{
    "type": "bundle",
    "id": "bundle--b528539c-7dc0-45d9-8e9b-e12cd0f66089",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--b2accece-fadb-44a9-be6d-e31c21b885c6",
            "created": "2023-03-08T12:51:43.216431Z",
            "modified": "2023-03-16T12:47:56.421112Z",
            "name": "SEKOIA",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4d2550d8-e9c7-41b1-b61d-5b323f3fe91f",
            "hashes": {
                "SHA-256": "7fccc871c889a4f4c13a977fdd5f062d6de23c3ffd27e72661c986fae6370387"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--671db2bf-3b96-4121-93c1-8f85ce4cba3d",
            "hashes": {
                "SHA-256": "ec8f97d5595d92ec678ffbf5ae1f60ce90e620088927f751c76935c46aa7dc41"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--97e23c53-d139-43c8-9956-20fa004ace38",
            "hashes": {
                "SHA-256": "9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--d481450f-a36d-4713-a050-37aaeed7fe5b",
            "value": "104.168.167.88"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--eba1efb6-356e-4389-8bfd-14352610d9cb",
            "value": "104.255.172.56"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--ac082f62-1f8b-4a2e-8b52-5d16da3878d2",
            "value": "172.93.181.221"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--8b6b525b-15aa-44d7-a28d-b79bcaac81d1",
            "value": "155.138.159.45"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--016f8311-c677-46c9-9aa2-8f68f6e329d2",
            "created": "2026-06-24T18:19:52.113078Z",
            "modified": "2026-06-24T18:19:52.113078Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Bluenoroff_downloader_win_curl_agent: TESTING { meta: id = \"ddeb2d8f-1b10-4a33-b768-d19412e8551a\" version = \"1.0\" intrusion_set = \"Bluenoroff\" description = \"Detect the downloader used by Bluenoroff to install it CurlAgent\" source = \"SEKOIA\" creation_date = \"2023-05-02\" classification = \"TLP:WHITE\" strings: $ = \"%s\\\\marcoor.dll\" wide $ = \"curl -A cur1-agent -L %s -s -d dl\" $ = \"curl -A cur1-agent -L %s -s -d da\" $ = \"cmd /c timeout /t 10 & rundll32 \\\"%s\\\" #1\" wide $ = \"cmd /c timeout /t 10 & Del /f /q \\\"%s\\\" & attrib -s -h \\\"%s\\\" & rundll32 \\\"%s\\\" #1\" wide condition: 3 of them }",
            "pattern_type": "yara",
            "valid_from": "2023-05-22T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--19374119-49ce-46e7-b482-c30c69dd5d28",
            "created": "2026-06-24T18:19:52.113741Z",
            "modified": "2026-06-24T18:19:52.113741Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Bluenoroff_downloader_mac_RustBucket { meta: id =\"5a003b68-ad9a-47f9-b157-dd898181dac2\" version = \"1.0\" malware = \"RustBucket\" description = \"RustBucket fake PDF reader\" source = \"SEKOIA\" creation_date = \"2023-04-24\" classification = \"TLP:WHITE\" reference = \"https://tinyurl.com/5n7f56a8\" hash = \"606bce13161693844b9eb36c96554883\" hash = \"b93d7b7b30207249c1c683df16bad107\" hash = \"ca86579220eecfaede268d1520d07fae\" hash = \"f8800dd176487601ccf2e27c094b297b\" strings: $down_exec1 = \"_down_update_run\" nocase $down_exec2 = \"downAndExec\" nocase $encrypt1 = \"_encrypt_pdf\" $encrypt2 = \"_encrypt_data\" $error_msg1 = \"_alertErr\" $error_msg2 = \"_show_error_msg\" $view_pdf1 = \"-[PEPWindow view_pdf:]\" $view_pdf2 = \"-[PEPWindow viewPDF:]\" condition: (uint32be(0) == 0xcafebabe or uint32be(0) == 0xcffaedfe) and 5 of them and filesize > 50KB }",
            "pattern_type": "yara",
            "valid_from": "2023-05-22T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--64841023-912e-45ba-adce-fe5a2ba18a34",
            "hashes": {
