{
    "type": "bundle",
    "id": "bundle--0073db68-c055-4713-be34-52f26f1e22bf",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--49cc63f3-b5a1-4d5c-be95-7453281b704f",
            "created": "2024-07-15T12:08:31.764005Z",
            "modified": "2025-06-30T05:06:50.380749Z",
            "name": "Darkatlas",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--82530325-9cf9-4434-b6ef-c28729c49d7a",
            "hashes": {
                "MD5": "a67cf9add2905c11f5c466bc01d554b0",
                "SHA-1": "977b824c1f2b8233cee80cd268f2b7d7976f6698",
                "SHA-256": "47d084e54d15d5d313f09f5b5fcdea0c9273dcddd9a564e154e222343f697822"
            }
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--1ab3cb7f-f6ca-47fe-926a-86d6aed93218",
            "created": "2026-09-20T10:50:22.021543Z",
            "modified": "2026-09-20T10:50:22.021543Z",
            "name": "YARA Rule",
            "pattern": "rule TrollAgent_Kimsuky_Stealer { meta: description = \"Detect TrollAgent Stealer\" author = \"Dark Atlas Squad\" date = \"2024-07-14\" strings: $ex1 = \"rollbackHookTrampoline\" wide ascii $ex2 = \"preUpdateHookTrampoline\" wide ascii $ex3 = \"compareTrampoline\" wide ascii $ex4 = \"doneTrampoline\" wide ascii $ex5 = \"authorizerTrampoline\" wide ascii condition: uint16(0) == 0x5a4d and pe.characteristics & pe.DLL and all of them and pe.number_of_exports > 11 and for any i in (0 .. pe.number_of_sections) : ( pe.sections[i].name == \".vmp0\" or pe.sections[i].name == \".vmp1\" ) }",
            "pattern_type": "yara",
            "valid_from": "2024-07-15T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--93eb440f-77c1-419d-be9c-6fac889105d5",
            "hashes": {
                "MD5": "2e5f2a154e1b67cd0d6a2f6b5feb6de7",
                "SHA-1": "fd2cdfaeafb2d6dbcf4482e58f75ac98fc4849e2",
                "SHA-256": "e7b05bcb7247d82e4f83356f6501fdb82669b5ad8a11e02ad2288403a84aef88"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6595dd02-bda9-4f41-ae88-95e4be1f2661",
            "hashes": {
                "MD5": "3b596ca429cf1b733f1ff3676189e44a",
                "SHA-1": "b67dcdf202437d44f8a4082d832e1c26b6fe580c",
                "SHA-256": "548c3df040e86892a8f4344efb999ffd7cce099476a70f323733ac83170c67d4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--91c0a32d-fc6e-441b-b2de-70075c50ba19",
            "hashes": {
                "MD5": "045f28a479ba19a95c0407a663e2f188",
                "SHA-1": "4bd7fae354d5784be051697fb82a4bdf9f44a431",
                "SHA-256": "3e55995b9dd82a34b76f5b79b3ff2149e003639f193b409f7f685b9604413a8a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4e3e365f-3f36-40be-ad35-017b114b79a2",
            "hashes": {
                "MD5": "9e75705b4930f50502bcbd740fc3ece1",
                "SHA-1": "cd087b4d2812c06389dd2e7572acfbca843f4b6e",
                "SHA-256": "36ea1b317b46c55ed01dd860131a7f6a216de71958520d7d558711e13693c9dc"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--3593f81e-60fa-4527-a7b6-83708d5eacba",
            "value": "http://sa.netup.p-e.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--e8788c7a-f67d-433d-acda-9fcc1dfc3ff5",
            "value": "http://dl.netup.p-e.kr/index.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2472c579-3042-4dc2-94c1-8c15d1175789",
            "value": "sa.netup.p-e.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--467d4d98-b0eb-40da-980f-2097f01267a9",
            "value": "dl.netup.p-e.kr"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--47fcd9a6-b235-45e5-94b9-5c6d7e908773",
            "hashes": {
                "MD5": "7457dc037c4a5f3713d9243a0dfb1a2c",
                "SHA-1": "4c8b7d968806f8108ccde6ac07a37b8174ac44bf",
                "SHA-256": "ff3718ae6bd59ad479e375c602a81811718dfb2669c2d1de497f02baf7b4adca"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9af1c554-d7c1-4334-a56e-90bf90faf2a2",
            "hashes": {
                "MD5": "88f183304b99c897aacfa321d58e1840",
                "SHA-1": "4a705f58918c00431de453d5b5f621fa42ff7169",
                "SHA-256": "61b8fbea8c0dfa337eb7ff978124ddf496d0c5f29bcb5672f3bd3d6bf832ac92"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5b9bae94-6491-48e1-97bd-b5bc0d06c018",
