{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:IX7CJFV3ZFC5Q2RADO66VK26SQ","short_pith_number":"pith:IX7CJFV3","canonical_record":{"source":{"id":"2505.21725","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-27T20:13:29Z","cross_cats_sorted":["cs.OS"],"title_canon_sha256":"459c71bda9fadc559c47c1add52dc7177c0bf298c9a2b78b7aeb09838b111f7a","abstract_canon_sha256":"4f67be69177e189a4eb66aa72a6ec3b141f7777ecc969d9e9f22f9a73739905d"},"schema_version":"1.0"},"canonical_sha256":"45fe2496bbc945d86a201bbdeaab5e94015ed9542ebca4dc528313926f88b020","source":{"kind":"arxiv","id":"2505.21725","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.21725","created_at":"2026-07-05T11:29:34Z"},{"alias_kind":"arxiv_version","alias_value":"2505.21725v2","created_at":"2026-07-05T11:29:34Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.21725","created_at":"2026-07-05T11:29:34Z"},{"alias_kind":"pith_short_12","alias_value":"IX7CJFV3ZFC5","created_at":"2026-07-05T11:29:34Z"},{"alias_kind":"pith_short_16","alias_value":"IX7CJFV3ZFC5Q2RA","created_at":"2026-07-05T11:29:34Z"},{"alias_kind":"pith_short_8","alias_value":"IX7CJFV3","created_at":"2026-07-05T11:29:34Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:IX7CJFV3ZFC5Q2RADO66VK26SQ","target":"record","payload":{"canonical_record":{"source":{"id":"2505.21725","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-27T20:13:29Z","cross_cats_sorted":["cs.OS"],"title_canon_sha256":"459c71bda9fadc559c47c1add52dc7177c0bf298c9a2b78b7aeb09838b111f7a","abstract_canon_sha256":"4f67be69177e189a4eb66aa72a6ec3b141f7777ecc969d9e9f22f9a73739905d"},"schema_version":"1.0"},"canonical_sha256":"45fe2496bbc945d86a201bbdeaab5e94015ed9542ebca4dc528313926f88b020","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:29:34.748226Z","signature_b64":"xdzIWU4rJEb/eISRYWSCJzdEn7JfL2MJYyZ1TYNOY6wvTAmnStXJ8h/fzWGSr2eYZHswd48qTgfCz2JPtR4mDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"45fe2496bbc945d86a201bbdeaab5e94015ed9542ebca4dc528313926f88b020","last_reissued_at":"2026-07-05T11:29:34.747515Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:29:34.747515Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2505.21725","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:29:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"dCIlcKtVMUONnVQeoEb6rXnsua6RmXDNoIHaHAD+7dwDQRkjIn+AbrDo5Z49n2yPXAakxuMSiknRihM11NTJBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T09:39:18.504230Z"},"content_sha256":"72914ee87014153c652e78567b2ff02a2d4552ee5843624bc763fcd954bff35e","schema_version":"1.0","event_id":"sha256:72914ee87014153c652e78567b2ff02a2d4552ee5843624bc763fcd954bff35e"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:IX7CJFV3ZFC5Q2RADO66VK26SQ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Lazarus Group Targets Crypto-Wallets and Financial Data while employing new Tradecrafts","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.OS"],"primary_cat":"cs.CR","authors_text":"Alessio Di Santo","submitted_at":"2025-05-27T20:13:29Z","abstract_excerpt":"This report presents a comprehensive analysis of a malicious software sample, detailing its architecture, behavioral characteristics, and underlying intent. Through static and dynamic examination, the malware core functionalities, including persistence mechanisms, command-and-control communication, and data exfiltration routines, are identified and its supporting infrastructure is mapped. By correlating observed indicators of compromise with known techniques, tactics, and procedures, this analysis situates the sample within the broader context of contemporary threat campaigns and infers the ca"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.21725","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2505.21725/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:29:34Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ahg3mVuH2kneuZv36NMLDKaXMWtQIVcFP9L+t1j8mDFq/GI6QxJrnp6kinaRA+BZy3qoh0x7BOqBzVe901iBAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-08T09:39:18.504783Z"},"content_sha256":"9d66ccaf319e5f1d4f4ea63da73523f1c65347673a9635afa2d83ea2af34b1c8","schema_version":"1.0","event_id":"sha256:9d66ccaf319e5f1d4f4ea63da73523f1c65347673a9635afa2d83ea2af34b1c8"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/IX7CJFV3ZFC5Q2RADO66VK26SQ/bundle.json","state_url":"https://pith.science/pith/IX7