{
    "type": "bundle",
    "id": "bundle--c9ea1a28-d90e-4fa8-acca-70c2b8252222",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2023-03-08T12:51:42.067091Z",
            "modified": "2023-03-10T04:35:51.526813Z",
            "name": "USCISA",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--6d93c434-3666-43c4-b8a3-73eafc938d89",
            "created": "2026-08-20T01:45:05.226582Z",
            "modified": "2026-08-20T01:45:05.226582Z",
            "name": "YARA Rule",
            "pattern": "rule CISA_3P_10301706_02 : HiddenCobra TWOPENCE backdoor dropper proxy spyware trojan\n{\nmeta:\nAuthor = \"CISA Trusted Third Party\"\nIncident = \"10301706.r2.v1\"\nDate = \"2020-08-11\"\nActor = \"Hidden Cobra\"\nCategory = \"Backdoor Dropper Proxy Spyware Trojan\"\nFamily = \"TWOPENCE\"\nDescription = \"Detects strings in TWOPENCE proxy tool\"\nMD5_1 = \"40e698f961eb796728a57ddf81f52b9a\"\nSHA256_1 = \"a917c1cc198cf36c0f2f6c24652e5c2e94e28d963b128d54f00144d216b2d118\"\nMD5_2 = \"dfd09e91b7f86a984f8687ed6033af9d\"\nSHA256_2 = \"aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83\"\nMD5_3 = \"bda82f0d9e2cb7996d2eefdd1e5b41c4\"\nSHA256_3 = \"f3ca8f15ca582dd486bd78fd57c2f4d7b958163542561606bebd250c827022de\"\nMD5_4 = \"97aaf130cfa251e5207ea74b2558293d\"\nSHA256_4 = \"9a776b895e93926e2a758c09e341accb9333edc1243d216a5e53f47c6043c852\"\nMD5_5 = \"889e320cf66520485e1a0475107d7419\"\nSHA256_5 = \"8cad61422d032119219f465331308c5a61e21c9a3a431b88e1f8b25129b7e2a1\"\nstrings:\n$cmd1 = \"ssylka\"\n$cmd2 = \"ustanavlivat\"\n$cmd3 = \"poluchit\"\n$cmd4 = \"pereslat\"\n$cmd5 = \"derzhat\"\n$cmd6 = \"vykhodit\"\n$cmd7 = \"Nachalo\"\n$cmd8 = \"kliyent2podklyuchit\"\n$frmt1 = \"Host: %s%s%s:%hu\"\n$frmt2 = \"%s%s%s%s%s%s%s%s%s%s\"\ncondition:\n(4 of ($cmd*)) and (1 of ($frmt*))\n}",
            "pattern_type": "yara",
            "valid_from": "2020-08-26T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--299fd79f-afef-41f1-a7d3-30f8f66b9242",
            "hashes": {
                "SHA-1": "f5fc9d893ae99f97e43adcef49801782daced2d7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9e4a30ad-b097-49e0-a698-fc075098ad22",
            "hashes": {
                "SHA-1": "bdb632b27ddb200693c1b0b80819a7463d4e7a98"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6b317226-8150-481d-8de7-e64b49d905f2",
            "hashes": {
                "MD5": "3c9e71400b72cc0213c9c3e4ab4df9df"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c4d78d2c-e3ed-40de-9604-5f154c5cba1e",
            "hashes": {
                "SHA-1": "c7e7dd96fefca77bb1097aeeefef126d597126bd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c6f549d7-cb1e-4609-9022-7ff429cc85e0",
            "hashes": {
                "MD5": "97aaf130cfa251e5207ea74b2558293d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e642ff77-4779-4694-8c35-610c02d34c06",
            "hashes": {
                "SHA-1": "b8fe7884d2dc4983fb0fbca192694ce2f4685e23"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e97fd627-f320-428f-9f69-6fff22557ec5",
            "hashes": {
                "MD5": "dfd09e91b7f86a984f8687ed6033af9d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--774fa00a-0d30-4d3e-815e-ea42b56e6292",
            "hashes": {
                "MD5": "40e698f961eb796728a57ddf81f52b9a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6580a575-28ab-4834-87af-ff5c8b6fc327",
            "hashes": {
                "SHA-256": "aca598e2c619424077ef8043cb4284729045d296ce95414c83ed70985c892c83"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e095dff9-c271-416c-afd9-8e36f6429a57",
            "hashes": {
