{
    "type": "bundle",
    "id": "bundle--6ec5ccb6-aad9-43da-b8ee-fd507bcda000",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--a96f8bbb-0501-4026-a441-edfe31375afa",
            "created": "2025-12-03T00:51:50.222128Z",
            "modified": "2026-06-29T08:28:32.135468Z",
            "name": "OpenSourceMalware",
            "identity_class": "organization"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--4c5afd07-1e36-4a6a-948e-894adbe938bd",
            "value": "http://193.32.204.199/?c=new"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5daaf448-96a1-47d0-a0bc-154e703d4f09",
            "value": "http://193.32.204.199:8080/?c=security"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--9ce4dc96-1e3c-497c-a743-81ef743caad6",
            "value": "http://193.32.204.199:8080/?c=auto_20261015"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--990df6d2-c3ec-400d-8521-31ddaceca118",
            "value": "http://193.32.204.199:8080/?c=auto_20261014"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--f78803a5-5f4a-4eb5-883e-c77798e6d5e4",
            "value": "http://193.32.204.199:8080/?c=auto_20261013"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--9db798b9-b051-4d2f-b9bf-a49b85d5d954",
            "value": "http://193.32.204.199:8080/?c=reinject"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--44694286-3fde-4cd0-9dda-59f8c3cd4ed6",
            "hashes": {
                "SHA-256": "40a007874722c46e0d194c4453f6cee26ee9c64513597784cc9c0e8b85471e7c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7e1be59b-ced8-4e4a-bf3e-e6306dd3493a",
            "hashes": {
                "SHA-256": "d301438d713006a7a63889969fb5a30389c88bba5fbd89ef22becac611823a4f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cee0f564-4ee9-40a3-bd3d-9829b278d22f",
            "hashes": {
                "MD5": "c6148e5bc447568429fdabab7866a73f",
                "SHA-1": "826199aa6e5f7e28085fbad95f1b44168c082c66",
                "SHA-256": "6d258db70677c99c08c9db37e002751eb0f0fb7c0cab2a4effd7c8fa8d115d19"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--93c0af54-3651-4121-9e9e-88f5af2ce250",
            "hashes": {
                "SHA-256": "a043f03e89ef55779f4f630138cf5efe1dd37632e176c7a0d9bbfa989ba84eeb"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c4ad0df7-df36-4f99-9600-190b1fe357f9",
            "hashes": {
                "SHA-256": "92dec8f50d934c338ff3c1bcbf1c9b028aa9561128d0077a101a1ef4dac0f0db"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a5adc844-39b0-4319-9262-2e200efe35ce",
            "hashes": {
                "SHA-256": "61eca87b4b4c3e6248dc0fde25ff9cf28637798a8c4be172eaef9843252d12f6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4b453390-5f2b-4003-894b-44ffd8a25c9e",
            "hashes": {
                "SHA-256": "cb3842832267421b9563c7bd32d3582a8fff624860e57c2c9058966735d4da60"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--a52ae976-5c5b-4f97-bd59-941221ac8d16",
            "value": "193.32.204.199"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--21a5efde-6a09-5457-b095-3687a21fa8b8",
            "created": "2026-10-21T06:08:01.365914Z",
            "modified": "2026-10-21T06:08:01.365914Z",
            "name": "PolinRider"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--a76ef500-e8ed-43f2-abdb-821df24b92c2",
            "created_by_ref": "identity--a96f8bbb-0501-4026-a441-edfe31375afa",
            "created": "2026-10-21T06:08:01.366198Z",
            "modified": "2026-10-21T06:08:01.366198Z",
            "name": "GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File",
            "published": "2026-10-16T00:00:00Z",
            "object_refs": [
                "identity--a96f8bbb-0501-4026-a441-edfe31375afa",
                "url--4c5afd07-1e36-4a6a-948e-894adbe938bd",
                "url--5daaf448-96a1-47d0-a0bc-154e703d4f09",
                "url--9ce4dc96-1e3c-497c-a743-81ef743caad6",
                "url--990df6d2-c3ec-400d-8521-31ddaceca118",
                "url--f78803a5-5f4a-4eb5-883e-c77798e6d5e4",
                "url--9db798b9-b051-4d2f-b9bf-a49b85d5d954",
                "file--44694286-3fde-4cd0-9dda-59f8c3cd4ed6",
                "file--7e1be59b-ced8-4e4a-bf3e-e6306dd3493a",
                "file--cee0f564-4ee9-40a3-bd3d-9829b278d22f",
                "file--93c0af54-3651-4121-9e9e-88f5af2ce250",
                "file--c4ad0df7-df36-4f99-9600-190b1fe357f9",
                "file--a5adc844-39b0-4319-9262-2e200efe35ce",
                "file--4b453390-5f2b-4003-894b-44ffd8a25c9e",
                "ipv4-addr--a52ae976-5c5b-4f97-bd59-941221ac8d16",
                "threat-actor--21a5efde-6a09-5457-b095-3687a21fa8b8"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file"
                }
            ]
        }
    ]
}