{
    "type": "bundle",
    "id": "bundle--19210fb6-bfa8-47f8-8163-7b787ff8320f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--bda7b4c4-9ad7-4780-8746-936e4977287c",
            "created": "2023-03-08T12:51:42.035297Z",
            "modified": "2023-03-10T04:33:44.753605Z",
            "name": "KRNCSC",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5e49e6e3-1881-48cd-b8dc-8497e9cf0cc5",
            "created": "2026-06-25T00:02:04.246631Z",
            "modified": "2026-06-25T00:02:04.246631Z",
            "name": "YARA Rule",
            "pattern": "rule operation_DREAMJOB_AMAZON_VNC { meta:\r\ntarget_entity = \u201cfile\u201d condition:\r\nfor any vt_behaviour_command_executions in vt.behaviour.command_executions:\r\n( vt_behaviour_command_executions ==\r\n\u201cC:\\\\Windows\\\\System32\\\\wuapihost.exe-Embedding\u201d or\r\nvt_behaviour_command_executions == \u201c\\\u201d%SAMPLEPATH%\\\\AmazonVNC Viewer.exe\\\u201d \u201c)\r\nand\r\nfor any vt_behaviour_http_conversations in vt.behaviour.http_conversations: (\r\nvt_behaviour_http_conversations.url == https://sifucanva.com/wp- includes/fonts/public/common.php)\r\n}",
            "pattern_type": "yara",
            "valid_from": "2024-02-19T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--88412474-be43-4f19-8299-e12b67d8de35",
            "hashes": {
                "MD5": "47999fa014b6cc5a2a71be590c938303"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f7322d77-a827-4f8b-b055-fd21359d290c",
            "hashes": {
                "MD5": "71e259242dfdba7ffa2698f1900919ec"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a3b0afdf-c0b0-417b-a95e-2e99b3833669",
            "hashes": {
                "MD5": "4631ef8db9c36b0f2534ac7193f2587e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--afb48173-777e-437b-9338-d5a06e4d7de3",
            "hashes": {
                "SHA-1": "ac9021eb798de8323702a5aeb7c590f1ebaa3786"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8f90004b-b422-4a84-aafc-e002055ccd19",
            "hashes": {
                "MD5": "f3482a38befdcd7d0b87d86f24cdb209"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cfb26fb3-2381-486b-a11d-04bafcef8d2f",
            "hashes": {
                "MD5": "028bd8471baa6610548fb721086f5b85"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1356da3e-c76c-41d4-972d-d80b95117de3",
            "hashes": {
                "SHA-1": "7da62cdb447a7ae3ae7b5f67a511e7cf2b26c7df"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5a1b2e6e-ed79-4182-b37d-145c4fc8639f",
            "hashes": {
                "SHA-1": "2e0d374f1e706ae1fa24558b54c5a1630302eab1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--83e5afca-cdd1-4a5b-95e6-abdac318a88c",
            "hashes": {
                "SHA-1": "7906270679014234b70aa63dd89e8282a945919c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7800a23c-9704-4b25-8758-67180f193126",
            "hashes": {
                "MD5": "607a2a8d2863c3144b8e901a16a76c33"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3d08b1ae-fc30-47a9-8952-297da98d6730",
            "hashes": {
                "SHA-1": "7b4d0d8e3bfcd634bc7d7a17fb546b7e8316a681"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--42668d42-d356-40b8-a439-82ba3c271081",
            "hashes": {
                "MD5": "3c2aa3687ac9f466ce909e2cb12b07a5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--22abf967-99d0-4d27-a803-4f7783521cd1",
            "hashes": {
                "SHA-1": "d5c8edb84e4ff33aea8865676ffe801ff0a71701"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a11bcba6-f51e-432f-be73-bbeb75dab818",
            "hashes": {
                "SHA-1": "3bc8acdd07c6d91652101d9c8b3326bee372a007"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2a928097-4db5-429f-b01e-0cd92987b744",
