{
  "type": "bundle",
  "spec_version": "2.1",
  "id": "bundle--89b9951e-848f-489e-9fd8-5156907b888f",
  "created": "2023-06-29T00:00:00.000Z",
  "modified": "2023-06-29T00:00:00.000Z",
  "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
  ],
  "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
  "objects": [
    {
      "type": "malware",
      "spec_version": "2.1",
      "id": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Smooth Operator",
      "description": "•\tSmooth Operator malware targets the macOS operating system. \n•\tSmooth Operator was distributed to victims as part of the 3CX supply chain attack.\n•\tThe infected software package was signed by 3CX and notarized by Apple.\n•\tHTTPS is used as a C2 channel, with an additional custom encoding algorithm used to obfuscate exfiltrated data.\n•\tSmooth Operator randomises the C2 server it communicates with. The 3CX website is included in the list of C2 Servers it can beacon to.\n•\tMalicious code inserted into a dynamic library (dylib) packaged with the 3CX software, downloads and runs a second stage payload.\n",
      "malware_types": [
        "backdoor"
      ],
      "is_family": false,
      "capabilities": [
        "communicates-with-c2",
        "determines-c2-server",
        "persists-after-system-reboot",
        "exfiltrates-data"
      ],
      "architecture_execution_envs": [
        "x86-64"
      ],
      "implementation_languages": [
        "objective-c"
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--2ee39264-86c5-4e27-b259-34f0eee2fb0b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Supply Chain Compromise: Compromise Software Dependencies and Development Tools as used by Smooth Operator",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ],
      "description": "Smooth Operator is trojanised, signed and notarized 3CX software components distributed via legitimate channels."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6a698fe-c826-461e-ad6a-08aff0342ac1",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--2ee39264-86c5-4e27-b259-34f0eee2fb0b",
      "target_ref": "attack-pattern--191cc6af-1bb2-4344-ab5f-28e496638720"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6def693b-6a74-48b6-b201-593a2291296f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
      "target_ref": "attack-pattern--2ee39264-86c5-4e27-b259-34f0eee2fb0b"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--8b377fc3-d805-435f-999a-d387d248a68d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Compromise Client Software Binary as used by Smooth Operator",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ],
      "description": "Smooth Operator runs as part of the 3CX software."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6b832d76-2125-4a14-beed-e46f04d1632b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--8b377fc3-d805-435f-999a-d387d248a68d",
      "target_ref": "attack-pattern--960c3c86-1480-4d72-b4e0-8c242e84a5c5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3bab6c71-a219-498e-95ef-46cece5faf58",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
      "target_ref": "attack-pattern--8b377fc3-d805-435f-999a-d387d248a68d"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--a4c6179b-8e3f-4507-ab96-a432e191eea1",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Deobfuscate/Decode Files or Information as used by Smooth Operator",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "Smooth Operator uses a custom algorithm to obfuscate data to be exfiltrated over the C2 channel. \nSmooth Operator deobfuscates data it writes to a file on disk as well as tasking responses. \n"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e378b164-351d-45de-b076-f9cc5bee0f9d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--a4c6179b-8e3f-4507-ab96-a432e191eea1",
      "target_ref": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--369ea8bc-d915-46b0-a135-7b85ce32b535",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
      "target_ref": "attack-pattern--a4c6179b-8e3f-4507-ab96-a432e191eea1"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--075d4111-1b0a-409e-89c3-306223330660",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Indicator Removal: File Deletion as used by Smooth Operator",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "Smooth Operator’s second stage deletes itself from disk immediately on execution."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7167cf4c-047d-4572-afb6-09f25ed824ee",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--075d4111-1b0a-409e-89c3-306223330660",
      "target_ref": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b77b989-aa3b-4271-8903-1d190033ec64",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
      "target_ref": "attack-pattern--075d4111-1b0a-409e-89c3-306223330660"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--7adbd58c-876c-41d0-9100-2bc1907c5020",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Virtualization/Sandbox Evasion: Time Based Evasion as used by Smooth Operator",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "description": "Smooth Operator sleeps for, at minimum, a week before beaconing."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fc4d2aa0-0933-4038-a7e7-5baba18306e9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--7adbd58c-876c-41d0-9100-2bc1907c5020",
      "target_ref": "attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b905b931-ae55-428e-ab10-80aa21e2a8ad",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
      "target_ref": "attack-pattern--7adbd58c-876c-41d0-9100-2bc1907c5020"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d958015f-f4a0-4742-b73e-d0e1435cb1d9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Automated Collection as used by Smooth Operator",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ],
      "description": "Smooth Operator stages collect data from the victim machine to be included in a beacon or exfiltration."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce73b49a-3f4c-4be2-b585-04dceceb57c1",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--d958015f-f4a0-4742-b73e-d0e1435cb1d9",
      "target_ref": "attack-pattern--30208d3e-0d6b-43c8-883e-44462a514619"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f2097ea-a4f3-47b9-b67e-baee7acdebf5",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
      "target_ref": "attack-pattern--d958015f-f4a0-4742-b73e-d0e1435cb1d9"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Application Layer Protocol: Web Protocols as used by Smooth Operator",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ],
      "description": "Smooth Operator command and control is over HTTPS."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ffcd405b-c23f-40d7-a4f2-79d7e3531615",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462",
      "target_ref": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d7a54ad0-0e4e-4d26-8395-e00912815a55",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f68a79bb-d6f0-4a44-8d04-3e787d83f334",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Fallback Channels as used by Smooth Operator",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ],
      "description": "Smooth Operator contains multiple C2 servers and randomly chooses a new server from the list for each beacon."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ad175047-73c0-4563-a885-f2fbbbd790f1",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--f68a79bb-d6f0-4a44-8d04-3e787d83f334",
      "target_ref": "attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--62b6705d-1047-4d51-8dcd-89a687add3f7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
      "target_ref": "attack-pattern--f68a79bb-d6f0-4a44-8d04-3e787d83f334"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--cc26d856-1fa9-4eed-bb29-6d68367faf6c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Automated Exfiltration as used by Smooth Operator",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ],
      "description": "Smooth Operator exfiltrates automatically collected data, not over the existing C2 channel."
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68eb4a14-2ee4-48db-969f-26fb353b2895",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "attack-pattern--cc26d856-1fa9-4eed-bb29-6d68367faf6c",
      "target_ref": "attack-pattern--774a3188-6ba9-4dc4-879d-d54ee48a5ce9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa06384b-a8f1-47f3-a4d5-515493da033a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "uses",
      "source_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
      "target_ref": "attack-pattern--cc26d856-1fa9-4eed-bb29-6d68367faf6c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9067773c-189e-467a-8ebc-4bf74fa8924d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--c9e481f9-0d33-44b3-9f1d-ac3612da9111",
      "target_ref": "indicator--895f3fc9-8e88-445e-812f-31953aaa39ee"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--778e4b55-0544-4484-a782-5caecb5a9e63",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--c9e481f9-0d33-44b3-9f1d-ac3612da9111",
      "target_ref": "indicator--48f1b61e-407b-42bf-9e8d-d680c1ab5716"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--26150b11-0898-4fcb-b8c7-4b21b23ea023",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--895f3fc9-8e88-445e-812f-31953aaa39ee",
      "target_ref": "indicator--c9e481f9-0d33-44b3-9f1d-ac3612da9111"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7fd6e20-046a-4a65-b2b1-a0729d14d750",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--895f3fc9-8e88-445e-812f-31953aaa39ee",
      "target_ref": "indicator--48f1b61e-407b-42bf-9e8d-d680c1ab5716"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ca56cce-ae24-4eb1-ba1a-616c3484bcf0",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--48f1b61e-407b-42bf-9e8d-d680c1ab5716",
      "target_ref": "indicator--c9e481f9-0d33-44b3-9f1d-ac3612da9111"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--67e9f6ca-bd7b-4288-8ebd-4cc3bc9892bc",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--48f1b61e-407b-42bf-9e8d-d680c1ab5716",
      "target_ref": "indicator--895f3fc9-8e88-445e-812f-31953aaa39ee"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d4425304-4af9-4bc5-bb66-7cc5fe3c5e40",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb2bd476-9226-49a4-a0b5-d37e09395700",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bea1dd06-48e6-4f22-ac09-215ecb333342",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b1acbf8-4bee-4023-9c58-28f621cb8a09",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--84abfe9d-291c-4c46-bb16-981a38251cff",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--464a43cd-bf9d-4155-9116-98782076bb7d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--baa6d96b-5119-466b-9e9a-444157b4148d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127",
      "target_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5f30be4-f60a-426f-bdc6-024fc3b90671",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127",
      "target_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27f9668c-c166-4075-92a1-0e868b34ae92",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7",
      "target_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--abf6c1c9-c681-44d2-b75e-636148bc4a8a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7",
      "target_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--68118c2d-5ef6-4d46-982c-6b9a5aeedd5c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205",
      "target_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac7f2b23-a1e9-481b-8b3a-8270028a0d42",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "related-to",
      "source_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205",
      "target_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9e481f9-0d33-44b3-9f1d-ac3612da9111",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'MD5' = 'd5101c3b86d973a848ab7ed79cd11e5a']",
      "description": "Trojanised, signed and notarized 3CX software package containing the malicious copy of libffmpeg.dylib.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Smooth Operator sample (MD5: d5101c3b86d973a848ab7ed79cd11e5a Filename: '3CXDesktopApp-18.12.416.dmg')",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1d6c0f0-abe1-43f7-b9d4-4fa84e6bed1a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--c9e481f9-0d33-44b3-9f1d-ac3612da9111",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--895f3fc9-8e88-445e-812f-31953aaa39ee",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-1' = '3dc840d32ce86cebf657b17cef62814646ba8e98']",
      "description": "Trojanised, signed and notarized 3CX software package containing the malicious copy of libffmpeg.dylib.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Smooth Operator sample (SHA-1: d5101c3b86d973a848ab7ed79cd11e5a Filename: '3CXDesktopApp-18.12.416.dmg')",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--36294f82-0b27-4702-9bce-f6a2dab29a88",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--895f3fc9-8e88-445e-812f-31953aaa39ee",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48f1b61e-407b-42bf-9e8d-d680c1ab5716",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-256' = 'e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec']",
      "description": "Trojanised, signed and notarized 3CX software package containing the malicious copy of libffmpeg.dylib.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Smooth Operator sample (SHA-256: d5101c3b86d973a848ab7ed79cd11e5a Filename: '3CXDesktopApp-18.12.416.dmg')",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1cd990d9-210e-4f48-bb2b-06bfc8271b32",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--48f1b61e-407b-42bf-9e8d-d680c1ab5716",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'MD5' = '660ea9b8205fbd2da59fefd26ae5115c']",
      "description": "Smooth Operator universal binary packaged inside the above disk image. Only the Intel x86_64 binary has malicious code present.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Smooth Operator sample (MD5: 660ea9b8205fbd2da59fefd26ae5115c Filename: 'libffmpeg.dylib')",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ddb693f-df34-4317-87eb-d5eeb7ba8630",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-1' = '769383fc65d1386dd141c960c9970114547da0c2']",
      "description": "Smooth Operator universal binary packaged inside the above disk image. Only the Intel x86_64 binary has malicious code present.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Smooth Operator sample (SHA-1: 660ea9b8205fbd2da59fefd26ae5115c Filename: 'libffmpeg.dylib')",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75557be1-e77d-4f57-badc-dc5d4c93a0c8",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--37326277-cf30-4d4d-994e-259a4794b02b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-256' = 'a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67']",
