{
    "type": "bundle",
    "id": "bundle--ef72d61a-948b-4c64-9a04-f61dc88675ff",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2023-03-08T12:51:42.067091Z",
            "modified": "2023-03-10T04:35:51.526813Z",
            "name": "USCISA",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--6d93c434-3666-43c4-b8a3-73eafc938d89",
            "created": "2026-09-29T07:08:24.596525Z",
            "modified": "2026-09-29T07:08:24.596525Z",
            "name": "YARA Rule",
            "pattern": "rule CISA_3P_10301706_02 : HiddenCobra TWOPENCE backdoor dropper proxy spyware trojan\n{\nmeta:\nAuthor = \"CISA Trusted Third Party\"\nIncident = \"10301706.r2.v1\"\nDate = \"2020-08-11\"\nActor = \"Hidden Cobra\"\nCategory = \"Backdoor Dropper Proxy Spyware Trojan\"\nFamily = \"TWOPENCE\"\nDescription = \"Detects strings in TWOPENCE proxy tool\"\nMD5_1 = \"40e698f961eb796728a57ddf81f52b9a\"\nSHA256_1 = \"a917c1cc198cf36c0f2f6c24652e5c2e94e28d963b128d54f00144d216b2d118\"\nMD5_2 = \"dfd09e91b7f86a984f8687ed6033af9d\"\nSHA256_2 = \"aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83\"\nMD5_3 = \"bda82f0d9e2cb7996d2eefdd1e5b41c4\"\nSHA256_3 = \"f3ca8f15ca582dd486bd78fd57c2f4d7b958163542561606bebd250c827022de\"\nMD5_4 = \"97aaf130cfa251e5207ea74b2558293d\"\nSHA256_4 = \"9a776b895e93926e2a758c09e341accb9333edc1243d216a5e53f47c6043c852\"\nMD5_5 = \"889e320cf66520485e1a0475107d7419\"\nSHA256_5 = \"8cad61422d032119219f465331308c5a61e21c9a3a431b88e1f8b25129b7e2a1\"\nstrings:\n$cmd1 = \"ssylka\"\n$cmd2 = \"ustanavlivat\"\n$cmd3 = \"poluchit\"\n$cmd4 = \"pereslat\"\n$cmd5 = \"derzhat\"\n$cmd6 = \"vykhodit\"\n$cmd7 = \"Nachalo\"\n$cmd8 = \"kliyent2podklyuchit\"\n$frmt1 = \"Host: %s%s%s:%hu\"\n$frmt2 = \"%s%s%s%s%s%s%s%s%s%s\"\ncondition:\n(4 of ($cmd*)) and (1 of ($frmt*))\n}",
            "pattern_type": "yara",
            "valid_from": "2020-08-26T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--eb2b787e-6543-4203-850c-c2f0e18109a9",
            "hashes": {
                "MD5": "dfd09e91b7f86a984f8687ed6033af9d",
                "SHA-1": "b8fe7884d2dc4983fb0fbca192694ce2f4685e23",
                "SHA-256": "aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--eb0ca4a1-bd7c-4a35-8c32-5e2cfa6b62f5",
            "hashes": {
                "MD5": "3c9e71400b72cc0213c9c3e4ab4df9df",
                "SHA-1": "bdb632b27ddb200693c1b0b80819a7463d4e7a98",
                "SHA-256": "70b494b0a8fdf054926829dcb3235fc7bd0346b6a19faf2a57891c71043b3b38"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a82b3f08-8843-4c2e-a547-bbfae2d1943b",
            "hashes": {
                "MD5": "97aaf130cfa251e5207ea74b2558293d",
                "SHA-1": "c7e7dd96fefca77bb1097aeeefef126d597126bd",
                "SHA-256": "9a776b895e93926e2a758c09e341accb9333edc1243d216a5e53f47c6043c852"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f7585472-49b8-42b6-8cc8-22e11fca2162",
            "hashes": {
                "MD5": "bda82f0d9e2cb7996d2eefdd1e5b41c4",
                "SHA-1": "9ff715209d99d2e74e64f9db894c114a8d13229a",
                "SHA-256": "f3ca8f15ca582dd486bd78fd57c2f4d7b958163542561606bebd250c827022de"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a9755cd6-7758-4bae-b285-32a2a6377464",
            "hashes": {
                "MD5": "889e320cf66520485e1a0475107d7419",
                "SHA-1": "f5fc9d893ae99f97e43adcef49801782daced2d7",
                "SHA-256": "8cad61422d032119219f465331308c5a61e21c9a3a431b88e1f8b25129b7e2a1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3ff49009-7931-42a8-97a1-7189d4255b21",
            "hashes": {
                "MD5": "40e698f961eb796728a57ddf81f52b9a",
                "SHA-1": "50b4f9a8fa6803f0aabb6fd9374244af40c2ba4c",
                "SHA-256": "a917c1cc198cf36c0f2f6c24652e5c2e94e28d963b128d54f00144d216b2d118"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28",
            "created": "2026-09-29T07:08:24.598718Z",
            "modified": "2026-09-29T07:08:24.598718Z",
            "name": "HiddenCobra"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--9f733d7a-8d81-4705-b58f-6c16ca7d6b95",
            "created_by_ref": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2026-09-29T07:08:24.599446Z",
            "modified": "2026-09-29T07:08:24.599446Z",
            "name": "MAR-10301706-2.v1 - North Korean Remote Access Tool: VIVACIOUSGIFT",
            "published": "2020-08-26T00:00:00Z",
            "object_refs": [
                "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
                "indicator--6d93c434-3666-43c4-b8a3-73eafc938d89",
                "file--eb2b787e-6543-4203-850c-c2f0e18109a9",
                "file--eb0ca4a1-bd7c-4a35-8c32-5e2cfa6b62f5",
                "file--a82b3f08-8843-4c2e-a547-bbfae2d1943b",
                "file--f7585472-49b8-42b6-8cc8-22e11fca2162",
                "file--a9755cd6-7758-4bae-b285-32a2a6377464",
                "file--3ff49009-7931-42a8-97a1-7189d4255b21",
                "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.cisa.gov/news-events/analysis-reports/ar20-239b"
                }
            ]
        }
    ]
}