{
    "type": "bundle",
    "id": "bundle--e6a52026-ab01-4920-9be2-ac1f6faf6e0b",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--703b0d0d-f70a-4de2-bff5-d252e8d966f9",
            "created": "2023-03-08T12:51:48.041368Z",
            "modified": "2025-01-30T02:20:08.905936Z",
            "name": "Google",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--7410bc76-45ea-4c6e-9f87-aea3876296bb",
            "created": "2026-06-24T19:51:25.045085Z",
            "modified": "2026-06-24T19:51:25.045085Z",
            "name": "YARA Rule",
            "pattern": "rule G_Downloader_JADESNOW_1 {\r\nmeta:\r\nauthor = \"Google Threat Intelligence Group (GTIG)\"\r\nstrings:\r\n$s1 = \"global['_V']\"\r\n$s2 = \"global['r']\"\r\n$s3 = \"umP\"\r\n$s4 = \"mergeConfig\"\r\n$s5 = \"charAt\" nocase\r\ncondition:\r\nuint16(0) != 0x5A4D and filesize < 10KB and #s3 > 2 and #s5 == 1 and all of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-10-16T00:00:00Z"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--6f18378a-c274-5486-a5c6-8e9a45b3505c",
            "created": "2026-06-24T19:51:25.047759Z",
            "modified": "2026-06-24T19:51:25.047759Z",
            "name": "UNC5342"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--9ece563e-9fc8-4b14-9f72-971e82784777",
            "created_by_ref": "identity--703b0d0d-f70a-4de2-bff5-d252e8d966f9",
            "created": "2026-06-24T19:51:25.051908Z",
            "modified": "2026-06-24T19:51:25.051908Z",
            "name": "DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains",
            "published": "2025-10-16T00:00:00Z",
            "object_refs": [
                "identity--703b0d0d-f70a-4de2-bff5-d252e8d966f9",
                "indicator--7410bc76-45ea-4c6e-9f87-aea3876296bb",
                "threat-actor--6f18378a-c274-5486-a5c6-8e9a45b3505c"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding"
                }
            ]
        }
    ]
}