{
    "type": "bundle",
    "id": "bundle--463d4ee0-3817-41d2-b942-007f96defd7b",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2023-03-08T12:51:42.067091Z",
            "modified": "2023-03-10T04:35:51.526813Z",
            "name": "USCISA",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--ca5ff2e4-bf33-41c0-a5a2-7d36fbc01454",
            "created": "2026-09-29T07:13:41.628595Z",
            "modified": "2026-09-29T07:13:41.628595Z",
            "name": "YARA Rule",
            "pattern": "rule CISA_3P_10301706_01 {\n  meta:\n    Author = \"CISA Trusted Third Party\"\n    Incident = \"10301706.r1.v1\"\n    Date = \"2020-08-11\"\n    Actor = \"Hidden Cobra\"\n    Category = \"Backdoor Keylogger Reconnaissance Screen-Capture Spyware Trojan\"\n    Family = \"ECCENTRICBANDWAGON\"\n    Description = \"Detects strings in ECCENTRICBANDWAGON proxy tool\"\n    MD5_1 = \"d45931632ed9e11476325189ccb6b530\"\n    SHA256_1 = \"efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e\"\n    MD5_2 = \"acd15f4393e96fe5eb920727dc083aed\"\n    SHA256_2 = \"32a4de070ca005d35a88503717157b0dc3f2e8da76ffd618fca6563aec9c81f8\"\n    MD5_3 = \"34404a3fb9804977c6ab86cb991fb130\"\n    SHA256_3 = \"c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec\"\n    MD5_4 = \"3122b0130f5135b6f76fca99609d5cbe\"\n    SHA256_4 = \"9ea5aa00e0a738b74066c61b1d35331170a9e0a84df1cc6cef58fd46a8ec5a2e\"\n  strings:\n    $sn1 = { FB 19 9D 57 [1-6] 9A D1 D6 D1 [1-6] 42 9E D8 FD }\n    $sn2 = { 4F 03 43 83 [1-6] 48 E0 1A 2E [1-6] 3B FD FD FD }\n    $sn3 = { 68 56 68 9A [1-12] 4D E1 1F 25 [1-12] 3F 38 54 0F [1-12] 73 30 62 A1 [1-12] DB 39 BD 56 }\n    $sn4 = \"%s\\\\chromeupdater_ps_%04d%02d%02d_%02d%02d%02d_%03d_%d\" wide ascii nocase\n    $sn5 = \"c:\\\\windows\\\\temp\\\\TMP0389A.tmp\" wide ascii nocase\n  condition:\n    any of them\n}",
            "pattern_type": "yara",
            "valid_from": "2020-08-26T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5ad6dd0c-de04-4716-b990-fb77ca1301ee",
            "hashes": {
                "MD5": "acd15f4393e96fe5eb920727dc083aed",
                "SHA-1": "c92529097cad8996f3a3c8eb34b56273c29bdce5",
                "SHA-256": "32a4de070ca005d35a88503717157b0dc3f2e8da76ffd618fca6563aec9c81f8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1930db88-1544-4739-b570-f0a198d92637",
            "hashes": {
                "MD5": "3122b0130f5135b6f76fca99609d5cbe",
                "SHA-1": "ce6bc34b887d60f6d416a05d5346504c54cff030",
                "SHA-256": "9ea5aa00e0a738b74066c61b1d35331170a9e0a84df1cc6cef58fd46a8ec5a2e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2791164b-75b0-4730-a366-f4907182d8e5",
            "hashes": {
                "MD5": "d45931632ed9e11476325189ccb6b530",
                "SHA-1": "081d5bd155916f8a7236c1ea2148513c0c2c9a33",
                "SHA-256": "efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4a27c246-3d07-4dcb-ae16-a667cd459cd0",
            "hashes": {
                "MD5": "34404a3fb9804977c6ab86cb991fb130",
                "SHA-1": "b345e6fae155bfaf79c67b38cf488bb17d5be56d",
                "SHA-256": "c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28",
            "created": "2026-09-29T07:13:41.630507Z",
            "modified": "2026-09-29T07:13:41.630507Z",
            "name": "HiddenCobra"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--522154fa-7808-4d82-8056-afd64ab54f73",
            "created_by_ref": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2026-09-29T07:13:41.631596Z",
            "modified": "2026-09-29T07:13:41.631596Z",
            "name": "MAR-10301706-1.v1 - North Korean Remote Access Tool: ECCENTRICBANDWAGON",
            "published": "2020-08-26T00:00:00Z",
            "object_refs": [
                "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
                "indicator--ca5ff2e4-bf33-41c0-a5a2-7d36fbc01454",
                "file--5ad6dd0c-de04-4716-b990-fb77ca1301ee",
                "file--1930db88-1544-4739-b570-f0a198d92637",
                "file--2791164b-75b0-4730-a366-f4907182d8e5",
                "file--4a27c246-3d07-4dcb-ae16-a667cd459cd0",
                "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.cisa.gov/news-events/analysis-reports/ar20-239a"
                }
            ]
        }
    ]
}