{
    "type": "bundle",
    "id": "bundle--87780ce8-71da-4799-be6c-2efc2c5e4750",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--acadf73f-9f52-4ca7-9140-95ee34cc35b2",
            "created": "2023-03-08T12:52:02.580609Z",
            "modified": "2023-03-08T12:52:02.58069Z",
            "name": "Alienvault",
            "identity_class": "organization"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--6b09131b-0227-4ac5-9e39-c49e6e874c77",
            "value": "whiat1001@gmail.com"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--003e84ad-9c9e-4a83-829f-9ed966548a80",
            "value": "johnS203@yahoo.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6a0a5e5d-dca7-4f35-80c2-dde1daef7246",
            "hashes": {
                "MD5": "f024ff4176f0036f97ebc95decfd1d5e"
            }
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--75e10c92-9377-4db7-9433-61c1b365e65d",
            "created": "2026-06-24T16:05:18.940676Z",
            "modified": "2026-06-24T16:05:18.940676Z",
            "name": "YARA Rule",
            "pattern": "rule rivts_pdb {\r\nmeta:\r\ndescription = \"Detects Rivts based on PDB folder\"\r\nauthor = \"cdoman@alienvault.com\"\r\ntlp = \"white\"\r\nlicense = \"MIT License\"\r\nstrings:\r\n$m = \"F:\\meWork\\\" nocase wide ascii\r\ncondition: uint16(0) == 0x5a4d and any of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2018-02-15T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4d8fdf21-950a-400c-8186-f00d9cfc99a9",
            "hashes": {
                "MD5": "ff4721e6edad7d3bec8e0c4d4a8c1d26"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e596593b-b6fe-44fd-a019-efe693975f5b",
            "hashes": {
                "MD5": "78d3c8705f8baf7d34e6a6737d1cfa18"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2207a2a6-dc6a-419d-8218-a7e088a542a0",
            "hashes": {
                "MD5": "fffa05401511ad2a89283c52d0c86472"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f30a8f26-eb6d-40e6-a464-fe6f771c116f",
            "hashes": {
                "MD5": "4b584695ba08e680452be6016886637a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4d17e046-2c54-41cc-9bfd-bc8c1d8e6a1b",
            "hashes": {
                "MD5": "344d3ec0d84d2853e416c664dd577f44"
            }
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--b5ed866e-ef9d-44f7-a1ca-0593e4600fca",
            "value": "xiake722@gmail.com"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--082cb3c2-fe19-47fc-af5b-ed486099037b",
            "value": "http://www.vok.rep.kp/CBC/CBC_download/HMSPlayer.exe"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--536dd72a-d71b-437a-9ecc-dbbf3b148b90",
            "value": "a-gwas-01.slyip.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fa83b8fb-b53e-4eb2-b885-e45151e8d373",
            "value": "a-gwas-01.dyndns.org"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1b99f6c7-7938-4b50-ad0a-d2f0f47c3d7a",
            "hashes": {
                "MD5": "3844ec6ec70347913bd1156f8cd159b8"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-06-24T16:05:18.950732Z",
            "modified": "2026-06-24T16:05:18.950732Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--be3bddf2-b101-4b56-b8df-0d62e35be91d",
            "created_by_ref": "identity--acadf73f-9f52-4ca7-9140-95ee34cc35b2",
            "created": "2026-06-24T16:05:18.95176Z",
            "modified": "2026-06-24T16:05:18.95176Z",
            "name": "North Korean Cyber-Attacks and Collateral Damage",
            "published": "2018-02-15T00:00:00Z",
            "object_refs": [
                "identity--acadf73f-9f52-4ca7-9140-95ee34cc35b2",
                "email-addr--6b09131b-0227-4ac5-9e39-c49e6e874c77",
                "email-addr--003e84ad-9c9e-4a83-829f-9ed966548a80",
                "file--6a0a5e5d-dca7-4f35-80c2-dde1daef7246",
                "indicator--75e10c92-9377-4db7-9433-61c1b365e65d",
                "file--4d8fdf21-950a-400c-8186-f00d9cfc99a9",
                "file--e596593b-b6fe-44fd-a019-efe693975f5b",
                "file--2207a2a6-dc6a-419d-8218-a7e088a542a0",
                "file--f30a8f26-eb6d-40e6-a464-fe6f771c116f",
                "file--4d17e046-2c54-41cc-9bfd-bc8c1d8e6a1b",
                "email-addr--b5ed866e-ef9d-44f7-a1ca-0593e4600fca",
                "url--082cb3c2-fe19-47fc-af5b-ed486099037b",
                "domain-name--536dd72a-d71b-437a-9ecc-dbbf3b148b90",
                "domain-name--fa83b8fb-b53e-4eb2-b885-e45151e8d373",
                "file--1b99f6c7-7938-4b50-ad0a-d2f0f47c3d7a",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.alienvault.com/blogs/security-essentials/north-korean-cyber-attacks-and-collateral-damage"
                }
            ]
        }
    ]
}