                "SHA-256": "c28e4031129f3e6e5c6fbd7b1cebd8dd21b6f87a8564b0fb9ee741a9b8bc0197"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0b55aa3b-c4b9-4333-8401-3fc1d06cd27a",
            "hashes": {
                "SHA-256": "62a5c6a600051bca4f7b3d11508ca1f968006b71089c71bf87b83ea8b34188e3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--649cb6f9-c8f3-420a-a47d-9e4a58ecdb0b",
            "hashes": {
                "SHA-256": "3b6f30369a4ee8bf9409d141b6d1b3fb4286c34984b5de005ed7431df549b17e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--933094be-ae40-4564-9bbb-d3f86a12867a",
            "hashes": {
                "SHA-256": "5ca7c871dfe24b27b5cf7e9bf087f44c7620d78a1d4fa76373f22abedbdf8f82"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a9f9cf9e-f8cb-47da-b9ba-e40023d6a3c6",
            "hashes": {
                "SHA-256": "46db9f2fc879bf643a8f05e2b35879b235cbb04aa06fe548f0bc7c7c02483cf3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5cc00534-a6f7-4eee-97cf-e442ec99560d",
            "hashes": {
                "SHA-256": "f603713bffb9e040bedfd0bb675ff5a6b3205d8bd4e1a3309ea6d1b608871184"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3538d096-043d-435d-bfd8-1e7a2504fcad",
            "hashes": {
                "SHA-256": "5072b28399c874f92e71793fa13207d946a28a2f5903365ac11ddf666d15d086"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--407e611a-f1cb-4d0e-8936-74bf81246654",
            "hashes": {
                "MD5": "f90b544f89cfbe38aee18024d7c39e40"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--294113d8-e792-4669-96d5-f298aafbc7fe",
            "hashes": {
                "MD5": "529c65521e8a07c8810b6d225f7e2a89"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--eef30453-33fc-4593-aa25-452d0653fab8",
            "hashes": {
                "SHA-256": "31cec2803bfc7750930d5864400388732a822da96c3f79c98ddee03949aa6a2d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--97f6b5f7-4208-4c2c-864a-49aed7ac819f",
            "hashes": {
                "SHA-256": "0d6964fe763c2e6404cde68af2c5f86d34cf50a88bd81bc06bba739010821db0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--414f3bda-806b-4b1e-ae94-047c38122870",
            "hashes": {
                "SHA-256": "5f00106f7f15e0ca00df4dbb0eeccd57930b4b81bc9aa3fca0c5af4eda339ab7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--45e12bac-da3e-4893-8021-e39fa0bc584e",
            "hashes": {
                "MD5": "606bce13161693844b9eb36c96554883"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c80295c8-a5df-4746-9a7b-5c1a40a1e000",
            "hashes": {
                "MD5": "ca86579220eecfaede268d1520d07fae"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f61def71-346e-40ec-a1c1-abfbae34b524",
            "hashes": {
                "SHA-256": "3ed9f34fedca38130776e5adabae363ac797fe89087e04e0c93d83fd62a7a9a4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--41c5d1ee-37a6-4446-a157-bea869b77f1b",
            "hashes": {
                "SHA-256": "ebad7317e1b01c2231bdbf37dfebdf656e3c8706e719fd37b66f0170b3d5cae0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c820ee77-566d-4348-8fe7-97d946a23ad8",
            "hashes": {
                "SHA-256": "3f0d5ddca2657044f4763ae53c4f33c8a7814ba451b60d24430a126674125624"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ea304347-ba41-475f-aa60-90d907562071",
            "hashes": {
                "SHA-256": "ff8832355ae99ffd66d0fe9eda2d74efdf3ed87bb2a4c215b93ade93165f7c0b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9f43ee31-1422-4b31-b184-9acddea372af",
            "hashes": {
                "MD5": "b93d7b7b30207249c1c683df16bad107"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ddfc9a00-901c-4859-8bc2-5037fe604e7b",
            "hashes": {
