{
    "type": "bundle",
    "id": "bundle--ed3e869e-2111-4b5c-b247-50737e1a3526",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--de461cbd-2e0d-496e-97ef-29e4006a8409",
            "created": "2023-03-08T12:51:55.917385Z",
            "modified": "2023-03-08T12:51:55.917478Z",
            "name": "Malwarelab",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cb6e8d79-983d-4edb-82ac-2a2c6bc58dd4",
            "hashes": {
                "MD5": "8fc7b0764541225e5505fa93a7376df4",
                "SHA-1": "c02a8450f93ca0d003d7b1db2be0253bbff7cce6",
                "SHA-256": "a8647a04563b746b1d8d4cdd67616cb646a3f6766d9c2d447541b9dc26452d8b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9a1f8a2a-aded-4dcf-be89-edd829073b4c",
            "hashes": {
                "MD5": "cd5357d1045948ba62710ad8128ae282",
                "SHA-1": "323e1f522f18415f8eef337a3551a736b69683d2",
                "SHA-256": "6590f66d6afe155b1109e81e2c36ece73236223ab17ae1a1c77a027be9f7d400"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d0509c01-360e-4f50-817d-cc7d4b15b62a",
            "hashes": {
                "MD5": "1bd0ca304cdecfa3bd4342b261285a72",
                "SHA-1": "c699826810a8e3fcb1408a53e1d75714385ed716",
                "SHA-256": "2627b7c827404ee49271bfc6bb152e52cf28e35c4bef1ad256018c5c08daea21"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9c57fdc6-32ac-4674-8101-98f1a88bb275",
            "hashes": {
                "MD5": "0071b20d27a24ae1e474145b8efc9718",
                "SHA-1": "6a82ebf8a6e868323b1de30a81cd6658ce4c31b6",
                "SHA-256": "d7ef8935437d61c975feb2bd826d018373df099047c33ad7305585774a272625"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--010129f1-f9b0-4ab6-bc7d-b3e198c2904f",
            "hashes": {
                "MD5": "c0a8483b836efdbae190cc069129d5c3",
                "SHA-1": "83c9095718ddd20cf287f5750256c00538ccd48f",
                "SHA-256": "3c5c1a7e7efe4eee3b7650167c664f730f40923a38c3e6640cbb2a4bfe9f64c6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1815d109-02ad-4f2b-8673-de5695010d14",
            "hashes": {
                "MD5": "92657b98c2b4ee4e8fa1b83921003c74",
                "SHA-1": "b84a1747f9672409a5daad0910681a9d33aa016f",
                "SHA-256": "21515fd6e6eb994defb589b4d0d9d956f7b4cb07823aaec501134ab063d883e9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5c8076ba-c333-4d79-ad2f-7b462b3e019d",
            "hashes": {
                "MD5": "59cb8474930ae7ea45b626443e01b66d",
                "SHA-1": "88069cb17ab766f2d4f68d679d11dcd844bcfb27",
                "SHA-256": "7fdfc719935d938651f45aafef3cd2ecc0020e9b77ac0780edb3ba585c16c9e2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b30591d3-31d7-4a51-b919-7443fdfcab13",
            "hashes": {
                "MD5": "14d79cd918b4f610c1a6d43cadeeff7b",
                "SHA-1": "ecd042eabdeae16532b9602be5786e408c3a622d",
                "SHA-256": "23d73fc8f10588944d8dc2073ce6af6d159943f11ac0c140c9b2e67fb0ad8b89"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--de9d9ced-c00f-4a5c-8d03-492160302997",
            "hashes": {
                "MD5": "075fba0c098d86d9f22b8ea8c3033207",
                "SHA-1": "b9d25359820c2fa990868764634a06e024201542",
                "SHA-256": "bb1b6865e62e6149ce7f849728fcbefa27358ceb9baaa53b8089c3fb9fb56ab3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b87ac927-b617-488d-89b7-02d7c688f424",
            "hashes": {
                "MD5": "78d42cedb0c012c62ef5be620c200d43",
                "SHA-1": "ed77b0dd1fe8a9c2ae7991333de550596ffb6fcc",
                "SHA-256": "454734dca530d54c4e8f543bdd33b5eb4b50f3039a953b54281dc67a09af4ca6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b6379012-db0f-4bbd-933e-0d5564e564fe",
            "hashes": {
                "MD5": "1f254dd0b85edd7e11339681979e3ad6",
                "SHA-1": "b4d72c236e3cd58d9f92c099dd2628163c3a05fb",
                "SHA-256": "66e5371c3da7dc9a80fb4c0fabfa23a30d82650c434eec86a95b6e239eccab88"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cda9c462-d50a-4b08-8ef2-6fdf59c9b952",
            "hashes": {
