{
  "observed_date": "2026-10-06",
  "scope": "Recovered files and synthetic protocol observations; captured task responses fail unchanged Lua client decoding, and end-to-end infection was not demonstrated.",
  "files": {
    "Claw_Onion_1.9.zip": {
      "size_bytes": 580808,
      "sha256": "a4d836eec38f35f790522da33cdb745a6623ce6802744aae9dac03e8d15cedcc"
    },
    "Launcher.cmd": {
      "size_bytes": 26,
      "sha256": "d71cdcdd390fb300904a7fdc31d56c0a3a728350eca2debf3d00d7932dc14839"
    },
    "lua51.exe": {
      "size_bytes": 872448,
      "sha256": "3ee51b5f9579b775e87edb23c238650a512c2fe46efc06694cd906a771727f97"
    },
    "rest.txt": {
      "size_bytes": 299679,
      "sha256": "58448cb79f50cf71408e7eabfe7e0718e77a09910fd59963f83840b67faa245f"
    }
  },
  "decoded_payloads": {
    "dist.lua": {
      "size_bytes": 198438,
      "sha256": "06bed48e1b04e9bb0b8a62cc3c733fb52a4a44496f6461795623dae61952a26f",
      "role": "Decoded second Lua loader",
      "specificity": "high"
    },
    "ip.txt decoded wrapper": {
      "size_bytes": 1211392,
      "sha256": "e8a038fdb6adfbea7740e9654c3dff46f3d58cfa4c1eb08850912e5810b46b0a",
      "role": "Decoded Windows wrapper before task-requested padding; not the legitimate Node.js runtime",
      "specificity": "high"
    },
    "inner native payload": {
      "size_bytes": 634880,
      "sha256": "d0bb735a344aab2dc5b874a9c928ce0bf5815c0e573ab313f8552b28aabc0601",
      "role": "Inner executable recovered offline; not established as a separate file written on a victim",
      "specificity": "high"
    }
  },
  "addresses": [
    {
      "ip": "217.119.129.99",
      "role": "Original Lua C2"
    },
    {
      "ip": "185.10.68.110",
      "role": "C2 returned by Polygon at observed blocks"
    },
    {
      "ip": "89.169.12.149",
      "role": "Recovered Lua C2"
    },
    {
      "ip": "144.31.57.121",
      "role": "Native collector; HTTP POST root"
    }
  ],
  "polygon": {
    "contract": "0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc",
    "selector": "0x3bc5de30",
    "method": "eth_call",
    "chain_id": 137,
    "observed_block": 95019999,
    "observed_block_timestamp_utc": "2026-10-05T21:19:10Z"
  },
  "lua_registration_path": "/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=",
  "repositories": [
    "christinminor459/OnionClaw",
    "Sydneycondemnatory52/ssh"
  ],
  "task_download_paths": [
    "22/cd.txt",
    "22/ip.txt"
  ],
  "artifacts": {
    "command_line": "lua51.exe rest.txt",
    "task840_destination": "%TEMP%\\dist.lua",
    "task838_destination": "%LOCALAPPDATA%\\Programs\\nodejs\\node.exe",
    "original_loader_conditional_persistence": "%LOCALAPPDATA%\\ODM5\\ODM5.exe",
    "original_loader_task_example": "AdobeCreativeCloud_ODM5",
    "response_cache": "<Documents>\\<MachineGuid>.json"
  },
  "assessment": "Inner payload strongly matches StealC v2 or a derivative; exact version and operator unconfirmed.",
  "last_follow_on_response": {
    "observed_utc": "2026-10-06T18:01:24Z",
    "opcode": "success",
    "loader": []
  },
  "cautions": [
    "IPs are historical observations, not proof of ongoing control.",
    "Public RPC services, Microsoft and GitHub are not malicious indicators by themselves.",
    "An upload success response does not independently establish server-side retention."
