mradermacher/AZERG-T3-Mistral-i1-GGUF
7B • Updated • 403 • 1
Datasets:
Tasks:
Text Generation
Modalities:
Text
Formats:
json
Languages:
English
Size:
10K - 100K
ArXiv:
License:
paragraph stringlengths 28 5.32k | entities listlengths 1 80 | relations listlengths 0 80 | record_id stringlengths 10 10 | source_dataset stringclasses 2
values | source_file stringclasses 1
value | source_row_index int64 0 805 | passage_sha256 stringlengths 64 64 |
|---|---|---|---|---|---|---|---|
GravityRAT has a feature to list the available services on the system. | [
{
"name": "GravityRAT",
"type": "MALWARE"
}
] | [] | train:0000 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 0 | dfb5e9a7675945d0df97a1cf2991f3b84df19ed63681ee8d6359626e96aebd4f |
Gustuff is mobile malware designed to steal users' banking and virtual currency credentials. | [
{
"name": "Gustuff",
"type": "MALWARE"
}
] | [] | train:0001 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 1 | 53ff66a837a81ab2a847292a20255e74231a6013eea0910bc62aee41c6b6226d |
Rocke has extracted tar.gz files after downloading them from a C2 server. | [
{
"name": "tar.gz",
"type": "INDICATOR"
},
{
"name": "C2",
"type": "INFRASTRUCTURE"
},
{
"name": "Rocke",
"type": "MALWARE"
}
] | [
{
"source_ref": "Rocke",
"target_ref": "C2",
"relationship_type": "communicates-with"
}
] | train:0002 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 2 | 065f4c98023b5bb3c1b9777e16e9eb0cf29d9cfb2d248b1ad03e75bcaeffa448 |
Green Lambert is a modular backdoor that security researchers assess has been used by an advanced threat group referred to as Longhorn and The Lamberts. First reported in 2017, the Windows variant of Green Lambert may have been used as early as 2008; a macOS version was uploaded to a multiscanner service in September 2... | [
{
"name": "Green Lambert",
"type": "MALWARE"
},
{
"name": "macOS",
"type": "INFRASTRUCTURE"
},
{
"name": "Windows",
"type": "INFRASTRUCTURE"
},
{
"name": "Longhorn",
"type": "THREAT_ACTOR"
},
{
"name": "The Lamberts",
"type": "THREAT_ACTOR"
}
] | [
{
"source_ref": "Longhorn",
"target_ref": "Green Lambert",
"relationship_type": "uses"
},
{
"source_ref": "Green Lambert",
"target_ref": "Windows",
"relationship_type": "targets"
},
{
"source_ref": "Green Lambert",
"target_ref": "macOS",
"relationship_type": "targets"
}... | train:0003 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 3 | 5556ccced16743452d0e6d9c720ef40589a4c9e92a196d3ea54c9bfbb207a541 |
VPNFilter is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. VPNFilter modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitori... | [
{
"name": "VPNFilter",
"type": "TOOL"
},
{
"name": "SCADA",
"type": "INFRASTRUCTURE"
},
{
"name": "Modbus",
"type": "TOOL"
},
{
"name": "ps",
"type": "TOOL"
}
] | [] | train:0004 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 4 | aa7dd6d0a688ef234d19f1a1e34b6c840be533eff9849488e64d4e14c52e4eaa |
NanHaiShu launches a script to delete their original decoy file to cover tracks. | [
{
"name": "NanHaiShu",
"type": "MALWARE"
}
] | [] | train:0005 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 5 | 869125b583f67259035df564b3771849bc4e25cb8c50e3c4158f5304d7ffdc49 |
Tonto Team has relied on user interaction to open their spearphishing attachments. | [
{
"name": "Tonto Team",
"type": "MALWARE"
}
] | [] | train:0006 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 6 | 7d2b2b57c3f617973d24db137e8c49dff3efe3e2aca82597f97bf322c2ff65d8 |
meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended destination. | [
{
"name": "Content Delivery Network",
"type": "INFRASTRUCTURE"
},
{
"name": "meek",
"type": "MALWARE"
}
] | [
{
"source_ref": "meek",
"target_ref": "Content Delivery Network",
"relationship_type": "uses"
}
] | train:0007 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 7 | a1a22933d4de69792ec94be9d05f7cb76c135bda915fd1449ab04f054fc33df7 |
QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware, most notably ProLock and Egregor. | [
{
"name": "QakBot",
"type": "MALWARE"
},
{
"name": "ProLock",
"type": "MALWARE"
},
{
"name": "Egregor",
"type": "MALWARE"
}
] | [] | train:0008 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 8 | 4b2a1e319d4e359b128912f2c205f11bffaa1f7a909e5a492c65e0590a904e42 |
T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM. | [
{
"name": "T9000",
"type": "MALWARE"
}
] | [] | train:0009 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 9 | 5eb87410e37f4518e6cd6e6074cfce304f6d7edd198db1677b2fdd4b971b4e20 |
BONDUPDATER persists using a scheduled task that executes every minute. | [
{
"name": "BONDUPDATER",
"type": "MALWARE"
}
] | [] | train:0010 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 10 | 65476bb568bd2b300db3641ccd1f9c4513a490d22df7fb6e4be821cc979dd8b3 |
UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence. | [
{
"name": "UBoatRAT",
"type": "MALWARE"
},
{
"name": "BITSAdmin",
"type": "TOOL"
}
] | [
{
"source_ref": "UBoatRAT",
"target_ref": "BITSAdmin",
"relationship_type": "uses"
}
] | train:0011 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 11 | d06e242fcb0869d997ade9b1bf3af2449ebfa8ea854688443edb0720c8105ed9 |
SilkBean is a piece of Android surveillanceware containing comprehensive remote access tool (RAT) functionality that has been used in targeting of the Uyghur ethnic group. | [
{
"name": "SilkBean",
"type": "MALWARE"
},
{
"name": "Android",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "SilkBean",
"target_ref": "Android",
"relationship_type": "targets"
}
] | train:0012 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 12 | d8f467c8fd9a15872e7566d37620eb4fe3eb0b8870abb585b478fdd2370b63ba |
Seasalt is malware that has been linked to APT1's 2010 operations. It shares some code similarities with OceanSalt. | [
{
"name": "Seasalt",
"type": "MALWARE"
},
{
"name": "APT1",
"type": "THREAT_ACTOR"
},
{
"name": "OceanSalt",
"type": "MALWARE"
}
] | [
{
"source_ref": "APT1",
"target_ref": "Seasalt",
"relationship_type": "uses"
}
] | train:0013 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 13 | 67578240896490c2cef2bf2416c71423fc93487a0ce1c8e31173239745a87aab |
Exobot is Android banking malware, primarily targeting financial institutions in Germany, Austria, and France. | [
{
"name": "Exobot",
"type": "MALWARE"
},
{
"name": "Android",
"type": "INFRASTRUCTURE"
},
{
"name": "Germany",
"type": "LOCATION"
},
{
"name": "Austria",
"type": "LOCATION"
},
{
"name": "France",
"type": "LOCATION"
}
] | [
{
"source_ref": "Exobot",
"target_ref": "Android",
"relationship_type": "targets"
},
{
"source_ref": "Exobot",