                "MD5": "f4b55da7870e9ecd5f3f565f40490996",
                "SHA-1": "4c729e0e247cfa7a4b047e463bc6e34ea4298e3b",
                "SHA-256": "b76b6bbda8703fa801898f843692ec1968e4b0c90dfae9764404c1a54abf650b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2f620175-0f85-40b9-986d-71fc52d3d8e3",
            "hashes": {
                "MD5": "2b02465b65024336a9e15d7f34c1f5d9",
                "SHA-1": "aa8214c2949bbf66c11a5e27f0e09a13427f5faa",
                "SHA-256": "48b8486979973656a15ca902b7bb973ee5cde9a59e2f3da53c86102d48d7dad8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3f7bd0bd-cdc8-4e8b-a67c-912af75ab8e0",
            "hashes": {
                "MD5": "65df11dea0c1d0f0304b376787e65ccb",
                "SHA-1": "c0d6bd29daa7d80b07e339fc48868639123e75a1",
                "SHA-256": "1b0c82e71a53300c969da61b085c8ce623202722cf3fa2d79160dac16642303f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f3f3f1c0-46cf-4c05-bf2a-a246c5013470",
            "hashes": {
                "MD5": "2efbe6901fc3f479bc32aaf13ce8cf12",
                "SHA-1": "7a58ba290eac891be743ffd1a74115799529873e",
                "SHA-256": "1076b25d5fa5cccdddcaf3f788789ae3c4ea9b034066693b6a0560af129ceda6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d7dc72b8-54cc-43a6-a038-b83b1c516e4f",
            "hashes": {
                "MD5": "f6d6f3580160cd29b285edf7d0c647ce",
                "SHA-1": "ceaf57f23ede93307da84abf07bcf137d258f55d",
                "SHA-256": "bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6dead7f2-7112-48c2-893a-13d8a79a296e",
            "hashes": {
                "MD5": "11fdc0be9d85b4ff1faf5ca33cc272ed",
                "SHA-1": "baae100337b76be346c3460711a0c413e639c7e1",
                "SHA-256": "37a3c01bb5eaf7ecbcfbfde1aab848956d782bb84445384c961edebe8d0e9969"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--70f55163-4366-483e-ac73-1661e813a261",
            "hashes": {
                "MD5": "265f407a157ab0ed017dd18cae0352ae",
                "SHA-1": "13c47e19182454efa60890656244ee11c76b4904",
                "SHA-256": "1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--07519134-5bc9-4473-825f-cfdf1f4f6bc2",
            "hashes": {
                "MD5": "25b37c971fd7e9e50e45691aa86e5f0a",
                "SHA-1": "975ae81997e6cd8c8a3901308d33c868f23e638f",
                "SHA-256": "26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--44e703b0-86f9-43fd-9569-9017f8d9834d",
            "hashes": {
                "MD5": "d1c652b4192857cb08907f0ba1790976",
                "SHA-1": "659c854bbdefe692ee8c52761e7a8c7ee35aa56c",
                "SHA-256": "ec254c40abff00b104a949f07b7b64235fc395ecb9311eb4020c1c4da0e6b5c4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7380aaeb-fa2d-4f71-b3b1-7aa4517c804a",
            "hashes": {
                "MD5": "7228705813d5bc6c6a62fc53ac019344",
                "SHA-1": "e6083b01fd23cc68680fea05490161e4fcd0c3dd",
                "SHA-256": "805183c19f4bffca871fb344247bd5d31357480c536c052c8b7c4109f507f3ef"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5ad41325-fdde-41ce-9eec-2058088b5746",
            "value": "http://www.elite4print.com/admin/order/batchPdfs.asp"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--6eb9ee78-ebfc-42a9-be22-4093cc33e582",
            "value": "https://www.sanlorenzoyacht.com/newsl/uploads/docs/1.dotm"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--f1fb4993-6f46-4197-ab12-c6f4119e4723",
            "value": "https://www.astedams.it/uploads/template/17.dotm"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--60b0ad22-c3c8-4aa8-b426-f98edc7a9529",
            "value": "https://www.sanlorenzoyacht.com/newsl/uploads/docs/43.dotm"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--026535aa-7680-4961-91d6-08842d9c0835",
            "created": "2026-10-09T12:30:25.052273Z",
            "modified": "2026-10-09T12:30:25.052273Z",
            "name": "YARA Rule",
