{"type":"bundle","id":"bundle--fb17adff-1351-4229-bb1c-2876dc0caf97","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f9381c8d-52ae-4e16-a879-35728b70e710","created":"2026-09-16T09:08:03.132Z","modified":"2026-09-16T09:08:03.132Z","name":"ZeroHour","identity_class":"system","description":"Indicators auto-extracted from public security reporting. Verify before use."},{"type":"indicator","spec_version":"2.1","id":"indicator--e033df8b-58e4-4437-aa4b-2aca13642254","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T09:08:03.132Z","created_by_ref":"identity--f9381c8d-52ae-4e16-a879-35728b70e710","name":"sha256: 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: s of compromise (IoCs):- Type Indicator Description SHA-256 106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42 KREMLIN JavaScript loader sample SHA-256 5ece7fd3766b0b7f8a","pattern":"[file:hashes.'SHA-256' = '106eac79396a3ff77b8f375c391260ce422be2ae4d55d3aa75b2635cbdc0fa42']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff3bf733-6971-4d52-8ddf-440c98638833","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T09:08:03.132Z","created_by_ref":"identity--f9381c8d-52ae-4e16-a879-35728b70e710","name":"sha256: 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: 70e83abba66ee07bcecea0 Related Wave B loader sample SHA-256 170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c Related Wave C loader sample SHA-256 42a3e2bb135fb46b11b127","pattern":"[file:hashes.'SHA-256' = '170dffb37e05f525f735bc9ad84b3908a488f7ce43fcb07739a10e4331e15a2c']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6062434c-1821-4fb3-8842-943e1e4ac57b","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T09:08:03.132Z","created_by_ref":"identity--f9381c8d-52ae-4e16-a879-35728b70e710","name":"sha256: 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: 81bdd66a4268 KREMLIN x64 extension installer binary SHA-256 223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca Malicious AVSync extension sample SHA-256 ba80216c960977fa4","pattern":"[file:hashes.'SHA-256' = '223be3f8648bf6998c4a58b972522e5fda8d9d0a57b4e163811930de66c3f7ca']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2fefef0-cf91-43c8-a4d2-f3ef1de03dd4","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T09:08:03.132Z","created_by_ref":"identity--f9381c8d-52ae-4e16-a879-35728b70e710","name":"sha256: 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: fcb07739a10e4331e15a2c Related Wave C loader sample SHA-256 42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9 PowerShell extension-installer implementation Domain connec","pattern":"[file:hashes.'SHA-256' = '42a3e2bb135fb46b11b127f45a266b3a4d9dff4aa1cf75433f93fe69ba51a9b9']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d35c68a5-10a6-4834-8768-1e110ac14935","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T09:08:03.132Z","created_by_ref":"identity--f9381c8d-52ae-4e16-a879-35728b70e710","name":"sha256: 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: aa75b2635cbdc0fa42 KREMLIN JavaScript loader sample SHA-256 5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552 First-stage popup JavaScript sample SHA-256 c8c38634dd44d7c","pattern":"[file:hashes.'SHA-256' = '5ece7fd3766b0b7f8aadefa562313cea6c3c94f9398658dd389910e5be44f552']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c8b1096-4816-48d6-afa2-f10b15ad1907","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T09:08:03.132Z","created_by_ref":"identity--f9381c8d-52ae-4e16-a879-35728b70e710","name":"sha256: ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: 3811930de66c3f7ca Malicious AVSync extension sample SHA-256 ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f Related Wave A loader sample SHA-256 cb15cbf3f01a92e609e4c2","pattern":"[file:hashes.'SHA-256' = 'ba80216c960977fa45e317f00dcf31e96acab29904a737cbc0bf86e929c3be5f']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f5e1731-58cb-40de-a659-26cb0516b284","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T09:08:03.132Z","created_by_ref":"identity--f9381c8d-52ae-4e16-a879-35728b70e710","name":"sha256: c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: 89910e5be44f552 First-stage popup JavaScript sample SHA-256 c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268 KREMLIN x64 extension installer binary SHA-256 223be3f8648b","pattern":"[file:hashes.'SHA-256' = 'c8c38634dd44d7c6162c66174a6ee23ee404265125166e8d757681bdd66a4268']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2a6df5e-a4c5-4846-be3f-3c67e78189bd","created":"2026-09-16T08:12:32.000Z","modified":"2026-09-16T09:08:03.132Z","created_by_ref":"identity--f9381c8d-52ae-4e16-a879-35728b70e710","name":"sha256: cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0","description":"Seen in \"KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension\" (Cyber Security News). Context: a737cbc0bf86e929c3be5f Related Wave A loader sample SHA-256 cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0 Related Wave B loader sample SHA-256 170dffb37e05f525f735bc","pattern":"[file:hashes.'SHA-256' = 'cb15cbf3f01a92e609e4c2bc26155e667e96c5d04770e83abba66ee07bcecea0']","pattern_type":"stix","valid_from":"2026-09-16T08:12:32.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/kremlin-banking-malware/"}]}]}