      "description": "Smooth Operator universal binary packaged inside the above disk image. Only the Intel x86_64 binary has malicious code present.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Smooth Operator sample (SHA-256: 660ea9b8205fbd2da59fefd26ae5115c Filename: 'libffmpeg.dylib')",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8888ae67-ab69-4515-b052-ac60909d2c6a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'MD5' = '5faf36ca90f6406a78124f538a03387a']",
      "description": "Smooth Operator second stage payload which exfiltrates 3CX victim data. Intel x86_x64 specific binary, not Universal.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Smooth Operator sample (MD5: 5faf36ca90f6406a78124f538a03387a Filename: 'UpdateAgent')",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--31f14523-f6b4-4ff7-a174-73ff80df26e5",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-1' = '9e9a5f8d86356796162cee881c843cde9eaedfb3']",
      "description": "Smooth Operator second stage payload which exfiltrates 3CX victim data. Intel x86_x64 specific binary, not Universal.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Smooth Operator sample (SHA-1: 5faf36ca90f6406a78124f538a03387a Filename: 'UpdateAgent')",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2adacbda-9710-47c2-a005-1f40c5cae8ee",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:hashes.'SHA-256' = '6c121f2b2efa6592c2c22b29218157ec9e63f385e7a1d7425857d603ddef8c59']",
      "description": "Smooth Operator second stage payload which exfiltrates 3CX victim data. Intel x86_x64 specific binary, not Universal.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Smooth Operator sample (SHA-256: 5faf36ca90f6406a78124f538a03387a Filename: 'UpdateAgent')",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01bc7152-dca7-48ab-b9f7-0c094402dd89",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00ee3415-619b-4f3f-bf1f-8545c9d787a3",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule Smooth_Operator_Obfuscation {\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule identifies unique strings and code present in the C2 string obfuscation code of Smooth Operator.\"\r\n        date = \"2023-06-29\"\r\n        hash1 = \"769383fc65d1386dd141c960c9970114547da0c2\"\r\n        hash2 = \"9e9a5f8d86356796162cee881c843cde9eaedfb3\"\r\n\r\n    strings:\r\n\t    $ = {48 69 ?? 61 60 60 60 48 89 ?? 48 C1 EA 3F 48 C1 ?? 25 01 ?? 6B ?? 55}\r\n\t\t$ = \"!#$%&()*+-.0123456789:;<>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]_abcdefghi\"\t\r\n\t\t$ = {3E00C7[5-6]26706572} // &per\r\n\t\t$ = {3E00C7[5-6]26646F6C} // &dol\r\n\t\t$ = {75733E00C7[5-6]26706C75} // &plus\r\n\t\t$ = {6D693E00C7[5-6]2673656D} // &semi\r\n\r\n    condition:\r\n\t    ((uint32(0) == 0xFEEDFACF) or (uint32(0) == 0xFEEDFACE) or (uint32(0) == 0xCAFEBABE) or (uint32(0) == 0xCAFEBABF)) and all of them\r\n}\r\n",
      "description": "This rule identifies unique strings and code present in the C2 string obfuscation code of Smooth Operator.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "YARA: Smooth_Operator_Obfuscation ",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39b724b1-89e8-4fe8-a280-608f99490367",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--00ee3415-619b-4f3f-bf1f-8545c9d787a3",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1990235c-f34f-486a-b352-c02709970dbd",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--00ee3415-619b-4f3f-bf1f-8545c9d787a3",
      "target_ref": "attack-pattern--a4c6179b-8e3f-4507-ab96-a432e191eea1"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b4b2939a-330e-4df7-b857-fbd05d7990c5",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--00ee3415-619b-4f3f-bf1f-8545c9d787a3",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2014cf71-22ea-4e5f-94a3-12dc860aa1a8",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--00ee3415-619b-4f3f-bf1f-8545c9d787a3",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--98a5bcf4-6df9-4091-b547-cd837fcb4be3",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--00ee3415-619b-4f3f-bf1f-8545c9d787a3",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ade21729-a285-492f-bbf8-45be7ef20822",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--00ee3415-619b-4f3f-bf1f-8545c9d787a3",
      "target_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3d56d9da-be98-4384-9fff-56b08af80bce",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--00ee3415-619b-4f3f-bf1f-8545c9d787a3",
      "target_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--01876fc4-1e69-41a2-b498-311c5526069b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--00ee3415-619b-4f3f-bf1f-8545c9d787a3",
      "target_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c610d803-3227-4c7b-978e-ea22a6534a76",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule Smooth_Operator_Obfuscation_2 {\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule identifies unique code sections in the C2 string obfuscation algorithm.\"\r\n        date = \"2023-06-29\"\r\n        hash1 = \"769383fc65d1386dd141c960c9970114547da0c2\"\r\n        hash2 = \"9e9a5f8d86356796162cee881c843cde9eaedfb3\"\r\n\r\n    strings:\r\n        $a_1 = {4869C8616060604889CA48C1EA3F48C1F92501D16BC95529C8[0-3]83F807}\r\n        $b_1 = {438D1C24F7DB41F7DC} // neg\r\n        $b_2 = {478D3C3641F7DF41F7DE} // neg\r\n\r\n    condition:\r\n        ((uint32(0) == 0xFEEDFACF) or (uint32(0) == 0xFEEDFACE) or (uint32(0) == 0xCAFEBABE) or (uint32(0) == 0xCAFEBABF)) and any of ($b*) and $a_1\r\n}\r\n",
      "description": "This rule identifies unique code sections in the C2 string obfuscation algorithm.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "YARA: Smooth_Operator_Obfuscation_2 ",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00e2f37e-4147-457e-899d-ca661e43c0d3",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--c610d803-3227-4c7b-978e-ea22a6534a76",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6f98142-cc92-4da4-9e50-e97dff3be30a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--c610d803-3227-4c7b-978e-ea22a6534a76",
      "target_ref": "attack-pattern--a4c6179b-8e3f-4507-ab96-a432e191eea1"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--95d07ee6-8805-43c7-b63e-3d135e83f62a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c610d803-3227-4c7b-978e-ea22a6534a76",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3ed45d88-c17a-4c90-8245-2cd3456fa488",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c610d803-3227-4c7b-978e-ea22a6534a76",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4ec32041-a1be-4aa2-b7ed-a34a77c98c75",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c610d803-3227-4c7b-978e-ea22a6534a76",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d128f57c-3eaa-4b49-af82-dbdb9d424b8b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c610d803-3227-4c7b-978e-ea22a6534a76",
      "target_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a6f97ef9-7a98-45e1-9aef-eeac757761d7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c610d803-3227-4c7b-978e-ea22a6534a76",
      "target_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0b5e4b9d-086f-4c47-a769-812ac6e22a45",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c610d803-3227-4c7b-978e-ea22a6534a76",
      "target_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc35dc8c-2f5f-4872-95a9-46dce5fbed48",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule Smooth_Operator_Strings {\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule identifies broader functionality across Smooth Operator, identifying strings observed throughout.\"\r\n        date = \"2023-06-29\"\r\n        hash1 = \"769383fc65d1386dd141c960c9970114547da0c2\"\r\n\r\n    strings:\r\n        $ = {80 [2] 7A 48 FF C0 48 83 F8 38} // .main_storage XOR loop\r\n        $ = \"<key>ProductVersion</key>\"\r\n        $ = \".session-lock\"\r\n        $ = \"%s/.main_storage\"\r\n        $ = \"%s/UpdateAgent\"\r\n        $ = {3715001316161B554F544A5A522D13141E150D095A342E5A4B4A544A415A2D13144C4E415A024C4E535A3B0A0A161F2D1F1831130E554F494D54494C5A5231322E3736565A1613111F5A3D1F191115535A39120815171F554B4A42544A544F494F43544B48425A291B1C1B0813554F494D54494C} // XOR'd UA\r\n        $ = {B02D[0-8]88470888470D884712884717C6472400} // victim ID generation\r\n\r\n    condition:\r\n\t((uint32(0) == 0xFEEDFACF) or (uint32(0) == 0xFEEDFACE) or (uint32(0) == 0xCAFEBABE) or (uint32(0) == 0xCAFEBABF)) and 4 of them\r\n}\r\n",
      "description": "This rule identifies broader functionality across Smooth Operator, identifying strings observed throughout.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "YARA: Smooth_Operator_Strings ",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b9300ebe-3dda-4fe5-b84c-5200c9c72d29",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--bc35dc8c-2f5f-4872-95a9-46dce5fbed48",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4388e614-4bcb-4951-a4d7-c0549128818a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--bc35dc8c-2f5f-4872-95a9-46dce5fbed48",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1e5f3cb-abe6-49f9-acdd-be7ff3bd0093",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--bc35dc8c-2f5f-4872-95a9-46dce5fbed48",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9b6904ac-7cf4-4e16-8e28-8c10a0cd836b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--bc35dc8c-2f5f-4872-95a9-46dce5fbed48",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f251775-6bc4-46bf-ab84-2ba95e68f7d9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule Smooth_Operator_C2_codes {\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule identifies sections of code which are responsible for parsing tasking command codes in Smooth Operator.\"\r\n        date = \"2023-06-29\"\r\n        hash1 = \"769383fc65d1386dd141c960c9970114547da0c2\"\r\n\r\n    strings:\r\n\t$ = {80340F7A48FFC14839C8} // XOR deobfuscate tasking\r\n        $ = {8B073D4938000074??3D018000008B4C24??0F[3-6]3D01900000} // C2 codes\r\n\r\n    condition:\r\n\t((uint32(0) == 0xFEEDFACF) or (uint32(0) == 0xFEEDFACE) or (uint32(0) == 0xCAFEBABE) or (uint32(0) == 0xCAFEBABF)) and all of them\r\n}",
      "description": "This rule identifies sections of code which are responsible for parsing tasking command codes in Smooth Operator.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "YARA: Smooth_Operator_C2_codes",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--75b0044d-3af3-4278-b68a-989d9a597cbe",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--2f251775-6bc4-46bf-ab84-2ba95e68f7d9",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5ba18f19-70f7-4aaa-82ed-164254a0baa1",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--2f251775-6bc4-46bf-ab84-2ba95e68f7d9",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a571ba6d-c61c-4f13-8e61-c830c70aaa53",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--2f251775-6bc4-46bf-ab84-2ba95e68f7d9",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--271745c6-9fc7-49b4-9b1a-1cd62c024aca",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--2f251775-6bc4-46bf-ab84-2ba95e68f7d9",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--58b367e1-ec2c-49ac-81da-776710fcaf51",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--2f251775-6bc4-46bf-ab84-2ba95e68f7d9",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a7cdf1a5-cd4a-4de6-9874-7cf85c369fbe",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule Smooth_Operator_Sleeps {\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule identifies algorithms used by the malware developer to generate random time values in Smooth Operator.\"\r\n        date = \"2023-06-29\"\r\n        hash1 = \"769383fc65d1386dd141c960c9970114547da0c2\"\r\n\r\n    strings:\r\n\t$ = {E8[4]E8[4]89C14869C93FC5254348C1E9246BC93D29C86BE83C81C5100E0000B80F000000} // between beacon time generation\r\n\t$ = {E8[4]E8[4]89C1490FAFCE48C1E9238D0C898D0C4929C8} // C2 index\r\n\t$ = {89E8D1E841BE932449924C0FAFF049C1EE224489F0C1E0044489F129C14101EE4101CE488DBC24[4]4C892FE8} // initial sleep\r\n\r\n    condition:\r\n        ((uint32(0) == 0xFEEDFACF) or (uint32(0) == 0xFEEDFACE) or (uint32(0) == 0xCAFEBABE) or (uint32(0) == 0xCAFEBABF)) and any of them\r\n}",
      "description": "This rule identifies algorithms used by the malware developer to generate random time values in Smooth Operator.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "YARA: Smooth_Operator_Sleeps ",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--00aed977-e882-4c3b-aa6e-6ced3957d2d7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--a7cdf1a5-cd4a-4de6-9874-7cf85c369fbe",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--824b3719-8a96-4a44-9e3c-70bcd310ab0e",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--a7cdf1a5-cd4a-4de6-9874-7cf85c369fbe",
      "target_ref": "attack-pattern--7adbd58c-876c-41d0-9100-2bc1907c5020"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46d9dfe1-f396-4809-a408-911e62273911",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--a7cdf1a5-cd4a-4de6-9874-7cf85c369fbe",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--db7db552-2c13-470b-9385-3bc17058525b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--a7cdf1a5-cd4a-4de6-9874-7cf85c369fbe",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a517313d-2639-41e0-a956-f19e16a5028f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--a7cdf1a5-cd4a-4de6-9874-7cf85c369fbe",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cdeed941-5338-4f13-baa4-a3608e436979",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "rule Smooth_Operator_II {\r\n    meta:\r\n        author = \"NCSC\"\r\n        description = \"This rule identifies strings observed in the second stage of Smooth Operator.\"\r\n        date = \"2023-06-29\"\r\n        hash1 = \"9e9a5f8d86356796162cee881c843cde9eaedfb3\"\r\n\r\n    strings:\r\n        $ = \"3cx_auth_id=%s;3cx_auth_token_content=%s;__tutma=true\"\r\n\t$ = \"AccountName\\\":\"\r\n        $ = \"url\\\": \\\"https://\"\r\n        $ = \"%s/Library/Application Support/3CX Desktop App/.main_storage\"\r\n        $ = \"%s/Library/Application Support/3CX Desktop App/config.json\"\r\n        $ = \"read_config\"\r\n        $ = \"enc_text\"\r\n        $ = \"send_post\"\r\n        $ = \"parse_json_config\"\r\n\r\n    condition:\r\n\t    ((uint32(0) == 0xFEEDFACF) or (uint32(0) == 0xFEEDFACE) or (uint32(0) == 0xCAFEBABE) or (uint32(0) == 0xCAFEBABF)) and 5 of them\r\n}\r\n",
      "description": "This rule identifies strings observed in the second stage of Smooth Operator.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "YARA: Smooth_Operator_II ",
      "pattern_type": "yara"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3c896143-1fc8-408c-bce9-626fede1149e",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--cdeed941-5338-4f13-baa4-a3608e436979",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9b1c819-9aaa-45d0-9010-ae7e4eff3256",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--cdeed941-5338-4f13-baa4-a3608e436979",
      "target_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--79961545-e3c0-41e3-96ce-ee932ee41a09",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--cdeed941-5338-4f13-baa4-a3608e436979",
