{
    "type": "bundle",
    "id": "bundle--10abc2c8-6721-4f60-a2d3-86d8c5dfd938",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--7d3cfc60-71ff-42fe-8e75-8f983817bc1f",
            "created": "2023-03-08T12:51:48.658768Z",
            "modified": "2023-03-08T12:51:48.658847Z",
            "name": "Threatray",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7d6fae7c-2884-4c9a-a0d0-835929cef1c0",
            "hashes": {
                "SHA-256": "f32f6b229913d68daad937cc72a57aa45291a9d623109ed48938815aa7b6005c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9b01b685-5bfa-4088-bceb-c84076445273",
            "hashes": {
                "SHA-256": "868a62feff8b46466e9d63b83135a7987bf6d332c13739aa11b747b3e2ad4bbf"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--946b4158-2ffd-45ae-b156-6c49cf16514d",
            "hashes": {
                "SHA-256": "1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0f5ffd6c-3e31-4d20-bda9-76863fe00484",
            "value": "52.202.193.124"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fd54eb50-99f6-488e-9e71-93cdf296226d",
            "hashes": {
                "SHA-256": "9137e886e414b12581852b96a1d90ee875053f16b79be57694df9f93f3ead506"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--037a1a7a-59e6-40de-8cdc-a04714c959ff",
            "hashes": {
                "SHA-256": "d231f3b6d6e4c56cb7f149cbc0178f7b80448c24f14dced5a864015512b0ba1f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3cb2fa31-146a-4e65-8221-38e193e084ca",
            "hashes": {
                "SHA-256": "d26987b705f537b10a11fb9913d0acc0218a0c0ae5f27e6f821d6d987b1cd4c7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4a65fab7-ae18-4229-8f7b-6713e5940584",
            "hashes": {
                "SHA-256": "f13aff9e1192c081c012f974b29bf60487385eed644d506d7f82b3538c2b035f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0efa0fda-c651-4f38-b04a-6049c623f914",
            "hashes": {
                "SHA-256": "fec82f2542d7f82e9fce3e16bfa4024f253adee7121973bd9d67a3c79441b83c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f7fe4531-31c0-4dc3-a7e3-45d69ee03b7d",
            "hashes": {
                "SHA-256": "8b3c8046fa776b70821b7e50baa772a395d3d245c10bdaa4b6171e0c5ce3f717"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a827aafa-cf02-4e1c-9e46-3fa78fcefc50",
            "hashes": {
                "SHA-256": "4aadf767491077ab83c6436cf108b014fc0bf8c3bd01cc6087a0f2b80564bc08"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a0c37850-d654-4149-8af0-adcc1e45792e",
            "hashes": {
                "SHA-256": "bbddcb280af742ce10842b18b9d7120632cc042a8fe42eed90fc4bc94f2d71ac"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--aa1490b2-594d-42f5-bfb0-679baf43e6d6",
            "hashes": {
                "SHA-256": "1892b72c053ab48edae8305ef449f2b5391921efea8b1d7c37d6d29f59edc92e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--736f5d16-3e58-4f96-a99e-7f5e103dde38",
            "hashes": {
                "SHA-256": "008e906f2727d502f130a549eeebfda23362e24b2f1ac6e2c198ea82acc8a06a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--baf9e2ca-ab5b-4444-83a9-b851fcb55a3d",
            "hashes": {
                "SHA-256": "ab194f2bad37bffd32fae9833dafaa04c79c9e117d86aa46432eadef64a43ad6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--792dfc9b-515c-491c-b12b-2e5fb1c81392",
            "hashes": {
                "SHA-256": "ebe4befd2a7f941baa65248d5dea09de809e638ec8e8caffae322aa3b6863c1c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d65d44e8-a4dd-4d5f-a613-13ed4ed0d58e",
            "hashes": {
                "SHA-256": "588cdbd3ee3594525eb62fa7bab148f6d7ab000737fc0c311a5588dc96794acc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--11afc25c-b56c-4901-94a4-d4c502b88b5b",
            "hashes": {
                "SHA-256": "4da0ac4c3f47f69c992abb5d6e9803348bf9f3c6028a7214dcabec9a2e729b99"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1e856553-578e-493d-97a8-7068af420ef7",
            "hashes": {