                "SHA-256": "07d206664a8d397273e69ce37ef7cf933c22e93b62d95b673d6e835876feba06"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9fa3318b-288f-4609-a08c-19528b36320e",
            "hashes": {
                "SHA-256": "b448381f244dc0072abd4f52e01ca93efaebb2c0a8ea8901c4725ecb1b2b0656"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c9f716ab-e753-4f28-a3b5-0adeb04b61b3",
            "hashes": {
                "SHA-256": "ea5fac3201a09c3c5c3701723ea9a5fec8bbc4f1f236463d651303f40a245452"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f6b8a6a2-da71-42d5-9186-fbc860d84a9c",
            "hashes": {
                "SHA-256": "d6d367453c513445313be7339666e4faeeebeae71620c187012ea5ae2901df34"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0fa4d4c4-d066-4ccd-94bb-0ff7f8ecad06",
            "hashes": {
                "SHA-256": "7c66d2d75be43d2c17e75d37c39344a9b5d29ee5c5861f178aa7d9f34208eb48"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4a137096-5f03-4103-939d-e6d844ef8d63",
            "hashes": {
                "MD5": "5c483473641807082e530744023044fd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c8524b7a-583b-4cad-b13f-0884904de0fd",
            "hashes": {
                "SHA-256": "6ca3a2f4cef27dac9d28c1ec2b29a8fa09dfc6dbbaf58e00dddbf5c1dd3b3cc3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8b6fd48e-10e9-44ab-88a1-6981cae6203b",
            "hashes": {
                "SHA-256": "ba5e982596fd03bea98f5de96c1258e56327358e134ceecd1d68e54480533d92"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4ee20afc-d7da-45c8-a78d-8e9cd275b5c0",
            "hashes": {
                "MD5": "4e05597d308d2368625dc19e86a9ca22"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e32bb8d1-8558-412b-b029-1d10642c84fe",
            "hashes": {
                "SHA-256": "b68bf400a23b1053f54911a2b826d341f6bf87c26bea5e6cf21710ee569a7aab"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--15b4d62a-999b-4606-888b-acb59071c945",
            "hashes": {
                "SHA-256": "e2f177b8806923f21a93952b61aedbeb02d829a67a820a7aab5ee72512e3d646"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d803831e-78ca-4e8f-b101-668e041cb615",
            "hashes": {
                "SHA-256": "61772375af1884fe73c5d154b8637dd62f26d23bc38d18462a88e2bbed483fd7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7773ae5e-76c5-41f7-bce6-82775524e929",
            "hashes": {
                "SHA-256": "83f457bc81514ec5e3ea123fc237811a36da6ce7f975ad56d62e34af4d1f37c0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3607952a-31fa-4072-b74b-18b67a4440ba",
            "hashes": {
                "SHA-256": "dda8a9e2a2e415be781a39fdf41f1551af2344f1b1a0ddf921d8aeba90343d1b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--358aac04-30fc-4ec5-adbd-403d3cdb76f5",
            "hashes": {
                "SHA-256": "b3cb7d0b656e8e4852def8548d2cf1edc4e64116434e1f2d9c9b150ee0f9861e"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8e023fe3-f85e-44c5-ba93-150ddcd03552",
            "value": "sarahbeery.docsend.me"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f6b84cdd-e7a1-4039-8580-89a01de74eda",
            "value": "172.86.121.143"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9d6fdea2-f29a-4f23-a439-52446c03e49a",
            "value": "104.255.172.52"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--57055719-bbec-4283-8370-7f28f917dbd5",
            "value": "149.248.52.31"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--6842a816-6df8-4776-be37-a727ee50927b",
            "value": "104.234.147.28"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--07f8df80-306b-45a1-aa5e-0ca94ee4d781",
