{
    "type": "bundle",
    "id": "bundle--9ea10bd4-2f6d-47ab-af2c-55b6c43a57af",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2023-03-08T12:51:42.067091Z",
            "modified": "2023-03-10T04:35:51.526813Z",
            "name": "USCISA",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--ca5ff2e4-bf33-41c0-a5a2-7d36fbc01454",
            "created": "2026-08-20T01:45:16.784007Z",
            "modified": "2026-08-20T01:45:16.784007Z",
            "name": "YARA Rule",
            "pattern": "rule CISA_3P_10301706_01 {\n  meta:\n    Author = \"CISA Trusted Third Party\"\n    Incident = \"10301706.r1.v1\"\n    Date = \"2020-08-11\"\n    Actor = \"Hidden Cobra\"\n    Category = \"Backdoor Keylogger Reconnaissance Screen-Capture Spyware Trojan\"\n    Family = \"ECCENTRICBANDWAGON\"\n    Description = \"Detects strings in ECCENTRICBANDWAGON proxy tool\"\n    MD5_1 = \"d45931632ed9e11476325189ccb6b530\"\n    SHA256_1 = \"efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e\"\n    MD5_2 = \"acd15f4393e96fe5eb920727dc083aed\"\n    SHA256_2 = \"32a4de070ca005d35a88503717157b0dc3f2e8da76ffd618fca6563aec9c81f8\"\n    MD5_3 = \"34404a3fb9804977c6ab86cb991fb130\"\n    SHA256_3 = \"c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec\"\n    MD5_4 = \"3122b0130f5135b6f76fca99609d5cbe\"\n    SHA256_4 = \"9ea5aa00e0a738b74066c61b1d35331170a9e0a84df1cc6cef58fd46a8ec5a2e\"\n  strings:\n    $sn1 = { FB 19 9D 57 [1-6] 9A D1 D6 D1 [1-6] 42 9E D8 FD }\n    $sn2 = { 4F 03 43 83 [1-6] 48 E0 1A 2E [1-6] 3B FD FD FD }\n    $sn3 = { 68 56 68 9A [1-12] 4D E1 1F 25 [1-12] 3F 38 54 0F [1-12] 73 30 62 A1 [1-12] DB 39 BD 56 }\n    $sn4 = \"%s\\\\chromeupdater_ps_%04d%02d%02d_%02d%02d%02d_%03d_%d\" wide ascii nocase\n    $sn5 = \"c:\\\\windows\\\\temp\\\\TMP0389A.tmp\" wide ascii nocase\n  condition:\n    any of them\n}",
            "pattern_type": "yara",
            "valid_from": "2020-08-26T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--88ebadfb-290e-49ff-98eb-891ebb94f827",
            "hashes": {
                "SHA-256": "9ea5aa00e0a738b74066c61b1d35331170a9e0a84df1cc6cef58fd46a8ec5a2e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4db7f66f-c3d7-4c52-b8a6-5c5b8771edce",
            "hashes": {
                "SHA-1": "ce6bc34b887d60f6d416a05d5346504c54cff030"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7a8e6e2a-af11-484f-b4ca-0b6ae694218e",
            "hashes": {
                "SHA-256": "32a4de070ca005d35a88503717157b0dc3f2e8da76ffd618fca6563aec9c81f8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--842f0891-b52f-43c9-bfd2-4803eaf18d05",
            "hashes": {
                "SHA-1": "c92529097cad8996f3a3c8eb34b56273c29bdce5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d2cd283f-44d5-43b8-90e2-1073765fbd25",
            "hashes": {
                "MD5": "acd15f4393e96fe5eb920727dc083aed"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--da1935fa-a4b0-42ec-8c64-7a4ce30d63e6",
            "hashes": {
                "MD5": "3122b0130f5135b6f76fca99609d5cbe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--401bbf45-257f-45d1-99c0-128b240b80e8",
            "hashes": {
                "SHA-1": "081d5bd155916f8a7236c1ea2148513c0c2c9a33"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2bebe799-b71a-4275-927c-59f1d42894a5",
            "hashes": {
                "SHA-256": "efd470cfa90b918e5d558e5c8c3821343af06eedfd484dfeb20c4605f9bdc30e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--24b77119-92cc-4f6e-8aaf-9fc7422e5a80",
            "hashes": {
                "MD5": "d45931632ed9e11476325189ccb6b530"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5e0acd07-6192-4b2d-8f11-8910c8045889",
            "hashes": {
                "SHA-1": "b345e6fae155bfaf79c67b38cf488bb17d5be56d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8b482704-5517-4896-9575-f825a3d3caf7",
            "hashes": {
                "SHA-256": "c6930e298bba86c01d0fe2c8262c46b4fce97c6c5037a193904cfc634246fbec"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f61c93c1-40c2-414a-8cf3-b3ab6da917b4",
            "hashes": {
                "MD5": "34404a3fb9804977c6ab86cb991fb130"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28",
            "created": "2026-08-20T01:45:16.787543Z",
            "modified": "2026-08-20T01:45:16.787543Z",
            "name": "HiddenCobra"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--522154fa-7808-4d82-8056-afd64ab54f73",
            "created_by_ref": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2026-08-20T01:45:16.788366Z",
            "modified": "2026-08-20T01:45:16.788366Z",
            "name": "MAR-10301706-1.v1 - North Korean Remote Access Tool: ECCENTRICBANDWAGON",
            "published": "2020-08-26T00:00:00Z",
            "object_refs": [
                "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
                "indicator--ca5ff2e4-bf33-41c0-a5a2-7d36fbc01454",
                "file--88ebadfb-290e-49ff-98eb-891ebb94f827",
                "file--4db7f66f-c3d7-4c52-b8a6-5c5b8771edce",
                "file--7a8e6e2a-af11-484f-b4ca-0b6ae694218e",
                "file--842f0891-b52f-43c9-bfd2-4803eaf18d05",
                "file--d2cd283f-44d5-43b8-90e2-1073765fbd25",
                "file--da1935fa-a4b0-42ec-8c64-7a4ce30d63e6",
                "file--401bbf45-257f-45d1-99c0-128b240b80e8",
                "file--2bebe799-b71a-4275-927c-59f1d42894a5",
                "file--24b77119-92cc-4f6e-8aaf-9fc7422e5a80",
                "file--5e0acd07-6192-4b2d-8f11-8910c8045889",
                "file--8b482704-5517-4896-9575-f825a3d3caf7",
                "file--f61c93c1-40c2-414a-8cf3-b3ab6da917b4",
                "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.cisa.gov/news-events/analysis-reports/ar20-239a"
                }
            ]
        }
    ]
}