{
    "type": "bundle",
    "id": "bundle--2baa8e44-9d88-415b-a79c-09e2b9036fa4",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--0c5262d6-a544-4758-b214-c1a416d6028e",
            "created": "2023-03-30T22:51:38.926787Z",
            "modified": "2024-09-18T02:59:36.415321Z",
            "name": "Elastic",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4bb7238b-3e88-4f41-b0a0-cb7fdc3a2bf5",
            "value": "crypto.hondchain.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--59276dec-c2a2-4787-9903-8f9a491ea55a",
            "hashes": {
                "SHA-256": "7887638bcafd57e2896c7c16698e927ce92fd7d409aae698d33cdca3ce8d25b8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e4f07ae7-03ec-4104-88c6-5be8dc5fd075",
            "hashes": {
                "SHA-256": "4f49514ab1794177a61c50c63b93b903c46f9b914c32ebe9c96aa3cbc1f99b16"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cbefded5-17b9-4605-87f5-187a0f101f0c",
            "hashes": {
                "SHA-256": "788261d948177acfcfeb1f839053c8ee9f325bd6fb3f07637a7465acdbbef76a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--de16e733-4dbb-42e3-9f1d-64eb7638694b",
            "hashes": {
                "SHA-256": "fe8c0e881593cc3dfa7a66e314b12b322053c67cbc9b606d5a2c0a12f097ef69"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3718a9c7-701e-4428-9986-72029a85d4ba",
            "hashes": {
                "SHA-256": "de81e5246978775a45f3dbda43e2716aaa1b1c4399fe7d44f918fccecc4dd500"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5da3dae0-5f5c-41e4-9855-cc1fabc646fb",
            "hashes": {
                "SHA-256": "1031871a8bb920033af87078e4a418ebd30a5d06152cd3c2c257aecdf8203ce6"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56bded15-af14-4846-8ac7-66274efa4d2e",
            "value": "https://webhostwatto.work.gd"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--58759f69-01a4-4b05-b858-561d4b264e98",
            "value": "docsend.linkpc.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a86ba73b-454f-49d8-ad54-852cc7a3a3bb",
            "value": "webhostwatto.work.gd"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--462a8eff-5600-41c0-b51a-c537de6ee678",
            "value": "jaicvc.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--2cd7143b-2309-4ddc-809e-1589ac93908a",
            "value": "64.44.141.15"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4d2550d8-e9c7-41b1-b61d-5b323f3fe91f",
            "hashes": {
                "SHA-256": "7fccc871c889a4f4c13a977fdd5f062d6de23c3ffd27e72661c986fae6370387"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--671db2bf-3b96-4121-93c1-8f85ce4cba3d",
            "hashes": {
                "SHA-256": "ec8f97d5595d92ec678ffbf5ae1f60ce90e620088927f751c76935c46aa7dc41"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--97e23c53-d139-43c8-9956-20fa004ace38",
            "hashes": {
                "SHA-256": "9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--d481450f-a36d-4713-a050-37aaeed7fe5b",
            "value": "104.168.167.88"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb",
            "created": "2026-06-24T16:58:50.837126Z",
            "modified": "2026-06-24T16:58:50.837126Z",
            "name": "Bluenoroff"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--56bbc61a-b6ab-5d88-821d-5dc5619cf909",
            "created": "2026-06-24T16:58:50.84364Z",
            "modified": "2026-06-24T16:58:50.84364Z",
            "name": "REF9135"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--9d0f99fb-ef1f-4880-ad23-b54ac2f422f3",
            "created_by_ref": "identity--0c5262d6-a544-4758-b214-c1a416d6028e",
            "created": "2026-06-24T16:58:50.844803Z",
            "modified": "2026-06-24T16:58:50.844803Z",
            "name": "The DPRK strikes using a new variant of RUSTBUCKET",
            "published": "2023-06-29T00:00:00Z",
            "object_refs": [
                "identity--0c5262d6-a544-4758-b214-c1a416d6028e",
                "domain-name--4bb7238b-3e88-4f41-b0a0-cb7fdc3a2bf5",
                "file--59276dec-c2a2-4787-9903-8f9a491ea55a",
                "file--e4f07ae7-03ec-4104-88c6-5be8dc5fd075",
                "file--cbefded5-17b9-4605-87f5-187a0f101f0c",
                "file--de16e733-4dbb-42e3-9f1d-64eb7638694b",
                "file--3718a9c7-701e-4428-9986-72029a85d4ba",
                "file--5da3dae0-5f5c-41e4-9855-cc1fabc646fb",
                "url--56bded15-af14-4846-8ac7-66274efa4d2e",
                "domain-name--58759f69-01a4-4b05-b858-561d4b264e98",
                "domain-name--a86ba73b-454f-49d8-ad54-852cc7a3a3bb",
                "domain-name--462a8eff-5600-41c0-b51a-c537de6ee678",
                "ipv4-addr--2cd7143b-2309-4ddc-809e-1589ac93908a",
                "file--4d2550d8-e9c7-41b1-b61d-5b323f3fe91f",
                "file--671db2bf-3b96-4121-93c1-8f85ce4cba3d",
                "file--97e23c53-d139-43c8-9956-20fa004ace38",
                "ipv4-addr--d481450f-a36d-4713-a050-37aaeed7fe5b",
                "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb",
                "threat-actor--56bbc61a-b6ab-5d88-821d-5dc5619cf909"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.elastic.co/kr/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket"
                }
            ]
        }
    ]
}