"target_ref": "Germany",
"relationship_type": "targets"
},
{
"source_ref": "Exobot",
"target_ref": "France",
"relationship_type": "targets"
},
{
"source_... | train:0014 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 14 | 49277043f9beeec5c775a339b11120bdcefec4d5bb96a0a9fe5a53dc638924b8 |
Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process. | [
{
"name": "Epic",
"type": "THREAT_ACTOR"
},
{
"name": "Explorer",
"type": "TOOL"
},
{
"name": "explorer.exe",
"type": "TOOL"
}
] | [] | train:0015 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 15 | 436ee3bb7983845323c05eca9db78d8c238ca24ccdfb96b30382414fa340defd |
DarkComet can access the victim’s webcam to take pictures. | [
{
"name": "DarkComet",
"type": "MALWARE"
}
] | [] | train:0016 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 16 | 0435cf022730f1739611413966977596c4d4352e01ec98d19f0f471bdac8933b |
JHUHUGIT is malware used by APT28. It is based on Carberp source code and serves as reconnaissance malware. | [
{
"name": "JHUHUGIT",
"type": "MALWARE"
},
{
"name": "APT28",
"type": "THREAT_ACTOR"
}
] | [
{
"source_ref": "APT28",
"target_ref": "JHUHUGIT",
"relationship_type": "uses"
}
] | train:0017 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 17 | 4d82a9b893bf8b1e422bacaabd10efbc7774642aae50d76b3138a6f78bf9b498 |
Shamoon is wiper malware that was first used by an Iranian group known as the "Cutting Sword of Justice" in 2012. Other versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. Shamoon has also been seen leveraging RawDisk and Filerase to carry out data wiping tasks. The term Shamoon is sometimes used ... | [
{
"name": "Shamoon",
"type": "MALWARE"
},
{
"name": "Cutting Sword of Justice",
"type": "THREAT_ACTOR"
},
{
"name": "RawDisk",
"type": "TOOL"
},
{
"name": "Filerase",
"type": "TOOL"
},
{
"name": "Shamoon 2",
"type": "MALWARE"
},
{
"name": "Shamoon 3",
... | [
{
"source_ref": "Cutting Sword of Justice",
"target_ref": "Shamoon",
"relationship_type": "uses"
},
{
"source_ref": "Shamoon 3",
"target_ref": "Shamoon",
"relationship_type": "variant-of"
},
{
"source_ref": "Shamoon 2",
"target_ref": "Shamoon",
"relationship_type": "varia... | train:0018 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 18 | 4d4f3f273a4900a29ccb7b1627ba3b3c8302f9d39ecc67e7a322502808695c7a |
Skidmap has checked for the existence of specific files including /usr/sbin/setenforce and /etc/selinux/config. It also has the ability to monitor the cryptocurrency miner file and process. | [
{
"name": "Skidmap",
"type": "MALWARE"
},
{
"name": "/usr/sbin/setenforce",
"type": "INDICATOR"
},
{
"name": "/etc/selinux/config",
"type": "INDICATOR"
}
] | [] | train:0019 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 19 | 32b2f6b2cd815bee264726176905e8aa0bc4916173f83dccd6209a52f9d71d31 |
PUNCHTRACK scrapes memory for properly formatted payment card data. | [
{
"name": "PUNCHTRACK",
"type": "MALWARE"
}
] | [] | train:0020 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 20 | 2f5eced095e1bc33e8092468869859065888b75f47d67402fd370872a00a9002 |
The 2022 Ukraine Electric Power Attack was a Sandworm Team campaign that used a combination of GOGETTER, Neo-REGEORG, CaddyWiper, and living of the land (LotL) techniques to gain access to a Ukrainian electric utility to send unauthorized commands from their SCADA system. | [
{
"name": "2022 Ukraine Electric Power Attack",
"type": "CAMPAIGN"
},
{
"name": "Sandworm Team",
"type": "THREAT_ACTOR"
},
{
"name": "GOGETTER",
"type": "MALWARE"
},
{
"name": "Neo-REGEORG",
"type": "MALWARE"
},
{
"name": "CaddyWiper",
"type": "MALWARE"
},
... | [
{
"source_ref": "Sandworm Team",
"target_ref": "GOGETTER",
"relationship_type": "uses"
},
{
"source_ref": "Sandworm Team",
"target_ref": "Neo-REGEORG",
"relationship_type": "uses"
},
{
"source_ref": "Sandworm Team",
"target_ref": "CaddyWiper",
"relationship_type": "uses"
... | train:0021 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 21 | 72e7dedd6588c9b9e0eb6edbad48d2cfa267241b57be5ccbc11ef530f0d06bed |
Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware. | [
{
"name": "Umbreon",
"type": "MALWARE"
},
{
"name": "libc",
"type": "TOOL"
},
{
"name": "strace",
"type": "TOOL"
}
] | [
{
"source_ref": "Umbreon",
"target_ref": "libc",
"relationship_type": "uses"
},
{
"source_ref": "Umbreon",
"target_ref": "strace",
"relationship_type": "uses"
}
] | train:0022 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 22 | a717911b2f99ab2f21b35b1e9891a6138a79b15ad9faa33d000eec1ea8f7fd47 |
FIVEHANDS is a customized version of DEATHRANSOM ransomware written in C++. FIVEHANDS has been used since at least 2021, including in Ransomware-as-a-Service (RaaS) campaigns, sometimes along with SombRAT. | [
{
"name": "FIVEHANDS",
"type": "MALWARE"
},
{
"name": "DEATHRANSOM",
"type": "MALWARE"
},
{
"name": "C++",
"type": "TOOL"
},
{
"name": "SombRAT",
"type": "MALWARE"
}
] | [
{
"source_ref": "DEATHRANSOM",
"target_ref": "FIVEHANDS",
"relationship_type": "variant-of"
},
{
"source_ref": "FIVEHANDS",
"target_ref": "C++",
"relationship_type": "uses"
}
] | train:0023 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 23 | 4e968acc40ce95bd0487f1797448bbd13c1757945aa4580968d0fa553fbbe31e |
AppleJeus has presented the user with a UAC prompt to elevate privileges while installing. | [
{
"name": "AppleJeus",
"type": "MALWARE"
}
] | [] | train:0024 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 24 | 25cc857cc88efdbdf2d486061c1ef537022780fccf84fdc12bd5aa240850ff0e |
ELMER is capable of performing directory listings. | [
{
"name": "ELMER",
"type": "MALWARE"
}
] | [] | train:0025 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 25 | 06f1ba73818da82acd1605a3dbdc17b769d5a0d3641e264d307270d96c6f93d0 |
Gold Dragon is a Korean-language, data gathering implant that was first observed in the wild in South Korea in July 2017. Gold Dragon was used along with Brave Prince and RunningRAT in operations targeting organizations associated with the 2018 Pyeongchang Winter Olympics. | [
{
"name": "Gold Dragon",
"type": "MALWARE"
},
{
"name": "Korean",
"type": "LOCATION"
},
{
"name": "South Korea",
"type": "LOCATION"
},
{
"name": "Brave Prince",
"type": "MALWARE"
},
{
"name": "RunningRAT",
"type": "MALWARE"
}
] | [
{
"source_ref": "Gold Dragon",
"target_ref": "South Korea",
"relationship_type": "targets"
}
] | train:0026 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 26 | 9b4bf5c946b004ae0391dc8c8f8abe7b6fd2cff3164bb7719d2bab7c1aa6ce1b |
CSPY Downloader is a tool designed to evade analysis and download additional payloads used by Kimsuky. | [
