{
    "type": "bundle",
    "id": "bundle--8c5a9449-b34f-4664-9e16-84df361d59bc",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--0648e9f1-986a-40ab-8f6c-0495948f69ec",
            "created": "2023-05-23T01:10:41.336415Z",
            "modified": "2024-09-11T13:26:42.312985Z",
            "name": "Genians",
            "identity_class": "organization"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--d95fb2ee-a6d6-4275-9972-dabb441bcee2",
            "value": "http://www.novel21.co.kr/data/editor/2110/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--89bf1025-ba05-4711-94f1-f6a3c4970544",
            "value": "http://www.daehoat.com/wp-content/uploads/2017/02/member.php"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--8667e3a8-57a0-4e99-b4e1-87ae4236a12d",
            "value": "218.150.78.231"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4c873cf0-1914-437f-b2d1-8a2097a8489a",
            "value": "121.254.222.10"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b8cd57e2-7652-4781-88ea-17c48e57e42b",
            "value": "webhostingkorea.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4b9f4de4-662f-4101-96ba-f4e893788ff7",
            "value": "61.100.9.206"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e90b136e-2715-42a7-9dd7-08b39af6d3ec",
            "value": "novel21.co.kr"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--bcaa992a-2519-405c-83dd-f5f1d88f6636",
            "value": "211.239.157.126"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8ececab2-faa6-4f21-993f-b14f5c672895",
            "value": "fe01.co.kr"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--83c78600-2bf3-49e4-b515-68ffb390d491",
            "value": "218.150.78.198"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--dccf2f6e-2f39-4852-918e-5209c745e8c6",
            "value": "daehoat.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--7483bf67-c827-4676-b858-c0d3fb225282",
            "value": "121.254.222.80"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--13f065d5-b058-479e-91fb-f61c6a271340",
            "value": "crwellfood.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5c10deed-a9fe-450a-827f-815df8c0d025",
            "hashes": {
                "MD5": "b6b0602310bb2d4360c52685119aac1b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e2f6849a-70c2-4fd6-9d60-e22ca2e691ad",
            "hashes": {
                "MD5": "7eb9cee1f696727752169f25cf79a338"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1e7878e5-8577-4646-a678-0d0ea49ce6d1",
            "hashes": {
                "MD5": "7cef19f9c4480adac0cd4702ff98f46c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4b29d9b8-8063-4c1c-8141-13d7f7a5341c",
            "hashes": {
                "MD5": "3715092aa00f380cefe8b4d2eddb7d08"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3be555f5-1f0d-5001-b84a-c6c910760fd0",
            "created": "2026-06-24T19:57:55.121691Z",
            "modified": "2026-06-24T19:57:55.121691Z",
            "name": "APT37"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--76885f58-6dc2-46ed-80fe-1c88ab5e74dd",
            "created_by_ref": "identity--0648e9f1-986a-40ab-8f6c-0495948f69ec",
            "created": "2026-06-24T19:57:55.146403Z",
            "modified": "2026-06-24T19:57:55.146403Z",
            "name": "MS \uc0ac\uce6d \ud53c\uc2f1\uacfc Dead-drop C2 \uae30\ubc18 APT37 NarwhalRAT \ubd84\uc11d",
            "published": "2026-06-14T00:00:00Z",
            "object_refs": [
                "identity--0648e9f1-986a-40ab-8f6c-0495948f69ec",
                "url--d95fb2ee-a6d6-4275-9972-dabb441bcee2",
                "url--89bf1025-ba05-4711-94f1-f6a3c4970544",
                "ipv4-addr--8667e3a8-57a0-4e99-b4e1-87ae4236a12d",
                "ipv4-addr--4c873cf0-1914-437f-b2d1-8a2097a8489a",
                "domain-name--b8cd57e2-7652-4781-88ea-17c48e57e42b",
                "ipv4-addr--4b9f4de4-662f-4101-96ba-f4e893788ff7",
                "domain-name--e90b136e-2715-42a7-9dd7-08b39af6d3ec",
                "ipv4-addr--bcaa992a-2519-405c-83dd-f5f1d88f6636",
                "domain-name--8ececab2-faa6-4f21-993f-b14f5c672895",
                "ipv4-addr--83c78600-2bf3-49e4-b515-68ffb390d491",
                "domain-name--dccf2f6e-2f39-4852-918e-5209c745e8c6",
                "ipv4-addr--7483bf67-c827-4676-b858-c0d3fb225282",
                "domain-name--13f065d5-b058-479e-91fb-f61c6a271340",
                "file--5c10deed-a9fe-450a-827f-815df8c0d025",
                "file--e2f6849a-70c2-4fd6-9d60-e22ca2e691ad",
                "file--1e7878e5-8577-4646-a678-0d0ea49ce6d1",
                "file--4b29d9b8-8063-4c1c-8141-13d7f7a5341c",
                "threat-actor--3be555f5-1f0d-5001-b84a-c6c910760fd0"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.genians.co.kr/blog/threat_intelligence/narwhalrat"
                }
            ]
        }
    ]
}