            "hashes": {
                "SHA-1": "294706ae0585abaf4e6c5e66a7f5141ac4281d57"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--788da83b-0d79-44c7-acc8-23a1c0d0c43b",
            "hashes": {
                "SHA-1": "127ced578e041f53b5988a7fefaa6e09e64f4bf9"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--093c2fe9-1dec-4e9b-a7a8-3544221e32bf",
            "value": "https://sifucanva.com/wp-"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--5962dd3f-f31b-400e-9d1d-36133632da3b",
            "value": "chrysalisc.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2913caa0-5bf2-4826-baec-1bbff6213a63",
            "value": "sifucanva.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4c5c529b-6708-4ac7-a7fa-2920641f458e",
            "value": "connection.lockscreen.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e4c76be4-f2ee-4c83-93bb-c954cb15ecc3",
            "value": "updating.dothome.co.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--04799e21-ee89-4911-99dc-95b82940df6a",
            "value": "job4writers.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2fa7616e-032a-4b81-b4cd-db178a0cd30b",
            "value": "rginfotechnology.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--cf09a960-fea3-4d9a-af90-c2824be78ede",
            "value": "thefrostery.co.uk"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--7270c396-75ad-40fc-a964-367dc8d1e963",
            "created_by_ref": "identity--bda7b4c4-9ad7-4780-8746-936e4977287c",
            "created": "2026-06-25T00:02:04.278486Z",
            "modified": "2026-06-25T00:02:04.278486Z",
            "name": "\u97d3\u7368 \ud569\ub3d9 \uc0ac\uc774\ubc84 \ubcf4\uc548 \uad8c\uace0\ubb38(\u5317 \ubc29\uc0b0\ubd84\uc57c \ud574\ud0b9)",
            "published": "2024-02-19T00:00:00Z",
            "object_refs": [
                "identity--bda7b4c4-9ad7-4780-8746-936e4977287c",
                "indicator--5e49e6e3-1881-48cd-b8dc-8497e9cf0cc5",
                "file--88412474-be43-4f19-8299-e12b67d8de35",
                "file--f7322d77-a827-4f8b-b055-fd21359d290c",
                "file--a3b0afdf-c0b0-417b-a95e-2e99b3833669",
                "file--afb48173-777e-437b-9338-d5a06e4d7de3",
                "file--8f90004b-b422-4a84-aafc-e002055ccd19",
                "file--cfb26fb3-2381-486b-a11d-04bafcef8d2f",
                "file--1356da3e-c76c-41d4-972d-d80b95117de3",
                "file--5a1b2e6e-ed79-4182-b37d-145c4fc8639f",
                "file--83e5afca-cdd1-4a5b-95e6-abdac318a88c",
                "file--7800a23c-9704-4b25-8758-67180f193126",
                "file--3d08b1ae-fc30-47a9-8952-297da98d6730",
                "file--42668d42-d356-40b8-a439-82ba3c271081",
                "file--22abf967-99d0-4d27-a803-4f7783521cd1",
                "file--a11bcba6-f51e-432f-be73-bbeb75dab818",
                "file--2a928097-4db5-429f-b01e-0cd92987b744",
                "file--788da83b-0d79-44c7-acc8-23a1c0d0c43b",
                "url--093c2fe9-1dec-4e9b-a7a8-3544221e32bf",
                "domain-name--5962dd3f-f31b-400e-9d1d-36133632da3b",
                "domain-name--2913caa0-5bf2-4826-baec-1bbff6213a63",
                "domain-name--4c5c529b-6708-4ac7-a7fa-2920641f458e",
                "domain-name--e4c76be4-f2ee-4c83-93bb-c954cb15ecc3",
                "domain-name--04799e21-ee89-4911-99dc-95b82940df6a",
                "domain-name--2fa7616e-032a-4b81-b4cd-db178a0cd30b",
                "domain-name--cf09a960-fea3-4d9a-af90-c2824be78ede"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.ncsc.go.kr:4018/main/cop/bbs/selectBoardArticle.do?bbsId=SecurityAdvice_main&nttId=118726&menuNo=020000&subMenuNo=020200&thirdMenuNo="
                }
            ]
        }
    ]
}