{
"name": "CSPY Downloader",
"type": "TOOL"
},
{
"name": "Kimsuky",
"type": "THREAT_ACTOR"
}
] | [
{
"source_ref": "Kimsuky",
"target_ref": "CSPY Downloader",
"relationship_type": "uses"
}
] | train:0027 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 27 | 886a5ca66533dda7103695d1a96f280ec5cfebb9441cdfb88fd97709f0910f5f |
zwShell is a remote access tool (RAT) written in Delphi that has been used by Night Dragon. | [
{
"name": "zwShell",
"type": "MALWARE"
},
{
"name": "Night Dragon",
"type": "THREAT_ACTOR"
},
{
"name": "Delphi",
"type": "TOOL"
}
] | [
{
"source_ref": "Night Dragon",
"target_ref": "zwShell",
"relationship_type": "uses"
},
{
"source_ref": "zwShell",
"target_ref": "Delphi",
"relationship_type": "uses"
}
] | train:0028 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 28 | 8427346a45c826aeebc9a7319cb33b9550ebe46bf5ac97ca59218de53177d1c0 |
Pass-The-Hash Toolkit can perform pass the hash. | [
{
"name": "Pass-The-Hash Toolkit",
"type": "TOOL"
}
] | [] | train:0029 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 29 | aeda372e15410e60283ad43f4bb6e987f010ff92dd055ebc1c18d76d93e2c605 |
DEFENSOR ID is a banking trojan capable of clearing a victim’s bank account or cryptocurrency wallet and taking over email or social media accounts. DEFENSOR ID performs the majority of its malicious functionality by abusing Android’s accessibility service. | [
{
"name": "DEFENSOR ID",
"type": "MALWARE"
},
{
"name": "Android",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "DEFENSOR ID",
"target_ref": "Android",
"relationship_type": "targets"
}
] | train:0030 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 30 | 468921c8e84bbc78cd808768130c1fa2c371b9778ecb2f019274007c05eb854e |
JPIN can use the command-line utility cacls.exe to change file permissions. | [
{
"name": "JPIN",
"type": "THREAT_ACTOR"
},
{
"name": "cacls.exe",
"type": "TOOL"
}
] | [
{
"source_ref": "JPIN",
"target_ref": "cacls.exe",
"relationship_type": "uses"
}
] | train:0031 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 31 | dd1f9dfd0a884bff1147cf5bf66fce7c18175227b15674c7ddcca23d4959c955 |
OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\; the malicious file by the same name is saved in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\. | [
{
"name": "OwaAuth",
"type": "TOOL"
},
{
"name": "owaauth.dll",
"type": "INDICATOR"
},
{
"name": "%ProgramFiles%\\Microsoft\\Exchange Server\\ClientAccess\\Owa\\Auth\\",
"type": "INDICATOR"
},
{
"name": "%ProgramFiles%\\Microsoft\\Exchange Server\\ClientAccess\\Owa\\bin\\",
... | [] | train:0032 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 32 | 213b8e9cc26ce3b7758b34ccb4cc30c2739d0642dc6b348e41de8640a806aa93 |
GolfSpy is Android spyware deployed by the group Bouncing Golf. | [
{
"name": "GolfSpy",
"type": "MALWARE"
},
{
"name": "Bouncing Golf",
"type": "THREAT_ACTOR"
},
{
"name": "Android",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "GolfSpy",
"target_ref": "Android",
"relationship_type": "targets"
},
{
"source_ref": "Bouncing Golf",
"target_ref": "GolfSpy",
"relationship_type": "uses"
}
] | train:0033 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 33 | a2e60e2d29b40312eba4c12aa747d9e28559d280c2f53db19c76060e203c8b5b |
BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing. | [
{
"name": "BendyBear",
"type": "MALWARE"
},
{
"name": "Windows",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "BendyBear",
"target_ref": "Windows",
"relationship_type": "uses"
}
] | train:0034 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 34 | 03d792f719ca96a01cff908a131cd9ecc1f442d831be4e24592d2f65b4bc49bb |
Ajax Security Team has used various social media channels to spearphish victims. | [
{
"name": "Ajax Security Team",
"type": "THREAT_ACTOR"
}
] | [] | train:0035 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 35 | 4ea5753ae5752cc33dd5d227934985c6f2c7778e2e7464eec33c54cfa08be34a |
To establish persistence, Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager. | [
{
"name": "Truvasys",
"type": "MALWARE"
},
{
"name": "Windows Task Manager",
"type": "TOOL"
},
{
"name": "Windows",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "Truvasys",
"target_ref": "Windows",
"relationship_type": "targets"
},
{
"source_ref": "Truvasys",
"target_ref": "Windows Task Manager",
"relationship_type": "uses"
}
] | train:0036 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 36 | 223734a2070077e5650d9eceb637f8975c2f9b89baafc0182e678a01c0698103 |
netsh can be used to discover system firewall settings. | [
{
"name": "netsh",
"type": "TOOL"
}
] | [] | train:0037 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 37 | b05c28f41f5ae1096d5560d665e19ffe9c0908ddf960ad5da917d8b6645a4898 |
SoreFang can enumerate domain accounts via net.exe user /domain. | [
{
"name": "net.exe",
"type": "TOOL"
},
{
"name": "SoreFang",
"type": "MALWARE"
}
] | [
{
"source_ref": "SoreFang",
"target_ref": "net.exe",
"relationship_type": "uses"
}
] | train:0038 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 38 | ec3b47ed1c6e7128746d2f15d41a705865888270c66bc7b4e811cc52c2427de2 |
RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started. | [
{
"name": "RegDuke",
"type": "MALWARE"
},
{
"name": "WINWORD.EXE",
"type": "INDICATOR"
}
] | [] | train:0039 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 39 | 8b637fb817718da800e16086e26e226ba7d116d3857dfb332e998e136aa03a6d |
Access Management technologies can be used to enforce authorization polices and decisions, especially when existing field devices do not provided sufficient capabilities to support user identification and authentication. | [
{
"name": "Access Management technologies can be used to enforce authorization polices and decisions, especially when existing field devices do not provided sufficient capabilities to support user identification and authentication.",
"type": "COURSE_OF_ACTION"
}
] | [] | train:0040 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 40 | 61fa123c480f8f4a96f866c95ca19afbbf0ff25c60a9288567f8b05147a80ae9 |
SEASHARPEE can timestomp files on victims using a Web shell. | [
{
"name": "SEASHARPEE",
"type": "MALWARE"
}
] | [] | train:0041 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 41 | 43adf074365046c2d7f915f93d6e97dd15293fe4ca63f312061df45a50690448 |
BADHATCH is a backdoor that has been utilized by FIN8 since at least 2019. BADHATCH has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy. | [
{
"name": "BADHATCH",
"type": "MALWARE"
},
{
"name": "FIN8",
"type": "THREAT_ACTOR"
},
{
"name": "United States",