  ],
  "schema_version": 2,
  "reviewed_date": "2026-10-07",
  "observation_dates": [
    "2026-10-05",
    "2026-10-06"
  ],
  "artifact_hashes": {
    "Claw_Onion_1.9.zip": {
      "size_bytes": 580808,
      "sha256": "a4d836eec38f35f790522da33cdb745a6623ce6802744aae9dac03e8d15cedcc",
      "role": "Original distribution archive",
      "specificity": "high"
    },
    "Launcher.cmd": {
      "size_bytes": 26,
      "sha256": "d71cdcdd390fb300904a7fdc31d56c0a3a728350eca2debf3d00d7932dc14839",
      "role": "Batch launcher; short command is not unique to this campaign",
      "specificity": "context_required"
    },
    "lua51.exe": {
      "size_bytes": 872448,
      "sha256": "3ee51b5f9579b775e87edb23c238650a512c2fe46efc06694cd906a771727f97",
      "role": "Bundled LuaJIT interpreter; runtime possession alone does not establish compromise",
      "specificity": "context_required"
    },
    "rest.txt": {
      "size_bytes": 299679,
      "sha256": "58448cb79f50cf71408e7eabfe7e0718e77a09910fd59963f83840b67faa245f",
      "role": "Original malicious Lua loader",
      "specificity": "high"
    },
    "cd.txt": {
      "size_bytes": 396876,
      "sha256": "c506fe9d218d6ff18e3ffc1f45e2f245b019b733e56dc6dd508ff0bb219a0c9b",
      "role": "Encoded task-840 HTTP response body, before hexadecimal/XOR decoding",
      "specificity": "high"
    },
    "dist.lua": {
      "size_bytes": 198438,
      "sha256": "06bed48e1b04e9bb0b8a62cc3c733fb52a4a44496f6461795623dae61952a26f",
      "role": "Decoded second Lua loader",
      "specificity": "high"
    },
    "ip.txt": {
      "size_bytes": 2422784,
      "sha256": "4f5414d1fb4c432bf706f626b0a83a6d60ada0e39efab5ebc62c86a1d2b76166",
      "role": "Encoded task-838 HTTP response body, before hexadecimal/XOR decoding",
      "specificity": "high"
    },
    "node.exe wrapper": {
      "size_bytes": 1211392,
      "sha256": "e8a038fdb6adfbea7740e9654c3dff46f3d58cfa4c1eb08850912e5810b46b0a",
      "role": "Decoded Windows wrapper before task-requested padding; not the legitimate Node.js runtime",
      "specificity": "high"
    },
    "embedded infostealer": {
      "size_bytes": 634880,
      "sha256": "d0bb735a344aab2dc5b874a9c928ce0bf5815c0e573ab313f8552b28aabc0601",
      "role": "Inner executable recovered offline; not established as a separate file written on a victim",
      "specificity": "high"
    }
  },
  "encoded_downloads": {
    "cd.txt": {
      "size_bytes": 396876,
      "sha256": "c506fe9d218d6ff18e3ffc1f45e2f245b019b733e56dc6dd508ff0bb219a0c9b",
      "role": "Encoded task-840 HTTP response body, before hexadecimal/XOR decoding",
      "specificity": "high"
    },
    "ip.txt": {
      "size_bytes": 2422784,
      "sha256": "4f5414d1fb4c432bf706f626b0a83a6d60ada0e39efab5ebc62c86a1d2b76166",
      "role": "Encoded task-838 HTTP response body, before hexadecimal/XOR decoding",
      "specificity": "high"
    }
  },
  "repository_details": [
    {
      "repository": "christinminor459/OnionClaw",
      "url": "https://github.com/christinminor459/OnionClaw",
      "role": "Contains analyzed malicious archive",
      "paths": [
        ".github/ISSUE_TEMPLATE/Claw_Onion_1.9.zip"
      ],
      "analyzed_commit": "524d4aa245cdc172b894f68b9397c885bcfb985b",
      "earliest_recovered_addition_commit": "3dcdb041e8a2b71e8124d9effc3a561b48b5fe23",
      "earliest_recovered_commit_timestamp_utc": "2026-04-06T23:30:29Z"
    },
    {
      "repository": "Sydneycondemnatory52/ssh",
      "url": "https://github.com/Sydneycondemnatory52/ssh",
      "role": "Hosts the two encoded task-download bodies",
      "paths": [
        "22/cd.txt",
        "22/ip.txt"
      ],
      "analyzed_commit": "3a21ace0edddbc2f5163f08ea0c5ee1321c7a354"
    }
  ],
  "task_downloads": [
    {
      "task_id": 840,
      "requested_url": "https://github.com/Sydneycondemnatory52/ssh/raw/refs/heads/main/22/cd.txt",
      "redirect_url": "https://raw.githubusercontent.com/Sydneycondemnatory52/ssh/refs/heads/main/22/cd.txt",
      "file_path": "Temp",
      "file_name": "dist.lua",
      "start": 1
    },
    {
      "task_id": 838,
      "requested_url": "https://github.com/Sydneycondemnatory52/ssh/raw/refs/heads/main/22/ip.txt",
      "redirect_url": "https://raw.githubusercontent.com/Sydneycondemnatory52/ssh/refs/heads/main/22/ip.txt",
      "file_path": "AppData",
      "file_name": "..\\Local\\Programs\\nodejs\\node.exe",
      "start": 1
    }
  ],
  "lua_task_report_path": "/task/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=",
  "original_lua_static_inventory": "lua-static-inventory.json",
  "collector_configuration": "collector-config.redacted.json",
  "related_component_match": {
    "filename": "register_codex_v3.1.zip",
    "sha256": "eee2d8effc5b0be997f93f1568ba228b997cd6c1cc59da635a862ad155dd1f59",
    "source": "https://bazaar.abuse.ch/sample/eee2d8effc5b0be997f93f1568ba228b997cd6c1cc59da635a862ad155dd1f59/",
    "role": "External SmartLoader-labeled archive containing identical rest.txt; not the analyzed OnionClaw ZIP",
    "first_seen_utc": "2026-04-07T14:17:42Z"
  },
  "records": [
    {
      "type": "sha256",
      "value": "a4d836eec38f35f790522da33cdb745a6623ce6802744aae9dac03e8d15cedcc",
      "component": "Claw_Onion_1.9.zip",
      "role": "Original distribution archive",
      "origin": "recomputed_from_saved_bytes",
      "specificity": "high"
    },
    {
      "type": "sha256",
      "value": "d71cdcdd390fb300904a7fdc31d56c0a3a728350eca2debf3d00d7932dc14839",
      "component": "Launcher.cmd",
      "role": "Batch launcher; short command is not unique to this campaign",
      "origin": "recomputed_from_saved_bytes",
      "specificity": "context_required"
    },
    {
      "type": "sha256",
      "value": "3ee51b5f9579b775e87edb23c238650a512c2fe46efc06694cd906a771727f97",
      "component": "lua51.exe",
