe123ef161a5f7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c1f463fd-54c0-4d62-a45a-ea080143b7cc",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd57cbd24021bde3b323b13276e3d488d0167a12c63fe6bfaab54f056bf5b70fd']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4316a924-1042-424c-86d7-8d651ea0b09e",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd914557a8488b729141ada90597985e548d6df07665bbd6c336053baa3c0e45f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9c94161a-6fdf-4c70-85aa-68c1aa27744d",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'dc25482df95393e9f0c559534735326e8bd202acd6847619d8c97013f39d010e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0d9811bf-8b56-40c4-9100-c225a7b52f30",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'dfca0c46e5575c88dbc5b452e03caf9a901a0642b081976b02e410eb6c1f5606']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--34a8eb36-f052-4a8e-b5bf-11290f565f1f",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e1e2257a321800a68bee242126b8cad62e31263a8fb7f687317c9104706aa517']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ad402d53-79f8-4d95-ae06-b4bbadcd1225",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e5825e0174d06bf397aa28e86336787d84bea71a4c80a6edb7ecf4601a878789']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--eba1208d-b2d5-43ec-8f10-ab9d1f3e9d4f",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ea2e5e4287ce1c570f8f7d8d46414523fec715be82092830cbcdf8c2154da692']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3b791a77-359d-434a-b350-68500d1aaffb",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f254ee4f97003bec2c845ce384fa38249cd22294d9d6ba7e6ab973be6fd4954a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ff4feac6-444a-4035-be7f-535b18127e01",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f58d9e7e18512eb19f32a7b94d2a477ad123d7bbeff1689f2487367035371815']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9d54d518-30ff-4f67-a96b-d980e863f30e",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "AMOS sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b08438155360f5cadd56c308a01b63ece0538af7fe20cabd8da187ccd76262e7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 69,
  "labels": [
   "AMOS",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--89580a67-2438-4a03-bd5e-4c0673248fdf",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '0de0ed1094b8857495a4b4914f15c67e06a1549952037e72c1651c7cc50a7b57']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--812b3e5b-4ac3-4aa2-b388-caf156da9de9",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '1802fa6cef6799deb57fbb42cb634047f255f310458b6a63716bb9cbeb3ae8ff']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--b6ea171a-ad46-4240-a1e1-346e0c7521c2",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'dd45b67a79fa5a19c7c37d06df03632318bce66bd750e0ccf8c7d8a55d53c8d9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ac90a8f4-2df0-4974-b911-46f31895c5aa",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '07be1a5a5d75c8cf33a17f4379f13bbdf20f8e3b30df291934088759300defac']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--15607db1-81dc-4496-b39b-3073dcf1feaf",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '087148ec3f18d6b8b699d0d5940dc23af4e3e7c920049c6c865254b3bb958ce9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fdce6cb1-a503-4c4e-b912-15232ccc8234",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '1f2de816dd49ccf3074102b38902c1ccc81b1786d0789971bbfb70ec3fd2fc75']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a9304668-3eed-4b74-a9c4-dbb0e8f1256d",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '1fc26715d960f204b10dcd967843728b552ae22a7647147deb8a6f3c86b899ba']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e9bb6962-ad04-4fb9-9eb3-fb1b398bf929",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '380a427f08c55b158cc0d90c38d3f741ea08a24a2811a2d9ca0c1d2dab5bfc66']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f649cde4-0e59-4014-a41c-9ba75d2cd7f6",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '38602089a296b98914abbd7939f0f94a9c6135b4ee839ab2aef016df2488e305']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--01c7568b-a345-4016-95a6-39db7e71dd1a",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '44901fe5e07cb3a5e0d4e278126e40f491ca8c67eb431bd2fcf764568bc16a65']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2f3f1dbb-7603-47e6-8a06-a16940d1382a",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '46eeb050ee375b52ed28cc9dd593e8b25fb148e92f01878d5bb073e9fb25ecb7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fb24d413-4e50-44e4-846b-8688699dc005",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '47958f939631f1adba24b37c21a53bed74dd6179fa5beb0d2b912816ed4b7d8b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8073a120-cb70-4f06-b80a-fc0548c3d5a5",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '4fc7a8e8b3f31afaca715d1d1cf0e5fe99eaf1cc904168d84b2a59c9530cadf3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bf670d50-c421-43f1-9ecb-c8fee33b8846",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '4ffd58dd83a3f89cade6d58e13b5919410e0cf1f30afdbf60bad1f716a061ac0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e614f479-c85d-45b8-95e1-1cf0f5beda74",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '501e191da3be2d085394eb13e133c40a59ee222bd45182259fa465c65698c402']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f7eb54e4-05a4-4a98-9500-50fbfdaac818",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '5b951b57c8529a2c09b4aadcc83376d7652c9674a61283fff443851d818bbab5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--7a99c8cf-4698-40e5-9bae-c73e1442e822",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '5fc8200c7584303a0a9967875ce8050b95a9838b38e24ac0f35b595f79ca6217']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--24ae23a7-f974-4510-b1bb-6b3afed246de",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ab25adf6f1b4b69b915555f1df2e7c4703b44a28a9aa0377e096b36c4bf406e6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f5d5e249-752d-4fd1-baa6-4b9e27746cae",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b95779be1565278c9595423f93d8dc6bbdc4bda8abbed130f4f8924d03300862']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a6ff8cb0-32a8-494f-9633-2f1864e13705",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd5e40d66ee25be808e3d7bd0926ef0a95cbac0397752a9317db0c006ae4914d0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0fc29d76-a3ca-45ed-a01e-b93d0f28775a",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'dbbbbfb98939a25f1b2ab0e260aa01f7f6b569799aba107daf1cb17d66475295']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--49d9561d-e068-4251-b399-6075ad0a5482",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'e1bc1d85b1e60ccf6d49c90677768d93bd4d65d819029fd6cdd7bbfb57b2efb1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--991942b3-7e55-4cd4-a38c-f5cb98c5b107",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f374939c71458fed913b6ef0287cc4f01a3612d69f0740807a7e820cb9dfdd91']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1b156cb6-3adc-419d-81af-7ce8dbb82680",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f585889eea97199802c699315490ce258b23c5e244eb0a5d60f1b7b7537290c2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 66,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--edab3239-4497-4699-9762-32b578b638a9",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '36255615c287a027617380e1a6e1094006fa483e470c89ef9d0615527624b7c3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--18510213-2fed-4a55-b0e8-9ddf538de8c0",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '9e18db120ac02fe1266b1f6af6956a3a728e79779c4c39ec7ab23294205c547a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d2f5f36c-381b-4258-b385-895e80039267",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'aed321323d7f8d18f8a97abcf50b8e80d57fb85fa3877ca8ca0e6d5a0bb408ab']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--f635f18d-3ac8-44d5-9880-7ea01cb163f4",
  "created": "2026-10-26T17:15:52.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f3f1ffbf525d56837674ce6ef0ab44fd8364f5aeba5f8c0ad8457ef638a2bb1a']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T17:15:52.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--aeeda160-cd83-4115-80ea-406173da1a32",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '41f63756cb911d7c249d7019272f0f27ed5e03ab8e720392c9060befe45cd161']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 63,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6994a56c-e578-41cf-beba-a2912f9475b8",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'aaa91164057b1651321a53f2999f8035b8918be27c38ec4f55fe19c732bee818']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 63,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8d035da7-4708-4951-a14f-838fea315760",
  "created": "2026-10-26T15:06:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd6b38ae41edcffba8a8a4b39500238fc8d66115c4ee85ea8fa2295adfb53cc60']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T15:06:01.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bb3a816b-3f8d-4009-af1e-03e30d07f465",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '351c9637fe7766c6fd4341e15853b5086631c5cf466f2166681ad867fcd0f49c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4b264813-0741-4e24-9c78-a2d7b7fcff23",