"type": "LOCATION"
},
{
"name": "Canada",
"type": "LOCATION"
},
{
"name": "South Africa",
"type": "LOCATION"
},
{
"name": "Panama",
"t... | [
{
"source_ref": "FIN8",
"target_ref": "BADHATCH",
"relationship_type": "uses"
},
{
"source_ref": "BADHATCH",
"target_ref": "United States",
"relationship_type": "targets"
},
{
"source_ref": "BADHATCH",
"target_ref": "Canada",
"relationship_type": "targets"
},
{
"s... | train:0042 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 42 | e604d04886ae6013345466822c2fa78141f212727746cf17ca4390be6bc47fd2 |
LITTLELAMB.WOOLTEA is a backdoor that was used by UNC5325 during Cutting Edge to deploy malware on targeted Ivanti Connect Secure VPNs and to establish persistence across system upgrades and patches. | [
{
"name": "Cutting Edge",
"type": "CAMPAIGN"
},
{
"name": "UNC5325",
"type": "THREAT_ACTOR"
},
{
"name": "LITTLELAMB.WOOLTEA",
"type": "MALWARE"
},
{
"name": "Ivanti Connect Secure VPNs",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "UNC5325",
"target_ref": "LITTLELAMB.WOOLTEA",
"relationship_type": "uses"
},
{
"source_ref": "Cutting Edge",
"target_ref": "UNC5325",
"relationship_type": "attributed-to"
},
{
"source_ref": "LITTLELAMB.WOOLTEA",
"target_ref": "Ivanti Connect Secure VPNs",
... | train:0043 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 43 | fb9a08341364e3cd9c98140bcad7ca487e44d46d1462e79218d581ab70cc0089 |
Bread was a large-scale billing fraud malware family known for employing many different cloaking and obfuscation techniques in an attempt to continuously evade Google Play Store’s malware detection. 1,700 unique Bread apps were detected and removed from the Google Play Store before being downloaded by users. | [
{
"name": "Bread",
"type": "MALWARE"
},
{
"name": "Google Play",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "Bread",
"target_ref": "Google Play",
"relationship_type": "targets"
}
] | train:0044 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 44 | 1e5b6ade21a4e8a68a326f74c7357de7ee627175c9810fd3da8ffa5c07e344d9 |
Once PowerShell downloads the final payload (NetwiredRC), it copies itself to the above mentioned path from where it gets executed. NetwireRAT is not a new malware/RAT on the surface. First seen in 2012, it attempts to steal victims' passwords, including login credentials, FTP credentials, credit card data etc. | [
{
"name": "NetwiredRC",
"type": "MALWARE"
},
{
"name": "NetwireRAT",
"type": "MALWARE"
},
{
"name": "PowerShell",
"type": "TOOL"
}
] | [
{
"source_ref": "PowerShell",
"target_ref": "NetwiredRC",
"relationship_type": "drops"
}
] | train:0045 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 45 | bd42297d4d2dddd4a405f3ed7fcf397b690ea719ff88a218c58fa082f5f8724d |
FLIPSIDE is a simple tool similar to Plink that is used by FIN5 to maintain access to victims. | [
{
"name": "FLIPSIDE",
"type": "TOOL"
},
{
"name": "FIN5",
"type": "THREAT_ACTOR"
},
{
"name": "Plink",
"type": "TOOL"
}
] | [
{
"source_ref": "FIN5",
"target_ref": "FLIPSIDE",
"relationship_type": "uses"
}
] | train:0046 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 46 | 81854d5946e0d760104375538600825d16d20ad7fde90706b88e0710843c64e1 |
Desert Scorpion is surveillanceware that has targeted the Middle East, specifically individuals located in Palestine. Desert Scorpion is suspected to have been operated by the threat actor APT-C-23. | [
{
"name": "Desert Scorpion",
"type": "MALWARE"
},
{
"name": "APT-C-23",
"type": "THREAT_ACTOR"
},
{
"name": "Middle East",
"type": "LOCATION"
},
{
"name": "Palestine",
"type": "LOCATION"
}
] | [
{
"source_ref": "Desert Scorpion",
"target_ref": "Middle East",
"relationship_type": "targets"
},
{
"source_ref": "Desert Scorpion",
"target_ref": "Palestine",
"relationship_type": "targets"
},
{
"source_ref": "APT-C-23",
"target_ref": "Desert Scorpion",
"relationship_typ... | train:0047 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 47 | 5f01ff7776ed6e16e8c59bb7fb45e512a3cb8cc342b732bf2979d634faa1027d |
Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems. | [
{
"name": "Hacking Team",
"type": "THREAT_ACTOR"
},
{
"name": "UEFI Rootkit",
"type": "MALWARE"
}
] | [
{
"source_ref": "UEFI Rootkit",
"target_ref": "Hacking Team",
"relationship_type": "authored-by"
}
] | train:0048 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 48 | 542a8ac97ee1389c7dca6729a80dfe2671ca2d8f966cdf2256b934cbd1f44069 |
Pillowmint has used shellcode which reads code stored in the registry keys \REGISTRY\SOFTWARE\Microsoft\DRM using the native Windows API as well as read HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces as part of its C2. | [
{
"name": "Pillowmint",
"type": "MALWARE"
},
{
"name": "Microsoft",
"type": "IDENTITY"
},
{
"name": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces",
"type": "INDICATOR"
},
{
"name": "C2",
"type": "INFRASTRUCTURE"
},
{
"name... | [
{
"source_ref": "Pillowmint",
"target_ref": "C2",
"relationship_type": "uses"
},
{
"source_ref": "Pillowmint",
"target_ref": "Windows",
"relationship_type": "uses"
}
] | train:0049 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 49 | e054596de05b9a22aff34637562056f5bb5a8057992c157f474d32b15091d44c |
Dok uses AppleScript to create a login item for persistence. | [
{
"name": "Dok",
"type": "MALWARE"
},
{
"name": "AppleScript",
"type": "TOOL"
}
] | [
{
"source_ref": "AppleScript",
"target_ref": "Dok",
"relationship_type": "uses"
}
] | train:0050 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 50 | eded4c5fe657b9b6c0c1ac35fba26bd179ee9c131d24e270f8a726661dc8e4a7 |
Caterpillar WebShell is a self-developed Web Shell tool created by the group Volatile Cedar. | [
{
"name": "Caterpillar WebShell",
"type": "MALWARE"
},
{
"name": "Volatile Cedar",
"type": "THREAT_ACTOR"
}
] | [
{
"source_ref": "Caterpillar WebShell",
"target_ref": "Volatile Cedar",
"relationship_type": "authored-by"
}
] | train:0051 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 51 | 18fcf16d4b463293fbfddcda87ea32de3a99489b266ae9a26615e58ecb62da14 |
Agent Smith is mobile malware that generates financial gain by replacing legitimate applications on devices with malicious versions that include fraudulent ads. As of July 2019 Agent Smith had infected around 25 million devices, primarily targeting India though effects had been observed in other Asian countries as well... | [
{
"name": "Agent Smith",
"type": "MALWARE"
},
{
"name": "Asian",
"type": "LOCATION"
},
{
"name": "Saudi Arabia",
"type": "LOCATION"
},
{
"name": "United Kingdom",
"type": "LOCATION"
},
{
"name": "United States",
