{
    "type": "bundle",
    "id": "bundle--2985a8cd-955f-4081-ade5-f61337a7c323",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--73e00b2e-370c-4b86-982a-3f0379027134",
            "created": "2023-03-08T12:51:58.84666Z",
            "modified": "2023-03-08T12:51:58.84674Z",
            "name": "Anomali",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--26618aca-1ed9-43e2-a6ac-722676f112fe",
            "hashes": {
                "MD5": "d1c27ee7ce18675974edf42d4eea25c6",
                "SHA-1": "7e2561eb67a6ead09f727d98b71c01f18985bbb9",
                "SHA-256": "4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9542d271-86c6-4f6a-92fb-d6e1e47a96c7",
            "hashes": {
                "MD5": "760c35a80d758f032d02cf4db12d3e55",
                "SHA-1": "1c66e67a8531e3ff1c64ae57e6edfde7bef2352d",
                "SHA-256": "e2ecec43da974db02f624ecadc94baf1d21fd1a5c4990c15863bb9929f781a0a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--72d72528-b439-4703-8eb3-a48977817c62",
            "hashes": {
                "MD5": "558b020ce2c80710605ed30678b6fd0c",
                "SHA-1": "c6eb8e46810f5806d056c4aa34e7b8d8a2c37cad",
                "SHA-256": "4cf164497c275ae0f86c28d7847b10f5bd302ba12b995646c32cb53d03b7e6b5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a514fe65-cc53-400c-a40c-7c01e4c87107",
            "hashes": {
                "MD5": "24d76abbc0a10e4c977a28b33c879248",
                "SHA-1": "525a8e3ae4e3df8c9c61f2a49e38541d196e9228",
                "SHA-256": "4659dadbf5b07c8c3c36ae941f71b631737631bc3fded2fe2af250ceba98959a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--88f52636-735e-4e6e-aeb4-e2f9db0d4c37",
            "hashes": {
                "MD5": "5d0ffbc8389f27b0649696f0ef5b3cfe",
                "SHA-1": "76bab478dcc70f979ce62cd306e9ba50ee84e37e",
                "SHA-256": "ae086350239380f56470c19d6a200f7d251c7422c7bc5ce74730ee8bab8e6283"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c3782cc7-3473-44a6-9e25-71c4bce30967",
            "hashes": {
                "MD5": "1d0e79feb6d7ed23eb1bf7f257ce4fee",
                "SHA-1": "70bf16597e375ad691f2c1efa194dbe7f60e4eeb",
                "SHA-256": "5b7c970fee7ebe08d50665f278d47d0e34c04acc19a91838de6a3fc63a8e5630"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--372f6548-0924-4e13-abcc-435b4eb49f72",
            "hashes": {
                "MD5": "6467c6df4ba4526c7f7a7bc950bd47eb",
                "SHA-1": "a1805d0611f2bd2751e69ee7e634bc963b1d9585",
                "SHA-256": "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55"
            }
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--ef5398e6-d030-4458-ae4b-c3a3ea511fd3",
            "created": "2026-10-10T10:21:20.638486Z",
            "modified": "2026-10-10T10:21:20.638486Z",
            "name": "YARA Rule",
            "pattern": "rule AnomaliLABS_Lazarus_wipe_file_routine {\r\nmeta:\r\nauthor = \"aaron shelmire\"\r\ndate = \"2015 May 26\"\r\ndesc = \u201cYara sig to detect File Wiping routine of the Lazarus group\u201d\r\nstrings:\r\n$rand_name_routine = { 99 B9 1A 00 00 00 F7 F9 80 C2 61 88 16 8A 46 01 46 84 C0 }\r\n/* imports for overwrite function */\r\n$imp_getTick = \"GetTickCount\"\r\n$imp_srand = \"srand\"\r\n$imp_CreateFile = \"CreateFileA\"\r\n$imp_SetFilePointer = \"SetFilePointer\"\r\n$imp_WriteFile = \"WriteFile\"\r\n$imp_FlushFileBuffers = \"FlushFileBuffers\"\r\n$imp_GetFileSizeEx = \"GetFileSizeEx\"\r\n$imp_CloseHandle = \"CloseHandle\"\r\n/* imports for rename function */\r\n$imp_strrchr = \"strrchr\"\r\n$imp_rand = \"rand\"\r\n$Move_File = \"MoveFileA\"\r\n$Move_FileEx = \"MoveFileEx\"\r\n$imp_RemoveDir = \"RemoveDirectoryA\"\r\n$imp_DeleteFile = \"DeleteFileA\"\r\n$imp_GetLastError = \"GetLastError\"\r\ncondition:\r\n$rand_name_routine and (11 of ($imp_*)) and ( 1 of ($Move_*))\r\n}",
            "pattern_type": "yara",
            "valid_from": "2016-05-27T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b5372057-0b27-4635-96e0-50570725a266",
            "hashes": {
                "MD5": "0d7d0f6728bfb5413fe69f897503a0a3",
                "SHA-1": "87d8803f0c399eca0c613bf90c917d66e1e2d57e",
                "SHA-256": "bdcfa3b6ca6b351e76241bca17e8f30cc8f35bed0309cee91966be9bd01cb848"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d074c8f0-9deb-4cf7-8e69-37592f4ef1d1",
            "hashes": {
                "MD5": "0b9bf941e2539eaa34756a9e2c0d5343",
                "SHA-1": "a1bc507b1c5c7a82e713554afe0f4cece900b6a2",
                "SHA-256": "ab9031e553b439290b9852ad39651c03bde00c300ea54bd61279fb9ae9f9434d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--34929550-10c2-4f11-9e24-4fa983fa58d6",
