{
    "type": "bundle",
    "id": "bundle--9098748d-31bf-4575-8497-64cf83752939",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
            "created": "2023-03-08T14:44:38.241293Z",
            "modified": "2023-03-08T14:44:38.241418Z",
            "name": "S2W",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--45a4058a-ed84-40f5-9b1d-7c52f8e2a627",
            "hashes": {
                "SHA-256": "9e1a3653029b5378736ea1debba44cd81988de73b6d8689f9eba792e719da79a"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--c8146291-4d22-4eb5-9e01-037e734d457d",
            "value": "3.3.14.5"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--eb9a6a1d-0883-46ea-b679-e46ef2cdb9eb",
            "value": "185.231.154.22"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9dfa8a10-6245-4f81-9cdc-d3c38e2f75eb",
            "value": "93.183.93.185"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f43d4653-0f1a-4c7d-a6ef-3d54218056d2",
            "value": "62.113.118.157"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0aa12766-a606-4950-b8e6-d795945e7ffe",
            "hashes": {
                "SHA-256": "5ea09247ad85915a8d1066d1825061cc8348e14c4e060e1eba840d5e56ab3e4d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e55ce540-862e-4455-b19e-e81757d11a35",
            "hashes": {
                "SHA-256": "0329bb5b3a450b0a8f148a57e045bf6ed40eb49a62e026bd71b021a2efc40aed"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2ead8d4e-9abf-44e6-ac52-0266c2c86988",
            "value": "phasechangesolutions.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9d5f0159-b904-4453-9d15-a10430de3b30",
            "hashes": {
                "SHA-256": "2189aa5be8a01bc29a314c3c3803c2b8131f49a84527c6b0a710b50df661575e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--02237bfa-d399-4f52-9ea8-11bc9132f5c1",
            "hashes": {
                "MD5": "9d6c79c0b395cceb83662aa3f7ed0123"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--74644255-fff1-47d9-9371-e55637ce3c5b",
            "hashes": {
                "SHA-256": "ba59f1ece68fa051400fd46467b0dc0a5294b8644c107646e75d225a45fff015"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ced357c3-61a1-4c00-9771-b1463655d028",
            "hashes": {
                "MD5": "7bb236041b91d4cd4fa129267cf109c3"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5eb3545f-d070-48cf-b67b-fe9f2dcebbc7",
            "value": "https://radionaranjalstereo.com/wp-content/themes/ai-news/js/inc/get.php?ra=iew&zw=lk0100"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--831eac47-adcc-4d18-a0c0-ccd244c1dc48",
            "value": "radionaranjalstereo.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c225c38a-64d7-4db5-8af5-65aefeb7f1d9",
            "value": "sibbss.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a14a3e44-5832-481d-b202-4eafc417cbe7",
            "hashes": {
                "MD5": "c56b5f0201a3b3de53e561fe76912bfd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2eed42a5-8632-4f3c-af6c-fdd98ae0158b",
            "hashes": {
                "MD5": "19dc387bffdc0a22f640bd38af320db4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--50e325ee-6dfd-4825-acec-cea929ba1129",
            "hashes": {
                "SHA-256": "7c08b9178c05ab765a3d7754ac99f4ba1abddb226dbb6cc898bc692bba1898a1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ef9c063b-9db1-45b4-a977-548bf1428a88",
            "hashes": {
                "SHA-256": "c2cc785857c64fa1f8fbb2e359a2638f187cd77cd29ca6701e38d750e822faa4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fd8610bb-bf14-4faf-9800-39c4e1a8dfe3",
            "hashes": {
                "MD5": "d357fc478765a22f403c699a812f29bd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a0810716-3220-4f2b-a695-926022274036",
            "hashes": {