CJFV3ZFC5Q2RADO66VK26SQ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/IX7CJFV3ZFC5Q2RADO66VK26SQ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-08T09:39:18Z","links":{"resolver":"https://pith.science/pith/IX7CJFV3ZFC5Q2RADO66VK26SQ","bundle":"https://pith.science/pith/IX7CJFV3ZFC5Q2RADO66VK26SQ/bundle.json","state":"https://pith.science/pith/IX7CJFV3ZFC5Q2RADO66VK26SQ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/IX7CJFV3ZFC5Q2RADO66VK26SQ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:IX7CJFV3ZFC5Q2RADO66VK26SQ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"4f67be69177e189a4eb66aa72a6ec3b141f7777ecc969d9e9f22f9a73739905d","cross_cats_sorted":["cs.OS"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-27T20:13:29Z","title_canon_sha256":"459c71bda9fadc559c47c1add52dc7177c0bf298c9a2b78b7aeb09838b111f7a"},"schema_version":"1.0","source":{"id":"2505.21725","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.21725","created_at":"2026-07-05T11:29:34Z"},{"alias_kind":"arxiv_version","alias_value":"2505.21725v2","created_at":"2026-07-05T11:29:34Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.21725","created_at":"2026-07-05T11:29:34Z"},{"alias_kind":"pith_short_12","alias_value":"IX7CJFV3ZFC5","created_at":"2026-07-05T11:29:34Z"},{"alias_kind":"pith_short_16","alias_value":"IX7CJFV3ZFC5Q2RA","created_at":"2026-07-05T11:29:34Z"},{"alias_kind":"pith_short_8","alias_value":"IX7CJFV3","created_at":"2026-07-05T11:29:34Z"}],"graph_snapshots":[{"event_id":"sha256:9d66ccaf319e5f1d4f4ea63da73523f1c65347673a9635afa2d83ea2af34b1c8","target":"graph","created_at":"2026-07-05T11:29:34Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2505.21725/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"This report presents a comprehensive analysis of a malicious software sample, detailing its architecture, behavioral characteristics, and underlying intent. Through static and dynamic examination, the malware core functionalities, including persistence mechanisms, command-and-control communication, and data exfiltration routines, are identified and its supporting infrastructure is mapped. By correlating observed indicators of compromise with known techniques, tactics, and procedures, this analysis situates the sample within the broader context of contemporary threat campaigns and infers the ca","authors_text":"Alessio Di Santo","cross_cats":["cs.OS"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-27T20:13:29Z","title":"Lazarus Group Targets Crypto-Wallets and Financial Data while employing new Tradecrafts"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.21725","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:72914ee87014153c652e78567b2ff02a2d4552ee5843624bc763fcd954bff35e","target":"record","created_at":"2026-07-05T11:29:34Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"4f67be69177e189a4eb66aa72a6ec3b141f7777ecc969d9e9f22f9a73739905d","cross_cats_sorted":["cs.OS"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-05-27T20:13:29Z","title_canon_sha256":"459c71bda9fadc559c47c1add52dc7177c0bf298c9a2b78b7aeb09838b111f7a"},"schema_version":"1.0","source":{"id":"2505.21725","kind":"arxiv","version":2}},"canonical_sha256":"45fe2496bbc945d86a201bbdeaab5e94015ed9542ebca4dc528313926f88b020","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"45fe2496bbc945d86a201bbdeaab5e94015ed9542ebca4dc528313926f88b020","first_computed_at":"2026-07-05T11:29:34.747515Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:29:34.747515Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"xdzIWU4rJEb/eISRYWSCJzdEn7JfL2MJYyZ1TYNOY6wvTAmnStXJ8h/fzWGSr2eYZHswd48qTgfCz2JPtR4mDQ==","signature_status":"signed_v1","signed_at":"2026-07-05T11:29:34.748226Z","signed_message":"canonical_sha256_bytes"},"source_id":"2505.21725","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:72914ee87014153c652e78567b2ff02a2d4552ee5843624bc763fcd954bff35e","sha256:9d66ccaf319e5f1d4f4ea63da73523f1c65347673a9635afa2d83ea2af34b1c8"],"state_sha256":"dac1cbe8c0282c8007fc4e3e5c5f93d0a58998013142d5c66e5607924a261769"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"LHaCqDkp+dPS3uxiEemyF6rkIU1dHcsKGXwpobrA6bkC7cxk6xup2Vpy45nHp+JJ4jKRopcJFOTRbF98xVgfBQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-08T09:39:18.509546Z","bundle_sha256":"dda9a8b68b2d7a62918a6dcd41fa9438cb6596c050f1dedb72b6bbc0b047de2c"}}