      "role": "Bundled LuaJIT interpreter; runtime possession alone does not establish compromise",
      "origin": "recomputed_from_saved_bytes",
      "specificity": "context_required"
    },
    {
      "type": "sha256",
      "value": "58448cb79f50cf71408e7eabfe7e0718e77a09910fd59963f83840b67faa245f",
      "component": "rest.txt",
      "role": "Original malicious Lua loader",
      "origin": "recomputed_from_saved_bytes",
      "specificity": "high"
    },
    {
      "type": "sha256",
      "value": "c506fe9d218d6ff18e3ffc1f45e2f245b019b733e56dc6dd508ff0bb219a0c9b",
      "component": "cd.txt",
      "role": "Encoded task-840 HTTP response body, before hexadecimal/XOR decoding",
      "origin": "recomputed_from_saved_bytes",
      "specificity": "high"
    },
    {
      "type": "sha256",
      "value": "06bed48e1b04e9bb0b8a62cc3c733fb52a4a44496f6461795623dae61952a26f",
      "component": "dist.lua",
      "role": "Decoded second Lua loader",
      "origin": "recomputed_from_saved_bytes",
      "specificity": "high"
    },
    {
      "type": "sha256",
      "value": "4f5414d1fb4c432bf706f626b0a83a6d60ada0e39efab5ebc62c86a1d2b76166",
      "component": "ip.txt",
      "role": "Encoded task-838 HTTP response body, before hexadecimal/XOR decoding",
      "origin": "recomputed_from_saved_bytes",
      "specificity": "high"
    },
    {
      "type": "sha256",
      "value": "e8a038fdb6adfbea7740e9654c3dff46f3d58cfa4c1eb08850912e5810b46b0a",
      "component": "node.exe wrapper",
      "role": "Decoded Windows wrapper before task-requested padding; not the legitimate Node.js runtime",
      "origin": "recomputed_from_saved_bytes",
      "specificity": "high"
    },
    {
      "type": "sha256",
      "value": "d0bb735a344aab2dc5b874a9c928ce0bf5815c0e573ab313f8552b28aabc0601",
      "component": "embedded infostealer",
      "role": "Inner executable recovered offline; not established as a separate file written on a victim",
      "origin": "recomputed_from_saved_bytes",
      "specificity": "high"
    },
    {
      "type": "ipv4",
      "value": "217.119.129.99",
      "component": "network",
      "role": "Original Lua C2",
      "origin": "decoded_from_original_rest_txt",
      "specificity": "high"
    },
    {
      "type": "url",
      "value": "http://217.119.129.99",
      "component": "network",
      "role": "Original Lua C2",
      "origin": "decoded_from_original_rest_txt",
      "specificity": "high"
    },
    {
      "type": "ipv4",
      "value": "185.10.68.110",
      "component": "network",
      "role": "C2 returned by Polygon at observed blocks",
      "origin": "saved_polygon_reply_at_block_95019999",
      "specificity": "high"
    },
    {
      "type": "url",
      "value": "http://185.10.68.110",
      "component": "network",
      "role": "C2 returned by Polygon at observed blocks",
      "origin": "saved_polygon_reply_at_block_95019999",
      "specificity": "high"
    },
    {
      "type": "ipv4",
      "value": "89.169.12.149",
      "component": "network",
      "role": "Recovered Lua C2",
      "origin": "decoded_from_recovered_dist_lua",
      "specificity": "high"
    },
    {
      "type": "url",
      "value": "http://89.169.12.149",
      "component": "network",
      "role": "Recovered Lua C2",
      "origin": "decoded_from_recovered_dist_lua",
      "specificity": "high"
    },
    {
      "type": "ipv4",
      "value": "144.31.57.121",
      "component": "network",
      "role": "Native collector; HTTP POST root",
      "origin": "decoded_from_inner_PE_and_validated_synthetic_collector_exchange",
      "specificity": "high"
    },
    {
      "type": "url",
      "value": "http://144.31.57.121/",
      "component": "network",
      "role": "Native collector; HTTP POST root",
      "origin": "decoded_from_inner_PE_and_validated_synthetic_collector_exchange",
      "specificity": "high"
    },
    {
      "type": "repository",
      "value": "https://github.com/christinminor459/OnionClaw",
      "component": "distribution",
      "role": "Contains analyzed malicious archive",
      "origin": "preserved_git_or_github_metadata",
      "specificity": "high"
    },
    {
      "type": "repository_path",
      "value": "christinminor459/OnionClaw/.github/ISSUE_TEMPLATE/Claw_Onion_1.9.zip",
      "component": "distribution",
      "role": "Contains analyzed malicious archive",
      "origin": "preserved_git_or_task_response",
      "specificity": "high"
    },
    {
      "type": "repository",
      "value": "https://github.com/Sydneycondemnatory52/ssh",
      "component": "distribution",
      "role": "Hosts the two encoded task-download bodies",
      "origin": "preserved_git_or_github_metadata",
      "specificity": "high"
    },
    {
      "type": "repository_path",
      "value": "Sydneycondemnatory52/ssh/22/cd.txt",
      "component": "distribution",
      "role": "Hosts the two encoded task-download bodies",
      "origin": "preserved_git_or_task_response",
      "specificity": "high"
    },
    {
      "type": "repository_path",
      "value": "Sydneycondemnatory52/ssh/22/ip.txt",
      "component": "distribution",
      "role": "Hosts the two encoded task-download bodies",
      "origin": "preserved_git_or_task_response",
      "specificity": "high"
    },
    {
      "type": "url",
      "value": "https://github.com/Sydneycondemnatory52/ssh/raw/refs/heads/main/22/cd.txt",
      "component": "task 840",
      "role": "Encoded payload download",
      "origin": "captured_http_download",
      "specificity": "high"
    },
    {
      "type": "url",
      "value": "https://raw.githubusercontent.com/Sydneycondemnatory52/ssh/refs/heads/main/22/cd.txt",
      "component": "task 840",
      "role": "Encoded payload download after GitHub redirect",
      "origin": "captured_http_download",
      "specificity": "high"
    },
    {
      "type": "url",
