{
    "type": "bundle",
    "id": "bundle--99dc7b75-8f19-4ad5-9910-33fd025d3874",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--f924a234-6732-41ee-bc8d-9100eba73165",
            "created": "2023-03-08T12:51:52.889089Z",
            "modified": "2024-09-11T13:26:05.365279Z",
            "name": "ReversingLabs",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--f7f9c532-2bf6-480b-83bd-dbdd115c9855",
            "created": "2026-10-09T12:04:40.76254Z",
            "modified": "2026-10-09T12:04:40.76254Z",
            "name": "YARA Rule",
            "pattern": "rule Copperhedge_F {\r\nstrings:\r\n$user_agent1 = \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome\"\r\n$user_agent2 = \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome\"\r\n$form_data1 = \"_webident_f\"\r\n$form_data2 = \"_webident_s\"\r\ncondition:\r\n($user_agent1 or $user_agent2) and $form_data1 and $form_data2\r\n}",
            "pattern_type": "yara",
            "valid_from": "2020-06-23T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a091db9f-14a2-44a4-92b7-8810ccce2255",
            "hashes": {
                "SHA-1": "9ff4836ff1670816995297234cb5f6e326c16d26"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b17fd343-4602-46e3-a868-f9cde4b37cd5",
            "hashes": {
                "MD5": "28ef91c65dc459592d02a198b0a446f0",
                "SHA-1": "49379896fa096f523e55f8daf1db00cf262852da",
                "SHA-256": "36557447ae92dd52604c6072e1ce493caf6fd6ddaa72097200ac3b84efee4274"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d79f0650-43f0-4266-bf8c-13ef3f8a6246",
            "hashes": {
                "MD5": "25e12c24e678028acafb88017f8c14ea",
                "SHA-1": "17e5e9fcd31ba8df50ef5474c27121615d704b8f",
                "SHA-256": "dc16292ecd055a38296be523f3133d363479998d343c44e9407c0d9a3363578b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--774fbb47-91ff-4443-a9eb-701dad3ba3c3",
            "hashes": {
                "MD5": "a230075620550c7093ca1d37a2bd6978",
                "SHA-1": "3a25b9bd8c0995c5a2e2a3a31fe4691a18d44e72",
                "SHA-256": "284865a5ca6528e82b15b57472dd6ffd426a5f18f2d5b9122f48a4f1b259f726"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1b1aaa29-a0c9-45fe-8a6b-e4142138b103",
            "hashes": {
                "SHA-1": "14b681e0c9ce9a02f2fb093927f043bbb608afc6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b90d57d2-5b72-4a58-b5f8-8065c715a493",
            "hashes": {
                "MD5": "1bad6702b4a40e4e48be86e7d0e8b17b",
                "SHA-1": "b5e134bc58f8eda4efd99a45628eb433c4bcbc19",
                "SHA-256": "d02f075d62e3c6dc5f22f784c29da5e00d1f84f6611d66b251db64deab59ea51"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a2682671-bf4b-4a41-b980-c4ad454e7d7d",
            "hashes": {
                "MD5": "e1068cacba806002b1cba6ebfb35e4f4",
                "SHA-1": "78925505b266e973ad7b5ec5b28c0f77cd65a628",
                "SHA-256": "8390e210162d9b14d5b0b1ef9746c16853aa2d29d1dfc4eab6a051885e0333ed"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8695d239-8c52-4626-aa89-86091eb98e03",
            "hashes": {
                "MD5": "7f035be4590a624a9dc816176af942da",
                "SHA-1": "5692a8fb1e5c1f0802c8e552dd043087e2914aa7",
                "SHA-256": "ad45c895ad49cc7f969d25809712e1b18a85ebb3ea0a7acab9fd78efa1392540"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8833cc83-2a24-47ea-942f-a18f701f66ba",
            "hashes": {
                "MD5": "ef118025c43889f0fb9d5c816e815981",
