{
    "type": "bundle",
    "id": "bundle--f6d56997-7429-48b5-b524-4b83cf485fd6",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--f924a234-6732-41ee-bc8d-9100eba73165",
            "created": "2023-03-08T12:51:52.889089Z",
            "modified": "2024-09-11T13:26:05.365279Z",
            "name": "ReversingLabs",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--f7f9c532-2bf6-480b-83bd-dbdd115c9855",
            "created": "2026-06-24T21:10:45.111656Z",
            "modified": "2026-06-24T21:10:45.111656Z",
            "name": "YARA Rule",
            "pattern": "rule Copperhedge_F {\r\nstrings:\r\n$user_agent1 = \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome\"\r\n$user_agent2 = \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome\"\r\n$form_data1 = \"_webident_f\"\r\n$form_data2 = \"_webident_s\"\r\ncondition:\r\n($user_agent1 or $user_agent2) and $form_data1 and $form_data2\r\n}",
            "pattern_type": "yara",
            "valid_from": "2020-06-23T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a091db9f-14a2-44a4-92b7-8810ccce2255",
            "hashes": {
                "SHA-1": "9ff4836ff1670816995297234cb5f6e326c16d26"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e3126c46-7697-4f6e-b850-09ac0c668f2c",
            "hashes": {
                "SHA-1": "588a298b51921f4ee8f6fb7ec837f80039328afe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b17fd343-4602-46e3-a868-f9cde4b37cd5",
            "hashes": {
                "SHA-1": "49379896fa096f523e55f8daf1db00cf262852da"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d79f0650-43f0-4266-bf8c-13ef3f8a6246",
            "hashes": {
                "SHA-1": "17e5e9fcd31ba8df50ef5474c27121615d704b8f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--774fbb47-91ff-4443-a9eb-701dad3ba3c3",
            "hashes": {
                "SHA-1": "3a25b9bd8c0995c5a2e2a3a31fe4691a18d44e72"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1b1aaa29-a0c9-45fe-8a6b-e4142138b103",
            "hashes": {
                "SHA-1": "14b681e0c9ce9a02f2fb093927f043bbb608afc6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b90d57d2-5b72-4a58-b5f8-8065c715a493",
            "hashes": {
                "SHA-1": "b5e134bc58f8eda4efd99a45628eb433c4bcbc19"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a2682671-bf4b-4a41-b980-c4ad454e7d7d",
            "hashes": {
                "SHA-1": "78925505b266e973ad7b5ec5b28c0f77cd65a628"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8695d239-8c52-4626-aa89-86091eb98e03",
            "hashes": {
                "SHA-1": "5692a8fb1e5c1f0802c8e552dd043087e2914aa7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3f074214-9bbb-4ee8-958d-d09c5c60a37f",
            "hashes": {
                "SHA-1": "b233b56cd9a11a273df389b98431f1deb8ab7e12"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8833cc83-2a24-47ea-942f-a18f701f66ba",
            "hashes": {
                "SHA-1": "e211559f3dfc6db100958b8c12e20f064111f26a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0e4b226f-e375-4aae-a284-9ae97e420792",
            "hashes": {
                "SHA-1": "2c879a1d4b6334c59ac5f11c2038d273d334befe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b0517ccd-31b0-4401-9d4c-d6282a64ff45",
            "hashes": {
                "SHA-1": "0faf5540bcb8782dd70bcb31f3aa9baf7e65a043"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e2b69cac-9eff-4936-860e-c657e6cb43f4",
            "hashes": {
                "SHA-1": "f744f5f97ace1a4862e764971449c28c4b880e8f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dd8a2796-13c3-4077-a76b-85055858ce3a",
            "hashes": {
                "SHA-1": "03138278b603bc120b2cba001a8adb0b2d7d82ea"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--182d88da-f6e8-4899-ad3b-f41c358ff0a4",
            "hashes": {
