{
    "type": "bundle",
    "id": "bundle--52b86a7b-8c6b-4799-b0d0-ca339b69fcf8",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--62791516-e53e-4728-ae58-19ce2cf2fa82",
            "created": "2025-11-15T02:03:14.609594Z",
            "modified": "2025-11-15T02:28:49.217997Z",
            "name": "RansomISAC",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--aaafb69f-656f-4bc3-b61f-c6857f1b6307",
            "value": "185.163.125.196"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--26591eeb-7c6f-4f90-82df-c00a759de675",
            "value": "147.124.202.208"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f35de203-ef9d-4e91-b1d9-79a762d146d5",
            "value": "163.245.194.216"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--ce0df1f2-17ad-491d-98fc-42de51998906",
            "value": "66.235.168.136"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--3c508568-d8f4-42c9-9eb3-b07b70bc9500",
            "value": "87.236.177.9"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2c187969-c88c-4997-85b3-37e61f15602f",
            "created": "2026-10-23T01:19:54.403487Z",
            "modified": "2026-10-23T01:19:54.403487Z",
            "name": "YARA Rule",
            "pattern": "rule Actor_APT_DPRK_MAL_SCRIPT_JS_Dropper_Unknown_Strings_Mar26\n{\n    meta:\n        rule_id = \"713af537-771f-44ee-b65c-1647d5ec9a84\"\n        date = \"13-03-2026\"\n        author = \"Ransom-ISAC\"\n        description = \"Detects JavaScript used by DPRK operators to fetch the next stage payloads\"\n        filehash1 = \"165324541c8f2d0a4bdac12fcf7ccc1738caf7e36bb11721186e0c560c4a8a69\"\n        filehash2 = \"e1790a08ebf0402d49e826b6f773b3b6e55f3cb5a755bc2067dda2a0c2737503\"\n    strings:\n        $js1 = \"const\" ascii\n        $js2 = \"async function\" ascii\n        $str1 = \"hostname\" ascii\n        $str2 = \"macs\" ascii\n        $str3 = \"networkInterfaces\" ascii\n        $str4 = \"filter\" ascii\n        $str5 = \"instanceId\" ascii\n        $str6 = \"errorMessage\" ascii\n        $str7 = \"setInterval\" ascii\n        $str8 = \"axios\" ascii\n        $hex1 = { 65 78 63 65 70 74 69 6f 6e 49 64 3a 22 65 6e 76 ?? ?? ?? ?? ?? ?? 22 }\n        $hex2 = { 27 73 74 61 74 75 73 27 2c 27 65 6e 76 ?? ?? ?? ?? ?? ?? 27 }\n        $uri = \":3000/api/errorMessage\" ascii\n        $mac = \"00:00:00:00:00:00\" ascii\n    condition:\n        all of ($js*) and 5 of ($str*) and (any of ($hex*) or $uri) and $mac and filesize < 25KB\n}",
            "pattern_type": "yara",
            "valid_from": "2026-03-16T00:00:00Z"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--a96a19c6-8d1a-4a85-a961-f7632cf170cd",
            "value": "kosukek748@gmail.com"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--a6fd154d-9140-426b-9e2e-38c230b91ee9",
            "value": "https://github.com/ArsagaPPro/Jp-Soccer2.git"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--0e393e7f-e839-4d8f-bf41-d406793d6f8b",
            "value": "https://sync-oracle-v3.vercel.app/api/getMoralisData"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--ab45559c-d9df-42bd-87eb-93b86513f03e",
            "value": "https://metric-analytics-refresh.vercel.app/api/getMoralisData"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--fec21fb2-7b17-4862-8332-d2462e2eee2e",
            "value": "https://jersey-factory.x.yupoo.com/"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--0d73e0e7-2a2f-4fe8-b787-60b665150a56",
            "value": "http://api-web3-auth.vercel.app/api/auth"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59907a40-7502-4d8c-a531-743fe7c772bd",
            "value": "http://147.124.202.208:3000/api/errorMessage"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--424c49c7-9c5c-4c0d-99bf-32a24c113fb0",
            "value": "http://88.99.212.230:3000/api/errorMessage"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--126e9fbe-7498-4ece-bad6-7203aa57edad",
            "value": "http://185.163.125.196:3000/api/errorMessage"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--033584e4-84c0-4b7e-b8d1-a62f2afa58ee",
            "value": "http://174.138.188.80:3000/api/errorMessage"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--385817df-30eb-4d99-bfcc-f9859253b700",
            "value": "http://163.245.194.216:3000/api/errorMessage"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--25d3e28d-217c-4dda-86e9-7b28bfc2e907",
            "value": "http://87.236.177.9:3000/api/errorMessage"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--d6ba86c3-f816-40bb-b0db-486a62689544",
            "value": "http://66.235.168.136:3000/api/errorMessage"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0579ac18-9e72-4900-9a15-c7faaf363801",
            "value": "sync-oracle-v3.vercel.app"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9a415095-cf0b-499b-ba40-1497d099169a",
            "value": "metric-analytics-refresh.vercel.app"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a4ecd9bc-d98f-453b-97c1-7734278a3cf2",