      "target_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c2c8bada-018c-4dc9-8997-3d78831d8121",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--cdeed941-5338-4f13-baa4-a3608e436979",
      "target_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93bc1f0c-aa40-4db3-9151-bd23a73a7d97",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'msstorageazure.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: msstorageazure.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6f37d44e-4a90-4f9f-8ce8-fdb897ee5ee8",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--93bc1f0c-aa40-4db3-9151-bd23a73a7d97",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ddedf3e-c6f6-491e-8d6b-fdda46f39d2d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--93bc1f0c-aa40-4db3-9151-bd23a73a7d97",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d22f28fb-1dfe-4d2b-8ab9-aaa70105a7a5",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--93bc1f0c-aa40-4db3-9151-bd23a73a7d97",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--eae320b1-0328-460e-88a9-04b73ba02eab",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--93bc1f0c-aa40-4db3-9151-bd23a73a7d97",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aa5d508b-fbe1-43c4-8bce-8a32f15efb64",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--93bc1f0c-aa40-4db3-9151-bd23a73a7d97",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--41176a1e-cfbb-4e1b-9797-48d60d845b53",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'officestoragebox.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: officestoragebox.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf90ffdb-e3c7-4124-9e0c-ed7ca3bc00de",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--41176a1e-cfbb-4e1b-9797-48d60d845b53",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8bfade5a-53dd-4b0f-a145-67d1f120c220",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--41176a1e-cfbb-4e1b-9797-48d60d845b53",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--17a9a39e-c987-4328-9523-94b78c467041",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--41176a1e-cfbb-4e1b-9797-48d60d845b53",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33630844-5db8-4713-8c61-8dbd44ad8499",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--41176a1e-cfbb-4e1b-9797-48d60d845b53",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3fb78fdd-1b65-470e-9d37-b6877b745c33",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--41176a1e-cfbb-4e1b-9797-48d60d845b53",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e857e946-5912-4850-a3ec-2e3522124530",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'visualstudiofactory.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: visualstudiofactory.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c468b656-f120-45b4-aee8-c261d711dd3e",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e857e946-5912-4850-a3ec-2e3522124530",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd8b5270-0ee8-49e0-b5a5-729ecd9c004b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e857e946-5912-4850-a3ec-2e3522124530",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a867f221-dc3c-44a8-834b-78ef6d92e9c9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e857e946-5912-4850-a3ec-2e3522124530",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b7bfa4e5-5f62-4ad6-98f8-4c6998107aa2",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e857e946-5912-4850-a3ec-2e3522124530",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f016d6a3-cef0-44d1-a879-ae18b89f4bf6",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e857e946-5912-4850-a3ec-2e3522124530",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e10e3bd-6b22-45bd-ab44-41977e892172",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'azuredeploystore.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: azuredeploystore.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ed53096-d548-4e0b-875d-5dcda6865ef0",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--1e10e3bd-6b22-45bd-ab44-41977e892172",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43e7f3f5-a609-45fb-94a0-c491abe2eba7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--1e10e3bd-6b22-45bd-ab44-41977e892172",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f1bb098c-1cbb-49ea-96be-a66e91ed0306",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--1e10e3bd-6b22-45bd-ab44-41977e892172",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--24e73420-c019-46ec-9da6-47d6a6425f45",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--1e10e3bd-6b22-45bd-ab44-41977e892172",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1e939da2-6e34-495d-8f29-445462bc6bf9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--1e10e3bd-6b22-45bd-ab44-41977e892172",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--240c7ced-6bd0-4e1b-8cae-d740e5b1e3df",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'msstorageboxes.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: msstorageboxes.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25fdda95-d56a-4400-b209-4344441a7800",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--240c7ced-6bd0-4e1b-8cae-d740e5b1e3df",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dcc14d13-acfc-402e-86b6-a63e5dd826bb",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--240c7ced-6bd0-4e1b-8cae-d740e5b1e3df",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3750756-9f1f-4c64-ab1d-31e79f9271d2",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--240c7ced-6bd0-4e1b-8cae-d740e5b1e3df",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--88d147ad-af94-408a-bf7e-ea49ab732490",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--240c7ced-6bd0-4e1b-8cae-d740e5b1e3df",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7adac23f-8b72-48f9-a4e2-cdecb2194227",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--240c7ced-6bd0-4e1b-8cae-d740e5b1e3df",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c375182f-df53-4e5a-a2d4-11c10822e03f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'officeaddons.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: officeaddons.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--666b4c82-d611-46e0-b8fa-86c246fcd90d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--c375182f-df53-4e5a-a2d4-11c10822e03f",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--295b14fd-f617-479c-bffe-8c1dd4f45c8c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--c375182f-df53-4e5a-a2d4-11c10822e03f",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ebff3502-dbdd-472f-bfae-34c4589e96a7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c375182f-df53-4e5a-a2d4-11c10822e03f",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--079457a7-a582-47cf-9598-58217b8fae20",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c375182f-df53-4e5a-a2d4-11c10822e03f",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb149218-1ff4-4ff4-85e4-b8d1f3b9c414",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--c375182f-df53-4e5a-a2d4-11c10822e03f",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c692470-7f6e-468f-b92a-2fddb44af8ca",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'sourceslabs.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: sourceslabs.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--677fe88b-426c-4073-8439-b09902771353",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--0c692470-7f6e-468f-b92a-2fddb44af8ca",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8fcab4c9-da85-4a0c-a958-ecabb316f44d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--0c692470-7f6e-468f-b92a-2fddb44af8ca",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4f931434-fcd1-440b-a25e-522d1f072d36",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--0c692470-7f6e-468f-b92a-2fddb44af8ca",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5adf9d5e-e265-4193-ace8-5eabd506a42a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--0c692470-7f6e-468f-b92a-2fddb44af8ca",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e64547e5-77ad-4bd5-bfe0-033b9c75ce86",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--0c692470-7f6e-468f-b92a-2fddb44af8ca",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--59007e4f-2809-4e50-9703-320032e3f2bd",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'zacharryblogs.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: zacharryblogs.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--34749803-ec44-4dd9-a39f-0cec0db41f4a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--59007e4f-2809-4e50-9703-320032e3f2bd",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9bb5ce1c-9f22-4d82-962d-a33d8f0573bc",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--59007e4f-2809-4e50-9703-320032e3f2bd",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14d1a327-57b3-4bb3-88fc-2312846a3663",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--59007e4f-2809-4e50-9703-320032e3f2bd",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f6579371-7bd3-42d4-88c7-e2a7f0708c2f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--59007e4f-2809-4e50-9703-320032e3f2bd",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43f3ee87-0c6b-43b9-b037-e845a6515d6b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--59007e4f-2809-4e50-9703-320032e3f2bd",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97086dd3-951f-4e00-b311-4dbdfc24845d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'pbxcloudeservices.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: pbxcloudeservices.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e3c59ae4-43ca-4fb5-8153-5d91a125e815",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--97086dd3-951f-4e00-b311-4dbdfc24845d",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b2c8d5f7-9f84-4f0e-98ec-2e7fb2a74b03",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--97086dd3-951f-4e00-b311-4dbdfc24845d",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--96399c47-6b10-47d7-aaee-810ae7ba545c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--97086dd3-951f-4e00-b311-4dbdfc24845d",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8153ebdb-4bea-4a5f-b3ef-e1bd635c3326",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--97086dd3-951f-4e00-b311-4dbdfc24845d",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7ac8b1be-4c37-4a5f-88bb-999dfe1b5a15",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--97086dd3-951f-4e00-b311-4dbdfc24845d",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--32ca8cf7-fa5d-4da4-b010-5b6e2b53eabc",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'pbxphonenetwork.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: pbxphonenetwork.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e1325ff8-6826-448a-98fa-84172bf56833",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--32ca8cf7-fa5d-4da4-b010-5b6e2b53eabc",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--61f07ae3-e0b9-4316-b050-864b38d53613",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--32ca8cf7-fa5d-4da4-b010-5b6e2b53eabc",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47bfa912-d71b-431f-b719-a8d923717af3",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--32ca8cf7-fa5d-4da4-b010-5b6e2b53eabc",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c36dfef-dc2a-4afe-ba10-eacf4fafb938",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--32ca8cf7-fa5d-4da4-b010-5b6e2b53eabc",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f13e7822-ce37-4b86-9d20-e20083e9ffaa",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--32ca8cf7-fa5d-4da4-b010-5b6e2b53eabc",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c847eec-3b50-49cd-979c-d438ea5d9869",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'akamaitechcloudservices.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: akamaitechcloudservices.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a44ba1fb-39da-4da5-a72c-e395df30430b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--5c847eec-3b50-49cd-979c-d438ea5d9869",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c51aa3c0-cde0-44bd-abc1-858ff28f04d7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--5c847eec-3b50-49cd-979c-d438ea5d9869",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--33de28c1-3f4b-4dad-a796-617d7e90ad84",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--5c847eec-3b50-49cd-979c-d438ea5d9869",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--267db390-1345-4204-a0c7-34f735fa7c35",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--5c847eec-3b50-49cd-979c-d438ea5d9869",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--edfa9c3d-8a23-4719-a33e-d508adb0aa7a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--5c847eec-3b50-49cd-979c-d438ea5d9869",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d9e0060-2183-49b9-956f-240ebe6b3114",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'azureonlinestorage.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: azureonlinestorage.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--356134e8-741d-46d2-9bd7-ead9fa4a57b6",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--9d9e0060-2183-49b9-956f-240ebe6b3114",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b641eb6d-cba4-4cc6-ad66-1fdb7f2d63e3",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--9d9e0060-2183-49b9-956f-240ebe6b3114",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c7fd9e5-22af-494e-95ea-1ed0062bcadb",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--9d9e0060-2183-49b9-956f-240ebe6b3114",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca3444b2-6a7b-4c86-954b-9cb5191d4825",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--9d9e0060-2183-49b9-956f-240ebe6b3114",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8a52576e-1b98-4bec-aa6f-0da08c738d22",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--9d9e0060-2183-49b9-956f-240ebe6b3114",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99f897ce-712c-4dd4-8fa8-802934c9fe5b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'msedgepackageinfo.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: msedgepackageinfo.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c9e0165c-4679-4d33-9764-4f621037a878",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--99f897ce-712c-4dd4-8fa8-802934c9fe5b",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--83bcf930-b3ee-41b3-a2a6-5bb3d8f594f7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--99f897ce-712c-4dd4-8fa8-802934c9fe5b",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f779b749-adb0-427a-9b52-18f2f31f8f18",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--99f897ce-712c-4dd4-8fa8-802934c9fe5b",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--724526b1-391f-4a53-b4f8-500122181c7a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--99f897ce-712c-4dd4-8fa8-802934c9fe5b",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cb3d6aab-26a1-4c71-b73c-1b736abf277e",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--99f897ce-712c-4dd4-8fa8-802934c9fe5b",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fca9627a-9f06-4a42-abe9-d12bfebba5e7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'glcloudservice.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: glcloudservice.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2cdd62cf-290f-4124-96f8-a663dc47b1a9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--fca9627a-9f06-4a42-abe9-d12bfebba5e7",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--25ae32f2-804d-4d5c-938c-d552d15bb90f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--fca9627a-9f06-4a42-abe9-d12bfebba5e7",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2c26cd8c-510d-496a-9ad8-f444d532b117",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--fca9627a-9f06-4a42-abe9-d12bfebba5e7",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--e68c8625-daff-42a9-9d6f-46bd48d2621e",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--fca9627a-9f06-4a42-abe9-d12bfebba5e7",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--fb964ac4-ad4c-4b3b-b163-69b2c7d98d02",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--fca9627a-9f06-4a42-abe9-d12bfebba5e7",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c7cbc29-775d-4ff7-9c96-6bfea525c8ca",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'pbxsources.com']",
