{
    "type": "bundle",
    "id": "bundle--a6f149b4-ef21-4b41-a971-4e7e00c54fed",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--a0c9d5b8-85f8-46ec-b653-9c17270dbb20",
            "created": "2026-08-13T15:49:56.991861Z",
            "modified": "2026-08-14T00:19:19.279755Z",
            "name": "CyberCentre",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--07b2a6fc-8fc9-4ac8-9a19-ae97064c246f",
            "value": "23.27.202.27"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--c29544b2-6785-4508-9dd4-eac983409afd",
            "value": "136.0.9.8"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--2cc5c760-1712-4cdd-8546-e80307fb7fc6",
            "value": "166.88.4.2"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--99107914-10f5-4f42-9572-89841b860443",
            "created": "2026-08-14T03:53:19.129412Z",
            "modified": "2026-08-14T03:53:19.129412Z",
            "name": "YARA Rule",
            "pattern": "rule jadesnow_obfuscated_downloader {\n    meta:\n        id = \"1vzA18HaXi4AzFlgIvijiq\"\n        fingerprint = \"02701150de12a2a30a570cb0c1147d32b005fe618a6eceb1452e1c1eaba6b27a\"\n        version = \"1.0\"\n        modified = \"2025-12-30\"\n        status = \"released\"\n        sharing = \"TLP:GREEN\"\n        source = \"CCCS\"\n        author = \"reveng@CCCS\"\n        description = \"Detects the obfuscated downloader appended to legitimate GitHub projects, used by jadesnow\"\n        category = \"malware\"\n        malware_type = \"downloader\"\n        report = \"TA25-0064\"\n        hash = \"d043f264ff5216fa724cad2d35ba4d895c43e295df72be6d46c07a3a46cfbd62\"\n        first_imported = \"2025-12-30\"\n    strings:\n        $obfuscated_downloader = /\\s{200}global\\[[\\x09\\x0A\\x0D\\x20-\\x7E]+function[\\x09\\x0A\\x0D\\x20-\\x7E]+\\.length;[\\x09\\x0A\\x0D\\x20-\\x7E]+charAt\\([\\x09\\x0A\\x0D\\x20-\\x7E]+\\.join/\n    condition:\n        uint16(0) != 0x5A4D and $obfuscated_downloader\n}",
            "pattern_type": "yara",
            "valid_from": "2026-03-31T00:00:00Z"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--682f8644-bdc6-42f6-ac22-7065e43fd556",
            "value": "23.27.202.143"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8ab74ac2-22d4-4842-a74b-1152536c493b",
            "hashes": {
                "SHA-256": "91822e59bd642f8e6f321011d0fb45b8a5f0854547ea898dead5d5af1db3ed9b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f6f4f902-aed7-439a-b690-62dad94f0d11",
            "hashes": {
                "SHA-256": "7237310e076459d2fce2f531941b5920e451f390a8b8e633787b62b68b1315d5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--707c7d35-b3a6-43e3-823c-e7fb486a4df5",
            "hashes": {
                "SHA-256": "d043f264ff5216fa724cad2d35ba4d895c43e295df72be6d46c07a3a46cfbd62"
            }
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--b8491b24-8315-436c-90c5-1ffef717ba89",
            "created_by_ref": "identity--a0c9d5b8-85f8-46ec-b653-9c17270dbb20",
            "created": "2026-08-14T03:53:19.135779Z",
            "modified": "2026-08-14T03:53:19.135779Z",
            "name": "EtherHiding: The trojan in your toolchain",
            "published": "2026-03-31T00:00:00Z",
            "object_refs": [
                "identity--a0c9d5b8-85f8-46ec-b653-9c17270dbb20",
                "ipv4-addr--07b2a6fc-8fc9-4ac8-9a19-ae97064c246f",
                "ipv4-addr--c29544b2-6785-4508-9dd4-eac983409afd",
                "ipv4-addr--2cc5c760-1712-4cdd-8546-e80307fb7fc6",
                "indicator--99107914-10f5-4f42-9572-89841b860443",
                "ipv4-addr--682f8644-bdc6-42f6-ac22-7065e43fd556",
                "file--8ab74ac2-22d4-4842-a74b-1152536c493b",
                "file--f6f4f902-aed7-439a-b690-62dad94f0d11",
                "file--707c7d35-b3a6-43e3-823c-e7fb486a4df5"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://cyber.gc.ca/en/news-events/etherhiding-trojan-your-toolchain"
                }
            ]
        }
    ]
}