{
    "type": "bundle",
    "id": "bundle--3e60b306-db70-4165-8c0c-8f1e48e6b733",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--5d199e7e-198c-47e8-ad62-397e3bd362e2",
            "created": "2023-03-08T12:51:51.400428Z",
            "modified": "2024-08-19T23:43:12.521753Z",
            "name": "Group-IB",
            "identity_class": "organization"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--feec94d2-4253-4b59-a296-b52c710d8ea4",
            "value": "https://filedn.com/lY24cv0IfefboNEIN0I9gqR"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e16e4e68-a843-40fb-917c-0b23e2654923",
            "value": "filedn.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--a487436d-8929-46d4-9998-212edb239314",
            "value": "104.168.165.203"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--1836ccdd-b973-4b33-afd0-ec45331c55d8",
            "value": "104.168.157.45"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3d0eca32-ce6c-4fd0-bc64-f2135f3b2404",
            "hashes": {
                "MD5": "959e71b8f743a202eb80b65acbb60f7c",
                "SHA-1": "78027c3800ff58321371a28b1e2a6d7e870add60",
                "SHA-256": "176e8a5a7b6737f8d3464c18a77deef778ec2b9b42b7e7eafc888aeaf2758c2d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bfe4f3d8-f53f-4838-86d4-6adccb33c358",
            "hashes": {
                "MD5": "3439de0b221320f58e3432c2672c4074",
                "SHA-1": "2efdf82808cd7f63ebc66f553ae94127c3d7c60b",
                "SHA-256": "9111d458d5665b1bf463859792e950fe8d8186df9a6a3241360dc11f34d018c2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0decb47b-92a1-432d-a733-0a78035accce",
            "hashes": {
                "MD5": "d8508b3c7ba4f2b9ed1cf3ff28fd6b83",
                "SHA-1": "4a93fe1e7fce91f3c3d99c733d9628ed952dbf2a",
                "SHA-256": "48ee5d0d44a015876d867fa515b04c1998fecf19badcbd69f4f3fa8497d57215"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e69b65f6-6133-484b-90bf-b2df6990af70",
            "hashes": {
                "MD5": "a26c2442743d234ccd3b0d104e13a798",
                "SHA-1": "c91f346d077efbcf45e53e4876b6b23f1e241db4",
                "SHA-256": "022344029b8bf951ba02b11025fe26c99193cb7c8a482c33862c9bbaa5e5528e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6e32ff37-15cb-433e-87c1-ffc65c33ebcf",
            "hashes": {
                "MD5": "0cbc6df98ce1d302f51714e100560a4d",
                "SHA-1": "e9519f91c7acfe68e614fc6d3416033334b1b68c",
                "SHA-256": "e87177e07ab9651b48664c3d22334248e012e8a2bab02f65c93fedd79af0a74f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4892d8c8-fd9c-49ac-99de-4af2f3a641cc",
            "hashes": {
                "MD5": "9edbd2f21b81183770fd767b31c2458c",
                "SHA-1": "60be225d1a90070d22bf2abcc740d311041cb432",
                "SHA-256": "878e3701df9b0abdaa7094e22d067c8398a9fc842cabe917fd5f75f2c84d8552"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e87095fc-c2f2-47c0-ae51-7fc8cbb55cc4",
            "hashes": {
                "MD5": "a489b72510dfd07e6d05b07e8547cf25",
                "SHA-1": "8380d7451f9c4477dd2e8c7c0ba46471bfc6dc27",
                "SHA-256": "4bce97eff4430708299a1bb4142b9d359d8adf77a2e1673bf76485df25e6d357"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--140698d6-6299-4c2e-9e43-33ee8e2e79a9",
            "hashes": {
                "MD5": "53b68b9304a0462761917608ca4e60e7",
                "SHA-1": "1602cc32d56ab7f7d70c508696134875a0a56000",
                "SHA-256": "7464850d7d6891418c503d0e1732812d7703d6c1fd5cf3c821f3c202786f9422"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--81d66a7c-f008-430b-a8c6-0713241d47cd",
            "hashes": {
                "MD5": "3d14dd06d85f513dfa96d875fdcc0298",
                "SHA-1": "afefb97605354c96d07d6e24a87798dd5891b583",
                "SHA-256": "f3e6e8df132155daf1d428dff61f0ca53ecd02015a0a0bbe1ad237519ab3cb58"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0b3c101d-0381-4eb7-b724-62261cf2d7ce",
            "hashes": {
