{
    "type": "bundle",
    "id": "bundle--f19d782c-7f4e-4469-9f3c-518c0eae2da2",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--62791516-e53e-4728-ae58-19ce2cf2fa82",
            "created": "2025-11-15T02:03:14.609594Z",
            "modified": "2025-11-15T02:28:49.217997Z",
            "name": "RansomISAC",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2af23ddd-335f-4cdf-80d2-48e9b746ad05",
            "created": "2026-09-26T11:32:55.511178Z",
            "modified": "2026-09-26T11:32:55.511178Z",
            "name": "YARA Rule",
            "pattern": "rule XCTDH_HashHiding_NullReceiver\n{\nmeta:\ndescription = \"XCTDH / NullReceiver Ethereum HashHiding C2-resolution module (_Z), DPRK Contagious Interview\"\nauthor = \"Ransom-ISAC\"\ndate = \"2026-09-25\"\nreference_technique = \"NullReceiver (OpenSourceMalware, Aug 2026)\"\nreference_campaign = \"XCTDH series (Ransom-ISAC, Oct 2025)\"\ntlp = \"CLEAR\"\nstrings:\n$init_i = \"global.i\" ascii\n$init_r1 = \"global.r=require\" ascii\n$init_r2 = \"global.r = require\" ascii\n$marker = \"RS260605\" ascii\n$wallet = \"33ff3edaf55a8e03dcbc7cb40d498a49\" ascii nocase\n$rpc_pn = \"ethereum-rpc.publicnode.com\" ascii\n$rpc_drpc = \"eth.drpc.org\" ascii\n$rpc_blast = \"blastapi.io\" ascii\n$m_block = \"eth_getBlockByNumber\" ascii\n$m_bnum = \"eth_blockNumber\" ascii\n$dec_ip1 = \".to.substring(2, 10)\" ascii\n$dec_ip2 = \".to.substring(2,10)\" ascii\n$dec_port1 = \".to.substring(10, 14)\" ascii\n$dec_port2 = \".to.substring(10,14)\" ascii\n$boot = \"/boot\" ascii\ncondition:\nfilesize < 4MB and\n(\n$marker or\n$wallet or\n$init_i and any of ($init_r1, $init_r2) and\n2 of ($rpc_pn, $rpc_drpc, $rpc_blast) or\nany of ($m_block, $m_bnum) or\nany of ($dec_ip1, $dec_ip2, $dec_port1, $dec_port2)\n)\n}",
            "pattern_type": "yara",
            "valid_from": "2026-09-25T00:00:00Z"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--a67b31df-2ecd-4870-bf6e-4e196e32e450",
            "value": "http://181.214.149.148:443/boot"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9f7f6222-b22a-4d00-9a84-18886113fc27",
            "value": "181.214.149.148"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e9c4eb03-ad7d-4339-ae94-db3a833b27eb",
            "value": "181.214.149.147"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--df632a9f-012a-4d51-a277-8f81f05989e7",
            "value": "23.27.20.187"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--4ab4f106-b539-4835-875e-bbcb96106295",
            "created_by_ref": "identity--62791516-e53e-4728-ae58-19ce2cf2fa82",
            "created": "2026-09-26T11:32:55.513402Z",
            "modified": "2026-09-26T11:32:55.513402Z",
            "name": "XCTDH Adopts Hash Hiding",
            "published": "2026-09-25T00:00:00Z",
            "object_refs": [
                "identity--62791516-e53e-4728-ae58-19ce2cf2fa82",
                "indicator--2af23ddd-335f-4cdf-80d2-48e9b746ad05",
                "url--a67b31df-2ecd-4870-bf6e-4e196e32e450",
                "ipv4-addr--9f7f6222-b22a-4d00-9a84-18886113fc27",
                "ipv4-addr--e9c4eb03-ad7d-4339-ae94-db3a833b27eb",
                "ipv4-addr--df632a9f-012a-4d51-a277-8f81f05989e7"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://ransom-isac.org/blog/xctdh-adopts-hash-hiding"
                }
            ]
        }
    ]
}