                "SHA-256": "da787cf1f4fd829dd4a7637bec392438b793c5f9c920560197545d20b58691af"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d87354e8-fd8d-4604-8e0e-003b30225b51",
            "hashes": {
                "SHA-256": "464eaa82103f6f479e0d62dd48d2dab8ece300458136c03165d20915ee658067"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ff1fcffd-c3c8-449d-888f-8496069ac8fd",
            "hashes": {
                "SHA-256": "5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a2a29085-7d66-443c-9a56-ff8392b61a20",
            "hashes": {
                "SHA-256": "0996a8e5ec1a41645309e2ca395d3a6b766a7c52784c974c776f258c1b25a76c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--96b7e2b9-fb0f-4772-8a8c-ad084bf9b549",
            "hashes": {
                "SHA-256": "49a13bf0aa53990771b7b7a7ab31d6805ed1b547e7d9f114e8e26a98f6fbee28"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--79ef1483-b134-45a8-a4b8-639495ca01fa",
            "hashes": {
                "SHA-256": "0dc3f66f4af3250f56a32f8e1b9e772c514f74718358d19c195e3950d370ea01"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--78c4bf8c-7635-4117-a17e-b92887aceb1c",
            "hashes": {
                "SHA-256": "87f389d8f3a63f0879aa9d9dfbbd2b2c9cf678b871b704a01b39e1eaa234020c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--29532e09-d9d7-4353-bf6e-7da6ef468902",
            "hashes": {
                "SHA-256": "f62adc678eaadc019277640e6695143a45336c2f91019f5d9308812db1d07285"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c6c3e8e9-890e-4768-b717-8656ae74735a",
            "hashes": {
                "SHA-256": "d0fa0bfef8b199a42f4f33145274576e5a7edeb5522fb342af41fdc16e9021e2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--992ff156-e117-4539-ad40-8b36173648f5",
            "hashes": {
                "SHA-256": "e83f5e0a51845d7078a3aca8ca7a5b786e8bdf284efd3e08b3472dbf3e098930"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3f3eabf8-a826-499a-9cbc-71ca71205234",
            "hashes": {
                "SHA-256": "63bae252d796bc9ac331fdc13744a72bd85d1065ef41a884dc11c6245ea933e2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--27ebdfc5-abbc-461b-a21e-1b2651d80870",
            "hashes": {
                "SHA-256": "7d7dc8125a26d9515d90a66bfd20d609820197c879030cb932d39b1c2998e9d4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--eb44a197-712e-47dc-9cc8-b49cede77bd4",
            "hashes": {
                "SHA-256": "ed11e94fd9aa3c7d4dd0b4345c106631fe52929c6e26a0daec2ed7d22e47ada0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--03cef78e-6fa4-499b-9188-16c9fd15b1c7",
            "hashes": {
                "SHA-256": "b0d6aee39e988196fdc821895a1f1aa63d1c032ea880c26a15c857068f34bfd9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b7b6efea-89ed-4449-abbd-c14a18c34461",
            "hashes": {
                "SHA-256": "f40d387631ddb0db70128e72239d0cae7a22b2135c0ec0d540e018aa727d4c8e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e2d361aa-d0bd-447e-b14f-d0c88304ff19",
            "hashes": {
                "SHA-256": "2f53109e01c431c1c1acec667adee07cf907cdc4d36429022f915654c9b7113b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a86162df-3577-4cf8-88c2-9ce644ad6661",
            "hashes": {
                "SHA-256": "69bac736f42e37302db7eca68b6fc138c3aa9a5c902c149e46cce8b42b172603"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--75cc324e-96c0-411b-b42c-5f28451a1809",
            "hashes": {
                "MD5": "f0ff67d4d34fe34d52a44b3515c44950"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dbe575d1-adc4-42cb-af90-209047eccbc0",
            "hashes": {
                "SHA-256": "0e447797aa20bff416073281adb09b73c15433ab855b5cdb2d883f8c2af9c414"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--868d60ce-00b7-4f2e-a90f-b72b18fb38fc",
            "hashes": {
                "SHA-256": "f4765f7b089d99b1cdcebf3ad7ba7e3e23ce411deab29b7afd782b23352e698f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c9688e39-f97d-4dc3-ae09-14581ce3cf74",
