{
    "type": "bundle",
    "id": "bundle--91d86ef5-f473-46e3-94cf-c4567e9689fa",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--243c3ae6-45e8-41db-8bdd-4897aaae4670",
            "created": "2023-03-08T12:51:43.142167Z",
            "modified": "2023-05-13T00:24:09.959414Z",
            "name": "PolySwarm",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--63c07a5a-058b-4c80-860d-96f03f73799d",
            "hashes": {
                "SHA-256": "da56b0416b205b36337af22738967445ff310ca0f6051b243f00b83baa67aa09"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b3fc825e-ed79-46b3-81a6-b5077e588c87",
            "value": "nidlogon.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c26ef709-a75d-4949-96c5-ffcff6406d98",
            "value": "st0746.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--784c988a-d0eb-4b74-bde6-fe383f094484",
            "value": "naverfiles.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0e1bb0e0-5d0a-423d-a872-a585bb9d9724",
            "value": "27.255.79.225"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--c81b2a49-e1c1-5e7a-b6e6-097ff83b2965",
            "created": "2026-06-24T19:46:38.348552Z",
            "modified": "2026-06-24T19:46:38.348552Z",
            "name": "RicochetChollima"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--492b873e-5dd6-4e72-9db3-faf63e420e77",
            "created_by_ref": "identity--243c3ae6-45e8-41db-8bdd-4897aaae4670",
            "created": "2026-06-24T19:46:38.351154Z",
            "modified": "2026-06-24T19:46:38.351154Z",
            "name": "Ricochet Chollima Using KoSpy Android Spyware",
            "published": "2025-03-17T00:00:00Z",
            "object_refs": [
                "identity--243c3ae6-45e8-41db-8bdd-4897aaae4670",
                "file--63c07a5a-058b-4c80-860d-96f03f73799d",
                "domain-name--b3fc825e-ed79-46b3-81a6-b5077e588c87",
                "domain-name--c26ef709-a75d-4949-96c5-ffcff6406d98",
                "domain-name--784c988a-d0eb-4b74-bde6-fe383f094484",
                "ipv4-addr--0e1bb0e0-5d0a-423d-a872-a585bb9d9724",
                "threat-actor--c81b2a49-e1c1-5e7a-b6e6-097ff83b2965"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.polyswarm.io/ricochet-chollima-using-kospy-android-spyware"
                }
            ]
        }
    ]
}