      "value": "https://github.com/Sydneycondemnatory52/ssh/raw/refs/heads/main/22/ip.txt",
      "component": "task 838",
      "role": "Encoded payload download",
      "origin": "captured_http_download",
      "specificity": "high"
    },
    {
      "type": "url",
      "value": "https://raw.githubusercontent.com/Sydneycondemnatory52/ssh/refs/heads/main/22/ip.txt",
      "component": "task 838",
      "role": "Encoded payload download after GitHub redirect",
      "origin": "captured_http_download",
      "specificity": "high"
    },
    {
      "type": "blockchain_contract",
      "value": "0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc",
      "component": "rest.txt / loader 839",
      "role": "Polygon mainnet C2 locator",
      "origin": "decoded_from_sample",
      "specificity": "high"
    },
    {
      "type": "function_selector",
      "value": "0x3bc5de30",
      "component": "rest.txt / loader 839",
      "role": "Getter used by the locator; correlate with contract",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "legitimate_rpc_host",
      "value": "polygon.drpc.org",
      "component": "rest.txt / loader 839",
      "role": "Ordered fallback provider for eth_call; not attacker-owned evidence",
      "origin": "decoded_from_sample",
      "specificity": "low"
    },
    {
      "type": "legitimate_rpc_host",
      "value": "polygon.publicnode.com",
      "component": "rest.txt / loader 839",
      "role": "Ordered fallback provider for eth_call; not attacker-owned evidence",
      "origin": "decoded_from_sample",
      "specificity": "low"
    },
    {
      "type": "legitimate_rpc_host",
      "value": "polygon-mainnet.gateway.tatum.io",
      "component": "rest.txt / loader 839",
      "role": "Ordered fallback provider for eth_call; not attacker-owned evidence",
      "origin": "decoded_from_sample",
      "specificity": "low"
    },
    {
      "type": "legitimate_rpc_host",
      "value": "polygon-public.nodies.app",
      "component": "rest.txt / loader 839",
      "role": "Ordered fallback provider for eth_call; not attacker-owned evidence",
      "origin": "decoded_from_sample",
      "specificity": "low"
    },
    {
      "type": "legitimate_rpc_host",
      "value": "rpc-mainnet.matic.quiknode.pro",
      "component": "rest.txt / loader 839",
      "role": "Ordered fallback provider for eth_call; not attacker-owned evidence",
      "origin": "decoded_from_sample",
      "specificity": "low"
    },
    {
      "type": "legitimate_service_url",
      "value": "http://ip-api.com/json/",
      "component": "rest.txt / loader 839",
      "role": "IP/geolocation metadata, initial request and possible retry",
      "origin": "assembled_from_sample",
      "specificity": "low"
    },
    {
      "type": "legitimate_service_url",
      "value": "https://www.microsoft.com",
      "component": "rest.txt / loader 839",
      "role": "Direct WinINet connectivity gate; failures wait 5 seconds and retry before C2 check-in",
      "origin": "decoded_from_sample",
      "specificity": "low"
    },
    {
      "type": "route_token",
      "value": "517b7c5e5663656a057f",
      "component": "rest.txt / loader 839",
      "role": "Input to Base64 route suffix",
      "origin": "decoded_from_sample",
      "specificity": "high"
    },
    {
      "type": "http_path",
      "value": "/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=",
      "component": "rest.txt / loader 839",
      "role": "Multipart registration and task/config request",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "http_path",
      "value": "/task/NTE3YjdjNWU1NjYzNjU2YTA1N2Y=",
      "component": "rest.txt / loader 839",
      "role": "POST encoded taskId and country; not proof of successful payload execution",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "loader_id",
      "value": "839",
      "component": "rest.txt / loader 839",
      "role": "Loader configuration identifier; also transformed into persistence names",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "xor_key",
      "value": "ECe6VGLRJum2qYtl79OiOU7aHot7Zhbn",
      "component": "rest.txt / loader 839",
      "role": "32-byte repeating XOR key shared by metadata, config/tasks, task downloads and filename markers",
      "origin": "decoded_from_sample",
      "specificity": "high"
    },
    {
      "type": "multipart_boundary",
      "value": "5kahi4ei7ymoc89zqy5whag7v5u8xvztt6pov",
      "component": "rest.txt / loader 839",
      "role": "Fixed registration boundary",
      "origin": "extracted_from_decoded_header",
      "specificity": "high"
    },
    {
      "type": "multipart_filename",
      "value": "9av9u1h7siayaeh1xfwy8y9xy649wjaroj0datp2ngc5nlwv1mg0ixy7",
      "component": "rest.txt / loader 839",
      "role": "Fixed screenshot upload filename; not a confirmed file written to disk",
      "origin": "extracted_from_decoded_header",
      "specificity": "high"
    },
    {
      "type": "user_agent",
      "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
      "component": "rest.txt / loader 839",
      "role": "WinINet HTTP helper user agent",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "mutex",
      "value": "h73l6jwoi76f57ulqfmtwdt7kysfymvxrenk8bx1b80xve4zzml7ofpyqhyzs189mrp4u5npw9",
      "component": "rest.txt / loader 839",
      "role": "Existing mutex / GetLastError 183 causes main to return",
      "origin": "decoded_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\ODM5\\ODM5.exe",
      "component": "rest.txt / loader 839",
      "role": "Conditional persistence copy of current executable",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\ODM5\\lua51.dll",
      "component": "rest.txt / loader 839",
      "role": "Conditional copy when ffi.load(\"lua51.dll\") succeeds",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\ODM5\\<script-or-DLL filename>",