            "value": "104.156.149.130"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--212ddfa6-c0e0-43bc-81ec-5ea552e1342b",
            "value": "104.168.138.7"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7e894096-00b3-4cde-a75a-7686ecadd98e",
            "hashes": {
                "SHA-256": "bea33fb3205319868784c028418411ee796d6ee3dfe9309f143e7e8106116a49"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ffc6aac5-d3b8-472f-b8db-ea8ab3bd373f",
            "hashes": {
                "SHA-256": "8e234482db790fa0a3d2bf5f7084ec4cfb74bffd5f6cbdc5abdbc1350f58e3fe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7feb4893-3dd7-4941-b34b-a96d69135065",
            "hashes": {
                "SHA-256": "9525f5081a5a7ab7d35cf2fb2d7524e0777e37fe3df62730e1e7de50506850f7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c4f98881-680c-4d5f-8d49-b774d362ba13",
            "hashes": {
                "SHA-256": "7981ebf35b5eff8be2f3849c8f3085b9cec10d9759ff4d3afd46990520de0407"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--de385cd6-800a-4b46-ba0b-dc504b6bac16",
            "hashes": {
                "SHA-256": "c56a97efd6d3470e14193ac9e194fa46d495e3dddc918219cca530b90f01d11e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2d92d296-4546-4d87-b794-5c3bc7855fba",
            "hashes": {
                "SHA-256": "38106b043ede31a66596299f17254d3f23cbe1f983674bf9ead5006e0f0bf880"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c2f92dfc-0918-40e5-98c5-19bd9346f88c",
            "hashes": {
                "MD5": "f8800dd176487601ccf2e27c094b297b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fba81254-d3bc-4e25-8f50-625773ca980b",
            "hashes": {
                "SHA-256": "e74e8cdf887ae2de25590c55cb52dad66f0135ad4a1df224155f772554ea970c"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--89c45080-f231-4f07-b3a2-0b8c66ef8fde",
            "value": "172.86.122.181"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--c64d87fd-2d90-4c88-a5d2-cc9baeee9ced",
            "value": "104.168.174.80"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4f11149a-74c5-4261-b4ef-ea25fb424855",
            "value": "149.28.247.34"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--839dc94a-b7a2-4fb4-9f45-3094e9b4db5c",
            "value": "152.89.247.87"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0d735ff4-6a8d-438e-a8bd-3418734e4e0e",
            "value": "172.86.121.130"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--01cddeda-e2f3-49d4-a64a-6548648ce240",
            "value": "155.138.219.140"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb",
            "created": "2026-06-24T18:19:52.145202Z",
            "modified": "2026-06-24T18:19:52.145202Z",
            "name": "Bluenoroff"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--a945d1a8-ada6-48d1-b769-4f9f43edae2c",
            "created_by_ref": "identity--b2accece-fadb-44a9-be6d-e31c21b885c6",
            "created": "2026-06-24T18:19:52.149189Z",
            "modified": "2026-06-24T18:19:52.149189Z",
            "name": "Bluenoroff\u2019s RustBucket campaign",
            "published": "2023-05-22T00:00:00Z",
            "object_refs": [
                "identity--b2accece-fadb-44a9-be6d-e31c21b885c6",
                "file--4d2550d8-e9c7-41b1-b61d-5b323f3fe91f",
                "file--671db2bf-3b96-4121-93c1-8f85ce4cba3d",
                "file--97e23c53-d139-43c8-9956-20fa004ace38",
                "ipv4-addr--d481450f-a36d-4713-a050-37aaeed7fe5b",
                "ipv4-addr--eba1efb6-356e-4389-8bfd-14352610d9cb",
                "ipv4-addr--ac082f62-1f8b-4a2e-8b52-5d16da3878d2",
                "ipv4-addr--8b6b525b-15aa-44d7-a28d-b79bcaac81d1",
                "indicator--016f8311-c677-46c9-9aa2-8f68f6e329d2",
