{
    "type": "bundle",
    "id": "bundle--1fb137bc-c53f-4651-9b08-bfabe2e2bf04",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--279efcac-f4a3-4fde-bbc0-e3c4c0b65000",
            "created": "2024-08-17T01:12:48.728304Z",
            "modified": "2024-10-04T00:49:45.192504Z",
            "name": "Kandji",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ab43bc8d-ad84-4fc7-8ccd-25ba47fe8012",
            "value": "buy2x.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--77d6e306-d5f5-4b5d-bbcc-380551fd5dbb",
            "hashes": {
                "MD5": "9607e95d635831a1e43e40c665b077b8",
                "SHA-1": "e17a10d05db73f77f69f74d5995d4023449f6980",
                "SHA-256": "9b839e9169babff1d14468d9f8497c165931dc65d5ff1f4b547925ff924c43fe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--25f196af-9cb1-491c-acc4-7e14a9349914",
            "hashes": {
                "MD5": "c64143eeb1a62c6d1ac0742263c692d8",
                "SHA-1": "67b2a61c7114c7110140d934399372338345f356",
                "SHA-256": "f1b3ce96462027644f9caa314d3da745dab139ee1cb14fe508234e76bd686f93"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b25f804f-66bf-43e4-891c-c9ac139ac501",
            "hashes": {
                "SHA-256": "a55029c963ff454e42483b9b6f0293dc546e06b2fb71e6ebaa4c6f146a9906a3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8515e680-ef8f-441f-9f4c-20c4f4128316",
            "hashes": {
                "MD5": "73e7de61c40241cc39ce84934c9e65f3",
                "SHA-1": "c1a80bcd7283195eca0190dc3645b73482467ad4",
                "SHA-256": "9623c98f7338d56b07b35cd379e31e685e32a9c5317d7bc4af5276916cef4ed3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--30906f2e-b650-4668-a043-3a95fce25ee9",
            "hashes": {
                "MD5": "7dcbf2bb4a6620a82bc2c4ecb03504bc",
                "SHA-1": "a72af7beb12a4357190fdee89b7dff3d18863906",
                "SHA-256": "e09d2277a19dddd751edb164bde064682a6acc41a7ee178a2dacd4f9ac357fc7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4aa5a2ef-c027-427c-a098-98f0523dad81",
            "hashes": {
                "MD5": "d37a8ff8653a577b87a617877e797b96",
                "SHA-1": "a1ac44621d57455f185ee5c1aa72a2cb3b659646",
                "SHA-256": "c52e3e73d7870bf8edc1b9ae52b26c08ef2466f948ef3446b2c865fd53d859dd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--67349e69-f9a7-4791-8917-2422cba23a51",
            "hashes": {
                "SHA-1": "a55029c963ff454e42483b9b6f0293dc546e06b2"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--fb04244c-aa79-438a-96fb-0c81e68fcf08",
            "value": "http://buy2x.com/OcMySY5QNkY/ABcTDInKWw/4SqSYtx%2B/EKfP7saoiP/BcA%3D%3D"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb",
            "created": "2026-09-19T08:43:34.868709Z",
            "modified": "2026-09-19T08:43:34.868709Z",
            "name": "Bluenoroff"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--7f46d3e2-300f-4abb-b4f5-aa23b711ef93",
            "created_by_ref": "identity--279efcac-f4a3-4fde-bbc0-e3c4c0b65000",
            "created": "2026-09-19T08:43:34.86995Z",
            "modified": "2026-09-19T08:43:34.86995Z",
            "name": "TodoSwift Disguises Malware Download Behind Bitcoin PDF",
            "published": "2024-08-16T00:00:00Z",
            "object_refs": [
                "identity--279efcac-f4a3-4fde-bbc0-e3c4c0b65000",
                "domain-name--ab43bc8d-ad84-4fc7-8ccd-25ba47fe8012",
                "file--77d6e306-d5f5-4b5d-bbcc-380551fd5dbb",
                "file--25f196af-9cb1-491c-acc4-7e14a9349914",
                "file--b25f804f-66bf-43e4-891c-c9ac139ac501",
                "file--8515e680-ef8f-441f-9f4c-20c4f4128316",
                "file--30906f2e-b650-4668-a043-3a95fce25ee9",
                "file--4aa5a2ef-c027-427c-a098-98f0523dad81",
                "file--67349e69-f9a7-4791-8917-2422cba23a51",
                "url--fb04244c-aa79-438a-96fb-0c81e68fcf08",
                "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.kandji.io/blog/todoswift-disguises-malware-download-behind-bitcoin-pdf"
                }
            ]
        }
    ]
}