      "description": "C2 domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: pbxsources.com",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a99afa4-3245-4f31-ba3b-2646299ced93",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--3c7cbc29-775d-4ff7-9c96-6bfea525c8ca",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ff087a65-3f7b-43a3-b7ea-67a78a3f0ae7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--3c7cbc29-775d-4ff7-9c96-6bfea525c8ca",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--86812761-a1b9-44a9-8edb-e3317f833a34",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--3c7cbc29-775d-4ff7-9c96-6bfea525c8ca",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--cafe26ad-0521-4017-8707-f84343f5ccbf",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--3c7cbc29-775d-4ff7-9c96-6bfea525c8ca",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--de8680dd-2d96-4705-b19f-0b14aba8fa36",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--3c7cbc29-775d-4ff7-9c96-6bfea525c8ca",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fb895084-b502-4239-92c1-0f10c0377f92",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[domain-name:value = 'sbmsa.wiki']",
      "description": "Exfiltration domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Domain Name: sbmsa.wiki",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ed4da97-f374-45cd-9f2e-a34f21262b48",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--fb895084-b502-4239-92c1-0f10c0377f92",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8e6b641c-cd73-44f9-85ea-ccc4f183fc09",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--fb895084-b502-4239-92c1-0f10c0377f92",
      "target_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2b9d9770-35e9-473d-bae8-fa1b84e7d35e",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--fb895084-b502-4239-92c1-0f10c0377f92",
      "target_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d09401c6-4b12-4305-b2e9-c90b3646ced6",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--fb895084-b502-4239-92c1-0f10c0377f92",
      "target_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a5a015f-56be-4118-b6d5-3c7f9bed4d33",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://msstorageazure.com/analysis']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://msstorageazure.com/analysis",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--097be33d-04c2-4d1e-8731-982f2616a088",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--9a5a015f-56be-4118-b6d5-3c7f9bed4d33",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c1201654-b6d4-47dc-8ee3-3d6166526d2c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--9a5a015f-56be-4118-b6d5-3c7f9bed4d33",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c245f63c-a3ab-4ab9-90ca-cb399b10d131",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--9a5a015f-56be-4118-b6d5-3c7f9bed4d33",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8457b3a4-a922-43c0-bfef-cf139e98d099",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--9a5a015f-56be-4118-b6d5-3c7f9bed4d33",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27b70cd2-6eff-48eb-bbb6-d6d0db510fc2",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--9a5a015f-56be-4118-b6d5-3c7f9bed4d33",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--36c56169-d0ad-4460-8606-dc7bf5de1e92",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://officestoragebox.com/api/biosync']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://officestoragebox.com/api/biosync",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3f66cc0-e661-4b9b-8e34-eb24ee4af831",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--36c56169-d0ad-4460-8606-dc7bf5de1e92",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9e4606da-8a70-472f-92ba-f6ff0516dcf1",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--36c56169-d0ad-4460-8606-dc7bf5de1e92",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4faa4d84-9a6f-4edb-a377-a47f0d840c10",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--36c56169-d0ad-4460-8606-dc7bf5de1e92",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7e7ed6c0-40a4-4511-9f20-a4166c97812b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--36c56169-d0ad-4460-8606-dc7bf5de1e92",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--919c7f54-4aec-4bee-963e-250b37e8152c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--36c56169-d0ad-4460-8606-dc7bf5de1e92",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec1708e1-f07d-4c8c-9c96-5dea7ee1f723",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://visualstudiofactory.com/groupcore']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://visualstudiofactory.com/groupcore",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bac0da80-072c-4bed-8aac-0a1e57964e4e",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--ec1708e1-f07d-4c8c-9c96-5dea7ee1f723",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5b78968a-fa09-47f9-bc75-58621c373f29",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--ec1708e1-f07d-4c8c-9c96-5dea7ee1f723",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a95bbed4-8929-42dd-b5f5-f44c591fc7c1",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--ec1708e1-f07d-4c8c-9c96-5dea7ee1f723",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ba6629b9-96f5-4881-acfe-2538f9cd3eb1",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--ec1708e1-f07d-4c8c-9c96-5dea7ee1f723",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dc576dfb-d2c5-4b44-a242-70e273400913",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--ec1708e1-f07d-4c8c-9c96-5dea7ee1f723",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e56ea705-ee2a-4822-9900-375deefc0c0f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://azuredeploystore.com/cloud/images']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://azuredeploystore.com/cloud/images",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--27b67287-f3f0-49d5-bb94-9af23bdd864c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e56ea705-ee2a-4822-9900-375deefc0c0f",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--063e944e-b3f1-44d5-9dfd-d6f0de465650",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e56ea705-ee2a-4822-9900-375deefc0c0f",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c559c408-2193-46dd-91ce-5cd925c61af4",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e56ea705-ee2a-4822-9900-375deefc0c0f",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9fab9d2a-f63c-4343-bb5c-833e3ea0d420",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e56ea705-ee2a-4822-9900-375deefc0c0f",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ac170274-91c0-4393-ab52-1181950d2bf6",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e56ea705-ee2a-4822-9900-375deefc0c0f",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89a7b8b9-ba68-4a15-bd4e-6e1e96dd6c14",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://msstorageboxes.com/xbox']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://msstorageboxes.com/xbox",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0c874352-1962-4cdc-ba22-7b43aad762cb",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--89a7b8b9-ba68-4a15-bd4e-6e1e96dd6c14",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c32efc95-2248-4574-8ba3-f88e887aa68f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--89a7b8b9-ba68-4a15-bd4e-6e1e96dd6c14",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8093a141-3213-46f9-a253-d83a3a2d67b9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--89a7b8b9-ba68-4a15-bd4e-6e1e96dd6c14",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4963c59b-783d-42e9-a739-5b6808876c9f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--89a7b8b9-ba68-4a15-bd4e-6e1e96dd6c14",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--22a6ecf4-a3f4-4137-932a-cfdbca360b5a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--89a7b8b9-ba68-4a15-bd4e-6e1e96dd6c14",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3196e639-bbab-4aa6-a46e-352e3c7abf59",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://officeaddons.com/quality']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://officeaddons.com/quality",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--aae2ae02-a30b-4b85-a20d-c7a12bf2d92e",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--3196e639-bbab-4aa6-a46e-352e3c7abf59",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ac94694-5379-4de8-9e42-496d29c87ff9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--3196e639-bbab-4aa6-a46e-352e3c7abf59",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1d493b97-7bec-4af1-80d3-f3adb1d7f895",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--3196e639-bbab-4aa6-a46e-352e3c7abf59",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ea422a14-4690-4177-a51c-dcbe26867256",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--3196e639-bbab-4aa6-a46e-352e3c7abf59",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--b97932af-210f-4ad2-9d23-58adb52c6220",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--3196e639-bbab-4aa6-a46e-352e3c7abf59",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e40e375d-d29b-4a19-927f-30ec0b484061",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://sourceslabs.com/status']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://sourceslabs.com/status",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a1e95fb0-056d-4037-8f11-2bc71bcd947b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e40e375d-d29b-4a19-927f-30ec0b484061",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78c1da90-a6af-48ee-92ee-bd488506b838",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--e40e375d-d29b-4a19-927f-30ec0b484061",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09f5d9c2-2e19-4b94-b1df-31263de95b81",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e40e375d-d29b-4a19-927f-30ec0b484061",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--147f6bf4-d211-4bac-9801-def2a87f8e79",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e40e375d-d29b-4a19-927f-30ec0b484061",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--7df2745a-e6e3-4fc5-ac08-ad030123728c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--e40e375d-d29b-4a19-927f-30ec0b484061",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--156c284d-8490-4692-896e-23e5eb85068e",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://zacharryblogs.com/xmlquery']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://zacharryblogs.com/xmlquery",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d3595c7c-cee4-45f2-aea1-bab5129821fa",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--156c284d-8490-4692-896e-23e5eb85068e",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ce9266c8-12c7-4159-8a7b-6148a2dfce27",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--156c284d-8490-4692-896e-23e5eb85068e",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--55f4c017-efa9-4fd3-84cd-5cd7551358a8",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--156c284d-8490-4692-896e-23e5eb85068e",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--1978b7f5-3603-4cd8-af80-96b58a4d88c7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--156c284d-8490-4692-896e-23e5eb85068e",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9786eddc-6609-4a8e-8055-be85c4f9e3e8",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--156c284d-8490-4692-896e-23e5eb85068e",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a07410e-9bf1-4ad9-ac36-a301dfed21cc",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://pbxcloudeservices.com/network']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://pbxcloudeservices.com/network",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--43a2ab6a-2188-4fdc-afe0-c0d9fc702c43",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--3a07410e-9bf1-4ad9-ac36-a301dfed21cc",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ee687977-163b-4a72-b93b-90201319a226",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--3a07410e-9bf1-4ad9-ac36-a301dfed21cc",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18b17e57-c87e-44f8-8497-93a978bb103c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--3a07410e-9bf1-4ad9-ac36-a301dfed21cc",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--15ddb153-f60a-412b-a288-53bd49a352d1",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--3a07410e-9bf1-4ad9-ac36-a301dfed21cc",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f37da8a2-5241-4bb4-8b6b-419eec6f0344",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--3a07410e-9bf1-4ad9-ac36-a301dfed21cc",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77f41a83-9d68-492b-8df7-8b6f498f6b35",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://pbxphonenetwork.com/phone']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://pbxphonenetwork.com/phone",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--10c9daff-d9ed-46b5-961f-3eb7837d0157",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--77f41a83-9d68-492b-8df7-8b6f498f6b35",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0081cd87-c983-4e68-b635-dd866102d77d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--77f41a83-9d68-492b-8df7-8b6f498f6b35",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--211c1da6-61e7-4490-820c-61a48de43c0f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--77f41a83-9d68-492b-8df7-8b6f498f6b35",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d0f25e67-4814-4120-877e-9cef3c2dfbba",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--77f41a83-9d68-492b-8df7-8b6f498f6b35",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--47657778-edd4-4230-8c35-6fe78