{
    "type": "bundle",
    "id": "bundle--b9c11cf7-362f-4cf3-90cb-fcc904e556b2",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2023-03-08T12:51:42.067091Z",
            "modified": "2023-03-10T04:35:51.526813Z",
            "name": "USCISA",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0e4b226f-e375-4aae-a284-9ae97e420792",
            "hashes": {
                "SHA-1": "2c879a1d4b6334c59ac5f11c2038d273d334befe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cc6e75da-366c-49ae-acdb-4f94748b6234",
            "hashes": {
                "MD5": "d2de01858417fa3b580b3a95857847d5"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--77979f7a-3c1d-464f-b884-6489747fdb90",
            "value": "112.217.108.138"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--44d14a9e-ccb4-460e-84b2-271ca81fda51",
            "created": "2026-08-20T01:45:33.206031Z",
            "modified": "2026-08-20T01:45:33.206031Z",
            "name": "YARA Rule",
            "pattern": "rule CISA_3P_10135536_02_rc4_key_2 { meta: Author = \"CISA Trusted Third Party\" Incident = \"10135536\" Date = \"2018-04-19\" Actor = \"Hidden Cobra\" Category = \"n/a\" Family = \"n/a\" Description = \"n/a\" strings: $s1 = { c6 ?? ?? 79 c6 ?? ?? e1 c6 ?? ?? 0a c6 ?? ?? 5d c6 ?? ?? 87 c6 ?? ?? 7d c6 ?? ?? 9f c6 ?? ?? f7 c6 ?? ?? 5d c6 ?? ?? 12 c6 ?? ?? 2e c6 ?? ?? 11 c6 ?? ?? 65 c6 ?? ?? ac c6 ?? ?? e3 c6 ?? ?? 25 } $s2 = { c7 ?? ?? 79 e1 0a 5d c7 ?? ?? 87 7d 9f f7 c7 ?? ?? 5d 12 2e 11 c7 ?? ?? 65 ac e3 25 } condition: (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them }",
            "pattern_type": "yara",
            "valid_from": "2020-05-12T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d65a30bd-c332-4491-a234-036e240a8f7f",
            "hashes": {
                "SHA-256": "d620d88dfe1dbc0b407d0c3010ff18963e8bb1534f32998322f5a16746a1d0a6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4a4fc6f9-ecbf-478f-a876-658080e63b83",
            "hashes": {
                "SHA-256": "aab2868a6ebc6bdee5bd12104191db9fc1950b30bcf96eab99801624651e77b6"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28",
            "created": "2026-08-20T01:45:33.207567Z",
            "modified": "2026-08-20T01:45:33.207567Z",
            "name": "HiddenCobra"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--94c05c71-8d97-436e-9a0f-fa959df2461f",
            "created_by_ref": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2026-08-20T01:45:33.207891Z",
            "modified": "2026-08-20T01:45:33.207891Z",
            "name": "MAR-10288834-3.v1 \u2013 North Korean Trojan: PEBBLEDASH",
            "published": "2020-05-12T00:00:00Z",
            "object_refs": [
                "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
                "file--0e4b226f-e375-4aae-a284-9ae97e420792",
                "file--cc6e75da-366c-49ae-acdb-4f94748b6234",
                "ipv4-addr--77979f7a-3c1d-464f-b884-6489747fdb90",
                "indicator--44d14a9e-ccb4-460e-84b2-271ca81fda51",
                "file--d65a30bd-c332-4491-a234-036e240a8f7f",
                "file--4a4fc6f9-ecbf-478f-a876-658080e63b83",
                "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.cisa.gov/news-events/analysis-reports/ar20-133c"
                }
            ]
        }
    ]
}