{
    "type": "bundle",
    "id": "bundle--bc774923-abc3-4822-ab4a-0508174feb91",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--5cb6c063-b2c4-4d8a-8bd2-88171741cb8f",
            "created": "2023-03-08T12:51:51.980512Z",
            "modified": "2024-04-04T09:49:05.246172Z",
            "name": "Norfolk",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--18d42973-ae2d-4798-b17c-fa3598d74d76",
            "value": "ip-api.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--81b921b7-3d66-4ab1-aef3-32d1c96eca8d",
            "hashes": {
                "MD5": "355b1bedeb19b546800de5ecc7933849",
                "SHA-1": "d585198e4ceb6545d4e043bd3dc2302b53293602",
                "SHA-256": "8b2f2fad1d1f1e6ad915ea2224dd9f8544edf4aaf910ab9b3a3112cc5806f16d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8eb03d44-8e46-4b8f-b78a-e0547f852acd",
            "hashes": {
                "MD5": "49a16a330965974c32b668fead7ecd44",
                "SHA-1": "f541f9700972163bc86e225b1b6df47e1e5f520f",
                "SHA-256": "72400a957654371be9363fdd2753ffea8f240a8b3e6e03edc116f8da96fa3ce4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4dbeb5bf-8efb-44fa-881f-e8390cee5048",
            "hashes": {
                "MD5": "3096a48834b35f1d8732bdda3e2b2397",
                "SHA-1": "ae6051c6cb2d7a15ed34c391f8ffbc07797e3e35",
                "SHA-256": "ba47df4e0cccdff1c6e81b7a9e347ac094efc8c94caab3f53ed0bd32d0293bf0"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--e9f35cea-fd6e-5fc7-a5b9-2894700cb511",
            "created": "2026-10-09T11:16:18.038211Z",
            "modified": "2026-10-09T11:16:18.038211Z",
            "name": "LabyrinthChollima"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--3db57f89-ed4f-4a7b-9bf2-ab4413113fdc",
            "created_by_ref": "identity--5cb6c063-b2c4-4d8a-8bd2-88171741cb8f",
            "created": "2026-10-09T11:16:18.039015Z",
            "modified": "2026-10-09T11:16:18.039015Z",
            "name": "North Korea\u2019s Post-Infection Python Payloads",
            "published": "2024-04-03T00:00:00Z",
            "object_refs": [
                "identity--5cb6c063-b2c4-4d8a-8bd2-88171741cb8f",
                "domain-name--18d42973-ae2d-4798-b17c-fa3598d74d76",
                "file--81b921b7-3d66-4ab1-aef3-32d1c96eca8d",
                "file--8eb03d44-8e46-4b8f-b78a-e0547f852acd",
                "file--4dbeb5bf-8efb-44fa-881f-e8390cee5048",
                "threat-actor--e9f35cea-fd6e-5fc7-a5b9-2894700cb511"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://norfolkinfosec.com/north-koreas-post-infection-python-payloads/"
                }
            ]
        }
    ]
}