b2aa2dc",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--77f41a83-9d68-492b-8df7-8b6f498f6b35",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5b999aac-adc1-4337-ad80-b70af7ae17a4",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://akamaitechcloudservices.com/v2/fileapi']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://akamaitechcloudservices.com/v2/fileapi",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--53b189fa-f302-4275-8278-c4a5981caacb",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--5b999aac-adc1-4337-ad80-b70af7ae17a4",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a90acf24-907f-4b1f-8037-886b18bada07",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--5b999aac-adc1-4337-ad80-b70af7ae17a4",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--da6b309d-fd92-4ae5-8e96-37dada1c447d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--5b999aac-adc1-4337-ad80-b70af7ae17a4",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--381df504-018b-4e41-99bf-128d7e94835c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--5b999aac-adc1-4337-ad80-b70af7ae17a4",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--3b33a6d9-ce41-4782-a6af-154bc14daca7",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--5b999aac-adc1-4337-ad80-b70af7ae17a4",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2833ec98-045a-46f0-8413-3a8acb6dda6b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://azureonlinestorage.com/google/storage']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://azureonlinestorage.com/google/storage",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca42bf49-aa8f-4a3f-9754-ba31d1ba9597",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--2833ec98-045a-46f0-8413-3a8acb6dda6b",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0d83b69e-89c6-4b97-bc74-379e65555236",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--2833ec98-045a-46f0-8413-3a8acb6dda6b",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c771424a-6271-4054-80f6-d7e5c1749b33",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--2833ec98-045a-46f0-8413-3a8acb6dda6b",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c5f556e5-fc44-4d3e-9d41-917474e9ba05",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--2833ec98-045a-46f0-8413-3a8acb6dda6b",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--46c23f44-f24a-48c8-9bf5-784faedf9fcb",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--2833ec98-045a-46f0-8413-3a8acb6dda6b",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26173e38-2de5-461b-9545-7f9ff7864215",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://msedgepackageinfo.com/ms-webview']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://msedgepackageinfo.com/ms-webview",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a1309ae-7a8f-4925-b58b-ac360fa39e66",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--26173e38-2de5-461b-9545-7f9ff7864215",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--f5ec3b16-b30c-4e6d-93ed-239283a6558a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--26173e38-2de5-461b-9545-7f9ff7864215",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--18c704ad-daac-4532-883c-429cd6bbc790",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--26173e38-2de5-461b-9545-7f9ff7864215",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--ca77e9eb-0a3e-4696-a510-c96f158b3513",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--26173e38-2de5-461b-9545-7f9ff7864215",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a3f856cd-4a06-41f7-b1be-41e7a7c656dd",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--26173e38-2de5-461b-9545-7f9ff7864215",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f905c41a-a486-4cdb-8231-71202244347d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://glcloudservice.com/v1/status']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://glcloudservice.com/v1/status",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2d8cae17-fa9e-465c-a2a2-5367539fcc91",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--f905c41a-a486-4cdb-8231-71202244347d",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8ed24a9a-5010-4615-9359-f775a1125c5c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--f905c41a-a486-4cdb-8231-71202244347d",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--a76a8534-bb1b-4972-a72a-d65477518758",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--f905c41a-a486-4cdb-8231-71202244347d",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--8c0b3500-55e2-4085-9009-ce430e8e266c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--f905c41a-a486-4cdb-8231-71202244347d",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--78a3eca8-7d89-44eb-ba35-7a4df063731a",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--f905c41a-a486-4cdb-8231-71202244347d",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--578e2d66-9118-4c5f-8bc5-767659945e49",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://pbxsources.com/queue']",
      "description": "C2 URL.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://pbxsources.com/queue",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d90689b4-e94e-4a4f-8904-5552a589c976",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--578e2d66-9118-4c5f-8bc5-767659945e49",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bf60997c-0259-4b97-a9cc-3766d0881744",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--578e2d66-9118-4c5f-8bc5-767659945e49",
      "target_ref": "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--dfb538ff-8b14-4682-8b0d-a188a0f1a0e6",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--578e2d66-9118-4c5f-8bc5-767659945e49",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--14771192-66c8-4c91-b016-014530cbfb08",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--578e2d66-9118-4c5f-8bc5-767659945e49",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--54c06edb-157d-4ebe-945b-b7196b8494de",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--578e2d66-9118-4c5f-8bc5-767659945e49",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62189daf-1010-4c2c-8bcb-be3ab6ea68c1",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[url:value = 'https://sbmsa.wiki/blog/_insert']",
      "description": "Exfiltration domain.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "URL: https://sbmsa.wiki/blog/_insert",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--5aa35c9c-12e8-4a47-a14a-85dd4c1e4059",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--62189daf-1010-4c2c-8bcb-be3ab6ea68c1",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4d5604ec-84fb-4e05-9c63-78fa5b2f4b82",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--62189daf-1010-4c2c-8bcb-be3ab6ea68c1",
      "target_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9eec5300-57d7-49da-836d-7268ee513349",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--62189daf-1010-4c2c-8bcb-be3ab6ea68c1",
      "target_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--bd7f6ccb-310f-4e5d-bf93-c74cc4d393fa",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--62189daf-1010-4c2c-8bcb-be3ab6ea68c1",
      "target_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82ab57ae-63f4-4842-9a67-d992b37e93eb",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:name = 'UpdateAgent']",
      "description": "Name given to downloaded payloads.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Filename: UpdateAgent",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--56a0f4b8-3cc4-4dfa-9d0d-ac31c890296d",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--82ab57ae-63f4-4842-9a67-d992b37e93eb",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--c7cd22ce-e75f-4c18-9441-2828d5e874fe",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--82ab57ae-63f4-4842-9a67-d992b37e93eb",
      "target_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--337c249f-a170-400f-afe9-09cb580869f9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--82ab57ae-63f4-4842-9a67-d992b37e93eb",
      "target_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9df9b169-7428-4986-b1a2-3911a8037758",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--82ab57ae-63f4-4842-9a67-d992b37e93eb",
      "target_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--192d5fdb-7a2f-4bb3-b647-c45e9f41336f",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "pattern": "[file:name = '.main_storage']",
      "description": "Malware file containing Victim ID and next scheduled time to beacon under XOR 0x7A.",
      "valid_from": "2023-06-29T00:00:00.000Z",
      "name": "Filename: .main_storage",
      "pattern_type": "stix"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--06ba1e4f-bb49-42de-b164-31db7e84b3c0",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "indicates",
      "source_ref": "indicator--192d5fdb-7a2f-4bb3-b647-c45e9f41336f",
      "target_ref": "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--9ee4115e-c113-4848-8141-05f8ecde5e0b",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--192d5fdb-7a2f-4bb3-b647-c45e9f41336f",
      "target_ref": "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--425f950a-e1a5-4522-902b-f453f8a7bce5",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--192d5fdb-7a2f-4bb3-b647-c45e9f41336f",
      "target_ref": "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0a23bd9b-d3fc-4622-87fc-45519d71db8c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--192d5fdb-7a2f-4bb3-b647-c45e9f41336f",
      "target_ref": "indicator--37326277-cf30-4d4d-994e-259a4794b02b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--913d6c06-c074-4b62-b854-3940cb1118bf",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--192d5fdb-7a2f-4bb3-b647-c45e9f41336f",
      "target_ref": "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--92f24760-ee60-4bd5-b6c9-2415db455aa9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--192d5fdb-7a2f-4bb3-b647-c45e9f41336f",
      "target_ref": "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--39793d97-89c8-4806-ab77-fef23af9d296",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "relationship_type": "derived-from",
      "source_ref": "indicator--192d5fdb-7a2f-4bb3-b647-c45e9f41336f",
      "target_ref": "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205"
    },
    {
      "type": "marking-definition", 
      "spec_version": "2.1", 
      "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", 
      "created": "2022-10-01T00:00:00.000Z",
      "modified": "2022-10-01T00:00:00.000Z", 
      "name": "TLP:CLEAR",
      "extensions": {
      "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": {
         "extension_type": "property-extension",
         "tlp_2_0" : "clear"
         }
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "created": "2021-05-20T12:00:00.000Z",
      "modified": "2021-05-20T12:00:00.000Z",
      "name": "NCSC",
      "contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--191cc6af-1bb2-4344-ab5f-28e496638720",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_version": "1.1",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1195.001",
          "url": "https://attack.mitre.org/techniques/T1195/001"
        },
        {
          "source_name": "Trendmicro NPM Compromise",
          "url": "https://www.trendmicro.com/vinfo/dk/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets",
          "description": "Trendmicro. (2018, November 29). Hacker Infects Node.js Package to Steal from Bitcoin Wallets. Retrieved April 10, 2019."
        }
      ],
      "x_mitre_deprecated": false,
      "revoked": false,
      "description": "Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)  \n\nTargeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. ",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "Compromise Software Dependencies and Development Tools",
      "x_mitre_detection": "Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity. ",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ],
      "x_mitre_is_subtechnique": true,
      "x_mitre_data_sources": [
        "File: File Metadata"
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--960c3c86-1480-4d72-b4e0-8c242e84a5c5",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "CrowdStrike Falcon OverWatch"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1554",
          "url": "https://attack.mitre.org/techniques/T1554"
        }
      ],
      "name": "Compromise Client Software Binary",
      "description": "Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server. Common client software types are SSH clients, FTP clients, email clients, and web browsers.\n\nAdversaries may make modifications to client software binaries to carry out malicious tasks when those applications are in use. For example, an adversary may copy source code for the client software, add a backdoor, compile for the target, and replace the legitimate application binary (or support files) with the backdoored one. Since these applications may be routinely executed by the user, the adversary can leverage this for persistent access to the host.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ],
      "x_mitre_detection": "Collect and analyze signing certificate metadata and check signature validity on software that executes within the environment. Look for changes to client software that do not correlate with known software or patch cycles. \n\nConsider monitoring for anomalous behavior from client applications, such as atypical module loads, file reads/writes, or network connections.",
      "x_mitre_version": "1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_mitre_data_sources": [
        "File: File Deletion",
        "File: File Metadata",
        "File: File Creation",
        "File: File Modification"
      ],
      "x_mitre_is_subtechnique": false,
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "x_mitre_platforms": [
        "Windows",
        "Linux",
        "macOS"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "Matthew Demaske, Adaptforward",
        "Red Canary"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_version": "1.1",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1140",
          "url": "https://attack.mitre.org/techniques/T1140"
        },
        {
          "source_name": "Volexity PowerDuke November 2016",
          "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/",
          "description": "Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017."
        },
        {
          "source_name": "Malwarebytes Targeted Attack against Saudi Arabia",
          "url": "https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/",
          "description": "Malwarebytes Labs. (2017, March 27). New targeted attack against Saudi Arabia Government. Retrieved July 3, 2017."
        },
        {
          "source_name": "Carbon Black Obfuscation Sept 2016",
          "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/",
          "description": "Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018."