      "component": "rest.txt / loader 839",
      "role": "Companion script/DLL path preserved under Base64(loaderId) directory",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "<Documents>\\<MachineGuid>.json",
      "component": "rest.txt / loader 839",
      "role": "Outer server response cache, written before loader/tasks decoding; used when live response is nil",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "file_path",
      "value": "%TEMP%\\<lowercase_hex(repeating_XOR(task_basename_plus_extension, key))>",
      "component": "rest.txt / loader 839",
      "role": "Empty task marker. Existing marker skips task unless task.relaunch==1. Created after decoded download, before payload processing/execution",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "file_path",
      "value": "<Root|Temp|AppData|Desktop>\\<task.file_name>",
      "component": "rest.txt / loader 839",
      "role": "Task output derived from selected base directory and server filename; path may contain subdirectories",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "file_path",
      "value": "C:\\Windows\\Setup\\Scripts\\ErrorHandler.cmd",
      "component": "rest.txt / loader 839",
      "role": "Conditional script containing a start/min cmd launch; requires relevant path/permissions",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "system_executable",
      "value": "C:/Windows/System32/oobe/Setup.exe",
      "component": "rest.txt / loader 839",
      "role": "Referenced by highest-privilege scheduled task Setup; not a dropped payload",
      "origin": "extracted_from_decoded_command",
      "specificity": "context_required"
    },
    {
      "type": "registry_path",
      "value": "HKLM\\Software\\Microsoft\\Cryptography\\MachineGuid",
      "component": "rest.txt / loader 839",
      "role": "Read machine identifier",
      "origin": "assembled_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "registry_path",
      "value": "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "component": "rest.txt / loader 839",
      "role": "Conditional autorun values based on executable basename",
      "origin": "assembled_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "registry_path",
      "value": "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run",
      "component": "rest.txt / loader 839",
      "role": "Associated approval value; desired REG_BINARY starts 02 then eleven zero bytes",
      "origin": "assembled_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "scheduled_task_name",
      "value": "AdobeCreativeCloud_ODM5",
      "component": "rest.txt / loader 839",
      "role": "Derived loader persistence task name: selected prefix + underscore + Base64(839)",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "CloudDrive_ODM5",
      "component": "rest.txt / loader 839",
      "role": "Derived loader persistence task name: selected prefix + underscore + Base64(839)",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "AudioManager_ODM5",
      "component": "rest.txt / loader 839",
      "role": "Derived loader persistence task name: selected prefix + underscore + Base64(839)",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "TaskScheduler_ODM5",
      "component": "rest.txt / loader 839",
      "role": "Derived loader persistence task name: selected prefix + underscore + Base64(839)",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "Setup",
      "component": "rest.txt / loader 839",
      "role": "Conditional highest-privilege task for Windows Setup.exe",
      "origin": "extracted_from_decoded_command",
      "specificity": "context_required"
    },
    {
      "type": "scheduled_task_name",
      "value": "<current executable or task output filename without extension>",
      "component": "rest.txt / loader 839",
      "role": "Other conditional task names are derived from filenames; no fixed malicious name",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "command_fragment",
      "value": "schtasks /create /sc daily /st %02d:%02d /f",
      "component": "rest.txt / loader 839",
      "role": "Context-dependent process command fragment; not standalone maliciousness",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "command_fragment",
      "value": "cmd /c \"",
      "component": "rest.txt / loader 839",
      "role": "Context-dependent process command fragment; not standalone maliciousness",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "command_fragment",
      "value": "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File \"",
      "component": "rest.txt / loader 839",
      "role": "Context-dependent process command fragment; not standalone maliciousness",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "command_fragment",
      "value": "powershell \"Start-Process",
      "component": "rest.txt / loader 839",
      "role": "Context-dependent process command fragment; not standalone maliciousness",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "command_fragment",
      "value": "start /min cmd /c \"\"",
      "component": "rest.txt / loader 839",
      "role": "Context-dependent process command fragment; not standalone maliciousness",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "command_fragment",
      "value": "rundll32 \"",
      "component": "rest.txt / loader 839",
      "role": "Context-dependent process command fragment; not standalone maliciousness",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "command_fragment",
      "value": "rundll32 '",
      "component": "rest.txt / loader 839",
      "role": "Context-dependent process command fragment; not standalone maliciousness",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "defender_command_fragment",
      "value": "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force",
      "component": "rest.txt / loader 839",