                "SHA-256": "5bcfb56c4c884e3657bbfeacca37853113d640b77dff9af519c08c4b64ca029d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2cab92e0-6e32-4b56-b09c-b047501cc50e",
            "hashes": {
                "MD5": "6d6433c328f6cdce4a80efce3a29ea3e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a7f367c8-104c-4f12-9514-19dbfe793d50",
            "hashes": {
                "SHA-256": "808425bc599cd60989c90978d179af1d4c72dd7abfe5e0518aca44b48af15725"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b0bf1f17-46a3-4b07-83c9-b52ee269c7bd",
            "hashes": {
                "SHA-256": "e63082cf4db94f06d583a6313e48353366b44ce07b7ffceacc5bc4db88bd8810"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--9d9401a7-f55f-45f1-99e4-b0ae442c0d38",
            "value": "https://phasechangesolutions.com/wp-admin/css/colors/coffee/hurryup/?rv=super^&za=mongo1"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--21230e2b-451e-476d-a558-7c081fd26724",
            "value": "http://sibbss.com/upload.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--7367af6f-6252-4bfb-88f9-e71c065f1a47",
            "value": "https://phasechangesolutions.com/wp-admin/css/colors/coffee/hurryup/?rv=super^&za=mongo0"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--8c4626d2-2aa7-40cf-a471-833f3b7f0c19",
            "value": "https://file.drive002.com/read/get.php?cu=ln3&so=xu6502"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--ffe4e5a6-3f19-44d5-ae7f-b3fddffc78df",
            "value": "https://www.cammirando.com/wp-admin/css/temp/movement/?ra=aaaaaa^&zw=default1"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--729c6133-2ffe-4f3c-bbaf-fc3645904ed2",
            "value": "https://werxtracts.com/wp-content/themes/stylish-fashion-shop/js/inc/get.php?ra=iew&zw=lk0100"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--06c4420b-ee25-461a-9991-6fc0650aff6c",
            "value": "http://mq734121.info/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--69e74af7-5dd4-4cee-954c-d914c1fd3587",
            "value": "https://jethropc.com/wp-admin/css/temp/hurry/?rv=papago^&za=honey0"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0318bafc-1737-47dd-ab2c-6410ed9a8764",
            "value": "mq734121.info"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--320173e5-9f79-4d5e-817b-0ffe695c39f7",
            "value": "file.drive002.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--59e2edde-df5b-4841-acc1-95bab1827b8f",
            "value": "werxtracts.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--01881d3c-1498-4897-89c5-e91b2724e3d0",
            "hashes": {
                "MD5": "5613ba2032bc1528991b583e17bad59a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ff829e78-cc05-49fa-ac6f-fedff60cd50b",
            "hashes": {
                "MD5": "3c81dc763a4f003ba6e33cd5b63068cd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f696974f-4c30-4bd8-9ef4-e033fb0633c1",
            "hashes": {
                "MD5": "d5809e5f848f228634aa45ffe4a5ece0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f224d6c8-667d-4d06-8fd2-ce4c84080f51",
            "hashes": {
                "MD5": "4f865db4192afb5bbcdeb2e899ca97a4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c893b6b0-c746-4eb0-8277-094b0c784088",
            "hashes": {
                "SHA-256": "77d05cc623f860ca2e6d47cdafc517aa0612de88291de7f2a3d95c5d04f1658a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6ca0e334-35fb-415c-86a9-0da25c5e9054",
            "hashes": {
                "MD5": "a0483db3725f8a50078daee7fd10f9bb"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5259bd00-8aec-49da-b260-e49723b6850c",
            "value": "http://storkse.com/upload.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--35f71fdf-2d4c-42ae-aecd-6249398c1080",