"type": "LOCATION"
},
{
"name": "India",... | [
{
"source_ref": "Agent Smith",
"target_ref": "India",
"relationship_type": "targets"
},
{
"source_ref": "Agent Smith",
"target_ref": "Asian",
"relationship_type": "targets"
},
{
"source_ref": "Agent Smith",
"target_ref": "Saudi Arabia",
"relationship_type": "targets"
},... | train:0052 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 52 | 9d34abf406d4f1c46742b9e73831d71763e126932e482c2e236b202527a595a1 |
The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey May 14, 2020 | [
{
"name": "APT10",
"type": "THREAT_ACTOR"
},
{
"name": "Turkey",
"type": "LOCATION"
}
] | [
{
"source_ref": "APT10",
"target_ref": "Turkey",
"relationship_type": "targets"
}
] | train:0053 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 53 | c086480a685b71d611b084ffacd9a0b16085d0e9530732e72f019a724a4086d3 |
BACKSPACE uses HTTP as a transport to communicate with its command server. | [
{
"name": "BACKSPACE",
"type": "MALWARE"
}
] | [] | train:0054 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 54 | 6c88a945ae3c412acf6fde39e35000878849b4e38f155b89862ffa0bad30845a |
Lucifer can decrypt its C2 address upon execution. | [
{
"name": "Lucifer",
"type": "MALWARE"
},
{
"name": "C2",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "Lucifer",
"target_ref": "C2",
"relationship_type": "uses"
}
] | train:0055 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 55 | 371a19472112513bb9d8fa7b3e9f578e0bc836042be85bfbce5b2b5666c8e454 |
Volgmer queries the system to identify existing services. | [
{
"name": "Volgmer",
"type": "MALWARE"
}
] | [] | train:0056 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 56 | fa9a1a7a883abd2fa3067347c15e592cbc2b3716400c278e4c8c9b6bd31ec3d7 |
WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications. | [
{
"name": "WellMail",
"type": "MALWARE"
}
] | [] | train:0057 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 57 | 48cdb31864e44ac03ef4645616704751555191b9f0a0dce67c4369dcd59440c5 |
The Unitronics Defacement Campaign was a collection of intrusions across multiple sectors by the CyberAv3ngers, where threat actors engaged in a seemingly opportunistic and global targeting and defacement of Unitronics Vision Series Programmable Logic Controller (PLC) with Human-Machine Interface (HMI). The sectors tha... | [
{
"name": "Unitronics Defacement Campaign",
"type": "CAMPAIGN"
},
{
"name": "CyberAv3ngers",
"type": "THREAT_ACTOR"
},
{
"name": "Unitronics",
"type": "IDENTITY"
}
] | [
{
"source_ref": "CyberAv3ngers",
"target_ref": "Unitronics Defacement Campaign",
"relationship_type": "attributed-to"
},
{
"source_ref": "CyberAv3ngers",
"target_ref": "Unitronics",
"relationship_type": "targets"
}
] | train:0058 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 58 | df20f8522a9b22a4e3c5511a276232b5f49c59d00e6e852213b20b348c754d2a |
MoleNet can perform WMI commands on the system. | [
{
"name": "MoleNet",
"type": "MALWARE"
}
] | [] | train:0059 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 59 | 68edde74347ca93b2658c8bd6925068c761260f015d2ceb7abbcba69d2449352 |
DEADEYE is a malware launcher that has been used by APT41 since at least May 2021. DEADEYE has variants that can either embed a payload inside a compiled binary (DEADEYE.EMBED) or append it to the end of a file (DEADEYE.APPEND). | [
{
"name": "DEADEYE",
"type": "MALWARE"
},
{
"name": "APT41",
"type": "THREAT_ACTOR"
}
] | [
{
"source_ref": "APT41",
"target_ref": "DEADEYE",
"relationship_type": "uses"
}
] | train:0060 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 60 | 1a920125e0f0b1002d33696201d806fc0dd1fbdf6ecb304fc78188410452dbf6 |
PUNCHBUGGY has saved information to a random temp file before exfil. | [
{
"name": "PUNCHBUGGY",
"type": "MALWARE"
}
] | [] | train:0061 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 61 | a9e3d0670c6b6c4096f06b5dd2ceb37a0535afde5559593481fad299de41217e |
REvil is a ransomware family that has been linked to the GOLD SOUTHFIELD group and operated as ransomware-as-a-service (RaaS) since at least April 2019. REvil is highly configurable and shares code similarities with the GandCrab RaaS. | [
{
"name": "REvil",
"type": "MALWARE"
},
{
"name": "GandCrab",
"type": "MALWARE"
},
{
"name": "GOLD SOUTHFIELD",
"type": "THREAT_ACTOR"
}
] | [
{
"source_ref": "GOLD SOUTHFIELD",
"target_ref": "REvil",
"relationship_type": "uses"
}
] | train:0062 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 62 | ff192a6a89144cc84d4398b46e77cf67c474617f185787b67a4dbff096559cf7 |
PowerShower is a PowerShell backdoor used by Inception for initial reconnaissance and to download and execute second stage payloads. | [
{
"name": "PowerShower",
"type": "MALWARE"
},
{
"name": "Inception",
"type": "THREAT_ACTOR"
},
{
"name": "PowerShell",
"type": "TOOL"
}
] | [
{
"source_ref": "Inception",
"target_ref": "PowerShower",
"relationship_type": "uses"
},
{
"source_ref": "Inception",
"target_ref": "PowerShell",
"relationship_type": "uses"
}
] | train:0063 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 63 | ab6e34e9ea5d9fde992577b64eb12460e97a49cc6ca0892e25c58d911d1ef196 |
NotPetya drops PsExec with the filename dllhost.dat. | [
{
"name": "NotPetya",
"type": "MALWARE"
},
{
"name": "PsExec",
"type": "TOOL"
},
{
"name": "dllhost.dat",
"type": "INDICATOR"
}
] | [
{
"source_ref": "NotPetya",
"target_ref": "PsExec",
"relationship_type": "drops"
},
{
"source_ref": "dllhost.dat",
"target_ref": "PsExec",
"relationship_type": "indicates"
}
] | train:0064 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 64 | 6fef3675c7ea1a3482848f9a881b9931f5be8b49b400167a41bcb9f39ad0dbb9 |
TinyTurla is a backdoor that has been used by Turla against targets in the US, Germany, and Afghanistan since at least 2020. | [
{
"name": "TinyTurla",
"type": "MALWARE"
},
{
"name": "US",
"type": "LOCATION"
},
{
"name": "Germany",
"type": "LOCATION"
},
{
"name": "Afghanistan",
"type": "LOCATION"
},
{
"name": "Turla",
"type": "THREAT_ACTOR"
}
] | [
{
"source_ref": "Turla",
"target_ref": "TinyTurla",
"relationship_type": "uses"
},
{
"source_ref": "TinyTurla",
"target_ref": "US",
"relationship_type": "targets"
},
{
"source_ref": "TinyTurla",
"target_ref": "Afghanistan",
"relationship_type": "targets"
},
{
"sou... | train:0065 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 65 | 7f99c07afc17fa27f9dcb34103a147e9e45c1c8406ec4b4257831d9b7a1e19bb |
PUNCHBUGGY is a backdoor malware used by FIN8 that has been observed targeting POS networks in the hospitality industry. | [
{
"name": "PUNCHBUGGY",
"type": "MALWARE"
},
{
"name": "FIN8",
"type": "THREAT_ACTOR"
