{
  "type": "SHA256",
  "indicator": "e450152d8dd9f7d2d92dbd53461a38ee8f154b69b2558ed43b5d3f603a43240a",
  "general": {
    "sections": [
      "general",
      "analysis"
    ],
    "type": "sha256",
    "type_title": "FileHash-SHA256",
    "indicator": "e450152d8dd9f7d2d92dbd53461a38ee8f154b69b2558ed43b5d3f603a43240a",
    "validation": [],
    "base_indicator": {
      "id": 4327464298,
      "indicator": "e450152d8dd9f7d2d92dbd53461a38ee8f154b69b2558ed43b5d3f603a43240a",
      "type": "FileHash-SHA256",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "69f32d843b6570c22f6059eb",
          "name": "EbeeApril2026 Pt8",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-05-30T10:03:42.474000",
          "created": "2026-04-30T10:23:00.416000",
          "tags": [
            "filehashsha256",
            "filehashmd5",
            "filehashsha1",
            "yara",
            "filepath",
            "cve20221388 url",
            "cve20151770 cve",
            "client"
          ],
          "references": [
            "IOCs.2026.csv"
          ],
          "public": 1,
          "adversary": "Trigona, SHub Stealer v2.0, Malicious Compiled HTML Help File, Vidar",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 95,
            "FileHash-MD5": 163,
            "FileHash-SHA1": 147,
            "FileHash-SHA256": 290,
            "CIDR": 1,
            "CVE": 12,
            "SSLCertFingerprint": 1,
            "domain": 90,
            "email": 2,
            "hostname": 116
          },
          "indicator_count": 917,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 40,
          "modified_text": "10 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-SHA256",
          "related_indicator_is_active": 1
        },
        {
          "id": "69f295c1c348d8af6f43cf73",
          "name": "ibcart",
          "description": "The full text of the text message sent to the BBC's Deepanshugoel99 website has now been published online, and it is the first time it has done so in the UK.",
          "modified": "2026-05-29T23:35:16.304000",
          "created": "2026-04-29T23:35:29.332000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "harshandc123",
            "id": "378589",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 100,
            "FileHash-SHA1": 100,
            "FileHash-SHA256": 149,
            "URL": 6,
            "domain": 6,
            "hostname": 4
          },
          "indicator_count": 365,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 15,
          "modified_text": "21 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-SHA256",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ee2a4a994a8a31bb6c5bbc",
          "name": "Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC.",
          "description": "A recent investigation revealed a malicious campaign leveraging fake GitHub repositories to distribute malware, specifically a LuaJIT-based loader known as SmartLoader, alongside a data-stealing payload called StealC. This campaign involved 109 malicious repositories across 103 accounts that impersonate popular open-source projects. Users are redirected to ZIP files containing the SmartLoader which is executed via a LuaJIT interpreter.",
          "modified": "2026-05-26T15:00:59.832000",
          "created": "2026-04-26T15:07:54.683000",
          "tags": [
            "github",
            "smartloader",
            "lua stage",
            "readme",
            "lua script",
            "luajit",
            "zip file",
            "polygon smart",
            "post",
            "lua runtime",
            "stealc",
            "prometheus",
            "look",
            "lua",
            "smartloader lua"
          ],
          "references": [
            "https://hexastrike.com/resources/blog/threat-intelligence/cloned-loaded-and-stolen-how-109-fake-github-repositories-delivered-smartloader-and-stealc/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "StealC",
              "display_name": "StealC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [
            "Finance"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 25,
            "FileHash-SHA1": 25,
            "FileHash-SHA256": 74,
            "URL": 2
          },
          "indicator_count": 126,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 541,
          "modified_text": "4 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-SHA256",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ecae6a156da44db667be66",
          "name": "imvfeoirewIVONVCIDJCJCW",
          "description": "",
          "modified": "2026-05-25T12:11:06.214000",
          "created": "2026-04-25T12:07:06.437000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "MohammedRizwan2001",
            "id": "361933",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 508,
            "FileHash-MD5": 100,
            "FileHash-SHA1": 100,
            "FileHash-SHA256": 187,
            "domain": 17,
            "hostname": 159
          },
          "indicator_count": 1071,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 21,
          "modified_text": "5 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-SHA256",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a0fc31ec62e1e6423184661",
          "name": "109 Fake GitHub Repositories Used to Deliver SmartLoader and StealC Malware",
          "description": "",
          "modified": "2026-05-22T02:44:46.085000",
          "created": "2026-05-22T02:44:46.085000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Cherryid",
            "id": "383941",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 5,
            "FileHash-SHA1": 5,
            "FileHash-SHA256": 5,
            "IPv4": 2,
            "hostname": 1
          },
          "indicator_count": 18,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 21,