        }
      ],
      "x_mitre_deprecated": false,
      "revoked": false,
      "description": "Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.\n\nOne such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows <code>copy /b</code> command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)\n\nSometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "Deobfuscate/Decode Files or Information",
      "x_mitre_detection": "Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation. If the functionality is contained within malware and uses the Windows API, then attempting to detect malicious behavior before or after the action may yield better results than attempting to perform analysis on loaded libraries or API calls. If scripts are used, then collecting the scripts for analysis may be necessary. Perform process and command-line monitoring to detect potentially malicious behavior related to scripts and system utilities such as [certutil](https://attack.mitre.org/software/S0160).\n\nMonitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "x_mitre_is_subtechnique": false,
      "x_mitre_data_sources": [
        "Process: Process Creation",
        "File: File Modification",
        "Script: Script Execution"
      ],
      "x_mitre_defense_bypassed": [
        "Anti-virus",
        "Host Intrusion Prevention Systems",
        "Signature-based Detection",
        "Network Intrusion Detection System"
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "Walker Johnson"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_version": "1.1",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1070.004",
          "url": "https://attack.mitre.org/techniques/T1070/004"
        },
        {
          "source_name": "Microsoft SDelete July 2016",
          "url": "https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete",
          "description": "Russinovich, M. (2016, July 4). SDelete v2.0. Retrieved February 8, 2018."
        }
      ],
      "x_mitre_deprecated": false,
      "revoked": false,
      "description": "Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.\n\nThere are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) functions include <code>del</code> on Windows and <code>rm</code> or <code>unlink</code> on Linux and macOS.",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "File Deletion",
      "x_mitre_detection": "It may be uncommon for events related to benign command-line functions such as DEL or third-party utilities or tools to be found in an environment, depending on the user base and how systems are typically used. Monitoring for command-line deletion functions to correlate with binaries or other files that an adversary may drop and remove may lead to detection of malicious activity. Another good practice is monitoring for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce. Some monitoring tools may collect command-line arguments, but may not capture DEL commands since DEL is a native function within cmd.exe.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        }
      ],
      "x_mitre_is_subtechnique": true,
      "x_mitre_data_sources": [
        "Command: Command Execution",
        "File: File Deletion"
      ],
      "x_mitre_defense_bypassed": [
        "Host forensic analysis"
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "Jorge Orchilles, SCYTHE",
        "Ruben Dodge, @shotgunner101",
        "Jeff Felling, Red Canary",
        "Deloitte Threat Library Team"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1497.003",
          "url": "https://attack.mitre.org/techniques/T1497/003"
        },
        {
          "source_name": "Deloitte Environment Awareness",
          "url": "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc",
          "description": "Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved May 18, 2021."
        },
        {
          "source_name": "Revil Independence Day",
          "url": "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/",
          "description": "Loman, M. et al. (2021, July 4). Independence Day: REvil uses supply chain exploit to attack hundreds of businesses. Retrieved September 30, 2021."
        },
        {
          "source_name": "Netskope Nitol",
          "url": "https://www.netskope.com/blog/nitol-botnet-makes-resurgence-evasive-sandbox-analysis-technique",
          "description": "Malik, A. (2016, October 14). Nitol Botnet makes a resurgence with evasive sandbox analysis technique. Retrieved September 30, 2021."
        },
        {
          "source_name": "Joe Sec Nymaim",
          "url": "https://www.joesecurity.org/blog/3660886847485093803",
          "description": "Joe Security. (2016, April 21). Nymaim - evading Sandboxes with API hammering. Retrieved September 30, 2021."
        },
        {
          "source_name": "Joe Sec Trickbot",
          "url": "https://www.joesecurity.org/blog/498839998833561473",
          "description": "Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021."
        },
        {
          "source_name": "ISACA Malware Tricks",
          "url": "https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/evasive-malware-tricks-how-malware-evades-detection-by-sandboxes",
          "description": "Kolbitsch, C. (2017, November 1). Evasive Malware Tricks: How Malware Evades Detection by Sandboxes. Retrieved March 30, 2021."
        }
      ],
      "name": "Time Based Evasion",
      "description": "Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.\n\nAdversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny.(Citation: Deloitte Environment Awareness)\n\nBenign commands or other operations may also be used to delay malware execution. Loops or otherwise needless repetitions of commands, such as [Ping](https://attack.mitre.org/software/S0097)s, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.(Citation: Revil Independence Day)(Citation: Netskope Nitol) Another variation, commonly referred to as API hammering, involves making various calls to [Native API](https://attack.mitre.org/techniques/T1106) functions in order to delay execution (while also potentially overloading analysis environments with junk data).(Citation: Joe Sec Nymaim)(Citation: Joe Sec Trickbot)\n\nAdversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-evasion"
        },
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ],
      "x_mitre_detection": "Time-based evasion will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained. Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection. ",
      "x_mitre_is_subtechnique": true,
      "x_mitre_version": "1.2",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_mitre_data_sources": [
        "Process: OS API Execution",
        "Command: Command Execution",
        "Process: Process Creation"
      ],
      "x_mitre_defense_bypassed": [
        "Host forensic analysis",
        "Signature-based detection",
        "Static File Analysis",
        "Anti-virus"
      ],
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--30208d3e-0d6b-43c8-883e-44462a514619",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows",
        "IaaS",
        "SaaS"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "Praetorian"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_version": "1.1",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1119",
          "url": "https://attack.mitre.org/techniques/T1119"
        }
      ],
      "x_mitre_deprecated": false,
      "revoked": false,
      "description": "Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data. This functionality could also be built into remote access tools. \n\nThis technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments.",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "Automated Collection",
      "x_mitre_detection": "Depending on the method used, actions could include common file system commands and parameters on the command-line interface within batch files or scripts. A sequence of actions like this may be unusual, depending on the system and network environment. Automated collection may occur along with other techniques such as [Data Staged](https://attack.mitre.org/techniques/T1074). As such, file access monitoring that shows an unusual process performing sequential file opens and potentially copy actions to another location on the file system for many files at once may indicate automated collection behavior. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), as well as through cloud APIs and command line interfaces.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "collection"
        }
      ],
      "x_mitre_is_subtechnique": false,
      "x_mitre_data_sources": [
        "Script: Script Execution",
        "Command: Command Execution",
        "File: File Access"
      ],
      "x_mitre_system_requirements": [
        "Permissions to access directories, files, and API endpoints that store information of interest."
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.001",
          "url": "https://attack.mitre.org/techniques/T1071/001"
        },
        {
          "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf",
          "description": "Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
          "source_name": "University of Birmingham C2"
        }
      ],
      "name": "Web Protocols",
      "description": "Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as HTTP and HTTPS that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ],
      "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)\n\nMonitor for web traffic to/from known-bad or suspicious domains. ",
      "x_mitre_is_subtechnique": true,
      "x_mitre_version": "1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_mitre_data_sources": [
        "Network Traffic: Network Traffic Flow",
        "Network Traffic: Network Traffic Content"
      ],
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "x_mitre_platforms": [
        "Linux",
        "Windows",
        "macOS"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "url": "https://attack.mitre.org/techniques/T1008",
          "external_id": "T1008"
        },
        {
          "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf",
          "description": "Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
          "source_name": "University of Birmingham C2"
        }
      ],
      "name": "Fallback Channels",
      "description": "Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ],
      "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)",
      "x_mitre_version": "1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_mitre_data_sources": [
        "Network Traffic: Network Connection Creation",
        "Network Traffic: Network Traffic Flow"
      ],
      "x_mitre_is_subtechnique": false,
      "x_killchain": "mitre-attack"