                "SHA-1": "e211559f3dfc6db100958b8c12e20f064111f26a",
                "SHA-256": "0f3bec96c2211f3c614d74c805ebae51a24b49fec1e23fc5a184ae0316a6e230"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b0517ccd-31b0-4401-9d4c-d6282a64ff45",
            "hashes": {
                "MD5": "4b66ddd221cb47869808eb96c0cbadbb",
                "SHA-1": "0faf5540bcb8782dd70bcb31f3aa9baf7e65a043",
                "SHA-256": "879ce8012cb1250497bf227d0344e348c9d1115c7f05d2f5d8c5b256515beafb"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dd8a2796-13c3-4077-a76b-85055858ce3a",
            "hashes": {
                "MD5": "64b59c0b9ca32d9427619161e3cf8a6c",
                "SHA-1": "03138278b603bc120b2cba001a8adb0b2d7d82ea",
                "SHA-256": "6816ebd4af6ab811a95b737a003cfc68f309b3d5884d495cd15f444668feee94"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a5baa4ad-e188-4963-9217-2d4fdccc039d",
            "hashes": {
                "MD5": "f1c263545ccb99b70696083187188a5b",
                "SHA-1": "84f3437bbccb514d639c0a6134298261aefb457e",
                "SHA-256": "ccb5dc3a0e55e640fab5d6b6ac823328700836bcbe6423632428a0ead7436caf"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7bfb5acd-a3fa-41bd-8836-a6a4ba4a2443",
            "hashes": {
                "SHA-1": "976553cafd72f8e1908f81f297fbc7dbc04c90cd"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b849a0eb-ac16-415e-841a-3744975b4007",
            "value": "221.161.45.202"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5dd21b7b-8b76-4186-b4b8-0c7129810dc4",
            "value": "61.106.174.191"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8c6814b1-c8f9-406f-9ed0-f049b61c9ed6",
            "hashes": {
                "MD5": "d2de01858417fa3b580b3a95857847d5",
                "SHA-1": "2c879a1d4b6334c59ac5f11c2038d273d334befe",
                "SHA-256": "aab2868a6ebc6bdee5bd12104191db9fc1950b30bcf96eab99801624651e77b6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e2b69cac-9eff-4936-860e-c657e6cb43f4",
            "hashes": {
                "MD5": "a8b6ec51ed88c0329fd3329cb615bbc9",
                "SHA-1": "f744f5f97ace1a4862e764971449c28c4b880e8f",
                "SHA-256": "37bb27f4eb40b8947e184afddba019001c12f97588e7f596ab6bc07f7c152602"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--182d88da-f6e8-4899-ad3b-f41c358ff0a4",
            "hashes": {
                "MD5": "db590ea77a92ae6435e2ec954d065ed4",
                "SHA-1": "ef0c0ef95b1542184a6a1f4d1f4ece583046ba0a",
                "SHA-256": "284bc471647f951c79e3e333b2b19aa37f84cc39b55441a82e2a5f7319131fac"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9bb6d3a4-740c-44d2-96dd-75a76d713350",
            "hashes": {
                "MD5": "0856655351acffa1ee459eeeaf164756",
                "SHA-1": "fe0f8a37887c8f8fb5eb3e8252a8df395b3e66e7",
                "SHA-256": "a1cdb784100906d0ac895297c5a0959ab21a9fb39c687baf176324ee84095472"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1fd948e5-fd7f-45d3-8abd-61c6308144f8",
            "hashes": {
                "MD5": "117fa0b8b8b965680c7b630c6e2bf01d",
                "SHA-1": "7202fea74865e085104f839574cd150613fbcf99",
                "SHA-256": "e6fc788b5ff7436da4450191a003966a68e2a1913c83f1d3aec78c65f3ba85ca"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3f074214-9bbb-4ee8-958d-d09c5c60a37f",
            "hashes": {
                "MD5": "b578ccf307d55d3267f98349e20ecff1",
                "SHA-1": "b233b56cd9a11a273df389b98431f1deb8ab7e12",