            "hashes": {
                "SHA-256": "1177105e51fa02f9977bd435f9066123ace32b991ed54912ece8f3d4fbeeade4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7d779379-e257-4d8a-aafa-3bdc138f412f",
            "hashes": {
                "SHA-256": "b59e8f44822ad6bc3b4067bfdfd1ad286b8ba76c1a3faff82a3feb7bdf96b9c5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2f40ae52-023f-4886-aab7-4e3c6a5db0eb",
            "hashes": {
                "SHA-256": "4d03a981bed15a3bd91f36972d7391b39791c582bb2959a9be154a74bd64db31"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1577bc1e-c34c-4e0f-baa4-d0ab73df83c2",
            "hashes": {
                "SHA-256": "350082b3f14e130c6337ef88d46d54d353ca6785508264112dfbd20ce4e47b98"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--1aca8a28-4171-4eab-a80b-44b615a39140",
            "value": "http://mail.neocyon.com/jsp/user/sms/sms_recv.jsp"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--54b9935d-617a-4e95-977c-94cdab72873c",
            "value": "mail.neocyon.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--25213559-1ec9-44e2-bef8-98eb3c572fc9",
            "hashes": {
                "SHA-256": "6310cd9f8b6ae1fdc1b55fe190026a119f7ea526cd3fc22a215bda51c9c28214"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--2bb933cc-412f-4774-a7b3-8f00c459a99b",
            "value": "http://mail.sisnet.co.kr/jsp/user/sms/sms_recv.jsp"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--8d7158d6-c987-4018-a00f-1453c3b411b0",
            "value": "http://www.allamwith.com/home/mobile/list.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--31f8adc6-7a72-46ea-9c08-7c5ed9de69f4",
            "value": "http://www.conkorea.com/cshop/banner/list.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--675e2f23-3c70-4140-b137-005c46e932b0",
            "value": "mail.sisnet.co.kr"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9fb6f834-9af2-43a4-81b2-3b79c0ef3481",
            "value": "45.58.112.77"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0f074dcf-0fa4-4bdf-819b-e7db1d2d37fa",
            "value": "185.208.158.208"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--405f5784-dd36-48a6-8152-f4e7a56772cd",
            "value": "23.229.111.197"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--6845773b-743b-48ad-9a26-2d4d73454f29",
            "value": "http://snum.or.kr/skin_img/skin.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--2ec29c93-ae92-45a8-9825-ec60917cb7f7",
            "value": "http://www.ddjm.co.kr/bbs/icon/skin/skin.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--914a8505-bae7-4adb-ae65-14cd6d5ee601",
            "value": "snum.or.kr"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--16fcf84c-e2a4-4584-9a03-9af9346026e6",
            "hashes": {
                "SHA-256": "ed5fbefd61a72ec9f8a5ebd7fa7bcd632ec55f04bdd4a4e24686edccb0268e05"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--6dd99b4f-1f02-453d-ba6b-7d21e94fc8b0",
            "value": "http://www.jinjinpig.co.kr/Anyboard/skin/board.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--897208c9-aab6-468f-8eeb-dace89d00caf",
            "value": "http://mail.namusoft.kr/jsp/user/eam/board.jsp"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0979aa07-ee56-45e5-af77-44d419dfa199",
            "value": "mail.namusoft.kr"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--779b8f52-56c4-5aee-b87a-0e7e139d8eff",
            "created": "2026-06-24T21:10:46.895903Z",
            "modified": "2026-06-24T21:10:46.895903Z",
            "name": "Andariel"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--9541c5ee-78da-4163-87cb-3f55e48187b8",
            "created_by_ref": "identity--7d3cfc60-71ff-42fe-8e75-8f983817bc1f",
            "created": "2026-06-24T21:10:46.921175Z",
            "modified": "2026-06-24T21:10:46.921175Z",
            "name": "Establishing the TigerRAT and TigerDownloader malware families",
            "published": "2021-12-22T00:00:00Z",