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "id": "attack-pattern--774a3188-6ba9-4dc4-879d-d54ee48a5ce9",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "x_mitre_platforms": [
        "Linux",
        "macOS",
        "Windows",
        "Network"
      ],
      "x_mitre_domains": [
        "enterprise-attack"
      ],
      "x_mitre_contributors": [
        "ExtraHop"
      ],
      "object_marking_refs": [
        "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
      ],
      "x_mitre_version": "1.2",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1020",
          "url": "https://attack.mitre.org/techniques/T1020"
        }
      ],
      "x_mitre_deprecated": false,
      "revoked": false,
      "description": "Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. \n\nWhen automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).",
      "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "name": "Automated Exfiltration",
      "x_mitre_detection": "Monitor process file access patterns and network behavior. Unrecognized processes or scripts that appear to be traversing file systems and sending network traffic may be suspicious.",
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ],
      "x_mitre_is_subtechnique": false,
      "x_mitre_data_sources": [
        "Network Traffic: Network Connection Creation",
        "Network Traffic: Network Traffic Content",
        "Script: Script Execution",
        "File: File Access",
        "Command: Command Execution",
        "Network Traffic: Network Traffic Flow"
      ],
      "x_mitre_attack_spec_version": "2.1.0",
      "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
      "x_killchain": "mitre-attack"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--141c29ad-3ac6-4dba-aa27-03e611eb9eb2",
      "created": "2023-06-29T00:00:00.000Z",
      "modified": "2023-06-29T00:00:00.000Z",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4",
      "name": "Malware Analysis Report: Smooth Operator",
      "description": "macOS supply chain malware that exfiltrates victim data using a custom data encoding algorithm over HTTPS\n•\tSmooth Operator malware targets the macOS operating system. \n•\tSmooth Operator was distributed to victims as part of the 3CX supply chain attack.\n•\tThe infected software package was signed by 3CX and notarized by Apple.\n•\tHTTPS is used as a C2 channel, with an additional custom encoding algorithm used to obfuscate exfiltrated data.\n•\tSmooth Operator randomises the C2 server it communicates with. The 3CX website is included in the list of C2 Servers it can beacon to.\n•\tMalicious code inserted into a dynamic library (dylib) packaged with the 3CX software, downloads and runs a second stage payload.\n",
      "published": "2023-06-29T00:00:00Z",
      "external_references": [
        {
          "source_name": "NCSC",
          "external_id": "NCSC/MAR/Smooth-Operator"
        }
      ],
      "report_types": [
        "malware"
      ],
      "object_refs": [
        "malware--98261e2f-a526-4100-8cb1-e40c9681d1e8",
        "attack-pattern--2ee39264-86c5-4e27-b259-34f0eee2fb0b",
        "relationship--a6a698fe-c826-461e-ad6a-08aff0342ac1",
        "relationship--6def693b-6a74-48b6-b201-593a2291296f",
        "attack-pattern--8b377fc3-d805-435f-999a-d387d248a68d",
        "relationship--6b832d76-2125-4a14-beed-e46f04d1632b",
        "relationship--3bab6c71-a219-498e-95ef-46cece5faf58",
        "attack-pattern--a4c6179b-8e3f-4507-ab96-a432e191eea1",
        "relationship--e378b164-351d-45de-b076-f9cc5bee0f9d",
        "relationship--369ea8bc-d915-46b0-a135-7b85ce32b535",
        "attack-pattern--075d4111-1b0a-409e-89c3-306223330660",
        "relationship--7167cf4c-047d-4572-afb6-09f25ed824ee",
        "relationship--3b77b989-aa3b-4271-8903-1d190033ec64",
        "attack-pattern--7adbd58c-876c-41d0-9100-2bc1907c5020",
        "relationship--fc4d2aa0-0933-4038-a7e7-5baba18306e9",
        "relationship--b905b931-ae55-428e-ab10-80aa21e2a8ad",
        "attack-pattern--d958015f-f4a0-4742-b73e-d0e1435cb1d9",
        "relationship--ce73b49a-3f4c-4be2-b585-04dceceb57c1",
        "relationship--6f2097ea-a4f3-47b9-b67e-baee7acdebf5",
        "attack-pattern--74b8acbb-611a-4876-b7db-26f43cc9a462",
        "relationship--ffcd405b-c23f-40d7-a4f2-79d7e3531615",
        "relationship--d7a54ad0-0e4e-4d26-8395-e00912815a55",
        "attack-pattern--f68a79bb-d6f0-4a44-8d04-3e787d83f334",
        "relationship--ad175047-73c0-4563-a885-f2fbbbd790f1",
        "relationship--62b6705d-1047-4d51-8dcd-89a687add3f7",
        "attack-pattern--cc26d856-1fa9-4eed-bb29-6d68367faf6c",
        "relationship--68eb4a14-2ee4-48db-969f-26fb353b2895",
        "relationship--aa06384b-a8f1-47f3-a4d5-515493da033a",
        "relationship--9067773c-189e-467a-8ebc-4bf74fa8924d",
        "relationship--778e4b55-0544-4484-a782-5caecb5a9e63",
        "relationship--26150b11-0898-4fcb-b8c7-4b21b23ea023",
        "relationship--b7fd6e20-046a-4a65-b2b1-a0729d14d750",
        "relationship--8ca56cce-ae24-4eb1-ba1a-616c3484bcf0",
        "relationship--67e9f6ca-bd7b-4288-8ebd-4cc3bc9892bc",
        "relationship--d4425304-4af9-4bc5-bb66-7cc5fe3c5e40",
        "relationship--fb2bd476-9226-49a4-a0b5-d37e09395700",
        "relationship--bea1dd06-48e6-4f22-ac09-215ecb333342",
        "relationship--5b1acbf8-4bee-4023-9c58-28f621cb8a09",
        "relationship--84abfe9d-291c-4c46-bb16-981a38251cff",
        "relationship--464a43cd-bf9d-4155-9116-98782076bb7d",
        "relationship--baa6d96b-5119-466b-9e9a-444157b4148d",
        "relationship--c5f30be4-f60a-426f-bdc6-024fc3b90671",
        "relationship--27f9668c-c166-4075-92a1-0e868b34ae92",
        "relationship--abf6c1c9-c681-44d2-b75e-636148bc4a8a",
        "relationship--68118c2d-5ef6-4d46-982c-6b9a5aeedd5c",
        "relationship--ac7f2b23-a1e9-481b-8b3a-8270028a0d42",
        "indicator--c9e481f9-0d33-44b3-9f1d-ac3612da9111",
        "relationship--f1d6c0f0-abe1-43f7-b9d4-4fa84e6bed1a",
        "indicator--895f3fc9-8e88-445e-812f-31953aaa39ee",
        "relationship--36294f82-0b27-4702-9bce-f6a2dab29a88",
        "indicator--48f1b61e-407b-42bf-9e8d-d680c1ab5716",
        "relationship--1cd990d9-210e-4f48-bb2b-06bfc8271b32",
        "indicator--2572c282-0794-4a5e-9219-11f82eafa1c9",
        "relationship--9ddb693f-df34-4317-87eb-d5eeb7ba8630",
        "indicator--b79398f8-043f-4aea-bd4a-3ab37952975f",
        "relationship--75557be1-e77d-4f57-badc-dc5d4c93a0c8",
        "indicator--37326277-cf30-4d4d-994e-259a4794b02b",
        "relationship--8888ae67-ab69-4515-b052-ac60909d2c6a",
        "indicator--7b3d2a61-8ee8-4bf0-92f9-9b9c5cea4127",
        "relationship--31f14523-f6b4-4ff7-a174-73ff80df26e5",
        "indicator--b540b120-d11d-4ecb-8287-e06ad00be5a7",
        "relationship--2adacbda-9710-47c2-a005-1f40c5cae8ee",
        "indicator--9d2870d8-7ebd-4e8b-bbdf-23b628179205",
        "relationship--01bc7152-dca7-48ab-b9f7-0c094402dd89",
        "indicator--00ee3415-619b-4f3f-bf1f-8545c9d787a3",
        "relationship--39b724b1-89e8-4fe8-a280-608f99490367",
        "relationship--1990235c-f34f-486a-b352-c02709970dbd",
        "relationship--b4b2939a-330e-4df7-b857-fbd05d7990c5",
        "relationship--2014cf71-22ea-4e5f-94a3-12dc860aa1a8",
        "relationship--98a5bcf4-6df9-4091-b547-cd837fcb4be3",
        "relationship--ade21729-a285-492f-bbf8-45be7ef20822",
        "relationship--3d56d9da-be98-4384-9fff-56b08af80bce",
        "relationship--01876fc4-1e69-41a2-b498-311c5526069b",
        "indicator--c610d803-3227-4c7b-978e-ea22a6534a76",
        "relationship--00e2f37e-4147-457e-899d-ca661e43c0d3",
        "relationship--f6f98142-cc92-4da4-9e50-e97dff3be30a",
        "relationship--95d07ee6-8805-43c7-b63e-3d135e83f62a",
        "relationship--3ed45d88-c17a-4c90-8245-2cd3456fa488",
        "relationship--4ec32041-a1be-4aa2-b7ed-a34a77c98c75",
        "relationship--d128f57c-3eaa-4b49-af82-dbdb9d424b8b",
        "relationship--a6f97ef9-7a98-45e1-9aef-eeac757761d7",
        "relationship--0b5e4b9d-086f-4c47-a769-812ac6e22a45",
        "indicator--bc35dc8c-2f5f-4872-95a9-46dce5fbed48",
        "relationship--b9300ebe-3dda-4fe5-b84c-5200c9c72d29",
        "relationship--4388e614-4bcb-4951-a4d7-c0549128818a",
        "relationship--f1e5f3cb-abe6-49f9-acdd-be7ff3bd0093",
        "relationship--9b6904ac-7cf4-4e16-8e28-8c10a0cd836b",
        "indicator--2f251775-6bc4-46bf-ab84-2ba95e68f7d9",
        "relationship--75b0044d-3af3-4278-b68a-989d9a597cbe",
        "relationship--5ba18f19-70f7-4aaa-82ed-164254a0baa1",
        "relationship--a571ba6d-c61c-4f13-8e61-c830c70aaa53",
        "relationship--271745c6-9fc7-49b4-9b1a-1cd62c024aca",
        "relationship--58b367e1-ec2c-49ac-81da-776710fcaf51",
        "indicator--a7cdf1a5-cd4a-4de6-9874-7cf85c369fbe",
        "relationship--00aed977-e882-4c3b-aa6e-6ced3957d2d7",
        "relationship--824b3719-8a96-4a44-9e3c-70bcd310ab0e",
        "relationship--46d9dfe1-f396-4809-a408-911e62273911",
        "relationship--db7db552-2c13-470b-9385-3bc17058525b",
        "relationship--a517313d-2639-41e0-a956-f19e16a5028f",
        "indicator--cdeed941-5338-4f13-baa4-a3608e436979",
        "relationship--3c896143-1fc8-408c-bce9-626fede1149e",
        "relationship--c9b1c819-9aaa-45d0-9010-ae7e4eff3256",
        "relationship--79961545-e3c0-41e3-96ce-ee932ee41a09",
        "relationship--c2c8bada-018c-4dc9-8997-3d78831d8121",
        "indicator--93bc1f0c-aa40-4db3-9151-bd23a73a7d97",
        "relationship--6f37d44e-4a90-4f9f-8ce8-fdb897ee5ee8",
        "relationship--8ddedf3e-c6f6-491e-8d6b-fdda46f39d2d",
        "relationship--d22f28fb-1dfe-4d2b-8ab9-aaa70105a7a5",
        "relationship--eae320b1-0328-460e-88a9-04b73ba02eab",
        "relationship--aa5d508b-fbe1-43c4-8bce-8a32f15efb64",
        "indicator--41176a1e-cfbb-4e1b-9797-48d60d845b53",
        "relationship--bf90ffdb-e3c7-4124-9e0c-ed7ca3bc00de",
        "relationship--8bfade5a-53dd-4b0f-a145-67d1f120c220",
        "relationship--17a9a39e-c987-4328-9523-94b78c467041",
        "relationship--33630844-5db8-4713-8c61-8dbd44ad8499",
        "relationship--3fb78fdd-1b65-470e-9d37-b6877b745c33",
        "indicator--e857e946-5912-4850-a3ec-2e3522124530",
        "relationship--c468b656-f120-45b4-aee8-c261d711dd3e",
        "relationship--bd8b5270-0ee8-49e0-b5a5-729ecd9c004b",
        "relationship--a867f221-dc3c-44a8-834b-78ef6d92e9c9",
        "relationship--b7bfa4e5-5f62-4ad6-98f8-4c6998107aa2",
        "relationship--f016d6a3-cef0-44d1-a879-ae18b89f4bf6",
        "indicator--1e10e3bd-6b22-45bd-ab44-41977e892172",
        "relationship--9ed53096-d548-4e0b-875d-5dcda6865ef0",
        "relationship--43e7f3f5-a609-45fb-94a0-c491abe2eba7",
        "relationship--f1bb098c-1cbb-49ea-96be-a66e91ed0306",
        "relationship--24e73420-c019-46ec-9da6-47d6a6425f45",
        "relationship--1e939da2-6e34-495d-8f29-445462bc6bf9",
        "indicator--240c7ced-6bd0-4e1b-8cae-d740e5b1e3df",
        "relationship--25fdda95-d56a-4400-b209-4344441a7800",