                "SHA-256": "8cad61422d032119219f465331308c5a61e21c9a3a431b88e1f8b25129b7e2a1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--35fe4820-6cdb-46e8-83e9-770f02b05d22",
            "hashes": {
                "SHA-256": "a917c1cc198cf36c0f2f6c24652e5c2e94e28d963b128d54f00144d216b2d118"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e5eae128-6bda-4f82-a387-1298bd729e83",
            "hashes": {
                "SHA-256": "70b494b0a8fdf054926829dcb3235fc7bd0346b6a19faf2a57891c71043b3b38"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2f897c11-340d-44bd-b7ec-f61665d2ff7e",
            "hashes": {
                "SHA-256": "9a776b895e93926e2a758c09e341accb9333edc1243d216a5e53f47c6043c852"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1283d880-41bc-4804-bcf1-5075e66d0c67",
            "hashes": {
                "SHA-256": "f3ca8f15ca582dd486bd78fd57c2f4d7b958163542561606bebd250c827022de"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3376a650-a9ba-493d-8d07-f6a2f3bb4f6d",
            "hashes": {
                "SHA-1": "9ff715209d99d2e74e64f9db894c114a8d13229a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4320df0f-df63-4b3c-b43e-fc6591225cdb",
            "hashes": {
                "MD5": "bda82f0d9e2cb7996d2eefdd1e5b41c4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6ec38732-61ff-4c35-b730-10cf2c22c05a",
            "hashes": {
                "MD5": "889e320cf66520485e1a0475107d7419"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9e625e4d-2450-44ee-b28a-1c4b941ad814",
            "hashes": {
                "SHA-1": "50b4f9a8fa6803f0aabb6fd9374244af40c2ba4c"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28",
            "created": "2026-08-20T01:45:05.230714Z",
            "modified": "2026-08-20T01:45:05.230714Z",
            "name": "HiddenCobra"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--9f733d7a-8d81-4705-b58f-6c16ca7d6b95",
            "created_by_ref": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2026-08-20T01:45:05.231462Z",
            "modified": "2026-08-20T01:45:05.231462Z",
            "name": "MAR-10301706-2.v1 - North Korean Remote Access Tool: VIVACIOUSGIFT",
            "published": "2020-08-26T00:00:00Z",
            "object_refs": [
                "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
                "indicator--6d93c434-3666-43c4-b8a3-73eafc938d89",
                "file--299fd79f-afef-41f1-a7d3-30f8f66b9242",
                "file--9e4a30ad-b097-49e0-a698-fc075098ad22",
                "file--6b317226-8150-481d-8de7-e64b49d905f2",
                "file--c4d78d2c-e3ed-40de-9604-5f154c5cba1e",
                "file--c6f549d7-cb1e-4609-9022-7ff429cc85e0",
                "file--e642ff77-4779-4694-8c35-610c02d34c06",
                "file--e97fd627-f320-428f-9f69-6fff22557ec5",
                "file--774fa00a-0d30-4d3e-815e-ea42b56e6292",
                "file--6580a575-28ab-4834-87af-ff5c8b6fc327",
                "file--e095dff9-c271-416c-afd9-8e36f6429a57",
                "file--35fe4820-6cdb-46e8-83e9-770f02b05d22",
                "file--e5eae128-6bda-4f82-a387-1298bd729e83",
                "file--2f897c11-340d-44bd-b7ec-f61665d2ff7e",
                "file--1283d880-41bc-4804-bcf1-5075e66d0c67",
                "file--3376a650-a9ba-493d-8d07-f6a2f3bb4f6d",
                "file--4320df0f-df63-4b3c-b43e-fc6591225cdb",
                "file--6ec38732-61ff-4c35-b730-10cf2c22c05a",
                "file--9e625e4d-2450-44ee-b28a-1c4b941ad814",
                "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.cisa.gov/news-events/analysis-reports/ar20-239b"
                }
            ]
        }
    ]
}