      "role": "loader.bypass_defender==1 requests runAs elevation; success not established",
      "origin": "extracted_from_decoded_command",
      "specificity": "high"
    },
    {
      "type": "loader_id",
      "value": "847",
      "component": "dist.lua",
      "role": "Second Lua loader identifier",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "mutex",
      "value": "5m9gr3w9a1jb3hvgth99giq6qxt73mr4wid7z34k7i3wf0u",
      "component": "dist.lua",
      "role": "Second loader's named mutex",
      "origin": "decoded_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\7d7752\\7d7752.exe",
      "component": "dist.lua",
      "role": "Conditional copied-interpreter persistence path",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\7d7752\\lua51.dll",
      "component": "dist.lua",
      "role": "Conditional companion copy; filename depends on launch mode and DLL-load success",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\7d7752\\<script-or-DLL filename>",
      "component": "dist.lua",
      "role": "Conditional companion copy; filename depends on launch mode and DLL-load success",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "scheduled_task_name",
      "value": "OfficeClickToRunTask_7d7752",
      "component": "dist.lua",
      "role": "Alternative conditional persistence task name, not an observed victim task",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "AdobeGCInvoker_7d7752",
      "component": "dist.lua",
      "role": "Alternative conditional persistence task name, not an observed victim task",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "OneDriveStandaloneUpdater_7d7752",
      "component": "dist.lua",
      "role": "Alternative conditional persistence task name, not an observed victim task",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "CCleanerSkipUAC_7d7752",
      "component": "dist.lua",
      "role": "Alternative conditional persistence task name, not an observed victim task",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "user_agent",
      "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36",
      "component": "dist.lua",
      "role": "HTTP client user agent; correlate with other evidence",
      "origin": "decoded_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "multipart_boundary",
      "value": "wutkehhuby8s7czym3rucktldq5u1mg7001yj",
      "component": "dist.lua",
      "role": "Fixed registration boundary",
      "origin": "decoded_from_sample",
      "specificity": "high"
    },
    {
      "type": "multipart_filename",
      "value": "afxl9eykp0vov318p2ausjmzmrthxi5wjkwbu9hquhmvdeurkjykjkahsjzk8qk09omgzcjv0jgnb8ac",
      "component": "dist.lua",
      "role": "Screenshot upload-part label; not a confirmed on-disk filename",
      "origin": "decoded_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\Programs\\nodejs\\node.exe",
      "component": "task838_destination",
      "role": "Task-derived destination",
      "origin": "derived_from_sample_and_recovered_task",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%TEMP%\\2b2c015378223437",
      "component": "task838_marker",
      "role": "Empty task marker created before payload execution",
      "origin": "derived_from_sample_and_recovered_task",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%TEMP%\\212a1642782b3933",
      "component": "task840_marker",
      "role": "Empty task marker created before payload execution",
      "origin": "derived_from_sample_and_recovered_task",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%TEMP%\\dist.lua",
      "component": "task 840",
      "role": "Second Lua destination selected by server",
      "origin": "recovered_task_response",
      "specificity": "context_required"
    },
    {
      "type": "command_line",
      "value": "lua51.exe rest.txt",
      "component": "original launch",
      "role": "Contents of the batch launcher after start",
      "origin": "saved_archive_member",
      "specificity": "context_required"
    },
    {
      "type": "command_line_pattern",
      "value": "\"<current Lua interpreter>\" \"%TEMP%\\dist.lua\"",
      "component": "task 840",
      "role": "Interpreter path can change after persistence copy",
      "origin": "static_launch_branch",
      "specificity": "context_required"
    },
    {
      "type": "command_line",
      "value": "\"%LOCALAPPDATA%\\Programs\\nodejs\\node.exe\" \"NTE3YjdjNWU1NjYzNjU2YTA1N2Y=\"",
      "component": "task 838",
      "role": "Recovered executable launch path and route-token argument",
      "origin": "static_launch_branch_and_task",
      "specificity": "high"
    },
    {
      "type": "task_id",
      "value": "840",
      "component": "first handoff",
      "role": "Server-issued task for cd.txt / dist.lua",
      "origin": "recovered_task_response",
      "specificity": "context_required"
    },
    {
      "type": "task_id",
      "value": "838",
      "component": "second handoff",
      "role": "Server-issued task for ip.txt / node.exe",
      "origin": "recovered_task_response",
      "specificity": "context_required"
    },
    {
      "type": "response_xor_key",
      "value": "tl@5gfx1$2x1ZzP#",
      "component": "both captured task responses",
      "role": "Recovered response-field key differs from the embedded Lua key; an analysis/decryption aid",
      "origin": "offline_reconstruction",
      "specificity": "context_required"
    },
    {
      "type": "aes_key",
      "value": "w9TfQVxbmvFGsGhKDBoCMEUAAeyZLvs3",
      "component": "node.exe wrapper",
      "role": "AES-256-ECB key for the embedded resource; an analysis/decryption aid",
      "origin": "reconstructed_from_wrapper_constants",
      "specificity": "context_required"
    },
    {
      "type": "rc4_key",
      "value": "MUdKjf9c8jzn5iJhFE",
      "component": "inner infostealer",
      "role": "Static string-decryption key; distinct from network key",