            "value": "storkse.com"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--aab18a00-1c23-4697-a515-8c89c1a04800",
            "value": "https://jethropc.com/wp-admin/css/temp/hurry/?rv=papago^&za=honey1"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--47e875e2-bc27-4da8-9de1-79e013fdf77d",
            "hashes": {
                "MD5": "3334d2605c0df26536058f73a43cb074"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--b4f8d4d7-7b1a-47a5-9f75-4ced6e391b96",
            "value": "https://www.cammirando.com/wp-admin/css/temp/movement/?ra=aaaaaa^&zw=default0"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--697d4b44-b0e8-49c2-a2d0-536ed7e11e31",
            "value": "http://oryzanine.com/index.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a6ab9acb-fc8e-4953-a6cc-62f780e611fe",
            "value": "oryzanine.com"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--3e097228-d76c-44c3-ad46-f56f03035969",
            "value": "http://serviceset.net/upload.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9d493c53-e983-48c4-9625-9a128fac342b",
            "value": "serviceset.net"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--aaa4b4a9-44f0-4b70-8f60-05bfbf5c15f6",
            "value": "https://downwarding.com/v2/read/get.php?vw=ln3&nv=xu6502"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--775285a9-de19-404d-8f1c-01bbe2538d1e",
            "value": "https://bgfile.com/v2/read/get.php?vw=ln3&nv=xu6502"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--21a8fb44-5240-4758-a562-2192cb23b946",
            "value": "downwarding.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--33a62be6-9dce-4535-b945-25b7beb95821",
            "value": "bgfile.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0d8adffd-3c5b-4af4-b667-d98679e440c9",
            "hashes": {
                "MD5": "6f5e4b45ca0d8c1128d27a15421eea38"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--cfe02be0-2acb-4eaf-8db2-095329c32cea",
            "value": "http://ttzcloud.com/upload.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--42e7101e-a71a-4ef1-b77b-9afe6e62f9b1",
            "value": "ttzcloud.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--20541b64-a980-459f-b866-3ba1bb2479d9",
            "hashes": {
                "SHA-256": "778e46f8f3641a92d34da68dffc168fdc936841c5ad3d8b44da62a7b2dfe2ee1"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--d262bbf6-5d9c-59a1-9ace-966472abcd6c",
            "created": "2026-06-24T21:03:50.081295Z",
            "modified": "2026-06-24T21:03:50.081295Z",
            "name": "puNK-003"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--b4bbddb8-d614-556b-8053-6b2299bfb1c2",
            "created": "2026-06-24T21:03:50.083833Z",
            "modified": "2026-06-24T21:03:50.083833Z",
            "name": "puNK-002"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--9e644064-7245-5727-bafd-2c20500ecbee",
            "created": "2026-06-24T21:03:50.086122Z",
            "modified": "2026-06-24T21:03:50.086122Z",
            "name": "puNK-001"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--f5cc1c8c-6b28-4ea7-be3e-4d205706a9ba",
            "created_by_ref": "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
            "created": "2026-06-24T21:03:50.106162Z",
            "modified": "2026-06-24T21:03:50.106162Z",
            "name": "Threat Tracking: Analysis of puNK-003\u2019s Lilith RAT ported to AutoIt Script",
            "published": "2024-08-22T00:00:00Z",
            "object_refs": [
                "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
                "file--45a4058a-ed84-40f5-9b1d-7c52f8e2a627",
                "ipv4-addr--c8146291-4d22-4eb5-9e01-037e734d457d",
                "ipv4-addr--eb9a6a1d-0883-46ea-b679-e46ef2cdb9eb",
                "ipv4-addr--9dfa8a10-6245-4f81-9cdc-d3c38e2f75eb",