        "relationship--dcc14d13-acfc-402e-86b6-a63e5dd826bb",
        "relationship--e3750756-9f1f-4c64-ab1d-31e79f9271d2",
        "relationship--88d147ad-af94-408a-bf7e-ea49ab732490",
        "relationship--7adac23f-8b72-48f9-a4e2-cdecb2194227",
        "indicator--c375182f-df53-4e5a-a2d4-11c10822e03f",
        "relationship--666b4c82-d611-46e0-b8fa-86c246fcd90d",
        "relationship--295b14fd-f617-479c-bffe-8c1dd4f45c8c",
        "relationship--ebff3502-dbdd-472f-bfae-34c4589e96a7",
        "relationship--079457a7-a582-47cf-9598-58217b8fae20",
        "relationship--cb149218-1ff4-4ff4-85e4-b8d1f3b9c414",
        "indicator--0c692470-7f6e-468f-b92a-2fddb44af8ca",
        "relationship--677fe88b-426c-4073-8439-b09902771353",
        "relationship--8fcab4c9-da85-4a0c-a958-ecabb316f44d",
        "relationship--4f931434-fcd1-440b-a25e-522d1f072d36",
        "relationship--5adf9d5e-e265-4193-ace8-5eabd506a42a",
        "relationship--e64547e5-77ad-4bd5-bfe0-033b9c75ce86",
        "indicator--59007e4f-2809-4e50-9703-320032e3f2bd",
        "relationship--34749803-ec44-4dd9-a39f-0cec0db41f4a",
        "relationship--9bb5ce1c-9f22-4d82-962d-a33d8f0573bc",
        "relationship--14d1a327-57b3-4bb3-88fc-2312846a3663",
        "relationship--f6579371-7bd3-42d4-88c7-e2a7f0708c2f",
        "relationship--43f3ee87-0c6b-43b9-b037-e845a6515d6b",
        "indicator--97086dd3-951f-4e00-b311-4dbdfc24845d",
        "relationship--e3c59ae4-43ca-4fb5-8153-5d91a125e815",
        "relationship--b2c8d5f7-9f84-4f0e-98ec-2e7fb2a74b03",
        "relationship--96399c47-6b10-47d7-aaee-810ae7ba545c",
        "relationship--8153ebdb-4bea-4a5f-b3ef-e1bd635c3326",
        "relationship--7ac8b1be-4c37-4a5f-88bb-999dfe1b5a15",
        "indicator--32ca8cf7-fa5d-4da4-b010-5b6e2b53eabc",
        "relationship--e1325ff8-6826-448a-98fa-84172bf56833",
        "relationship--61f07ae3-e0b9-4316-b050-864b38d53613",
        "relationship--47bfa912-d71b-431f-b719-a8d923717af3",
        "relationship--0c36dfef-dc2a-4afe-ba10-eacf4fafb938",
        "relationship--f13e7822-ce37-4b86-9d20-e20083e9ffaa",
        "indicator--5c847eec-3b50-49cd-979c-d438ea5d9869",
        "relationship--a44ba1fb-39da-4da5-a72c-e395df30430b",
        "relationship--c51aa3c0-cde0-44bd-abc1-858ff28f04d7",
        "relationship--33de28c1-3f4b-4dad-a796-617d7e90ad84",
        "relationship--267db390-1345-4204-a0c7-34f735fa7c35",
        "relationship--edfa9c3d-8a23-4719-a33e-d508adb0aa7a",
        "indicator--9d9e0060-2183-49b9-956f-240ebe6b3114",
        "relationship--356134e8-741d-46d2-9bd7-ead9fa4a57b6",
        "relationship--b641eb6d-cba4-4cc6-ad66-1fdb7f2d63e3",
        "relationship--0c7fd9e5-22af-494e-95ea-1ed0062bcadb",
        "relationship--ca3444b2-6a7b-4c86-954b-9cb5191d4825",
        "relationship--8a52576e-1b98-4bec-aa6f-0da08c738d22",
        "indicator--99f897ce-712c-4dd4-8fa8-802934c9fe5b",
        "relationship--c9e0165c-4679-4d33-9764-4f621037a878",
        "relationship--83bcf930-b3ee-41b3-a2a6-5bb3d8f594f7",
        "relationship--f779b749-adb0-427a-9b52-18f2f31f8f18",
        "relationship--724526b1-391f-4a53-b4f8-500122181c7a",
        "relationship--cb3d6aab-26a1-4c71-b73c-1b736abf277e",
        "indicator--fca9627a-9f06-4a42-abe9-d12bfebba5e7",
        "relationship--2cdd62cf-290f-4124-96f8-a663dc47b1a9",
        "relationship--25ae32f2-804d-4d5c-938c-d552d15bb90f",
        "relationship--2c26cd8c-510d-496a-9ad8-f444d532b117",
        "relationship--e68c8625-daff-42a9-9d6f-46bd48d2621e",
        "relationship--fb964ac4-ad4c-4b3b-b163-69b2c7d98d02",
        "indicator--3c7cbc29-775d-4ff7-9c96-6bfea525c8ca",
        "relationship--0a99afa4-3245-4f31-ba3b-2646299ced93",
        "relationship--ff087a65-3f7b-43a3-b7ea-67a78a3f0ae7",
        "relationship--86812761-a1b9-44a9-8edb-e3317f833a34",
        "relationship--cafe26ad-0521-4017-8707-f84343f5ccbf",
        "relationship--de8680dd-2d96-4705-b19f-0b14aba8fa36",
        "indicator--fb895084-b502-4239-92c1-0f10c0377f92",
        "relationship--9ed4da97-f374-45cd-9f2e-a34f21262b48",
        "relationship--8e6b641c-cd73-44f9-85ea-ccc4f183fc09",
        "relationship--2b9d9770-35e9-473d-bae8-fa1b84e7d35e",
        "relationship--d09401c6-4b12-4305-b2e9-c90b3646ced6",
        "indicator--9a5a015f-56be-4118-b6d5-3c7f9bed4d33",
        "relationship--097be33d-04c2-4d1e-8731-982f2616a088",
        "relationship--c1201654-b6d4-47dc-8ee3-3d6166526d2c",
        "relationship--c245f63c-a3ab-4ab9-90ca-cb399b10d131",
        "relationship--8457b3a4-a922-43c0-bfef-cf139e98d099",
        "relationship--27b70cd2-6eff-48eb-bbb6-d6d0db510fc2",
        "indicator--36c56169-d0ad-4460-8606-dc7bf5de1e92",
        "relationship--d3f66cc0-e661-4b9b-8e34-eb24ee4af831",
        "relationship--9e4606da-8a70-472f-92ba-f6ff0516dcf1",
        "relationship--4faa4d84-9a6f-4edb-a377-a47f0d840c10",
        "relationship--7e7ed6c0-40a4-4511-9f20-a4166c97812b",
        "relationship--919c7f54-4aec-4bee-963e-250b37e8152c",
        "indicator--ec1708e1-f07d-4c8c-9c96-5dea7ee1f723",
        "relationship--bac0da80-072c-4bed-8aac-0a1e57964e4e",
        "relationship--5b78968a-fa09-47f9-bc75-58621c373f29",
        "relationship--a95bbed4-8929-42dd-b5f5-f44c591fc7c1",
        "relationship--ba6629b9-96f5-4881-acfe-2538f9cd3eb1",
        "relationship--dc576dfb-d2c5-4b44-a242-70e273400913",
        "indicator--e56ea705-ee2a-4822-9900-375deefc0c0f",
        "relationship--27b67287-f3f0-49d5-bb94-9af23bdd864c",
        "relationship--063e944e-b3f1-44d5-9dfd-d6f0de465650",
        "relationship--c559c408-2193-46dd-91ce-5cd925c61af4",
        "relationship--9fab9d2a-f63c-4343-bb5c-833e3ea0d420",
        "relationship--ac170274-91c0-4393-ab52-1181950d2bf6",
        "indicator--89a7b8b9-ba68-4a15-bd4e-6e1e96dd6c14",
        "relationship--0c874352-1962-4cdc-ba22-7b43aad762cb",
        "relationship--c32efc95-2248-4574-8ba3-f88e887aa68f",
        "relationship--8093a141-3213-46f9-a253-d83a3a2d67b9",
        "relationship--4963c59b-783d-42e9-a739-5b6808876c9f",
        "relationship--22a6ecf4-a3f4-4137-932a-cfdbca360b5a",
        "indicator--3196e639-bbab-4aa6-a46e-352e3c7abf59",
        "relationship--aae2ae02-a30b-4b85-a20d-c7a12bf2d92e",
        "relationship--6ac94694-5379-4de8-9e42-496d29c87ff9",
        "relationship--1d493b97-7bec-4af1-80d3-f3adb1d7f895",
        "relationship--ea422a14-4690-4177-a51c-dcbe26867256",
        "relationship--b97932af-210f-4ad2-9d23-58adb52c6220",
        "indicator--e40e375d-d29b-4a19-927f-30ec0b484061",
        "relationship--a1e95fb0-056d-4037-8f11-2bc71bcd947b",
        "relationship--78c1da90-a6af-48ee-92ee-bd488506b838",
        "relationship--09f5d9c2-2e19-4b94-b1df-31263de95b81",
        "relationship--147f6bf4-d211-4bac-9801-def2a87f8e79",
        "relationship--7df2745a-e6e3-4fc5-ac08-ad030123728c",
        "indicator--156c284d-8490-4692-896e-23e5eb85068e",
        "relationship--d3595c7c-cee4-45f2-aea1-bab5129821fa",
        "relationship--ce9266c8-12c7-4159-8a7b-6148a2dfce27",
        "relationship--55f4c017-efa9-4fd3-84cd-5cd7551358a8",
        "relationship--1978b7f5-3603-4cd8-af80-96b58a4d88c7",
        "relationship--9786eddc-6609-4a8e-8055-be85c4f9e3e8",
        "indicator--3a07410e-9bf1-4ad9-ac36-a301dfed21cc",
        "relationship--43a2ab6a-2188-4fdc-afe0-c0d9fc702c43",
        "relationship--ee687977-163b-4a72-b93b-90201319a226",
        "relationship--18b17e57-c87e-44f8-8497-93a978bb103c",
        "relationship--15ddb153-f60a-412b-a288-53bd49a352d1",
        "relationship--f37da8a2-5241-4bb4-8b6b-419eec6f0344",
        "indicator--77f41a83-9d68-492b-8df7-8b6f498f6b35",
        "relationship--10c9daff-d9ed-46b5-961f-3eb7837d0157",
        "relationship--0081cd87-c983-4e68-b635-dd866102d77d",
        "relationship--211c1da6-61e7-4490-820c-61a48de43c0f",
        "relationship--d0f25e67-4814-4120-877e-9cef3c2dfbba",
        "relationship--47657778-edd4-4230-8c35-6fe78b2aa2dc",
        "indicator--5b999aac-adc1-4337-ad80-b70af7ae17a4",
        "relationship--53b189fa-f302-4275-8278-c4a5981caacb",
        "relationship--a90acf24-907f-4b1f-8037-886b18bada07",
        "relationship--da6b309d-fd92-4ae5-8e96-37dada1c447d",
        "relationship--381df504-018b-4e41-99bf-128d7e94835c",
        "relationship--3b33a6d9-ce41-4782-a6af-154bc14daca7",
        "indicator--2833ec98-045a-46f0-8413-3a8acb6dda6b",
        "relationship--ca42bf49-aa8f-4a3f-9754-ba31d1ba9597",
        "relationship--0d83b69e-89c6-4b97-bc74-379e65555236",
        "relationship--c771424a-6271-4054-80f6-d7e5c1749b33",
        "relationship--c5f556e5-fc44-4d3e-9d41-917474e9ba05",
        "relationship--46c23f44-f24a-48c8-9bf5-784faedf9fcb",
        "indicator--26173e38-2de5-461b-9545-7f9ff7864215",
        "relationship--4a1309ae-7a8f-4925-b58b-ac360fa39e66",
        "relationship--f5ec3b16-b30c-4e6d-93ed-239283a6558a",
        "relationship--18c704ad-daac-4532-883c-429cd6bbc790",
        "relationship--ca77e9eb-0a3e-4696-a510-c96f158b3513",
        "relationship--a3f856cd-4a06-41f7-b1be-41e7a7c656dd",
        "indicator--f905c41a-a486-4cdb-8231-71202244347d",
        "relationship--2d8cae17-fa9e-465c-a2a2-5367539fcc91",
        "relationship--8ed24a9a-5010-4615-9359-f775a1125c5c",
        "relationship--a76a8534-bb1b-4972-a72a-d65477518758",
        "relationship--8c0b3500-55e2-4085-9009-ce430e8e266c",
        "relationship--78a3eca8-7d89-44eb-ba35-7a4df063731a",
        "indicator--578e2d66-9118-4c5f-8bc5-767659945e49",
        "relationship--d90689b4-e94e-4a4f-8904-5552a589c976",
        "relationship--bf60997c-0259-4b97-a9cc-3766d0881744",
        "relationship--dfb538ff-8b14-4682-8b0d-a188a0f1a0e6",
        "relationship--14771192-66c8-4c91-b016-014530cbfb08",
        "relationship--54c06edb-157d-4ebe-945b-b7196b8494de",
        "indicator--62189daf-1010-4c2c-8bcb-be3ab6ea68c1",
        "relationship--5aa35c9c-12e8-4a47-a14a-85dd4c1e4059",
        "relationship--4d5604ec-84fb-4e05-9c63-78fa5b2f4b82",
        "relationship--9eec5300-57d7-49da-836d-7268ee513349",
        "relationship--bd7f6ccb-310f-4e5d-bf93-c74cc4d393fa",
        "indicator--82ab57ae-63f4-4842-9a67-d992b37e93eb",
        "relationship--56a0f4b8-3cc4-4dfa-9d0d-ac31c890296d",
        "relationship--c7cd22ce-e75f-4c18-9441-2828d5e874fe",
        "relationship--337c249f-a170-400f-afe9-09cb580869f9",
        "relationship--9df9b169-7428-4986-b1a2-3911a8037758",
        "indicator--192d5fdb-7a2f-4bb3-b647-c45e9f41336f",
        "relationship--06ba1e4f-bb49-42de-b164-31db7e84b3c0",
        "relationship--9ee4115e-c113-4848-8141-05f8ecde5e0b",
        "relationship--425f950a-e1a5-4522-902b-f453f8a7bce5",
        "relationship--0a23bd9b-d3fc-4622-87fc-45519d71db8c",
        "relationship--913d6c06-c074-4b62-b854-3940cb1118bf",
        "relationship--92f24760-ee60-4bd5-b6c9-2415db455aa9",
        "relationship--39793d97-89c8-4806-ab77-fef23af9d296"
      ],
      "x_version": "1.0"
    }
  ]
}