{
    "type": "bundle",
    "id": "bundle--c49ee167-c88b-4050-80a8-9986222d90d4",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--a8d58fde-d21c-496d-a3ff-84409afef5b4",
            "created": "2023-03-08T12:51:56.363175Z",
            "modified": "2024-08-19T10:06:03.021098Z",
            "name": "Qianxin",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--014d9ce1-b786-497c-9dbb-31db87d78f02",
            "hashes": {
                "MD5": "95c92bcfc39ceafc1735f190a575c60c",
                "SHA-1": "a3cda1db25d43e27061827255e0b192a9c714f7e",
                "SHA-256": "811b42bb169f02d1b0b3527e2ca6c00630bebd676b235cd4e391e9e595f9dfa8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2f1d7a81-6fcd-4799-8be4-5bc8682d493f",
            "hashes": {
                "MD5": "0821884168a644f3c27176a52763acc9",
                "SHA-1": "1f6c7c9219f6b6ea30cd481968ae1a038789be67",
                "SHA-256": "e7fae41c0bd8d3d95253bd75dce99015599ecc404bd8d737cec305fc3e4dd018"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--bbcd58f7-7a70-438a-abc4-5b2a336ab4d1",
            "value": "wbg0909.scienceontheweb.net"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--0ba7879e-b82d-4bbf-acbd-edb46a2dea23",
            "value": "http://alyssalove.getenjoyment.net/0423/v.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8eb410c4-8044-4941-b1b9-28f319958b5b",
            "value": "alyssalove.getenjoyment.net"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a5f4fb5e-47e7-4804-a7db-b7fec3e947fe",
            "hashes": {
                "MD5": "8de75256d0e579416263cb3c61fc6c55",
                "SHA-1": "65ce09dc6abbf0217ed8f62dbad3fd05c84446e8",
                "SHA-256": "d3138e7b0dcf5e916834b045c1b006a1cd223dca75626bd1354b47dbd0c63ae2"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--8dd1a6f2-58fb-40fb-a5ed-239724084f31",
            "value": "http://1213rt.atwebpages.com/cohb/d.php?filename=corona"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--e0ed8671-2b9b-489e-987b-6ff91726e64c",
            "value": "http://wbg0909.scienceontheweb.net/0412/download.php?filename=corona"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fcc254f2-081d-405a-a79f-6869abe70d88",
            "value": "1213rt.atwebpages.com"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-10-10T12:20:31.526205Z",
            "modified": "2026-10-10T12:20:31.526205Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--845ef4e0-3bd7-4e28-9d8c-549be764edc8",
            "created_by_ref": "identity--a8d58fde-d21c-496d-a3ff-84409afef5b4",
            "created": "2026-10-10T12:20:31.526489Z",
            "modified": "2026-10-10T12:20:31.526489Z",
            "name": "Kimsuky APT\u7ec4\u7ec7\u5229\u7528blogspot\u5206\u53d1\u6076\u610f\u8f7d\u8377\u7684\u653b\u51fb\u6d3b\u52a8\u5206\u6790",
            "published": "2021-07-19T00:00:00Z",
            "object_refs": [
                "identity--a8d58fde-d21c-496d-a3ff-84409afef5b4",
                "file--014d9ce1-b786-497c-9dbb-31db87d78f02",
                "file--2f1d7a81-6fcd-4799-8be4-5bc8682d493f",
                "domain-name--bbcd58f7-7a70-438a-abc4-5b2a336ab4d1",
                "url--0ba7879e-b82d-4bbf-acbd-edb46a2dea23",
                "domain-name--8eb410c4-8044-4941-b1b9-28f319958b5b",
                "file--a5f4fb5e-47e7-4804-a7db-b7fec3e947fe",
                "url--8dd1a6f2-58fb-40fb-a5ed-239724084f31",
                "url--e0ed8671-2b9b-489e-987b-6ff91726e64c",
                "domain-name--fcc254f2-081d-405a-a79f-6869abe70d88",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://ti.qianxin.com/blog/articles/Analysis-of-attack-activities-of-Kimsuky-APT-group-using-blogspot-to-distribute-malicious-payloads/"
                }
            ]
        }
    ]
}