      "origin": "reconstructed_from_inner_payload",
      "specificity": "context_required"
    },
    {
      "type": "rc4_key",
      "value": "9S2C1bqN4XmuXPCvczHpRq",
      "component": "native collector",
      "role": "Network JSON encoding key; an analysis/decryption aid, not a user credential",
      "origin": "reconstructed_from_inner_payload_and_validated_protocol",
      "specificity": "context_required"
    },
    {
      "type": "collector_request_type",
      "value": "create",
      "component": "native collector",
      "role": "JSON type field inside Base64(RC4(JSON)); correlate with collector endpoint",
      "origin": "static_code_and_synthetic_exchange",
      "specificity": "context_required"
    },
    {
      "type": "collector_request_type",
      "value": "upload_file",
      "component": "native collector",
      "role": "JSON type field inside Base64(RC4(JSON)); correlate with collector endpoint",
      "origin": "static_code_and_synthetic_exchange",
      "specificity": "context_required"
    },
    {
      "type": "collector_request_type",
      "value": "done",
      "component": "native collector",
      "role": "JSON type field inside Base64(RC4(JSON)); correlate with collector endpoint",
      "origin": "static_code_and_synthetic_exchange",
      "specificity": "context_required"
    },
    {
      "type": "collector_request_type",
      "value": "loader",
      "component": "native collector",
      "role": "JSON type field inside Base64(RC4(JSON)); correlate with collector endpoint",
      "origin": "static_code_and_synthetic_exchange",
      "specificity": "context_required"
    },
    {
      "type": "http_path",
      "value": "/",
      "component": "native collector",
      "role": "Observed collector POST endpoint on 144.31.57.121",
      "origin": "static_code_and_synthetic_exchange",
      "specificity": "context_required"
    },
    {
      "type": "related_sha256",
      "value": "eee2d8effc5b0be997f93f1568ba228b997cd6c1cc59da635a862ad155dd1f59",
      "component": "register_codex_v3.1.zip",
      "role": "External SmartLoader-labeled archive containing identical rest.txt; not the analyzed OnionClaw ZIP",
      "origin": "MalwareBazaar_primary_record",
      "specificity": "reference_only"
    }
  ],
  "interpretation": [
    "Historical sample/response indicators; no current infrastructure availability or ownership assertion.",
    "Downloaded file possession does not establish execution or theft.",
    "LuaJIT, the short batch command, generic system paths and legitimate service hosts require surrounding evidence.",
    "Persistence, registry and Defender branches are conditional; no victim artifacts were observed.",
    "Empty task markers are created before payload execution.",
    "Task 838 requests padding: a written node.exe can differ from the recovered unpadded wrapper hash.",
    "The embedded infostealer hash describes an offline recovered PE, not a confirmed standalone dropped file.",
    "The 157-entry static inventory includes generic APIs and configuration fields, not 157 standalone malicious indicators.",
    "The collector configuration lists legitimate collection targets, not indicators that those applications are compromised.",
    "No session token, raw request, victim information, sample executable or script is published in this set."
  ],
  "host_artifacts": [
    {
      "type": "mutex",
      "value": "h73l6jwoi76f57ulqfmtwdt7kysfymvxrenk8bx1b80xve4zzml7ofpyqhyzs189mrp4u5npw9",
      "component": "rest.txt / loader 839",
      "role": "Existing mutex / GetLastError 183 causes main to return",
      "origin": "decoded_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\ODM5\\ODM5.exe",
      "component": "rest.txt / loader 839",
      "role": "Conditional persistence copy of current executable",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\ODM5\\lua51.dll",
      "component": "rest.txt / loader 839",
      "role": "Conditional copy when ffi.load(\"lua51.dll\") succeeds",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\ODM5\\<script-or-DLL filename>",
      "component": "rest.txt / loader 839",
      "role": "Companion script/DLL path preserved under Base64(loaderId) directory",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "<Documents>\\<MachineGuid>.json",
      "component": "rest.txt / loader 839",
      "role": "Outer server response cache, written before loader/tasks decoding; used when live response is nil",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "file_path",
      "value": "%TEMP%\\<lowercase_hex(repeating_XOR(task_basename_plus_extension, key))>",
      "component": "rest.txt / loader 839",
      "role": "Empty task marker. Existing marker skips task unless task.relaunch==1. Created after decoded download, before payload processing/execution",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "file_path",
      "value": "<Root|Temp|AppData|Desktop>\\<task.file_name>",
      "component": "rest.txt / loader 839",
      "role": "Task output derived from selected base directory and server filename; path may contain subdirectories",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "file_path",
      "value": "C:\\Windows\\Setup\\Scripts\\ErrorHandler.cmd",
      "component": "rest.txt / loader 839",
      "role": "Conditional script containing a start/min cmd launch; requires relevant path/permissions",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "registry_path",
      "value": "HKLM\\Software\\Microsoft\\Cryptography\\MachineGuid",
      "component": "rest.txt / loader 839",
      "role": "Read machine identifier",
      "origin": "assembled_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "registry_path",
      "value": "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "component": "rest.txt / loader 839",
      "role": "Conditional autorun values based on executable basename",