          "modified_text": "8 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-SHA256",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IOCs.2026.csv",
        "https://hexastrike.com/resources/blog/threat-intelligence/cloned-loaded-and-stolen-how-109-fake-github-repositories-delivered-smartloader-and-stealc/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "Trigona, SHub Stealer v2.0, Malicious Compiled HTML Help File, Vidar"
          ],
          "malware_families": [
            "Stealc"
          ],
          "industries": [
            "Finance"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "69f32d843b6570c22f6059eb",
      "name": "EbeeApril2026 Pt8",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-05-30T10:03:42.474000",
      "created": "2026-04-30T10:23:00.416000",
      "tags": [
        "filehashsha256",
        "filehashmd5",
        "filehashsha1",
        "yara",
        "filepath",
        "cve20221388 url",
        "cve20151770 cve",
        "client"
      ],
      "references": [
        "IOCs.2026.csv"
      ],
      "public": 1,
      "adversary": "Trigona, SHub Stealer v2.0, Malicious Compiled HTML Help File, Vidar",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 95,
        "FileHash-MD5": 163,
        "FileHash-SHA1": 147,
        "FileHash-SHA256": 290,
        "CIDR": 1,
        "CVE": 12,
        "SSLCertFingerprint": 1,
        "domain": 90,
        "email": 2,
        "hostname": 116
      },
      "indicator_count": 917,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 40,
      "modified_text": "10 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-SHA256",
      "related_indicator_is_active": 1
    },
    {
      "id": "69f295c1c348d8af6f43cf73",
      "name": "ibcart",
      "description": "The full text of the text message sent to the BBC's Deepanshugoel99 website has now been published online, and it is the first time it has done so in the UK.",
      "modified": "2026-05-29T23:35:16.304000",
      "created": "2026-04-29T23:35:29.332000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "harshandc123",
        "id": "378589",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 100,
        "FileHash-SHA1": 100,
        "FileHash-SHA256": 149,
        "URL": 6,
        "domain": 6,
        "hostname": 4
      },
      "indicator_count": 365,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 15,
      "modified_text": "21 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-SHA256",
      "related_indicator_is_active": 1
    },
    {
      "id": "69ee2a4a994a8a31bb6c5bbc",
      "name": "Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC.",
      "description": "A recent investigation revealed a malicious campaign leveraging fake GitHub repositories to distribute malware, specifically a LuaJIT-based loader known as SmartLoader, alongside a data-stealing payload called StealC. This campaign involved 109 malicious repositories across 103 accounts that impersonate popular open-source projects. Users are redirected to ZIP files containing the SmartLoader which is executed via a LuaJIT interpreter.",
      "modified": "2026-05-26T15:00:59.832000",
      "created": "2026-04-26T15:07:54.683000",
      "tags": [
        "github",
        "smartloader",
        "lua stage",
        "readme",
        "lua script",
        "luajit",
        "zip file",
        "polygon smart",
        "post",
        "lua runtime",
        "stealc",
        "prometheus",
        "look",
        "lua",
        "smartloader lua"
      ],
      "references": [
        "https://hexastrike.com/resources/blog/threat-intelligence/cloned-loaded-and-stolen-how-109-fake-github-repositories-delivered-smartloader-and-stealc/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "StealC",
          "display_name": "StealC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [
        "Finance"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 25,
        "FileHash-SHA1": 25,
        "FileHash-SHA256": 74,
        "URL": 2
      },
      "indicator_count": 126,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 541,
      "modified_text": "4 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-SHA256",
      "related_indicator_is_active": 1
    },
    {
      "id": "69ecae6a156da44db667be66",
      "name": "imvfeoirewIVONVCIDJCJCW",
      "description": "",
      "modified": "2026-05-25T12:11:06.214000",
      "created": "2026-04-25T12:07:06.437000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "MohammedRizwan2001",
        "id": "361933",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 508,
        "FileHash-MD5": 100,
        "FileHash-SHA1": 100,
        "FileHash-SHA256": 187,
        "domain": 17,
        "hostname": 159
      },
      "indicator_count": 1071,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 21,
      "modified_text": "5 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-SHA256",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a0fc31ec62e1e6423184661",
      "name": "109 Fake GitHub Repositories Used to Deliver SmartLoader and StealC Malware",
      "description": "",
      "modified": "2026-05-22T02:44:46.085000",
      "created": "2026-05-22T02:44:46.085000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Cherryid",
        "id": "383941",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 5,
        "FileHash-SHA1": 5,
        "FileHash-SHA256": 5,
        "IPv4": 2,
        "hostname": 1
      },
      "indicator_count": 18,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 21,
      "modified_text": "8 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-SHA256",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "e450152d8dd9f7d2d92dbd53461a38ee8f154b69b2558ed43b5d3f603a43240a",
    "type": "Hash"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "e450152d8dd9f7d2d92dbd53461a38ee8f154b69b2558ed43b5d3f603a43240a",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780173336.5509174
}