},
{
"name": "POS networks",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "FIN8",
"target_ref": "PUNCHBUGGY",
"relationship_type": "uses"
}
] | train:0066 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 66 | c0652db28f17c1f58fd4606bc516eff8cd1a5cb1f753aad523d4154a79e546ea |
Chameleon is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, Chameleon has been observed targeting users in Australia and Poland by masquerading as official apps. | [
{
"name": "Chameleon",
"type": "MALWARE"
},
{
"name": "Android",
"type": "INFRASTRUCTURE"
},
{
"name": "Australia",
"type": "LOCATION"
},
{
"name": "Poland",
"type": "LOCATION"
}
] | [
{
"source_ref": "Chameleon",
"target_ref": "Android",
"relationship_type": "targets"
},
{
"source_ref": "Chameleon",
"target_ref": "Australia",
"relationship_type": "targets"
},
{
"source_ref": "Chameleon",
"target_ref": "Poland",
"relationship_type": "targets"
}
] | train:0067 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 67 | ca3a841695d1ba32e1a2aa69c2afdfd89eee94a5c5edc1c6abae203aae1ece8e |
OBAD is an Android malware family. | [
{
"name": "Android",
"type": "INFRASTRUCTURE"
},
{
"name": "OBAD",
"type": "MALWARE"
}
] | [
{
"source_ref": "OBAD",
"target_ref": "Android",
"relationship_type": "targets"
}
] | train:0068 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 68 | 899d55d60c446ef85caf2f7c9b74560836e35be0f21a954a9d7de9dcfba8cecf |
SNUGRIDE communicates-with its C2 server over HTTP. | [
{
"name": "SNUGRIDE",
"type": "MALWARE"
},
{
"name": "C2",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "SNUGRIDE",
"target_ref": "C2",
"relationship_type": "communicates-with"
}
] | train:0069 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 69 | eb4bacf550adb627f608bf6e2ee2bd6b481859b020416ca2afd4cd448837d777 |
PLAINTEE is a malware sample that has been used by Rancor in targeted attacks in Singapore and Cambodia. | [
{
"name": "PLAINTEE",
"type": "MALWARE"
},
{
"name": "Rancor",
"type": "THREAT_ACTOR"
},
{
"name": "Singapore",
"type": "LOCATION"
},
{
"name": "Cambodia",
"type": "LOCATION"
}
] | [
{
"source_ref": "Rancor",
"target_ref": "PLAINTEE",
"relationship_type": "uses"
},
{
"source_ref": "PLAINTEE",
"target_ref": "Singapore",
"relationship_type": "targets"
},
{
"source_ref": "PLAINTEE",
"target_ref": "Cambodia",
"relationship_type": "targets"
}
] | train:0070 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 70 | 346010e4c4570cd33b272552f452465830e39740580a2066ac691646f8253e6a |
Hancitor is a downloader that has been used by Pony and other information stealing malware. | [
{
"name": "Hancitor",
"type": "TOOL"
},
{
"name": "Pony",
"type": "MALWARE"
}
] | [
{
"source_ref": "Pony",
"target_ref": "Hancitor",
"relationship_type": "uses"
}
] | train:0071 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 71 | aa4f39f92ba43a2bc7c8fcf9530cac464a8cb88ced2b1e9fe27ec946f889bd9f |
FruitFly saves itself with a leading "." to make it a hidden file. | [
{
"name": "FruitFly",
"type": "MALWARE"
}
] | [] | train:0072 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 72 | 10a8103e43441e64b0b56f552a31f440c5485fbd27eca9a5c77f24123b132cb6 |
SMOKEDHAM has used Powershell to download UltraVNC and Ngrok from third-party file sharing sites. | [
{
"name": "SMOKEDHAM",
"type": "MALWARE"
},
{
"name": "Powershell",
"type": "TOOL"
},
{
"name": "UltraVNC",
"type": "TOOL"
},
{
"name": "Ngrok",
"type": "TOOL"
}
] | [
{
"source_ref": "SMOKEDHAM",
"target_ref": "Powershell",
"relationship_type": "uses"
},
{
"source_ref": "SMOKEDHAM",
"target_ref": "UltraVNC",
"relationship_type": "uses"
},
{
"source_ref": "SMOKEDHAM",
"target_ref": "Ngrok",
"relationship_type": "uses"
}
] | train:0073 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 73 | e4f799923bfefc18f2e5dc258e25b72d18db6790b683e4c4c25955f49791443a |
adbupd is a backdoor used by PLATINUM that is similar to Dipsind. | [
{
"name": "adbupd",
"type": "MALWARE"
},
{
"name": "PLATINUM",
"type": "THREAT_ACTOR"
},
{
"name": "Dipsind",
"type": "MALWARE"
}
] | [
{
"source_ref": "PLATINUM",
"target_ref": "adbupd",
"relationship_type": "uses"
}
] | train:0074 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 74 | 98e78ba5ae7cb3009401739f3e217cb6122a2465e0d486d54823f7bd54e6361c |
BitPaymer can set values in the Registry to help in execution. | [
{
"name": "BitPaymer",
"type": "MALWARE"
}
] | [] | train:0075 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 75 | 959fe768fa7fba75eb461a9d4c31954997f175f81a35883c42782b57490948e7 |
XTunnel is capable of probing the network for open ports. | [
{
"name": "XTunnel",
"type": "TOOL"
}
] | [] | train:0076 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 76 | d5281c0e797f04c0598ef896ac54a4c70dcd5d5e801f3cf9708bd6b920c0fb24 |
Grandoreiro can detect VMWare via its I/O port and Virtual PC via the vpcext instruction. | [
{
"name": "Grandoreiro",
"type": "MALWARE"
},
{
"name": "VMWare",
"type": "TOOL"
}
] | [] | train:0077 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 77 | e56dd2b999b6e06e98bee1aad5171a1216191c0d0d02f0128135fde92d887090 |
Chinoxy is a backdoor that has been used since at least November 2018, during the FunnyDream campaign, to gain persistence and drop additional payloads. According to security researchers, Chinoxy has been used by Chinese-speaking threat actors. | [
{
"name": "Chinoxy",
"type": "MALWARE"
},
{
"name": "FunnyDream",
"type": "CAMPAIGN"
},
{
"name": "Chinese",
"type": "LOCATION"
}
] | [
{
"source_ref": "Chinoxy",
"target_ref": "Chinese",
"relationship_type": "originates-from"
}
] | train:0078 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 78 | a06fe75ca402a52e4eb15a79c8cc1b4013c77ac827e49c7ff67660af5ae30823 |
WannaCry uses attrib +h and icacls . /grant Everyone:F /T /C /Q to make some of its files hidden and grant all users full access controls. | [
{
"name": "WannaCry",
"type": "MALWARE"
}
] | [] | train:0079 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 79 | e4ae4808257f2f7cd05313040ea67881ebbb2db1b0648cb3295252751913f1c8 |
WolfRAT is malware based on a leaked version of Dendroid that has primarily targeted Thai users. WolfRAT has most likely been operated by the now defunct organization Wolf Research. | [
{
"name": "WolfRAT",
"type": "MALWARE"
},
{
"name": "Dendroid",
"type": "MALWARE"
},
{
"name": "Wolf Research",
"type": "THREAT_ACTOR"
},
{
"name": "Thai",
"type": "LOCATION"
}
] | [
{
"source_ref": "Wolf Research",
"target_ref": "WolfRAT",
"relationship_type": "uses"
},
{
"source_ref": "WolfRAT",
"target_ref": "Dendroid",
"relationship_type": "variant-of"