            "hashes": {
                "MD5": "96f4e767aa6bb1a1a5ab22e0662eec86",
                "SHA-1": "acd710b0c0c45154dd378b0e0ce3893667fd3493",
                "SHA-256": "ebb6d7009fafbfc5dd53ac6e55fb306a2484783ccde762096a7897434c211bb0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0220851c-e882-435b-923f-1d9c26b92b04",
            "hashes": {
                "MD5": "7f549a71dddac3de68015ad489da4cca",
                "SHA-1": "ee6464c4a360e8a87303ccb293ae2f563258519c",
                "SHA-256": "ddebee8fe97252203e6c943fb4f9b37ade3d5fefe90edba7a37e4856056f8cd6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d8cc5548-b1b0-4858-b2a6-69f35d7b4a96",
            "hashes": {
                "MD5": "c157acf215bba49b893649fd59804265",
                "SHA-1": "b5290f23d5346cf02c075845543f00093f2e79b1",
                "SHA-256": "138464214c78a73e3714d784697745acbf692ef40419d31418e4018e752cb92b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c97f5ecc-cf5c-4644-bad9-ef0e99fbe700",
            "hashes": {
                "MD5": "b0ec717aeece8d5d865a4f7481e941c5",
                "SHA-1": "0c446b40b0a8f503f1071b5351c54c98e2e04b7a",
                "SHA-256": "8ebe1659d4df02d6f166e3e23a26499b7fd74157e5852c6172058c2b4e4c3d38"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e11e8fa5-dbf9-43c2-9cfa-0bf8b74a526b",
            "hashes": {
                "MD5": "5a85ea837323554a0578f78f4e7febd8",
                "SHA-1": "95bca980cc91862fcabb0c66e7fcac1de4376afe",
                "SHA-256": "4a1798f9458928429bcab3413f951006ff0a93053b84da0bad919c80e85798cc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ce3da82a-d1b6-4bb3-b5d3-830e7faca1c8",
            "hashes": {
                "MD5": "909e1b840909522fe6ba3d4dfd197d93",
                "SHA-1": "781386119695d5d38bd533130d724c9abf6f4ff6",
                "SHA-256": "764189cf2707175251df6837da12797420ae4c482ad70f50cc0ec4acd21e4dff"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f26ca6c4-6747-4dce-a2c2-c9281cdab65c",
            "hashes": {
                "MD5": "f7272bb1374bf3af193ea1d1845b27fd",
                "SHA-1": "6207b92842b28a438330a2bf0ee8dcab7ef0a163",
                "SHA-256": "b07b37f0246bd436addbe5d702b12485d7bc8a9ef1475b54bff513a18e68fef7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e25ab141-d916-40ac-8941-a73de45b0dc9",
            "hashes": {
                "MD5": "e1864a55d5ccb76af4bf7a0ae16279ba",
                "SHA-1": "58dab205ecb1e0972027eb92f68cec6d208e5ab5",
                "SHA-256": "f6cb8343444771c3d03cc90e3ac5f76ff9a4cb9cd41e65c3b7f52b38b20c0c27"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-10-10T10:21:20.641853Z",
            "modified": "2026-10-10T10:21:20.641853Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--4d15b467-c3ae-4ec1-bcd6-b8b8b2e4b0e4",
            "created_by_ref": "identity--73e00b2e-370c-4b86-982a-3f0379027134",
            "created": "2026-10-10T10:21:20.643023Z",
            "modified": "2026-10-10T10:21:20.643023Z",
            "name": "Evidence of Stronger Ties Between North Korea and SWIFT Banking Attacks",
            "published": "2016-05-27T00:00:00Z",
            "object_refs": [
                "identity--73e00b2e-370c-4b86-982a-3f0379027134",
                "file--26618aca-1ed9-43e2-a6ac-722676f112fe",
                "file--9542d271-86c6-4f6a-92fb-d6e1e47a96c7",
                "file--72d72528-b439-4703-8eb3-a48977817c62",
                "file--a514fe65-cc53-400c-a40c-7c01e4c87107",
                "file--88f52636-735e-4e6e-aeb4-e2f9db0d4c37",
                "file--c3782cc7-3473-44a6-9e25-71c4bce30967",
                "file--372f6548-0924-4e13-abcc-435b4eb49f72",
                "indicator--ef5398e6-d030-4458-ae4b-c3a3ea511fd3",
                "file--b5372057-0b27-4635-96e0-50570725a266",
                "file--d074c8f0-9deb-4cf7-8e69-37592f4ef1d1",
                "file--34929550-10c2-4f11-9e24-4fa983fa58d6",
                "file--0220851c-e882-435b-923f-1d9c26b92b04",
                "file--d8cc5548-b1b0-4858-b2a6-69f35d7b4a96",
                "file--c97f5ecc-cf5c-4644-bad9-ef0e99fbe700",
                "file--e11e8fa5-dbf9-43c2-9cfa-0bf8b74a526b",
                "file--ce3da82a-d1b6-4bb3-b5d3-830e7faca1c8",
                "file--f26ca6c4-6747-4dce-a2c2-c9281cdab65c",
                "file--e25ab141-d916-40ac-8941-a73de45b0dc9",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.anomali.com/blog/evidence-of-stronger-ties-between-north-korea-and-swift-banking-attacks"
                }
            ]
        }
    ]
}