                "ipv4-addr--f43d4653-0f1a-4c7d-a6ef-3d54218056d2",
                "file--0aa12766-a606-4950-b8e6-d795945e7ffe",
                "file--e55ce540-862e-4455-b19e-e81757d11a35",
                "domain-name--2ead8d4e-9abf-44e6-ac52-0266c2c86988",
                "file--9d5f0159-b904-4453-9d15-a10430de3b30",
                "file--02237bfa-d399-4f52-9ea8-11bc9132f5c1",
                "file--74644255-fff1-47d9-9371-e55637ce3c5b",
                "file--ced357c3-61a1-4c00-9771-b1463655d028",
                "url--5eb3545f-d070-48cf-b67b-fe9f2dcebbc7",
                "domain-name--831eac47-adcc-4d18-a0c0-ccd244c1dc48",
                "domain-name--c225c38a-64d7-4db5-8af5-65aefeb7f1d9",
                "file--a14a3e44-5832-481d-b202-4eafc417cbe7",
                "file--2eed42a5-8632-4f3c-af6c-fdd98ae0158b",
                "file--50e325ee-6dfd-4825-acec-cea929ba1129",
                "file--ef9c063b-9db1-45b4-a977-548bf1428a88",
                "file--fd8610bb-bf14-4faf-9800-39c4e1a8dfe3",
                "file--a0810716-3220-4f2b-a695-926022274036",
                "file--2cab92e0-6e32-4b56-b09c-b047501cc50e",
                "file--a7f367c8-104c-4f12-9514-19dbfe793d50",
                "file--b0bf1f17-46a3-4b07-83c9-b52ee269c7bd",
                "url--9d9401a7-f55f-45f1-99e4-b0ae442c0d38",
                "url--21230e2b-451e-476d-a558-7c081fd26724",
                "url--7367af6f-6252-4bfb-88f9-e71c065f1a47",
                "url--8c4626d2-2aa7-40cf-a471-833f3b7f0c19",
                "url--ffe4e5a6-3f19-44d5-ae7f-b3fddffc78df",
                "url--729c6133-2ffe-4f3c-bbaf-fc3645904ed2",
                "url--06c4420b-ee25-461a-9991-6fc0650aff6c",
                "url--69e74af7-5dd4-4cee-954c-d914c1fd3587",
                "domain-name--0318bafc-1737-47dd-ab2c-6410ed9a8764",
                "domain-name--320173e5-9f79-4d5e-817b-0ffe695c39f7",
                "domain-name--59e2edde-df5b-4841-acc1-95bab1827b8f",
                "file--01881d3c-1498-4897-89c5-e91b2724e3d0",
                "file--ff829e78-cc05-49fa-ac6f-fedff60cd50b",
                "file--f696974f-4c30-4bd8-9ef4-e033fb0633c1",
                "file--f224d6c8-667d-4d06-8fd2-ce4c84080f51",
                "file--c893b6b0-c746-4eb0-8277-094b0c784088",
                "file--6ca0e334-35fb-415c-86a9-0da25c5e9054",
                "url--5259bd00-8aec-49da-b260-e49723b6850c",
                "domain-name--35f71fdf-2d4c-42ae-aecd-6249398c1080",
                "url--aab18a00-1c23-4697-a515-8c89c1a04800",
                "file--47e875e2-bc27-4da8-9de1-79e013fdf77d",
                "url--b4f8d4d7-7b1a-47a5-9f75-4ced6e391b96",
                "url--697d4b44-b0e8-49c2-a2d0-536ed7e11e31",
                "domain-name--a6ab9acb-fc8e-4953-a6cc-62f780e611fe",
                "url--3e097228-d76c-44c3-ad46-f56f03035969",
                "domain-name--9d493c53-e983-48c4-9625-9a128fac342b",
                "url--aaa4b4a9-44f0-4b70-8f60-05bfbf5c15f6",
                "url--775285a9-de19-404d-8f1c-01bbe2538d1e",
                "domain-name--21a8fb44-5240-4758-a562-2192cb23b946",
                "domain-name--33a62be6-9dce-4535-b945-25b7beb95821",
                "file--0d8adffd-3c5b-4af4-b667-d98679e440c9",
                "url--cfe02be0-2acb-4eaf-8db2-095329c32cea",
                "domain-name--42e7101e-a71a-4ef1-b77b-9afe6e62f9b1",
                "file--20541b64-a980-459f-b866-3ba1bb2479d9",
                "threat-actor--d262bbf6-5d9c-59a1-9ace-966472abcd6c",
                "threat-actor--b4bbddb8-d614-556b-8053-6b2299bfb1c2",
                "threat-actor--9e644064-7245-5727-bafd-2c20500ecbee"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://medium.com/s2wblog/threat-tracking-analysis-of-punk-003s-lilith-rat-ported-to-autoit-script-30dd59e68213"
                }
            ]
        }
    ]
}