{
    "type": "bundle",
    "id": "bundle--6427eb6a-b1a9-4a79-9011-7bbb7c8a8ed6",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--8668d146-eeac-4e79-a044-f0e8f62445be",
            "created": "2023-03-08T12:51:46.256897Z",
            "modified": "2023-03-09T23:01:57.67829Z",
            "name": "ESET",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--01dfda2e-b5a8-4cd8-8cf6-9f7cb337be42",
            "hashes": {
                "MD5": "aac5a52b939f3fe792726a13ff7a1747",
                "SHA-1": "f6760fb1f8b019af2304ea6410001b63a1809f1d",
                "SHA-256": "cc307cfb401d1ae616445e78b610ab72e1c7fb49b298ea003dd26ea80372089a"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--91345244-c916-4fd3-aac4-63f91de7a931",
            "value": "23.254.211.230"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--042b4e86-3aa7-440a-8a65-2e58c41f6849",
            "value": "172.93.201.88"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f1aea897-7811-4835-80fc-c4b0348418bb",
            "hashes": {
                "MD5": "451c23709ecd5a8461ad060f6346930c",
                "SHA-1": "58b0516d28bd7218b1908fb266b8fe7582e22a5f",
                "SHA-256": "5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e68ed59b-3df0-4b87-8eca-7149f5cac720",
            "hashes": {
                "MD5": "3cf7232e5185109321921046d039cf10",
                "SHA-1": "3a63477a078ce10e53dfb5639e35d74f93cefa81",
                "SHA-256": "492a643bd1efdaca4ca125ade1b606e7bbf00e995ac9115ac84d1c4c59cb66dd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2fecd424-195a-493e-b478-7d8158f4745c",
            "hashes": {
                "SHA-1": "0ca1723afe261cd85b05c9ef424fc50290dce7df"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--135e48c5-ca7e-4505-b480-de3f9e200b32",
            "hashes": {
                "MD5": "fc41cb8425b6432af8403959bb59430d",
                "SHA-1": "9d8bade2030c93d0a010aa57b90915eb7d99ec82",
                "SHA-256": "f638e5a20114019ad066dd0e856f97fd865798d8fbed1766662d970beff652ca"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--6946663f-bd7f-4c12-ae3d-27078c170d03",
            "value": "38.108.185.79"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--2ec1c37d-d46f-4542-b41c-e74203e9f187",
            "value": "38.108.185.115"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e5e1acc1-ffc9-41a0-aa27-f170852a8d4f",
            "value": "journalide.org"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--38ad0efe-3b9d-4d4a-ba13-917f7e6be387",
            "hashes": {
                "MD5": "5131ae1d27739f56bba92852be3a0cc2",
                "SHA-1": "2acc6f1d4656978f4d503929b8c804530d7e7cf6",
                "SHA-256": "480b8c9df70396f44cdca00fd860fdf38ce1d8493ebeed6fe679dd3fd799b7f6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c0edd9cc-5042-4071-b155-3bfb037846bf",
            "hashes": {
                "SHA-256": "eebb01932de0b5605dd460cc82844d8693c00ea8ab5ffdf8dbede6528c1c18fd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--754b264e-50b2-421c-be49-6b3f5f721cb8",
            "hashes": {
                "MD5": "cedb9cdbad254f60cfb215b9bff84fb9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--11b45758-afd2-4aec-8d8d-cb254db3b28f",
            "hashes": {
                "MD5": "af2bc70f1c97a2f583f7b87aea3c8a6c",
                "SHA-1": "7491bd61ed15298ce5ee5ffd01c8c82a2cdb40ec",
                "SHA-256": "ea31e626368b923419e8966747ca33473e583376095c48e815916ff90382dda5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--03e99ce9-76d6-4fbe-90a7-916487630f4b",
            "hashes": {
                "MD5": "da450236dc92a53c8476b0b0de9a88e2",
                "SHA-1": "dcef83d8ee080b54dc54759c59f955e73d67aa65",
                "SHA-256": "cc36b610705d96dd8a82faf8bce1e1d6197948518318f2332323de3c5d05999d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5381049d-2f5d-48c5-b29c-b84311edfe43",
            "hashes": {
                "MD5": "6426fe4dc604c7f1784ed1d48ab4ffc8",
                "SHA-1": "3b88cda62cdd918b62ef5aa8c5a73a46f176d18b",
                "SHA-256": "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f1f2c8e0-67e4-438e-8759-aa3338c80efd",
            "hashes": {
                "SHA-1": "cad1120d91b812acafef7175f949dd1b09c6c21a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e8b34e31-87d6-4837-ab56-c9580f9dfaa2",
            "hashes": {
                "MD5": "76111d9780b2d0b5adee61cf752d937e",
                "SHA-1": "5b03294b72c0caa5fb20e7817002c600645eb475",
                "SHA-256": "9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6bb40865-d77e-4492-9c3f-cf5eb34f1c15",