            "object_refs": [
                "identity--7d3cfc60-71ff-42fe-8e75-8f983817bc1f",
                "file--7d6fae7c-2884-4c9a-a0d0-835929cef1c0",
                "file--9b01b685-5bfa-4088-bceb-c84076445273",
                "file--946b4158-2ffd-45ae-b156-6c49cf16514d",
                "ipv4-addr--0f5ffd6c-3e31-4d20-bda9-76863fe00484",
                "file--fd54eb50-99f6-488e-9e71-93cdf296226d",
                "file--037a1a7a-59e6-40de-8cdc-a04714c959ff",
                "file--3cb2fa31-146a-4e65-8221-38e193e084ca",
                "file--4a65fab7-ae18-4229-8f7b-6713e5940584",
                "file--0efa0fda-c651-4f38-b04a-6049c623f914",
                "file--f7fe4531-31c0-4dc3-a7e3-45d69ee03b7d",
                "file--a827aafa-cf02-4e1c-9e46-3fa78fcefc50",
                "file--a0c37850-d654-4149-8af0-adcc1e45792e",
                "file--aa1490b2-594d-42f5-bfb0-679baf43e6d6",
                "file--736f5d16-3e58-4f96-a99e-7f5e103dde38",
                "file--baf9e2ca-ab5b-4444-83a9-b851fcb55a3d",
                "file--792dfc9b-515c-491c-b12b-2e5fb1c81392",
                "file--d65d44e8-a4dd-4d5f-a613-13ed4ed0d58e",
                "file--11afc25c-b56c-4901-94a4-d4c502b88b5b",
                "file--1e856553-578e-493d-97a8-7068af420ef7",
                "file--d87354e8-fd8d-4604-8e0e-003b30225b51",
                "file--ff1fcffd-c3c8-449d-888f-8496069ac8fd",
                "file--a2a29085-7d66-443c-9a56-ff8392b61a20",
                "file--96b7e2b9-fb0f-4772-8a8c-ad084bf9b549",
                "file--79ef1483-b134-45a8-a4b8-639495ca01fa",
                "file--78c4bf8c-7635-4117-a17e-b92887aceb1c",
                "file--29532e09-d9d7-4353-bf6e-7da6ef468902",
                "file--c6c3e8e9-890e-4768-b717-8656ae74735a",
                "file--992ff156-e117-4539-ad40-8b36173648f5",
                "file--3f3eabf8-a826-499a-9cbc-71ca71205234",
                "file--27ebdfc5-abbc-461b-a21e-1b2651d80870",
                "file--eb44a197-712e-47dc-9cc8-b49cede77bd4",
                "file--03cef78e-6fa4-499b-9188-16c9fd15b1c7",
                "file--b7b6efea-89ed-4449-abbd-c14a18c34461",
                "file--e2d361aa-d0bd-447e-b14f-d0c88304ff19",
                "file--a86162df-3577-4cf8-88c2-9ce644ad6661",
                "file--75cc324e-96c0-411b-b42c-5f28451a1809",
                "file--dbe575d1-adc4-42cb-af90-209047eccbc0",
                "file--868d60ce-00b7-4f2e-a90f-b72b18fb38fc",
                "file--c9688e39-f97d-4dc3-ae09-14581ce3cf74",
                "file--7d779379-e257-4d8a-aafa-3bdc138f412f",
                "file--2f40ae52-023f-4886-aab7-4e3c6a5db0eb",
                "file--1577bc1e-c34c-4e0f-baa4-d0ab73df83c2",
                "url--1aca8a28-4171-4eab-a80b-44b615a39140",
                "domain-name--54b9935d-617a-4e95-977c-94cdab72873c",
                "file--25213559-1ec9-44e2-bef8-98eb3c572fc9",
                "url--2bb933cc-412f-4774-a7b3-8f00c459a99b",
                "url--8d7158d6-c987-4018-a00f-1453c3b411b0",
                "url--31f8adc6-7a72-46ea-9c08-7c5ed9de69f4",
                "domain-name--675e2f23-3c70-4140-b137-005c46e932b0",
                "ipv4-addr--9fb6f834-9af2-43a4-81b2-3b79c0ef3481",
                "ipv4-addr--0f074dcf-0fa4-4bdf-819b-e7db1d2d37fa",
                "ipv4-addr--405f5784-dd36-48a6-8152-f4e7a56772cd",
                "url--6845773b-743b-48ad-9a26-2d4d73454f29",
                "url--2ec29c93-ae92-45a8-9825-ec60917cb7f7",
                "domain-name--914a8505-bae7-4adb-ae65-14cd6d5ee601",
                "file--16fcf84c-e2a4-4584-9a03-9af9346026e6",
                "url--6dd99b4f-1f02-453d-ba6b-7d21e94fc8b0",
                "url--897208c9-aab6-468f-8eeb-dace89d00caf",
                "domain-name--0979aa07-ee56-45e5-af77-44d419dfa199",
                "threat-actor--779b8f52-56c4-5aee-b87a-0e7e139d8eff"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://threatray.com/blog/establishing-the-tigerrat-and-tigerdownloader-malware-families/"
                }
            ]
        }
    ]
}