                "indicator--19374119-49ce-46e7-b482-c30c69dd5d28",
                "file--64841023-912e-45ba-adce-fe5a2ba18a34",
                "file--0b55aa3b-c4b9-4333-8401-3fc1d06cd27a",
                "file--649cb6f9-c8f3-420a-a47d-9e4a58ecdb0b",
                "file--933094be-ae40-4564-9bbb-d3f86a12867a",
                "file--a9f9cf9e-f8cb-47da-b9ba-e40023d6a3c6",
                "file--5cc00534-a6f7-4eee-97cf-e442ec99560d",
                "file--3538d096-043d-435d-bfd8-1e7a2504fcad",
                "file--407e611a-f1cb-4d0e-8936-74bf81246654",
                "file--294113d8-e792-4669-96d5-f298aafbc7fe",
                "file--eef30453-33fc-4593-aa25-452d0653fab8",
                "file--97f6b5f7-4208-4c2c-864a-49aed7ac819f",
                "file--414f3bda-806b-4b1e-ae94-047c38122870",
                "file--45e12bac-da3e-4893-8021-e39fa0bc584e",
                "file--c80295c8-a5df-4746-9a7b-5c1a40a1e000",
                "file--f61def71-346e-40ec-a1c1-abfbae34b524",
                "file--41c5d1ee-37a6-4446-a157-bea869b77f1b",
                "file--c820ee77-566d-4348-8fe7-97d946a23ad8",
                "file--ea304347-ba41-475f-aa60-90d907562071",
                "file--9f43ee31-1422-4b31-b184-9acddea372af",
                "file--ddfc9a00-901c-4859-8bc2-5037fe604e7b",
                "file--9fa3318b-288f-4609-a08c-19528b36320e",
                "file--c9f716ab-e753-4f28-a3b5-0adeb04b61b3",
                "file--f6b8a6a2-da71-42d5-9186-fbc860d84a9c",
                "file--0fa4d4c4-d066-4ccd-94bb-0ff7f8ecad06",
                "file--4a137096-5f03-4103-939d-e6d844ef8d63",
                "file--c8524b7a-583b-4cad-b13f-0884904de0fd",
                "file--8b6fd48e-10e9-44ab-88a1-6981cae6203b",
                "file--4ee20afc-d7da-45c8-a78d-8e9cd275b5c0",
                "file--e32bb8d1-8558-412b-b029-1d10642c84fe",
                "file--15b4d62a-999b-4606-888b-acb59071c945",
                "file--d803831e-78ca-4e8f-b101-668e041cb615",
                "file--7773ae5e-76c5-41f7-bce6-82775524e929",
                "file--3607952a-31fa-4072-b74b-18b67a4440ba",
                "file--358aac04-30fc-4ec5-adbd-403d3cdb76f5",
                "domain-name--8e023fe3-f85e-44c5-ba93-150ddcd03552",
                "ipv4-addr--f6b84cdd-e7a1-4039-8580-89a01de74eda",
                "ipv4-addr--9d6fdea2-f29a-4f23-a439-52446c03e49a",
                "ipv4-addr--57055719-bbec-4283-8370-7f28f917dbd5",
                "ipv4-addr--6842a816-6df8-4776-be37-a727ee50927b",
                "ipv4-addr--07f8df80-306b-45a1-aa5e-0ca94ee4d781",
                "ipv4-addr--212ddfa6-c0e0-43bc-81ec-5ea552e1342b",
                "file--7e894096-00b3-4cde-a75a-7686ecadd98e",
                "file--ffc6aac5-d3b8-472f-b8db-ea8ab3bd373f",
                "file--7feb4893-3dd7-4941-b34b-a96d69135065",
                "file--c4f98881-680c-4d5f-8d49-b774d362ba13",
                "file--de385cd6-800a-4b46-ba0b-dc504b6bac16",
                "file--2d92d296-4546-4d87-b794-5c3bc7855fba",
                "file--c2f92dfc-0918-40e5-98c5-19bd9346f88c",
                "file--fba81254-d3bc-4e25-8f50-625773ca980b",
                "ipv4-addr--89c45080-f231-4f07-b3a2-0b8c66ef8fde",
                "ipv4-addr--c64d87fd-2d90-4c88-a5d2-cc9baeee9ced",
                "ipv4-addr--4f11149a-74c5-4261-b4ef-ea25fb424855",
                "ipv4-addr--839dc94a-b7a2-4fb4-9f45-3094e9b4db5c",
                "ipv4-addr--0d735ff4-6a8d-438e-a8bd-3418734e4e0e",
                "ipv4-addr--01cddeda-e2f3-49d4-a64a-6548648ce240",
                "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.sekoia.io/bluenoroffs-rustbucket-campaign/"
                }
            ]
        }
    ]
}