{
    "type": "bundle",
    "id": "bundle--a7ee34f6-6e67-4e66-9949-0e7f02102993",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2023-03-08T12:51:42.067091Z",
            "modified": "2023-03-10T04:35:51.526813Z",
            "name": "USCISA",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a0a93be3-a316-4d77-9121-36c254fe0992",
            "hashes": {
                "SHA-256": "129b8825eaf61dcc2321aad7b84632233fa4bbc7e24bdf123b507157353930f0"
            }
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ca24a74-5b46-4256-b3c9-903633050388",
            "created": "2026-08-20T01:45:16.783819Z",
            "modified": "2026-08-20T01:45:16.783819Z",
            "name": "YARA Rule",
            "pattern": "rule CISA_3P_10257062 : HiddenCobra_FASTCASH_trojan\n{\n    meta:\n        Author = \"CISA Trusted Third Party\"\n        Date = \"2020-08-11\"\n        Actor = \"Hidden Cobra\"\n        Category = \"Trojan\"\n        Family = \"FASTCASH\"\n        Description = \"Detects HiddenCobra FASTCASH samples\"\n        MD5_1 = \"a2b1a45a242cee03fab0bedb2e460587\"\n        SHA256_1 = \"5cb7a352535b447609849e20aec18c84d8b58e377d9c6365eafb45cdb7ef949b\"\n    strings:\n        $sn_config_key1 = \"Slsklqc^mNgq`lyznqr[q^123\"\n        $sn_config_key2 = \"zRuaDglxjec^tDttSlsklqc^m\"\n        $sn_logfile1 = \"C:\\\\intel\\\\_DMP_V\\\\spvmdl.dat\"\n        $sn_logfile2 = \"C:\\\\intel\\\\_DMP_V\\\\spvmlog_%X.dat\"\n        $sn_logfile3 = \"C:\\\\intel\\\\_DMP_V\\\\TMPL_%X.dat\"\n        $sn_logfile4 = \"C:\\\\intel\\\\mvblk.dat\"\n        $sn_logfile5 = \"C:\\\\intel\\\\_DMP_V\\\\spvmsuc.dat\"\n    condition:\n        all of ($sn*)\n}",
            "pattern_type": "yara",
            "valid_from": "2020-08-26T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--edcf549b-f615-4478-95f6-3ec118730301",
            "created": "2026-08-20T01:45:16.784019Z",
            "modified": "2026-08-20T01:45:16.784019Z",
            "name": "YARA Rule",
            "pattern": "rule CISA_10257062_01 : ATM_Malware\n{\n    meta:\n        Author = \"CISA Code & Media Analysis\"\n        Incident = \"10257062\"\n        Date = \"2019-09-26\"\n        Last_Modified = \"20200117_1732\"\n        Category = \"Financial\"\n        Family = \"ATM_Malware\"\n        MD5_1 = \"c4141ee8e9594511f528862519480d36\"\n        SHA256_1 = \"129b8825eaf61dcc2321aad7b84632233fa4bbc7e24bdf123b507157353930f0\"\n    strings:\n        $x3 = \"RECV SOCK= 0x%p, BUF= 0x%p, LEN= 0x%08X, RET= %08X, IP= %s, Port= %d\" fullword ascii\n        $x4 = \"init_hashmap succ\" fullword ascii\n        $x5 = \"89*(w8y92r3y9*yI2H28Y9(*y3@*\" fullword ascii\n    condition:\n        ($x3) and ($x4) and ($x5)\n}",
            "pattern_type": "yara",
            "valid_from": "2020-08-26T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--10019027-df9c-4b9c-85ce-3ff869653b9b",
            "hashes": {
                "SHA-1": "e9c9ef312370d995d303e8fc60de4e4765436f58"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a5aa54c8-a894-4603-9816-3fa6f326d061",
            "hashes": {
                "MD5": "a2b1a45a242cee03fab0bedb2e460587"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1e55d03a-4561-46f2-9ee8-8e2e2b4ff054",
            "hashes": {
                "SHA-256": "5cb7a352535b447609849e20aec18c84d8b58e377d9c6365eafb45cdb7ef949b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bb3b536f-6cc8-4a41-a668-3f2d5715a543",
            "hashes": {
                "SHA-1": "2b22d9c673d031dfd07986906184e1d31908cea1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2f1ee5c1-93fa-47fc-9c7c-043fc709e185",
            "hashes": {
                "MD5": "c4141ee8e9594511f528862519480d36"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cd7481d0-9650-45ea-83b5-1a826c8c16ae",
            "hashes": {
                "SHA-1": "730c1b9e950932736fc4b02cbdb4e4e891485ac2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6635d31c-8d6b-49bf-8336-7e6aec14fa4e",
            "hashes": {
                "SHA-256": "39cbad3b2aac6298537a85f0463453d54ab2660c913f4f35ba98fffeb0b15655"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c43c3011-ddfd-4ada-a94b-737bea8e289d",
            "hashes": {
                "MD5": "89081f2e14e9266de8c042629b764926"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28",
            "created": "2026-08-20T01:45:16.787027Z",
            "modified": "2026-08-20T01:45:16.787027Z",
            "name": "HiddenCobra"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--34588dea-5cc9-490a-ab2f-a66f831aaad7",
            "created_by_ref": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2026-08-20T01:45:16.787339Z",
            "modified": "2026-08-20T01:45:16.787339Z",
            "name": "MAR-10257062-1.v2 - North Korean Remote Access Tool: FASTCASH for Windows",
            "published": "2020-08-26T00:00:00Z",
            "object_refs": [
                "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
                "file--a0a93be3-a316-4d77-9121-36c254fe0992",
                "indicator--5ca24a74-5b46-4256-b3c9-903633050388",
                "indicator--edcf549b-f615-4478-95f6-3ec118730301",
                "file--10019027-df9c-4b9c-85ce-3ff869653b9b",
                "file--a5aa54c8-a894-4603-9816-3fa6f326d061",
                "file--1e55d03a-4561-46f2-9ee8-8e2e2b4ff054",
                "file--bb3b536f-6cc8-4a41-a668-3f2d5715a543",
                "file--2f1ee5c1-93fa-47fc-9c7c-043fc709e185",
                "file--cd7481d0-9650-45ea-83b5-1a826c8c16ae",
                "file--6635d31c-8d6b-49bf-8336-7e6aec14fa4e",
                "file--c43c3011-ddfd-4ada-a94b-737bea8e289d",
                "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.cisa.gov/news-events/analysis-reports/ar20-239c"
                }
            ]
        }
    ]
}