                "SHA-1": "ef0c0ef95b1542184a6a1f4d1f4ece583046ba0a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9bb6d3a4-740c-44d2-96dd-75a76d713350",
            "hashes": {
                "SHA-1": "fe0f8a37887c8f8fb5eb3e8252a8df395b3e66e7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--49802781-e037-4a1c-ba5f-1851071d78e2",
            "hashes": {
                "SHA-1": "8c6d92becc487dc0043e446f99f165b06af36d72"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a5baa4ad-e188-4963-9217-2d4fdccc039d",
            "hashes": {
                "SHA-1": "84f3437bbccb514d639c0a6134298261aefb457e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7bfb5acd-a3fa-41bd-8836-a6a4ba4a2443",
            "hashes": {
                "SHA-1": "976553cafd72f8e1908f81f297fbc7dbc04c90cd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1fd948e5-fd7f-45d3-8abd-61c6308144f8",
            "hashes": {
                "SHA-1": "7202fea74865e085104f839574cd150613fbcf99"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b849a0eb-ac16-415e-841a-3744975b4007",
            "value": "221.161.45.202"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5dd21b7b-8b76-4186-b4b8-0c7129810dc4",
            "value": "61.106.174.191"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--62132bfa-a326-4cc1-884e-ab0a8efe8fa7",
            "hashes": {
                "SHA-1": "29ddf9baad018518060814a03d424f4e08a0e914"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28",
            "created": "2026-06-24T21:10:45.127849Z",
            "modified": "2026-06-24T21:10:45.127849Z",
            "name": "HiddenCobra"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--e5c8b638-4438-43c7-bacf-ff8c6f1b5ce5",
            "created_by_ref": "identity--f924a234-6732-41ee-bc8d-9100eba73165",
            "created": "2026-06-24T21:10:45.130563Z",
            "modified": "2026-06-24T21:10:45.130563Z",
            "name": "Hidden Cobra - from a shed skin to the viper\u2019s nest",
            "published": "2020-06-23T00:00:00Z",
            "object_refs": [
                "identity--f924a234-6732-41ee-bc8d-9100eba73165",
                "indicator--f7f9c532-2bf6-480b-83bd-dbdd115c9855",
                "file--a091db9f-14a2-44a4-92b7-8810ccce2255",
                "file--e3126c46-7697-4f6e-b850-09ac0c668f2c",
                "file--b17fd343-4602-46e3-a868-f9cde4b37cd5",
                "file--d79f0650-43f0-4266-bf8c-13ef3f8a6246",
                "file--774fbb47-91ff-4443-a9eb-701dad3ba3c3",
                "file--1b1aaa29-a0c9-45fe-8a6b-e4142138b103",
                "file--b90d57d2-5b72-4a58-b5f8-8065c715a493",
                "file--a2682671-bf4b-4a41-b980-c4ad454e7d7d",
                "file--8695d239-8c52-4626-aa89-86091eb98e03",
                "file--3f074214-9bbb-4ee8-958d-d09c5c60a37f",
                "file--8833cc83-2a24-47ea-942f-a18f701f66ba",
                "file--0e4b226f-e375-4aae-a284-9ae97e420792",
                "file--b0517ccd-31b0-4401-9d4c-d6282a64ff45",
                "file--e2b69cac-9eff-4936-860e-c657e6cb43f4",
                "file--dd8a2796-13c3-4077-a76b-85055858ce3a",
                "file--182d88da-f6e8-4899-ad3b-f41c358ff0a4",
                "file--9bb6d3a4-740c-44d2-96dd-75a76d713350",
                "file--49802781-e037-4a1c-ba5f-1851071d78e2",
                "file--a5baa4ad-e188-4963-9217-2d4fdccc039d",
                "file--7bfb5acd-a3fa-41bd-8836-a6a4ba4a2443",
                "file--1fd948e5-fd7f-45d3-8abd-61c6308144f8",
                "ipv4-addr--b849a0eb-ac16-415e-841a-3744975b4007",
                "ipv4-addr--5dd21b7b-8b76-4186-b4b8-0c7129810dc4",
                "file--62132bfa-a326-4cc1-884e-ab0a8efe8fa7",
                "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.reversinglabs.com/blog/hidden-cobra"
                }
            ]
        }
    ]
}