{
    "type": "bundle",
    "id": "bundle--6c66e48f-f6f4-4338-a7e2-12004105fb95",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--d6060d27-a078-4b68-808e-0f825436ce05",
            "created": "2025-02-20T01:00:01.713031Z",
            "modified": "2025-02-20T01:01:57.020342Z",
            "name": "ENKI",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f7bed63d-6475-4bce-b9e4-b2e40be59938",
            "value": "158.247.240.40"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b82d6b0c-eca3-49c9-afa8-bd6c529e33ab",
            "hashes": {
                "MD5": "6e5198c3aae9005cc58d011a8c6f0bec",
                "SHA-1": "373583cb44b5c1b551de50ff97abdba8560bf1e7",
                "SHA-256": "3a56acfeac7e99494e2ac54c7f998a4504832dc117dd79e9c2f74d7ad8ecad57"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8e9c7375-ac51-4b78-83cd-b1a04f8e208f",
            "hashes": {
                "MD5": "42d24ccfb0a05c5f299181ca3afc7ae3",
                "SHA-1": "f84ec2b072e76383e135450328f9072c2700a4b6",
                "SHA-256": "65e2e61ff2bf030a327189292d4998068860ee0d2a07e6ad259755ca8e32c432"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--523e5b8e-9463-4c57-a058-4a2c165bc9c1",
            "hashes": {
                "MD5": "ca9cb7bb06398670abc6d19186c336cd",
                "SHA-1": "7d05405dffd4cbd66f9c90633388fa7d13808073",
                "SHA-256": "249c9107bce4aefb125ac36d8f0b7288754ce5763c3ca13f5ad618dc89846770"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--673693b8-09c9-41ab-84f7-48bc255e9ecf",
            "hashes": {
                "MD5": "310ebb7ca19ff9b75d4054c340b0c82e",
                "SHA-1": "b1cf4f1264039e94e9c3d1c3889e1c26b413b385",
                "SHA-256": "20f2b30542fee92d08500da075ee2d5237920fa0fed0bf544bad75918805f8bf"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e2cd46d9-3078-4de6-b61b-5c37b7c5ffb5",
            "hashes": {
                "MD5": "52a321e48902b8fbd1e984d9bd15f278",
                "SHA-1": "ef581890bc75b31b914b513ccda53c7d3f25058f",
                "SHA-256": "cab399f07bf9083158af533a84fef44b4ca8b12edc3a9f45a682938c930b4caa"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b4491a29-a99d-4796-b2a6-7dd5de60559e",
            "hashes": {
                "MD5": "108b5fd1b62489fd5cdb4ebd4a463226",
                "SHA-1": "305a970a51eb755efcfe279bdb76274b301bcc6d",
                "SHA-256": "534bbe4ac27e4e2dfaa6e4a20f3961580f1b63ebfa04206af58be2cf2909b3cd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--580acf51-3be1-4d97-93c6-ca09ca1e39a6",
            "hashes": {
                "SHA-1": "3a665cf99a9b7a79f4fecb77bbe2bf5ff79687e3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--888aeb34-acf5-4040-b5fa-6d3696df3797",
            "hashes": {
                "MD5": "81bfe3b3204ede1fca418e44aa19b310",
                "SHA-1": "f5d944f771b890e7c0f88f743eb79654fe402228",
                "SHA-256": "d4a4acf9cf2ca2bc38c3990351b1867029085f0ec2fcbc02f5402fa2fcbe102c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--59d08cb8-d2f6-4a5b-8e86-cc02945aa69b",
            "hashes": {
                "MD5": "f96cf8cafbaf112548f6f122d9270cca"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2ed7fe20-7eaf-4fc2-9634-0bf47c759df2",
            "hashes": {
                "SHA-256": "a872738399912091389ae9720d5e068a0ef3b7d4c42b1ff24ea864f6c85683e9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--059c02e0-5b2f-4423-8dbf-6c3adac1a5d8",
            "hashes": {
