{
    "type": "bundle",
    "id": "bundle--58c6a698-67a2-40b1-8f03-f86cc50b7f94",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--d6060d27-a078-4b68-808e-0f825436ce05",
            "created": "2025-02-20T01:00:01.713031Z",
            "modified": "2025-02-20T01:01:57.020342Z",
            "name": "ENKI",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f7bed63d-6475-4bce-b9e4-b2e40be59938",
            "value": "158.247.240.40"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b82d6b0c-eca3-49c9-afa8-bd6c529e33ab",
            "hashes": {
                "MD5": "6e5198c3aae9005cc58d011a8c6f0bec"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8e9c7375-ac51-4b78-83cd-b1a04f8e208f",
            "hashes": {
                "MD5": "42d24ccfb0a05c5f299181ca3afc7ae3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--523e5b8e-9463-4c57-a058-4a2c165bc9c1",
            "hashes": {
                "MD5": "ca9cb7bb06398670abc6d19186c336cd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--673693b8-09c9-41ab-84f7-48bc255e9ecf",
            "hashes": {
                "MD5": "310ebb7ca19ff9b75d4054c340b0c82e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e2cd46d9-3078-4de6-b61b-5c37b7c5ffb5",
            "hashes": {
                "MD5": "52a321e48902b8fbd1e984d9bd15f278"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b4491a29-a99d-4796-b2a6-7dd5de60559e",
            "hashes": {
                "MD5": "108b5fd1b62489fd5cdb4ebd4a463226"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--580acf51-3be1-4d97-93c6-ca09ca1e39a6",
            "hashes": {
                "SHA-1": "3a665cf99a9b7a79f4fecb77bbe2bf5ff79687e3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--888aeb34-acf5-4040-b5fa-6d3696df3797",
            "hashes": {
                "MD5": "81bfe3b3204ede1fca418e44aa19b310"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--59d08cb8-d2f6-4a5b-8e86-cc02945aa69b",
            "hashes": {
                "MD5": "f96cf8cafbaf112548f6f122d9270cca"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2ed7fe20-7eaf-4fc2-9634-0bf47c759df2",
            "hashes": {
                "SHA-256": "a872738399912091389ae9720d5e068a0ef3b7d4c42b1ff24ea864f6c85683e9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--059c02e0-5b2f-4423-8dbf-6c3adac1a5d8",
            "hashes": {
                "MD5": "a6c26a0b5df0db6a35b15c24342f27f8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8d0b3b0d-872f-4600-bd91-38173b495003",
            "hashes": {
                "SHA-1": "1dc0668a628ea91766a75c87319a23b24939c07b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8981efdd-6ede-4096-9093-1811c97d6b04",
            "hashes": {
                "MD5": "e78be07019dfaf682c601985ac3ba424"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--1342cf51-c3b5-4939-99d1-40c5d6e00633",
            "value": "147.135.109.226"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4d664b68-3ca2-4e85-a2ef-69f9e27c2019",
            "value": "95.214.54.164"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--7e77e30b-1445-4d39-9b2d-907f15752cb7",
            "value": "195.177.94.43"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--a65f5f6c-a522-4d4c-aca8-9d2e98d1252e",
            "value": "158.247.250.251"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e6aef9b5-5733-4b2e-a2b2-2584cc1974c1",
            "value": "161.248.239.119"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--14061f4a-f93a-49f3-a077-c779bedd152e",
            "value": "dhl.com"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-06-24T22:44:21.66805Z",
            "modified": "2026-06-24T22:44:21.66805Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--bdb9fd7e-e563-4cc0-b6b6-15f35ad3140a",
            "created_by_ref": "identity--d6060d27-a078-4b68-808e-0f825436ce05",
            "created": "2026-06-24T22:44:21.703235Z",
            "modified": "2026-06-24T22:44:21.703235Z",
            "name": "\uad6d\ub0b4 IP\uc5d0\uc11c \uc720\ud3ec\ub41c PureCrypter \uc801\uc6a9 Formbook \ud398\uc774\ub85c\ub4dc \ubd84\uc11d",
            "published": "2025-08-29T00:00:00Z",
            "object_refs": [
                "identity--d6060d27-a078-4b68-808e-0f825436ce05",
                "ipv4-addr--f7bed63d-6475-4bce-b9e4-b2e40be59938",
                "file--b82d6b0c-eca3-49c9-afa8-bd6c529e33ab",
                "file--8e9c7375-ac51-4b78-83cd-b1a04f8e208f",
                "file--523e5b8e-9463-4c57-a058-4a2c165bc9c1",
                "file--673693b8-09c9-41ab-84f7-48bc255e9ecf",
                "file--e2cd46d9-3078-4de6-b61b-5c37b7c5ffb5",
                "file--b4491a29-a99d-4796-b2a6-7dd5de60559e",
                "file--580acf51-3be1-4d97-93c6-ca09ca1e39a6",
                "file--888aeb34-acf5-4040-b5fa-6d3696df3797",
                "file--59d08cb8-d2f6-4a5b-8e86-cc02945aa69b",
                "file--2ed7fe20-7eaf-4fc2-9634-0bf47c759df2",
                "file--059c02e0-5b2f-4423-8dbf-6c3adac1a5d8",
                "file--8d0b3b0d-872f-4600-bd91-38173b495003",
                "file--8981efdd-6ede-4096-9093-1811c97d6b04",
                "ipv4-addr--1342cf51-c3b5-4939-99d1-40c5d6e00633",
                "ipv4-addr--4d664b68-3ca2-4e85-a2ef-69f9e27c2019",
                "ipv4-addr--7e77e30b-1445-4d39-9b2d-907f15752cb7",
                "ipv4-addr--a65f5f6c-a522-4d4c-aca8-9d2e98d1252e",
                "ipv4-addr--e6aef9b5-5733-4b2e-a2b2-2584cc1974c1",
                "domain-name--14061f4a-f93a-49f3-a077-c779bedd152e",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.enki.co.kr/media-center/blog/analysis-of-formbook-payload-loaded-by-purecrypter-distributed-from-south-korean-ip"
                }
            ]
        }
    ]
}