            "hashes": {
                "MD5": "27ef6917fe32685fdf9b755eb8e97565",
                "SHA-1": "6d531b021b20febf1dafa730582944eb82d9c6f3",
                "SHA-256": "2e0ffaab995f22b7684052e53b8c64b9283b5e81503b88664785fe6d6569a55e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f1427f19-cd4c-4a93-bc73-214ecf7018a1",
            "hashes": {
                "MD5": "7b6d02a459fdaa4caa1a5bf741c4bd42",
                "SHA-1": "4eea45c22881a092ac7a8b0a5379076d5803e83e",
                "SHA-256": "f8ab78e1db3a3cc3793f7680a90dc1d8ce087226ef59950b7acd6bb1beffd6e3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ab025434-4079-4d14-a797-9f97c1d9c813",
            "hashes": {
                "MD5": "c8e7b0d3b6afa22e801cacaf16b37355",
                "SHA-1": "3d1731fa03f2bb8b3ca74ab49c83923428e58362",
                "SHA-256": "955cb4f01eb18f0d259fcb962e36a339e8fe082963dfd9f72d3851210f7d2d3b"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--8bebe6a1-1beb-45a1-80d3-74a7ad87ba2b",
            "value": "http://qi.limsjo.p-e.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--63a4722d-8ddc-457f-a6b6-6e5f1a3cd43c",
            "value": "http://ol.negapa.p-e.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--888e6bd4-f278-400c-a374-bb62c934120f",
            "value": "http://ai.negapa.p-e.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--8cfb1781-c7f1-4b76-92e2-721d5ff352e4",
            "value": "http://ar.kostin.p-e.kr/index.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--59bf25ac-0dd6-44d1-a941-55b10f0b55a6",
            "value": "ai.negapa.p-e.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4021851c-cd46-4620-88ee-d6ade3210b99",
            "value": "ar.kostin.p-e.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--32cc4c56-b274-4ee9-92c2-4922895e6738",
            "value": "ol.negapa.p-e.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b087534e-3965-4a3f-8a8e-e473cb91a00e",
            "value": "qi.limsjo.p-e.kr"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-09-20T10:50:22.024836Z",
            "modified": "2026-09-20T10:50:22.024836Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--1d13e468-cb6a-4d61-a103-b9c55f34f35a",
            "created_by_ref": "identity--49cc63f3-b5a1-4d5c-be95-7453281b704f",
            "created": "2026-09-20T10:50:22.03203Z",
            "modified": "2026-09-20T10:50:22.03203Z",
            "name": "Kimsuky APT: The TrollAgent Stealer Analysis",
            "published": "2024-07-15T00:00:00Z",
            "object_refs": [
                "identity--49cc63f3-b5a1-4d5c-be95-7453281b704f",
                "file--82530325-9cf9-4434-b6ef-c28729c49d7a",
                "indicator--1ab3cb7f-f6ca-47fe-926a-86d6aed93218",
                "file--93eb440f-77c1-419d-be9c-6fac889105d5",
                "file--6595dd02-bda9-4f41-ae88-95e4be1f2661",
                "file--91c0a32d-fc6e-441b-b2de-70075c50ba19",
                "file--4e3e365f-3f36-40be-ad35-017b114b79a2",
                "url--3593f81e-60fa-4527-a7b6-83708d5eacba",
                "url--e8788c7a-f67d-433d-acda-9fcc1dfc3ff5",
                "domain-name--2472c579-3042-4dc2-94c1-8c15d1175789",
                "domain-name--467d4d98-b0eb-40da-980f-2097f01267a9",
                "file--47fcd9a6-b235-45e5-94b9-5c6d7e908773",
                "file--9af1c554-d7c1-4334-a56e-90bf90faf2a2",
                "file--5b9bae94-6491-48e1-97bd-b5bc0d06c018",
                "file--f1427f19-cd4c-4a93-bc73-214ecf7018a1",
                "file--ab025434-4079-4d14-a797-9f97c1d9c813",
                "url--8bebe6a1-1beb-45a1-80d3-74a7ad87ba2b",
                "url--63a4722d-8ddc-457f-a6b6-6e5f1a3cd43c",
                "url--888e6bd4-f278-400c-a374-bb62c934120f",
                "url--8cfb1781-c7f1-4b76-92e2-721d5ff352e4",
                "domain-name--59bf25ac-0dd6-44d1-a941-55b10f0b55a6",
                "domain-name--4021851c-cd46-4620-88ee-d6ade3210b99",
                "domain-name--32cc4c56-b274-4ee9-92c2-4922895e6738",
                "domain-name--b087534e-3965-4a3f-8a8e-e473cb91a00e",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://darkatlas.io/blog/kimsuky-apt-the-trollagent-stealer-analysis"
                }
            ]
        }
    ]
}