},
{
"source_ref": "WolfRAT",
"target_ref": "Thai",
"relationship_type": "targets"
}
] | train:0080 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 80 | 06b6b80ee8eec8c65b2504613d1b763d2c8b3152804abda0352d1119d593e8ff |
WIREFIRE is a web shell written in Python that exists as trojanized logic to the visits.py component of Ivanti Connect Secure VPN appliances. WIREFIRE was used during Cutting Edge for downloading files and command execution. | [
{
"name": "WIREFIRE",
"type": "MALWARE"
},
{
"name": "Cutting Edge",
"type": "CAMPAIGN"
},
{
"name": "visits.py",
"type": "INDICATOR"
},
{
"name": "Python",
"type": "TOOL"
},
{
"name": "Ivanti Connect Secure VPN",
"type": "INFRASTRUCTURE"
}
] | [
{
"source_ref": "WIREFIRE",
"target_ref": "Python",
"relationship_type": "uses"
},
{
"source_ref": "WIREFIRE",
"target_ref": "Ivanti Connect Secure VPN",
"relationship_type": "targets"
},
{
"source_ref": "visits.py",
"target_ref": "Ivanti Connect Secure VPN",
"relationshi... | train:0081 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 81 | a662bb896b9fc37d438903d7d10a53b274d646832e2db479969ab01a46c0a332 |
CHEMISTGAMES is a modular backdoor that has been deployed by Sandworm Team. | [
{
"name": "CHEMISTGAMES",
"type": "MALWARE"
},
{
"name": "Sandworm Team",
"type": "THREAT_ACTOR"
}
] | [
{
"source_ref": "CHEMISTGAMES",
"target_ref": "Sandworm Team",
"relationship_type": "authored-by"
}
] | train:0082 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 82 | 6d29feaaefbce39966fe1a1c74447600ef81aaba93a524b28f65c2babe71d79c |
CrossRAT can list all files on a system. | [
{
"name": "CrossRAT",
"type": "MALWARE"
}
] | [] | train:0083 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 83 | 52bc791e8e874269bc2f280d610b5acbd120ef65de8109311e0021a917bf45e4 |
FLIPSIDE uses RDP to tunnel traffic from a victim environment. | [
{
"name": "FLIPSIDE",
"type": "MALWARE"
},
{
"name": "RDP",
"type": "TOOL"
}
] | [
{
"source_ref": "FLIPSIDE",
"target_ref": "RDP",
"relationship_type": "uses"
}
] | train:0084 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 84 | 238fa77b31c3b02f75291f00bc4771cdb09cb9fb78eaa42945425c19428e43eb |
BlackMould is a web shell based on China Chopper for servers running Microsoft IIS. First reported in December 2019, it has been used in malicious campaigns by GALLIUM against telecommunication providers. | [
{
"name": "BlackMould",
"type": "MALWARE"
},
{
"name": "China Chopper",
"type": "TOOL"
},
{
"name": "Microsoft IIS",
"type": "INFRASTRUCTURE"
},
{
"name": "GALLIUM",
"type": "THREAT_ACTOR"
}
] | [
{
"source_ref": "BlackMould",
"target_ref": "China Chopper",
"relationship_type": "uses"
},
{
"source_ref": "BlackMould",
"target_ref": "Microsoft IIS",
"relationship_type": "targets"
},
{
"source_ref": "GALLIUM",
"target_ref": "BlackMould",
"relationship_type": "uses"
... | train:0085 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 85 | 4e206cb618d242a1f146b2f3fbe696aff95b267dbcad12f9d0d149350b68f48f |
Mis-Type is a backdoor hybrid that was used by Dust Storm in 2012. | [
{
"name": "Mis-Type",
"type": "MALWARE"
},
{
"name": "Dust Storm",
"type": "THREAT_ACTOR"
}
] | [
{
"source_ref": "Dust Storm",
"target_ref": "Mis-Type",
"relationship_type": "uses"
}
] | train:0086 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 86 | 49008dcfc6461b06b129322378aadc61af959f2c90caa0327a3e1bb8a63d15fc |
P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments. | [
{
"name": "P8RAT",
"type": "MALWARE"
},
{
"name": "VMware",
"type": "TOOL"
},
{
"name": "VirtualBox",
"type": "TOOL"
}
] | [
{
"source_ref": "P8RAT",
"target_ref": "VMware",
"relationship_type": "uses"
},
{
"source_ref": "P8RAT",
"target_ref": "VirtualBox",
"relationship_type": "uses"
}
] | train:0087 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 87 | f53e32558035bc1edb9351d2f515f830c4972ba2e66839498fca86472abe0312 |
ANDROMEDA is commodity malware that was widespread in the early 2010's and continues to be observed in infections across a wide variety of industries. During the 2022 C0026 campaign, threat actors re-registered expired ANDROMEDA C2 domains to spread malware to select targets in Ukraine. | [
{
"name": "ANDROMEDA",
"type": "MALWARE"
},
{
"name": "C2",
"type": "INFRASTRUCTURE"
},
{
"name": "C0026",
"type": "CAMPAIGN"
},
{
"name": "Ukraine",
"type": "LOCATION"
}
] | [
{
"source_ref": "ANDROMEDA",
"target_ref": "C2",
"relationship_type": "communicates-with"
},
{
"source_ref": "ANDROMEDA",
"target_ref": "Ukraine",
"relationship_type": "targets"
}
] | train:0088 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 88 | b83e1920bfbdfbad70084f899cba2ad18eae53a18e78230745a96e31ab172d88 |
Utilize Safety Instrumented Systems (SIS) to provide an additional layer of protection to hazard scenarios that may cause property damage. A SIS will typically include sensors, logic solvers, and a final control element that can be used to automatically respond to an hazardous condition | [
{
"name": "Utilize Safety Instrumented Systems (SIS) to provide an additional layer of protection to hazard scenarios that may cause property damage.",
"type": "COURSE_OF_ACTION"
}
] | [] | train:0089 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 89 | 3ad200351bb04b68544b9823fbd54b95ca6c77acc0b6f23edb09c327ccdad91f |
ConnectWise can be used to execute PowerShell commands on target machines. | [
{
"name": "ConnectWise",
"type": "TOOL"
},
{
"name": "PowerShell",
"type": "TOOL"
}
] | [] | train:0090 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 90 | c1af7147c580e86e0dd6c477f68b8e1b5bb0cb0cc39959c31ed720d088ca0824 |
Flagpro is a Windows-based, first-stage downloader that has been used by BlackTech since at least October 2020. It has primarily been used against defense, media, and communications companies in Japan. | [
{
"name": "Flagpro",
"type": "MALWARE"
},
{
"name": "BlackTech",
"type": "THREAT_ACTOR"
},
{
"name": "Windows",
"type": "INFRASTRUCTURE"
},
{
"name": "Japan",
"type": "LOCATION"
}
] | [
{
"source_ref": "Flagpro",
"target_ref": "Windows",
"relationship_type": "targets"
},
{
"source_ref": "BlackTech",
"target_ref": "Flagpro",
"relationship_type": "uses"
},
{
"source_ref": "Flagpro",
"target_ref": "Japan",
"relationship_type": "targets"
}
] | train:0091 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 91 | e71d7b4f904e04eea8a13516b8512ae2f165cb386c9509a4d44bbc8e330b55b5 |
WellMail is a lightweight malware written in Golang used by APT29, similar in design and structure to WellMess. | [
{
"name": "WellMail",
"type": "MALWARE"
},
{
"name": "APT29",