            "pattern": "rule apt_NK_Lazarus_DllImplat_cfg_decoder { meta: reference = \"https://blog.malwarelab.pl/posts/lazarus_validator/\" hash = \"bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114\" hash = \"26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa\" author = \"Maciej Kotowicz, mak@malwarelab.pl\" copyright = \"MalwareLab.pl\" date = \"2020-05-18\" strings: $c0 = { 6A 15 59 8B F2 8D 7C 24 ?? F3 A5 8B ?? 24 ?? 83 E? 0F 6A 10 58 2B C? F7 D? 1B ?? 23 ?? 03 } $c1 = { B9 15 00 00 00 8B F2 8D 7C 24 ?? F3 A5 8B ?? 24 ?? [2] 83 E? 0F } condition: uint16(0) == 0x5a4d and any of them }",
            "pattern_type": "yara",
            "valid_from": "2020-05-15T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--82840755-9339-4c12-a78f-27ae7c8c95cb",
            "created": "2026-10-09T12:30:25.052449Z",
            "modified": "2026-10-09T12:30:25.052449Z",
            "name": "YARA Rule",
            "pattern": "rule apt_NK_Lazarus_DllImplat_cmd_line { meta: reference = \"https://blog.malwarelab.pl/posts/lazarus_validator/\" hash = \"141931bf718c5c4d3931f64b04e2112b65a6bcd46c0092300ff6824b573f8b36\" hash = \"b76b6bbda8703fa801898f843692ec1968e4b0c90dfae9764404c1a54abf650b\" hash = \"37a3c01bb5eaf7ecbcfbfde1aab848956d782bb84445384c961edebe8d0e9969\" hash = \"bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114\" hash = \"a8647a04563b746b1d8d4cdd67616cb646a3f6766d9c2d447541b9dc26452d8b\" hash = \"bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114\" hash = \"48b8486979973656a15ca902b7bb973ee5cde9a59e2f3da53c86102d48d7dad8\" hash = \"21515fd6e6eb994defb589b4d0d9d956f7b4cb07823aaec501134ab063d883e9\" hash = \"26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa\" author = \"Maciej Kotowicz, mak@malwarelab.pl\" copyright = \"MalwareLab.pl\" date = \"2020-05-18\" strings: $s0 = \" %s 0 0 %s 1\" $s1 = / %s 0 0 [0-9]+ 1/ condition: any of them and filesize <2MB }",
            "pattern_type": "yara",
            "valid_from": "2020-05-15T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--79a39584-60a3-4187-af7e-4f77456391ea",
            "hashes": {
                "MD5": "3aa8eddf26f5944a24dfeb57c9f49a17",
                "SHA-1": "5245f91cd7fcc816726a15cfffc3ad635f46ba39",
                "SHA-256": "d79bfa19e4d32692030d15c2767beb8cd88dc552d51245c88f42edd5129326f0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2745cb0d-5182-4476-9432-1d59f703507f",
            "hashes": {
                "SHA-256": "0f0b242fb5d73d08b856bc43432b350000000000000000000000000000000000"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--54811254-d406-4efd-929a-b5383dfd9db2",
            "hashes": {
                "SHA-256": "7f39a52fc6a51b5dd3830064c63f9d4900000000000000000000000000000000"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dfbec13b-c05d-49c8-9680-9ccbd22f984c",
            "hashes": {
                "SHA-256": "141931bf718c5c4d3931f64b04e2112b65a6bcd46c0092300ff6824b573f8b36"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f663aa77-ea50-4d19-a7f9-f5f212631ef6",
            "hashes": {
                "SHA-256": "7b5089c2bea3ec4aa98c5cdf69dac21500000000000000000000000000000000"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0c351a2f-3f16-43b1-815c-5180c94bf30c",
            "hashes": {
                "SHA-256": "cb38822697af45210d2759889c2eb2bf00000000000000000000000000000000"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e38a6936-a5db-40bd-b2cd-29c472a11638",
            "hashes": {
                "MD5": "59fab92d51c50467c1356080e6a5dead",
                "SHA-1": "1e462392bbf06b2f8be00aa63fff99148a90e190",
                "SHA-256": "69e50a20ea6be94e4336ba8cea3c438e8ce7c4aab66ce1baf26bc3a77200fb27"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--aceb2e29-7728-4f35-94ac-91599d3adb6e",
            "hashes": {
                "MD5": "074c02f7f5badd5c94d840c1e2ae9f72",
                "SHA-1": "5e8c30fb6a7396d4757e8b8f61f13720dac3a60f",
                "SHA-256": "cf44576adcfc51a062457398797f99e85b504a70208938180639c2e0cde7ca95"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fe1cdb72-cd61-440f-8cf7-4ec0b0dd60b9",
            "hashes": {
                "MD5": "b493f37ee0fddb1d832ddacaaf417029",
                "SHA-1": "ea8f32b859d98af901e3db7dfc333ad9091f8957",