  "created": "2026-10-26T13:05:51.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '56665c1ad61818334eb9d373cebb9b18270bd89a73399990d42ee5d72f136735']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T13:05:51.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--fa3745b1-a374-4e85-a49d-2e72b8642a1c",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '0647cc5b55ff4edeab21ad4a46d6f4903ba1ee0b70a387efe16bd34bb0056f1b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a94cf463-f622-4702-8cc8-fc87340ae120",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '09eccbaeaf9c3d2acc679c1992d7a054ff0904e34e0059053d35084542d44faa']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9abdeee6-77f8-45f8-bed4-4e90fd127ae0",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '1c585c7b2fdb8c6e5e0f89342ed65051fdf9f7e58ec18674a89dc047ab36842b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--aca836de-647e-4e0d-9547-386cd932ae55",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '1db0ce93704bde6b3eb5c7aaaa95cfb6cd1883c737c801822a1f4fb923b58ad3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--476f5358-4ecb-491f-990e-e70398b1ace1",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '32077d21911b81602f6ca974d6346e0f14eff60a10e09aaa5e0b802bb442976b']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--48d4c5f2-0a6c-4b54-a351-4fa894b5c332",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '52a8162b20c91d33084c66a48faff57225b59425053dae2f3fd3091c7c4c55b2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d348f2f7-9d60-4908-9a52-6e1aa1ceabe1",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '627cd4ae5a8a94d60b52546565d9bf86cc0926a60408d1d22f3a024e1b31e8c6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d4189ddc-4259-4421-ba5c-bdc2e7004ba6",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '68add8af6bf69e784711e825b72f1a9aabb1626ba7532968214826718ba037d1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--63b2cddf-b986-4f14-90a0-5597593742ba",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '712ae558638f3490f6b998628d2da1878a3c3c1e7d6565f673c8d54b9a4fec06']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--bd29a639-329b-4b47-999d-24da88e3f6e4",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '76a2c569415292d186f6c0fe8fb5fb9222f4e5a60316dccf6b6d427faa2299e5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--25542bc9-0a0e-4156-bdb8-a48a91ce56b1",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '96fb88a5f46e226ad093a9e1188cd9c765be685d811095e23e03419a2df843f1']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8d5a5116-4a67-4dc6-9721-383c2846a457",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a045d1322d75f0842b910a77f19b420de6a3c9d847f71c03658f38334a3f5b1e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6a093147-570b-4584-aa46-8e785cf8c520",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'aebc98473ccc033c28c99e885bf0a14cfafc6e16bb80c271ac95fc6e1a20eb31']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--d8c7044e-3a71-412a-b426-d3e702e85c1b",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b351696378f387e5e174be3f0ebeca8f481384800c1bfb471a870abd44e243a9']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--3e86b1b1-d4dd-4690-8d4b-434fdf5d2143",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c4de68a0f6ca98238b1ce2b1172207fcd5475971d640e6e1b60ee063d85ca640']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4fa725cb-fa63-40f4-86f9-29a0f22c26f1",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd709ed61e55621cc099da8522c5e8e114786819fe1952afa953b9dfe29d94811']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6ccd36ae-4f98-428b-8cc1-61f1af152a35",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd75517f9cee3363dfe8cd9f74855b3ece98cd994ba900818fa5ec121eb67eda7']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--dc2b9b1a-49d1-4d19-8ec9-190cb0ee0d6e",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'db229ee7d68627647c54289d2c5302695324d4357e79252e29dfd1c47e9e16ca']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c56c4064-09cc-4395-88ab-17fa39bee200",
  "created": "2026-10-26T11:03:29.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'f3a1f6b95746874ee7ef01773448f5a2f7bdead3a4785788d24bbe8ffd75c006']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T11:03:29.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4d9d6488-848d-4517-b972-6b9e1702928f",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '26c92d1fbffdfdb66755e5a56f81d0c7dd7d0ef4698bcc486d157fc9684ba377']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--23c30e36-1d2b-4826-892e-4db59b35f4ee",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '2cb2c91e4a0c720557449b203b153a02ee74f42146dd20f62064bed102030574']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--483a7b0c-b7da-43c4-b386-63b84b2eb25a",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '66dd482fdb6e7a59c68aa4c2404a77c151705015e7a42b08b79dac0d2f97038f']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8af62c1f-3256-4eb1-bed6-367113435541",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'a27f7b764307902a907b1ca0439ea8061541f33166099b77e8bfdf33348d7eba']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8b4e7a52-41b8-4e4b-a366-b9932360e273",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c512ec6faadd7f2403b02be6a149eb316c7d76d2eb173727347f7dfcf1ec861e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--6f12d993-cda4-4f6f-