{
    "type": "bundle",
    "id": "bundle--c8cca02e-d24e-497b-b2ab-3c72cfb62e6b",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--26f043d6-2bd6-459a-b07f-6d4d79229bfc",
            "created": "2026-01-13T04:01:05.551348Z",
            "modified": "2026-01-13T04:03:03.479042Z",
            "name": "RedAsgard",
            "identity_class": "organization"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--578aa97f-fe51-46e6-b0c7-622496ca6e46",
            "value": "http://138.226.247.154/session/8f3d559759e67132"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--c4e00c2b-9e62-435b-b794-53a572fb0169",
            "value": "https://db-connectors.vercel.app/server/v2"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--43a2ca4c-34ff-426a-b8ab-2ae949d8c755",
            "value": "blue-eagle-26751.zap.cloud"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ebf57548-de47-41d9-9191-92642c825c70",
            "value": "green-horse-42739.zap.cloud"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--faf5d0fa-8478-477f-9e5a-073ef9b7b13e",
            "value": "chainmanamgentagency.info"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--71d6a847-000b-4b33-afbe-cef7e088693f",
            "value": "db-connectors.vercel.app"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a1855454-aa12-45a0-8eeb-0415b1284077",
            "hashes": {
                "SHA-256": "5dff1771d10845cc06c6e501d9f3e4359ebe60bcf6a0d3699d8ed41abab24857"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0a865a83-b7f4-46d1-adab-e62ed76ac99f",
            "value": "185.248.161.18"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--c415b3aa-0465-4189-b7d1-c89d9753affa",
            "value": "147.189.169.26"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e777c018-df41-4ced-a7e9-da99dca80f24",
            "value": "94.249.185.106"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--ddafcc6d-b512-4d30-92af-6af6399925d7",
            "value": "138.226.247.154"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--66a3728e-5d8d-45fb-a7fa-f98cbcb767dc",
            "hashes": {
                "MD5": "7c587a9a4b52a9acda55ff820804bbe5",
                "SHA-1": "fba7f6b54682f75aef456984dd2590e500b49923",
                "SHA-256": "47a76888121a06bf9d56313b21be269a3b5acb32a7c25c0ef8c4739e219c27ce"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--dc9f09e9-c894-53f2-b8c7-e83de1a6be9a",
            "created": "2026-11-14T11:04:24.863155Z",
            "modified": "2026-11-14T11:04:24.863155Z",
            "name": "DevPopper"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--39f24384-1a97-4d23-bb95-1af6850fb609",
            "created_by_ref": "identity--26f043d6-2bd6-459a-b07f-6d4d79229bfc",
            "created": "2026-11-14T11:04:24.86396Z",
            "modified": "2026-11-14T11:04:24.86396Z",
            "name": "Hunting Lazarus Part X: DEV#POPPER Returns, Stealing Browser Credentials (Technical Record)",
            "published": "2026-11-13T00:00:00Z",
            "object_refs": [
                "identity--26f043d6-2bd6-459a-b07f-6d4d79229bfc",
                "url--578aa97f-fe51-46e6-b0c7-622496ca6e46",
                "url--c4e00c2b-9e62-435b-b794-53a572fb0169",
                "domain-name--43a2ca4c-34ff-426a-b8ab-2ae949d8c755",
                "domain-name--ebf57548-de47-41d9-9191-92642c825c70",
                "domain-name--faf5d0fa-8478-477f-9e5a-073ef9b7b13e",
                "domain-name--71d6a847-000b-4b33-afbe-cef7e088693f",
                "file--a1855454-aa12-45a0-8eeb-0415b1284077",
                "ipv4-addr--0a865a83-b7f4-46d1-adab-e62ed76ac99f",
                "ipv4-addr--c415b3aa-0465-4189-b7d1-c89d9753affa",
                "ipv4-addr--e777c018-df41-4ced-a7e9-da99dca80f24",
                "ipv4-addr--ddafcc6d-b512-4d30-92af-6af6399925d7",
                "file--66a3728e-5d8d-45fb-a7fa-f98cbcb767dc",
                "threat-actor--dc9f09e9-c894-53f2-b8c7-e83de1a6be9a"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://redasgard.com/blog/hunting-lazarus-part10-devpopper-returns-technical-record"
                }
            ]
        }
    ]
}