                "MD5": "22a477da55c7391dd0fc6176241d108e",
                "SHA-1": "5e38363e7c196a3627dc10a8292bb72473599c2e",
                "SHA-256": "a4cab67569d0b35c249dc536fb25dabdc12839ed4e945c59ec826c0a241b792a"
            }
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--cda367ec-2d82-4d8e-aa8c-41acc829d0a9",
            "created": "2026-09-20T01:31:51.433974Z",
            "modified": "2026-09-20T01:31:51.433974Z",
            "name": "YARA Rule",
            "pattern": "rule rustyattr\r\n{\r\n  meta:\r\n    author = \"Sharmine Low\"\r\n    company = \"Group-IB\"\r\n    family = \"rustyattr\"\r\n    description = \"Detects rust binary of rustyattr\"\r\n    severity = 9\r\n    date = \"2024-10-30\"\r\n    sample = \"176e8a5a7b6737f8d3464c18a77deef778ec2b9b42b7e7eafc888aeaf2758c2d\"\r\n\r\n  strings:\r\n    $s1 = \"run_command\"\r\n    $s2 = \"get_application_properties\"\r\n    $s3 = \"get_application_path\"\r\n    $s4 = \"close_main_window\"\r\n    $s5 = \"show_main_window\"\r\n\r\n    $r1 = \"window.__TAURI__.\"\r\n\r\n  condition:\r\n    all of ($s*) and $r1\r\n}",
            "pattern_type": "yara",
            "valid_from": "2024-11-13T00:00:00Z"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--544237f2-c330-4193-bd90-b2b3630f957c",
            "value": "https://support.docsend.site/519529/check"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--f4c5ef09-cb0e-4ac9-b681-a22b7570e509",
            "value": "https://support.cloudstore.business/256977/check"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--0006ebf1-e2f0-4a0a-95c9-f8f361d67848",
            "value": "https://filedn.com/lY24cv0IfefboNEIN0I9gqR/dragonfly/Discussion%20Points%20for%20Synergy%20Exploration_Over.pdf"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1860a959-3012-4bc6-a707-91fb0cc28d2b",
            "value": "support.cloudstore.business"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--cf9ccbe9-273b-4138-a2f4-19ae8dc41502",
            "value": "support.docsend.site"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-09-20T01:31:51.435928Z",
            "modified": "2026-09-20T01:31:51.435928Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--23d21bef-7a82-4403-b132-2a2148d75438",
            "created_by_ref": "identity--5d199e7e-198c-47e8-ad62-397e3bd362e2",
            "created": "2026-09-20T01:31:51.438211Z",
            "modified": "2026-09-20T01:31:51.438211Z",
            "name": "Stealthy Attributes of APT Lazarus: Evading Detection with Extended Attributes",
            "published": "2024-11-13T00:00:00Z",
            "object_refs": [
                "identity--5d199e7e-198c-47e8-ad62-397e3bd362e2",
                "url--feec94d2-4253-4b59-a296-b52c710d8ea4",
                "domain-name--e16e4e68-a843-40fb-917c-0b23e2654923",
                "ipv4-addr--a487436d-8929-46d4-9998-212edb239314",
                "ipv4-addr--1836ccdd-b973-4b33-afd0-ec45331c55d8",
                "file--3d0eca32-ce6c-4fd0-bc64-f2135f3b2404",
                "file--bfe4f3d8-f53f-4838-86d4-6adccb33c358",
                "file--0decb47b-92a1-432d-a733-0a78035accce",
                "file--e69b65f6-6133-484b-90bf-b2df6990af70",
                "file--6e32ff37-15cb-433e-87c1-ffc65c33ebcf",
                "file--4892d8c8-fd9c-49ac-99de-4af2f3a641cc",
                "file--e87095fc-c2f2-47c0-ae51-7fc8cbb55cc4",
                "file--140698d6-6299-4c2e-9e43-33ee8e2e79a9",
                "file--81d66a7c-f008-430b-a8c6-0713241d47cd",
                "file--0b3c101d-0381-4eb7-b724-62261cf2d7ce",
                "indicator--cda367ec-2d82-4d8e-aa8c-41acc829d0a9",
                "url--544237f2-c330-4193-bd90-b2b3630f957c",
                "url--f4c5ef09-cb0e-4ac9-b681-a22b7570e509",
                "url--0006ebf1-e2f0-4a0a-95c9-f8f361d67848",
                "domain-name--1860a959-3012-4bc6-a707-91fb0cc28d2b",
                "domain-name--cf9ccbe9-273b-4138-a2f4-19ae8dc41502",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.group-ib.com/blog/stealthy-attributes-of-apt-lazarus/"
                }
            ]
        }
    ]
}