8f25-578d63bc22ae",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '3625aa321074e66100ed2fa56e46ca69ca2d1c710b47e5cb2e3e46fa67d1022e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--08cb8629-e7b3-49b2-86b1-71c3684acc4b",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '49bac78a78186901197fc2a003dd730697f1863e6c3d57c83a6c1dbaf8f127da']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--ca7f8d36-2153-4d0b-94ab-85af977787fc",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = '521a6a40c9fd2befc6ef796588bf3b4d8f3d3252e7e32d57b31c083225c514c6']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a41a3052-1473-4ad0-bbb4-c6ac53af2a69",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '632a5f0b20063ab99570d0b40d5ca9bf80424f3ab5787cbfe5e4a715a41162b0']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--0b3e61d5-7142-4b63-be34-f52c301828ad",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '91f6d8d43971d6ad698b7c48fd5580181cd971cb3468b8f90be84c72642575ce']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--282d4c38-c5f5-4012-87c7-f3e33dbcbc3b",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ad1c96c881748e684de8fe3a994400f3c5fe51320ff52d20bedb360411f1896e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--4dba0fb8-7bc6-46ab-b02a-9d262ea0750e",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b27757d81bb6de6fd7865b09378b05cbf6297604b4a200bb8c60e094ac5816c3']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a8a9c2bf-f3f6-4276-b2fd-56446ea4556a",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b742ddf353a2c1fa1e22bc10adf74fb00ef35aad98779022e5e86378684f2f4c']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--a72ac5eb-3a32-4fb2-9f2f-323d986b0090",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bd3f2f7d114b9a83080c7d40717c2a46ca26d04e8542442fbda28f35de86a2be']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--9bce8806-4c24-453b-b3f4-4b611269f815",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown malware sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bd591e02e9d19c71c322fe489ebbcbc49e80b65851aaa1fea46722b1300dc6c5']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Unknown malware",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--8fe9abe4-7bad-43d8-a3ef-8d77f4bbbdf5",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bf9d31d816c3acb190406f3fbeabfb810bbbab9a1fb292d4cc629c8da2237262']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cd8325ef-a0d9-4a3e-8851-574bff89fa6d",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'c156a2f26872b1f1591a26e5ab2fc83079c1a1d092a7415ca1e63fb627013e5e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--1dacdd02-e978-4ac8-b53b-30603e0648a8",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'd87a4f91a871643915d156fe396418afd6d682675d9c61db39b428cfcb4233a2']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--2e7d9223-5022-4c52-9484-32a8da6962ca",
  "created": "2026-10-26T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = 'ebb84e94c2f070b0cbda548d837e04763e45071e56450e02caa2303defb2eb50']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--c66c0448-eba0-4ff1-a474-46df61fb9bac",
  "created": "2026-10-25T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'b5906c5780bfb8d8535c2914e6a1029ef4137cd119995bf281058bd06236bbae']",
  "pattern_type": "stix",
  "valid_from": "2026-10-25T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Unknown Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--cdcd1253-37be-45f2-a575-eebeda3b07ba",
  "created": "2026-10-25T00:00:00.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Unknown Stealer sha256",
  "pattern": "[file:hashes.'SHA-256' = 'bbf7f1683cf2e27ddd72cc11137a01077294ccc006b3fb701f7dd64fac7221fd']",
  "pattern_type": "stix",
  "valid_from": "2026-10-25T00:00:00.000Z",
  "confidence": 63,
  "labels": [
   "Unknown Stealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e07cc32c-dfbb-42ca-ad16-06a97b1c0abb",
  "created": "2026-10-26T08:49:01.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "SalatStealer sha256",
  "pattern": "[file:hashes.'SHA-256' = '3d9a86801bebaf5495e8c024623215ad6984b4b8a0cc1268391d951eeab8c906']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T08:49:01.000Z",
  "confidence": 60,
  "labels": [
   "SalatStealer",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 },
 {
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--e8e20d7b-c635-4f1b-9621-82f538ea60ca",
  "created": "2026-10-26T19:21:50.000Z",
  "modified": "2026-10-27T03:12:52.000Z",
  "name": "Mirai sha256",
  "pattern": "[file:hashes.'SHA-256' = '6e136391f87beac4ae152e4f3f24ad61fb7b06df0fdb39d0005660ea1c5ea55e']",
  "pattern_type": "stix",
  "valid_from": "2026-10-26T19:21:50.000Z",
  "confidence": 57,
  "labels": [
   "Mirai",
   "band:medium"
  ],
  "description": "Malware infrastructure (ThreatFox-reported) | ATT&CK T1071, T1105 | sources: ThreatFox",
  "created_by_ref": "identity--3238f2ba-6d62-56c4-a7c5-05c6ccafaef0"
 }
]