{
    "type": "bundle",
    "id": "bundle--aff357a9-f6da-41b6-b1e8-19eb5be49a00",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--3eebcb51-94b6-4fac-b6a6-a3705fa488fe",
            "created": "2024-09-09T00:20:56.276149Z",
            "modified": "2024-09-09T10:33:59.047954Z",
            "name": "Contagio",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0b83d844-d8c4-4ab8-b8df-8e61cc97b9a1",
            "hashes": {
                "SHA-256": "cbd1634cf7c638f2faf5e3ec79137db6704ec9de8df798fc46aeeed38de3da9b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7f44494b-6b0a-4a52-95d5-4661fef3d0df",
            "hashes": {
                "SHA-256": "d9add2bfdfebfa235575687de356f0cefb3e4c55964c4cb8bfdcdc58294eeaca"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--15d9e9d8-0feb-4c12-840b-7b3fa84daefd",
            "hashes": {
                "SHA-256": "381d3ba5fd446e53f1c71f05a2b97124382146b4c7f28884174334db7b347219"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3c859c0e-3e78-4b4c-a92b-e9baca431d82",
            "hashes": {
                "SHA-256": "4b1cba57928e02665be444a51937228c4d7315ff5e08c13a03bd7c77eebdcf5e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0b8f8913-9cd6-40df-8c70-75d082e44000",
            "hashes": {
                "SHA-256": "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--07508793-2a33-5982-b040-9114591a8330",
            "created": "2026-06-24T18:42:41.238642Z",
            "modified": "2026-06-24T18:42:41.238642Z",
            "name": "CitrineSleet"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--85c59d81-c21a-4174-9c30-445265b57805",
            "created_by_ref": "identity--3eebcb51-94b6-4fac-b6a6-a3705fa488fe",
            "created": "2026-06-24T18:42:41.241235Z",
            "modified": "2026-06-24T18:42:41.241235Z",
            "name": "2022-2024 North Korea Citrine Sleet /Lazarus FUDMODULE ( BYOVD ) Rootkit Samples",
            "published": "2024-09-02T00:00:00Z",
            "object_refs": [
                "identity--3eebcb51-94b6-4fac-b6a6-a3705fa488fe",
                "file--0b83d844-d8c4-4ab8-b8df-8e61cc97b9a1",
                "file--7f44494b-6b0a-4a52-95d5-4661fef3d0df",
                "file--15d9e9d8-0feb-4c12-840b-7b3fa84daefd",
                "file--3c859c0e-3e78-4b4c-a92b-e9baca431d82",
                "file--0b8f8913-9cd6-40df-8c70-75d082e44000",
                "threat-actor--07508793-2a33-5982-b040-9114591a8330"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://contagiodump.blogspot.com/2024/09/2022-2024-north-korea-citrine-sleet.html"
                }
            ]
        }
    ]
}