"type": "THREAT_ACTOR"
},
{
"name": "WellMess",
"type": "MALWARE"
},
{
"name": "Golang",
"type": "TOOL"
}
] | [
{
"source_ref": "APT29",
"target_ref": "WellMail",
"relationship_type": "uses"
},
{
"source_ref": "WellMail",
"target_ref": "Golang",
"relationship_type": "uses"
},
{
"source_ref": "WellMail",
"target_ref": "WellMess",
"relationship_type": "variant-of"
}
] | train:0092 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 92 | 06b7c55078406cfdf006925272bac036a1a8ca820a003bc048d3c3d8ec71517a |
BLUELIGHT can collect process filenames and SID authority level. | [
{
"name": "BLUELIGHT",
"type": "MALWARE"
}
] | [] | train:0093 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 93 | db3efa0f846f2cad1f30635b0a88a374437039edc86fd2a30fd184683c7e4e57 |
HUI Loader is a custom DLL loader that has been used since at least 2015 by China-based threat groups including Cinnamon Tempest and menuPass to deploy malware on compromised hosts. HUI Loader has been observed in campaigns loading SodaMaster, PlugX, Cobalt Strike, Komplex, and several strains of ransomware. | [
{
"name": "HUI Loader",
"type": "MALWARE"
},
{
"name": "China",
"type": "LOCATION"
},
{
"name": "Cinnamon Tempest",
"type": "THREAT_ACTOR"
},
{
"name": "menuPass",
"type": "THREAT_ACTOR"
},
{
"name": "SodaMaster",
"type": "MALWARE"
},
{
"name": "PlugX"... | [
{
"source_ref": "HUI Loader",
"target_ref": "China",
"relationship_type": "originates-from"
},
{
"source_ref": "Cinnamon Tempest",
"target_ref": "HUI Loader",
"relationship_type": "uses"
},
{
"source_ref": "menuPass",
"target_ref": "HUI Loader",
"relationship_type": "uses... | train:0094 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 94 | 9053642794d40cee8429106adfe416805965167c6fdccfd3ba1a80de27db5372 |
It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware. | [
{
"name": "Wiper",
"type": "MALWARE"
}
] | [] | train:0095 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 95 | 826710db2022b8b19eb6566c2c77f8682d1334440c5785201fd5d694ff7090d4 |
Revenge RAT has the ability to access the webcam. | [
{
"name": "Revenge RAT",
"type": "MALWARE"
}
] | [] | train:0096 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 96 | 878874fe138f5c3b2c485e2d97967fcdba57c4842a50f3e295fc4b8afcbfe27e |
ELMER is a non-persistent, proxy-aware HTTP backdoor written in Delphi that has been used by APT16. | [
{
"name": "ELMER",
"type": "MALWARE"
},
{
"name": "APT16",
"type": "THREAT_ACTOR"
},
{
"name": "Delphi",
"type": "TOOL"
}
] | [
{
"source_ref": "ELMER",
"target_ref": "Delphi",
"relationship_type": "uses"
},
{
"source_ref": "APT16",
"target_ref": "ELMER",
"relationship_type": "uses"
}
] | train:0097 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 97 | d4fd81c0a6654d0f7d55d52924b9e2a68fc5db0d7c153c3dd546afdf13eb8271 |
SUGARDUMP is a proprietary browser credential harvesting tool that was used by UNC3890 during the C0010 campaign. The first known SUGARDUMP version was used since at least early 2021, a second SMTP C2 version was used from late 2021-early 2022, and a third HTTP C2 variant was used since at least April 2022. | [
{
"name": "SUGARDUMP",
"type": "MALWARE"
},
{
"name": "UNC3890",
"type": "THREAT_ACTOR"
},
{
"name": "C2",
"type": "INFRASTRUCTURE"
},
{
"name": "C0010",
"type": "CAMPAIGN"
}
] | [
{
"source_ref": "UNC3890",
"target_ref": "SUGARDUMP",
"relationship_type": "uses"
},
{
"source_ref": "C0010",
"target_ref": "UNC3890",
"relationship_type": "attributed-to"
},
{
"source_ref": "SUGARDUMP",
"target_ref": "C2",
"relationship_type": "communicates-with"
}
] | train:0098 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 98 | 7ca5f7fd1e42ac71ccc1f729c0568e76d627ae0e62fb430a148f8953f2c069ce |
AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader. | [
{
"name": "PowerShell",
"type": "TOOL"
},
{
"name": "AutoIt",
"type": "MALWARE"
}
] | [
{
"source_ref": "AutoIt",
"target_ref": "PowerShell",
"relationship_type": "uses"
}
] | train:0099 | AnnoCTRPlus | azerg_v3/raw/azerg_annoctr_mix_train.json | 99 | 0a67b964151164d14eb4cbc0837916ebec871498bdf900b8222bde7eef2fccb5 |
End of preview. Expand in Data Studio
AZERG-Dataset
Cyber threat intelligence annotations for From Text to Actionable Intelligence: Automating STIX Entity and Relationship Extraction, accepted at RAID 2025. The entity and relationship annotation scheme is based on STIX 2.1.
Updated dataset
The October 2026 update provides the train/test split matching the paper's dataset counts and adds consolidated passage–annotation pairs as the default configuration. The previous release is preserved in old/.
| Split | AZERG Data passages | AnnoCTRPlus passages | Entities | Relationships |
|---|---|---|---|---|
| Train | 62 | 744 | 2,664 | 1,510 |
| Test | 108 | 0 | 1,347 | 565 |
| Total | 170 | 744 | 4,011 | 2,075 |
Each consolidated record contains the passage (paragraph), entity names and types (entities), relationships (relations), and its source corpus (source_dataset: AZERG Data or AnnoCTRPlus). Relationships use entity-name strings in source_ref and target_ref, with the label in relationship_type. Record IDs and passage hashes support cross-referencing.
These are extraction annotations; generating complete STIX bundles additionally requires STIX object properties, IDs, and references.
from datasets import load_dataset
dataset = load_dataset("QCRI/AZERG-Dataset") # consolidated train/test pairs
t4 = load_dataset("QCRI/AZERG-Dataset", "T4") # task-specific instructions
Files and tasks
consolidated/train.jsonandconsolidated/test.json: complete passage-level annotation records.train/andtest/: task examples withinstruction,input, andoutputfields.old/: previous release, retained for reference.
T1 detects entities; T2 assigns entity types; T3 classifies candidate pairs as related (YES) or unrelated (NO); T4 identifies relationship types. MixTask combines the training examples across all four tasks. Training filenames prefixed with azerg include both source corpora.
Original AZERG reports
azerg_report_urls.txt lists 20 original report URLs recovered from the AZERG collection workspace, one URL per line. This list covers AZERG only, not AnnoCTRPlus. It is a recovered reference list, not a verified complete inventory of the paper's 21 AZERG reports or a passage-to-report mapping.
Citation
@article{lekssays2025azerg,
title={From Text to Actionable Intelligence: Automating STIX Entity and Relationship Extraction},
author={Lekssays, Ahmed and Sencar, Husrev Taha and Yu, Ting},
journal={arXiv preprint arXiv:2507.16576},
year={2025}
}
Code: qcri/azerg.
- Downloads last month
- 397