            "value": "jersey-factory.x.yupoo.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--441ef1b2-f6cd-47ce-aa49-cb068ba3953e",
            "value": "api-web3-auth.vercel.app"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--aa48d360-3ba2-4dbf-a5ea-9c202c1ffdf3",
            "hashes": {
                "SHA-256": "165324541c8f2d0a4bdac12fcf7ccc1738caf7e36bb11721186e0c560c4a8a69"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3fdb9a5f-c027-4c32-b96b-61e5adda936d",
            "hashes": {
                "SHA-256": "e1790a08ebf0402d49e826b6f773b3b6e55f3cb5a755bc2067dda2a0c2737503"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bde23710-3866-4305-bed6-cae03e7bc340",
            "hashes": {
                "SHA-256": "1e498ea74be7447fb13c53670084532294f4bbe0f4fd3748da1a3900a5a63cf0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--573de51f-be7d-400b-bf77-2477bb0449d0",
            "hashes": {
                "SHA-256": "57be9d3be7da3e8dff28b8d32de4427d4a31b8df2bebd972a1bd2270b5dadd83"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8a10da46-94a7-4673-b457-665fe58af773",
            "hashes": {
                "SHA-256": "d33d0c358a75bfb73cbf901868c5ebfb6eccc8baaed073395c63a0b9caa73dd7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3a7938db-9df3-41b0-a79f-617eadfe9d41",
            "hashes": {
                "SHA-256": "8bae383ed46c28477b602b75d55c3e13469f5a2944f30203c20d0097b10e6bc2"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--c3e41046-e239-4e9e-8179-92de46864015",
            "value": "174.138.188.80"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4be34cef-cf2d-4c00-a72b-3e092d524d8a",
            "value": "104.192.42.117"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--140f121e-0cc3-4651-b279-695479077c6d",
            "value": "web3-metric-analytics.vercel.app"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--c18c07ac-ce26-4e98-8327-a28790266cc4",
            "value": "https://web3-metric-analytics.vercel.app/api/getMoralisData"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--517f1d6a-514b-592b-8216-43a310ad6d08",
            "created": "2026-10-23T01:19:54.406857Z",
            "modified": "2026-10-23T01:19:54.406857Z",
            "name": "ContagiousInterview"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--b8019a7c-8169-4586-aaba-723ef4c3a9b8",
            "created_by_ref": "identity--62791516-e53e-4728-ae58-19ce2cf2fa82",
            "created": "2026-10-23T01:19:54.409611Z",
            "modified": "2026-10-23T01:19:54.409611Z",
            "name": "Contagious Interview: VS Code to RAT",
            "published": "2026-03-16T00:00:00Z",
            "object_refs": [
                "identity--62791516-e53e-4728-ae58-19ce2cf2fa82",
                "ipv4-addr--aaafb69f-656f-4bc3-b61f-c6857f1b6307",
                "ipv4-addr--26591eeb-7c6f-4f90-82df-c00a759de675",
                "ipv4-addr--f35de203-ef9d-4e91-b1d9-79a762d146d5",
                "ipv4-addr--ce0df1f2-17ad-491d-98fc-42de51998906",
                "ipv4-addr--3c508568-d8f4-42c9-9eb3-b07b70bc9500",
                "indicator--2c187969-c88c-4997-85b3-37e61f15602f",
                "email-addr--a96a19c6-8d1a-4a85-a961-f7632cf170cd",
                "url--a6fd154d-9140-426b-9e2e-38c230b91ee9",
                "url--0e393e7f-e839-4d8f-bf41-d406793d6f8b",
                "url--ab45559c-d9df-42bd-87eb-93b86513f03e",
                "url--fec21fb2-7b17-4862-8332-d2462e2eee2e",
                "url--0d73e0e7-2a2f-4fe8-b787-60b665150a56",
                "url--59907a40-7502-4d8c-a531-743fe7c772bd",
                "url--424c49c7-9c5c-4c0d-99bf-32a24c113fb0",
                "url--126e9fbe-7498-4ece-bad6-7203aa57edad",
                "url--033584e4-84c0-4b7e-b8d1-a62f2afa58ee",
                "url--385817df-30eb-4d99-bfcc-f9859253b700",
                "url--25d3e28d-217c-4dda-86e9-7b28bfc2e907",
                "url--d6ba86c3-f816-40bb-b0db-486a62689544",
                "domain-name--0579ac18-9e72-4900-9a15-c7faaf363801",
                "domain-name--9a415095-cf0b-499b-ba40-1497d099169a",
                "domain-name--a4ecd9bc-d98f-453b-97c1-7734278a3cf2",
                "domain-name--441ef1b2-f6cd-47ce-aa49-cb068ba3953e",
                "file--aa48d360-3ba2-4dbf-a5ea-9c202c1ffdf3",
                "file--3fdb9a5f-c027-4c32-b96b-61e5adda936d",
                "file--bde23710-3866-4305-bed6-cae03e7bc340",
                "file--573de51f-be7d-400b-bf77-2477bb0449d0",
                "file--8a10da46-94a7-4673-b457-665fe58af773",
                "file--3a7938db-9df3-41b0-a79f-617eadfe9d41",
                "ipv4-addr--c3e41046-e239-4e9e-8179-92de46864015",
                "ipv4-addr--4be34cef-cf2d-4c00-a72b-3e092d524d8a",
                "domain-name--140f121e-0cc3-4651-b279-695479077c6d",
                "url--c18c07ac-ce26-4e98-8327-a28790266cc4",
                "threat-actor--517f1d6a-514b-592b-8216-43a310ad6d08"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://ransom-isac.org/blog/contagious-interview-vscode-to-rat/"
                }
            ]
        }
    ]
}