            "hashes": {
                "MD5": "c01dc42f65acaf1c917c0cc29ba63adc",
                "SHA-1": "d288766fa268bc2534f85fd06a5d52264e646c47",
                "SHA-256": "4257bb11570ed15b8a15aa3fc051a580eab5d09c2f9d79e4b264b752c8e584fc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b5c372c4-0af9-4205-8e4e-f982d341a9e7",
            "hashes": {
                "MD5": "9e4d9edb07c348b10863d89b6bb08141",
                "SHA-1": "65122e5129fc74d6b5ebafcc3376abae0145bc14",
                "SHA-256": "5a07b09eea34d7faa9c37e2806a556cd95f97699597bd1123339849b6e942d95"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9542d271-86c6-4f6a-92fb-d6e1e47a96c7",
            "hashes": {
                "MD5": "760c35a80d758f032d02cf4db12d3e55",
                "SHA-1": "1c66e67a8531e3ff1c64ae57e6edfde7bef2352d",
                "SHA-256": "e2ecec43da974db02f624ecadc94baf1d21fd1a5c4990c15863bb9929f781a0a"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--e5ae0977-3698-4969-9019-87c939c6401c",
            "value": "https://journalide.org/djour.php"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--464d903c-47ae-49f4-a411-f3df6b1e0030",
            "created": "2026-10-10T22:05:20.799967Z",
            "modified": "2026-10-10T22:05:20.799967Z",
            "name": "YARA Rule",
            "pattern": "/*\r\nThe following rule will only work with YARA version >= 3.11.0\r\n*/\r\nimport \"pe\"\r\nrule RichHeaders_Lazarus_NukeSped_IconicPayloads_3CX_Q12023\r\n{\r\nmeta:\r\ndescription = \" Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12\"\r\nauthor = \"ESET Research\"\r\ndate = \"2023-03-31\"\r\nhash = \"3B88CDA62CDD918B62EF5AA8C5A73A46F176D18B\"\r\nhash = \"CAD1120D91B812ACAFEF7175F949DD1B09C6C21A\"\r\nhash = \"5B03294B72C0CAA5FB20E7817002C600645EB475\"\r\nhash = \"7491BD61ED15298CE5EE5FFD01C8C82A2CDB40EC\"\r\ncondition:\r\npe.rich_signature.toolid(259, 30818) == 9 and\r\npe.rich_signature.toolid(256, 31329) == 1 and\r\npe.rich_signature.toolid(261, 30818) >= 30 and pe.rich_signature.toolid(261, 30818) <= 38 and\r\npe.rich_signature.toolid(261, 29395) >= 134 and pe.rich_signature.toolid(261, 29395) <= 164 and\r\npe.rich_signature.toolid(257, 29395) >= 6 and pe.rich_signature.toolid(257, 29395) <= 14\r\n}",
            "pattern_type": "yara",
            "valid_from": "2023-04-20T00:00:00Z"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--b08ee5a3-01f3-4a9e-b216-30c600523ede",
            "value": "https://od.lk/d/NTJfMzg4MDE1NzJf/vxmedia"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--766ca1e5-0d57-44ba-b602-f192f1ad64da",
            "created_by_ref": "identity--8668d146-eeac-4e79-a044-f0e8f62445be",
            "created": "2026-10-10T22:05:20.809702Z",
            "modified": "2026-10-10T22:05:20.809702Z",
            "name": "Linux malware strengthens links between Lazarus and the 3CX supply\u2011chain attack",
            "published": "2023-04-20T00:00:00Z",
            "object_refs": [
                "identity--8668d146-eeac-4e79-a044-f0e8f62445be",
                "file--01dfda2e-b5a8-4cd8-8cf6-9f7cb337be42",
                "ipv4-addr--91345244-c916-4fd3-aac4-63f91de7a931",
                "ipv4-addr--042b4e86-3aa7-440a-8a65-2e58c41f6849",
                "file--f1aea897-7811-4835-80fc-c4b0348418bb",
                "file--e68ed59b-3df0-4b87-8eca-7149f5cac720",
                "file--2fecd424-195a-493e-b478-7d8158f4745c",
                "file--135e48c5-ca7e-4505-b480-de3f9e200b32",
                "ipv4-addr--6946663f-bd7f-4c12-ae3d-27078c170d03",
                "ipv4-addr--2ec1c37d-d46f-4542-b41c-e74203e9f187",
                "domain-name--e5e1acc1-ffc9-41a0-aa27-f170852a8d4f",
                "file--38ad0efe-3b9d-4d4a-ba13-917f7e6be387",
                "file--c0edd9cc-5042-4071-b155-3bfb037846bf",
                "file--754b264e-50b2-421c-be49-6b3f5f721cb8",
                "file--11b45758-afd2-4aec-8d8d-cb254db3b28f",
                "file--03e99ce9-76d6-4fbe-90a7-916487630f4b",
                "file--5381049d-2f5d-48c5-b29c-b84311edfe43",
                "file--f1f2c8e0-67e4-438e-8759-aa3338c80efd",
                "file--e8b34e31-87d6-4837-ab56-c9580f9dfaa2",
                "file--6bb40865-d77e-4492-9c3f-cf5eb34f1c15",
                "file--b5c372c4-0af9-4205-8e4e-f982d341a9e7",
                "file--9542d271-86c6-4f6a-92fb-d6e1e47a96c7",
                "url--e5ae0977-3698-4969-9019-87c939c6401c",
                "indicator--464d903c-47ae-49f4-a411-f3df6b1e0030",
                "url--b08ee5a3-01f3-4a9e-b216-30c600523ede"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack/"
                }
            ]
        }
    ]
}