{
    "type": "bundle",
    "id": "bundle--1acf72b3-692c-4f6d-8f1c-78366e110458",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--5cb6c063-b2c4-4d8a-8bd2-88171741cb8f",
            "created": "2023-03-08T12:51:51.980512Z",
            "modified": "2024-04-04T09:49:05.246172Z",
            "name": "Norfolk",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--18d42973-ae2d-4798-b17c-fa3598d74d76",
            "value": "ip-api.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f193fc7f-a547-486c-b82c-2c0d73e45d62",
            "hashes": {
                "SHA-256": "8b2f2fad1d1f1e6ad915ea2224dd9f8544edf4aaf910ab9b3a3112cc5806f16d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8eb03d44-8e46-4b8f-b78a-e0547f852acd",
            "hashes": {
                "SHA-256": "72400a957654371be9363fdd2753ffea8f240a8b3e6e03edc116f8da96fa3ce4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4dbeb5bf-8efb-44fa-881f-e8390cee5048",
            "hashes": {
                "SHA-256": "ba47df4e0cccdff1c6e81b7a9e347ac094efc8c94caab3f53ed0bd32d0293bf0"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--e9f35cea-fd6e-5fc7-a5b9-2894700cb511",
            "created": "2026-06-24T17:08:18.332916Z",
            "modified": "2026-06-24T17:08:18.332916Z",
            "name": "LabyrinthChollima"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--3db57f89-ed4f-4a7b-9bf2-ab4413113fdc",
            "created_by_ref": "identity--5cb6c063-b2c4-4d8a-8bd2-88171741cb8f",
            "created": "2026-06-24T17:08:18.335508Z",
            "modified": "2026-06-24T17:08:18.335508Z",
            "name": "North Korea\u2019s Post-Infection Python Payloads",
            "published": "2024-04-03T00:00:00Z",
            "object_refs": [
                "identity--5cb6c063-b2c4-4d8a-8bd2-88171741cb8f",
                "domain-name--18d42973-ae2d-4798-b17c-fa3598d74d76",
                "file--f193fc7f-a547-486c-b82c-2c0d73e45d62",
                "file--8eb03d44-8e46-4b8f-b78a-e0547f852acd",
                "file--4dbeb5bf-8efb-44fa-881f-e8390cee5048",
                "threat-actor--e9f35cea-fd6e-5fc7-a5b9-2894700cb511"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://norfolkinfosec.com/north-koreas-post-infection-python-payloads/"
                }
            ]
        }
    ]
}