                "SHA-256": "a769b39d0c80d1a035dd51efa28b09221cbb6c912def95a57c8910455e333756"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5e0502cf-a82f-4adc-9db5-3db5f481fbb0",
            "hashes": {
                "MD5": "223e954fd67c6cf75c3a6f987b94784b",
                "SHA-1": "1b43809aab3860da552410521b8fa949c4de86ed",
                "SHA-256": "f3e4947e32c6b1d0303b342a74426d4de0ad2de8d2bfb83f0003a1ebc650b7a7"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--d8a25631-6810-4451-a2f8-d16f8c59960c",
            "value": "https://www.curiofirenze.com/newsl/include/inc-map.asp"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--b72cc426-9c9a-4863-8bc6-ea2f732a2a93",
            "value": "http://www.astedams.it/include/inc-elenco-offerter.asp"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--922be6bc-e6ea-4c6e-82a9-b6c3ac05ed17",
            "value": "https://www.astedams.it/uploads/frame/61.dotm"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-10-09T12:30:25.055372Z",
            "modified": "2026-10-09T12:30:25.055372Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--178974ef-ce92-4bc6-8ed6-97902ea20f45",
            "created_by_ref": "identity--de461cbd-2e0d-496e-97ef-29e4006a8409",
            "created": "2026-10-09T12:30:25.055696Z",
            "modified": "2026-10-09T12:30:25.055696Z",
            "name": "In depth analysis of Lazarus validator",
            "published": "2020-05-15T00:00:00Z",
            "object_refs": [
                "identity--de461cbd-2e0d-496e-97ef-29e4006a8409",
                "file--cb6e8d79-983d-4edb-82ac-2a2c6bc58dd4",
                "file--9a1f8a2a-aded-4dcf-be89-edd829073b4c",
                "file--d0509c01-360e-4f50-817d-cc7d4b15b62a",
                "file--9c57fdc6-32ac-4674-8101-98f1a88bb275",
                "file--010129f1-f9b0-4ab6-bc7d-b3e198c2904f",
                "file--1815d109-02ad-4f2b-8673-de5695010d14",
                "file--5c8076ba-c333-4d79-ad2f-7b462b3e019d",
                "file--b30591d3-31d7-4a51-b919-7443fdfcab13",
                "file--de9d9ced-c00f-4a5c-8d03-492160302997",
                "file--b87ac927-b617-488d-89b7-02d7c688f424",
                "file--b6379012-db0f-4bbd-933e-0d5564e564fe",
                "file--cda9c462-d50a-4b08-8ef2-6fdf59c9b952",
                "file--2f620175-0f85-40b9-986d-71fc52d3d8e3",
                "file--3f7bd0bd-cdc8-4e8b-a67c-912af75ab8e0",
                "file--f3f3f1c0-46cf-4c05-bf2a-a246c5013470",
                "file--d7dc72b8-54cc-43a6-a038-b83b1c516e4f",
                "file--6dead7f2-7112-48c2-893a-13d8a79a296e",
                "file--70f55163-4366-483e-ac73-1661e813a261",
                "file--07519134-5bc9-4473-825f-cfdf1f4f6bc2",
                "file--44e703b0-86f9-43fd-9569-9017f8d9834d",
                "file--7380aaeb-fa2d-4f71-b3b1-7aa4517c804a",
                "url--5ad41325-fdde-41ce-9eec-2058088b5746",
                "url--6eb9ee78-ebfc-42a9-be22-4093cc33e582",
                "url--f1fb4993-6f46-4197-ab12-c6f4119e4723",
                "url--60b0ad22-c3c8-4aa8-b426-f98edc7a9529",
                "indicator--026535aa-7680-4961-91d6-08842d9c0835",
                "indicator--82840755-9339-4c12-a78f-27ae7c8c95cb",
                "file--79a39584-60a3-4187-af7e-4f77456391ea",
                "file--2745cb0d-5182-4476-9432-1d59f703507f",
                "file--54811254-d406-4efd-929a-b5383dfd9db2",
                "file--dfbec13b-c05d-49c8-9680-9ccbd22f984c",
                "file--f663aa77-ea50-4d19-a7f9-f5f212631ef6",
                "file--0c351a2f-3f16-43b1-815c-5180c94bf30c",
                "file--e38a6936-a5db-40bd-b2cd-29c472a11638",
                "file--aceb2e29-7728-4f35-94ac-91599d3adb6e",
                "file--fe1cdb72-cd61-440f-8cf7-4ec0b0dd60b9",
                "file--5e0502cf-a82f-4adc-9db5-3db5f481fbb0",
                "url--d8a25631-6810-4451-a2f8-d16f8c59960c",
                "url--b72cc426-9c9a-4863-8bc6-ea2f732a2a93",
                "url--922be6bc-e6ea-4c6e-82a9-b6c3ac05ed17",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.malwarelab.pl/posts/lazarus_validator/"
                }
            ]
        }
    ]
}