                "SHA-256": "ccafbcff1596e3dfd28dcb97a5ba85e6845e69464742edfe136fe09bbec86ba1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--62132bfa-a326-4cc1-884e-ab0a8efe8fa7",
            "hashes": {
                "MD5": "86685ec8c3c717aa2a9702e2c9dec379",
                "SHA-1": "29ddf9baad018518060814a03d424f4e08a0e914",
                "SHA-256": "c2f150dbe9a8efb72dc46416ca29acdbae6fd4a2af16b27f153eaabd4772a2a1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--49802781-e037-4a1c-ba5f-1851071d78e2",
            "hashes": {
                "MD5": "778a7ed1aa3ce2d8eb719765cac3c166",
                "SHA-1": "8c6d92becc487dc0043e446f99f165b06af36d72",
                "SHA-256": "c10363059c57c52501c01f85e3bb43533ccc639f0ea57f43bae5736a8e7a9bc8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e3126c46-7697-4f6e-b850-09ac0c668f2c",
            "hashes": {
                "MD5": "29e273fcfee8c5a90f4de6214a0fde87",
                "SHA-1": "588a298b51921f4ee8f6fb7ec837f80039328afe",
                "SHA-256": "afba8105793b635d4ed7febdae4b744826ca8b2381c1b85f5e528bb672ed63c2"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28",
            "created": "2026-10-09T12:04:40.767095Z",
            "modified": "2026-10-09T12:04:40.767095Z",
            "name": "HiddenCobra"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--e5c8b638-4438-43c7-bacf-ff8c6f1b5ce5",
            "created_by_ref": "identity--f924a234-6732-41ee-bc8d-9100eba73165",
            "created": "2026-10-09T12:04:40.768677Z",
            "modified": "2026-10-09T12:04:40.768677Z",
            "name": "Hidden Cobra - from a shed skin to the viper\u2019s nest",
            "published": "2020-06-23T00:00:00Z",
            "object_refs": [
                "identity--f924a234-6732-41ee-bc8d-9100eba73165",
                "indicator--f7f9c532-2bf6-480b-83bd-dbdd115c9855",
                "file--a091db9f-14a2-44a4-92b7-8810ccce2255",
                "file--b17fd343-4602-46e3-a868-f9cde4b37cd5",
                "file--d79f0650-43f0-4266-bf8c-13ef3f8a6246",
                "file--774fbb47-91ff-4443-a9eb-701dad3ba3c3",
                "file--1b1aaa29-a0c9-45fe-8a6b-e4142138b103",
                "file--b90d57d2-5b72-4a58-b5f8-8065c715a493",
                "file--a2682671-bf4b-4a41-b980-c4ad454e7d7d",
                "file--8695d239-8c52-4626-aa89-86091eb98e03",
                "file--8833cc83-2a24-47ea-942f-a18f701f66ba",
                "file--b0517ccd-31b0-4401-9d4c-d6282a64ff45",
                "file--dd8a2796-13c3-4077-a76b-85055858ce3a",
                "file--a5baa4ad-e188-4963-9217-2d4fdccc039d",
                "file--7bfb5acd-a3fa-41bd-8836-a6a4ba4a2443",
                "ipv4-addr--b849a0eb-ac16-415e-841a-3744975b4007",
                "ipv4-addr--5dd21b7b-8b76-4186-b4b8-0c7129810dc4",
                "file--8c6814b1-c8f9-406f-9ed0-f049b61c9ed6",
                "file--e2b69cac-9eff-4936-860e-c657e6cb43f4",
                "file--182d88da-f6e8-4899-ad3b-f41c358ff0a4",
                "file--9bb6d3a4-740c-44d2-96dd-75a76d713350",
                "file--1fd948e5-fd7f-45d3-8abd-61c6308144f8",
                "file--3f074214-9bbb-4ee8-958d-d09c5c60a37f",
                "file--62132bfa-a326-4cc1-884e-ab0a8efe8fa7",
                "file--49802781-e037-4a1c-ba5f-1851071d78e2",
                "file--e3126c46-7697-4f6e-b850-09ac0c668f2c",
                "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.reversinglabs.com/blog/hidden-cobra"
                }
            ]
        }
    ]
}