      "origin": "assembled_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "registry_path",
      "value": "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run",
      "component": "rest.txt / loader 839",
      "role": "Associated approval value; desired REG_BINARY starts 02 then eleven zero bytes",
      "origin": "assembled_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "scheduled_task_name",
      "value": "AdobeCreativeCloud_ODM5",
      "component": "rest.txt / loader 839",
      "role": "Derived loader persistence task name: selected prefix + underscore + Base64(839)",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "CloudDrive_ODM5",
      "component": "rest.txt / loader 839",
      "role": "Derived loader persistence task name: selected prefix + underscore + Base64(839)",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "AudioManager_ODM5",
      "component": "rest.txt / loader 839",
      "role": "Derived loader persistence task name: selected prefix + underscore + Base64(839)",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "TaskScheduler_ODM5",
      "component": "rest.txt / loader 839",
      "role": "Derived loader persistence task name: selected prefix + underscore + Base64(839)",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "Setup",
      "component": "rest.txt / loader 839",
      "role": "Conditional highest-privilege task for Windows Setup.exe",
      "origin": "extracted_from_decoded_command",
      "specificity": "context_required"
    },
    {
      "type": "scheduled_task_name",
      "value": "<current executable or task output filename without extension>",
      "component": "rest.txt / loader 839",
      "role": "Other conditional task names are derived from filenames; no fixed malicious name",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "defender_command_fragment",
      "value": "Add-MpPreference -ExclusionPath $env:SystemDrive -ExclusionExtension .exe, .dll -Force",
      "component": "rest.txt / loader 839",
      "role": "loader.bypass_defender==1 requests runAs elevation; success not established",
      "origin": "extracted_from_decoded_command",
      "specificity": "high"
    },
    {
      "type": "mutex",
      "value": "5m9gr3w9a1jb3hvgth99giq6qxt73mr4wid7z34k7i3wf0u",
      "component": "dist.lua",
      "role": "Second loader's named mutex",
      "origin": "decoded_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\7d7752\\7d7752.exe",
      "component": "dist.lua",
      "role": "Conditional copied-interpreter persistence path",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\7d7752\\lua51.dll",
      "component": "dist.lua",
      "role": "Conditional companion copy; filename depends on launch mode and DLL-load success",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\7d7752\\<script-or-DLL filename>",
      "component": "dist.lua",
      "role": "Conditional companion copy; filename depends on launch mode and DLL-load success",
      "origin": "derived_from_sample",
      "specificity": "context_required"
    },
    {
      "type": "scheduled_task_name",
      "value": "OfficeClickToRunTask_7d7752",
      "component": "dist.lua",
      "role": "Alternative conditional persistence task name, not an observed victim task",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "AdobeGCInvoker_7d7752",
      "component": "dist.lua",
      "role": "Alternative conditional persistence task name, not an observed victim task",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "OneDriveStandaloneUpdater_7d7752",
      "component": "dist.lua",
      "role": "Alternative conditional persistence task name, not an observed victim task",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "scheduled_task_name",
      "value": "CCleanerSkipUAC_7d7752",
      "component": "dist.lua",
      "role": "Alternative conditional persistence task name, not an observed victim task",
      "origin": "derived_from_sample",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%LOCALAPPDATA%\\Programs\\nodejs\\node.exe",
      "component": "task838_destination",
      "role": "Task-derived destination",
      "origin": "derived_from_sample_and_recovered_task",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%TEMP%\\2b2c015378223437",
      "component": "task838_marker",
      "role": "Empty task marker created before payload execution",
      "origin": "derived_from_sample_and_recovered_task",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%TEMP%\\212a1642782b3933",
      "component": "task840_marker",
      "role": "Empty task marker created before payload execution",
      "origin": "derived_from_sample_and_recovered_task",
      "specificity": "high"
    },
    {
      "type": "file_path",
      "value": "%TEMP%\\dist.lua",
      "component": "task 840",
      "role": "Second Lua destination selected by server",
      "origin": "recovered_task_response",
      "specificity": "context_required"
    },
    {
      "type": "command_line",
      "value": "lua51.exe rest.txt",
      "component": "original launch",
      "role": "Contents of the batch launcher after start",
      "origin": "saved_archive_member",
      "specificity": "context_required"
    },
    {
      "type": "command_line_pattern",
      "value": "\"<current Lua interpreter>\" \"%TEMP%\\dist.lua\"",
      "component": "task 840",
      "role": "Interpreter path can change after persistence copy",
      "origin": "static_launch_branch",
      "specificity": "context_required"
    },
    {
      "type": "command_line",
      "value": "\"%LOCALAPPDATA%\\Programs\\nodejs\\node.exe\" \"NTE3YjdjNWU1NjYzNjU2YTA1N2Y=\"",
      "component": "task 838",
      "role": "Recovered executable launch path and route-token argument",
      "origin": "static_launch_branch_and_task",
      "specificity": "high"
    }
  ]
}