                "MD5": "a6c26a0b5df0db6a35b15c24342f27f8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8d0b3b0d-872f-4600-bd91-38173b495003",
            "hashes": {
                "SHA-1": "1dc0668a628ea91766a75c87319a23b24939c07b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8981efdd-6ede-4096-9093-1811c97d6b04",
            "hashes": {
                "MD5": "e78be07019dfaf682c601985ac3ba424",
                "SHA-1": "411397e2875f7dd5a5d69748862918c57c7a32fb",
                "SHA-256": "be05370871f033c1dd3ce5a6a72a9f1cd4ecdd21d4e3435718cb25eea041666b"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--1342cf51-c3b5-4939-99d1-40c5d6e00633",
            "value": "147.135.109.226"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4d664b68-3ca2-4e85-a2ef-69f9e27c2019",
            "value": "95.214.54.164"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--7e77e30b-1445-4d39-9b2d-907f15752cb7",
            "value": "195.177.94.43"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--a65f5f6c-a522-4d4c-aca8-9d2e98d1252e",
            "value": "158.247.250.251"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e6aef9b5-5733-4b2e-a2b2-2584cc1974c1",
            "value": "161.248.239.119"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--14061f4a-f93a-49f3-a077-c779bedd152e",
            "value": "dhl.com"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-09-20T12:43:15.204886Z",
            "modified": "2026-09-20T12:43:15.204886Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--bdb9fd7e-e563-4cc0-b6b6-15f35ad3140a",
            "created_by_ref": "identity--d6060d27-a078-4b68-808e-0f825436ce05",
            "created": "2026-09-20T12:43:15.214585Z",
            "modified": "2026-09-20T12:43:15.214585Z",
            "name": "\uad6d\ub0b4 IP\uc5d0\uc11c \uc720\ud3ec\ub41c PureCrypter \uc801\uc6a9 Formbook \ud398\uc774\ub85c\ub4dc \ubd84\uc11d",
            "published": "2025-08-29T00:00:00Z",
            "object_refs": [
                "identity--d6060d27-a078-4b68-808e-0f825436ce05",
                "ipv4-addr--f7bed63d-6475-4bce-b9e4-b2e40be59938",
                "file--b82d6b0c-eca3-49c9-afa8-bd6c529e33ab",
                "file--8e9c7375-ac51-4b78-83cd-b1a04f8e208f",
                "file--523e5b8e-9463-4c57-a058-4a2c165bc9c1",
                "file--673693b8-09c9-41ab-84f7-48bc255e9ecf",
                "file--e2cd46d9-3078-4de6-b61b-5c37b7c5ffb5",
                "file--b4491a29-a99d-4796-b2a6-7dd5de60559e",
                "file--580acf51-3be1-4d97-93c6-ca09ca1e39a6",
                "file--888aeb34-acf5-4040-b5fa-6d3696df3797",
                "file--59d08cb8-d2f6-4a5b-8e86-cc02945aa69b",
                "file--2ed7fe20-7eaf-4fc2-9634-0bf47c759df2",
                "file--059c02e0-5b2f-4423-8dbf-6c3adac1a5d8",
                "file--8d0b3b0d-872f-4600-bd91-38173b495003",
                "file--8981efdd-6ede-4096-9093-1811c97d6b04",
                "ipv4-addr--1342cf51-c3b5-4939-99d1-40c5d6e00633",
                "ipv4-addr--4d664b68-3ca2-4e85-a2ef-69f9e27c2019",
                "ipv4-addr--7e77e30b-1445-4d39-9b2d-907f15752cb7",
                "ipv4-addr--a65f5f6c-a522-4d4c-aca8-9d2e98d1252e",
                "ipv4-addr--e6aef9b5-5733-4b2e-a2b2-2584cc1974c1",
                "domain-name--14061f4a-f93a-49f3-a077-c779bedd152e",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.enki.co.kr/media-center/blog/analysis-of-formbook-payload-loaded-by-purecrypter-distributed-from-south-korean-ip"
                }
            ]
        }
    ]
}