{
  "Event": {
    "analysis": "1",
    "date": "2020-06-10",
    "extends_uuid": "",
    "info": "[Threat Intel] Honda Hacked: Japanese Car Giant Confirms Cyber Attack On Global Operations",
    "protected": false,
    "publish_timestamp": "1772418818",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1772418813",
    "uuid": "e8f1c068-f648-4678-b557-a4196cdf7ebc",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"Snake-Ekans\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Automotive\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120044",
        "local": false,
        "name": "rectifyq:sub-category=\"intrusion-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#190061",
        "local": false,
        "name": "rectifyq:topic=\"ics-ot\"",
        "relationship_type": ""
      },
      {
        "colour": "#f1dfed",
        "local": false,
        "name": "rectifyq:TA-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#d92121",
        "local": false,
        "name": "rectifyq:target=\"targeted\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#dff146",
        "local": false,
        "name": "IT-impact-ICS",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:sector=\"Industrial\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772247019",
        "to_ids": false,
        "type": "link",
        "uuid": "ddb09027-1e58-4459-9a23-f117706124e7",
        "value": "https://www.forbes.com/sites/daveywinder/2020/06/10/honda-hacked-japanese-car-giant-confirms-cyber-attack-on-global-operations-snake-ransomware/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772247019",
        "to_ids": false,
        "type": "link",
        "uuid": "2d420fcb-cd51-42d5-9dbb-ec88fc610ff8",
        "value": "https://www.bleepingcomputer.com/news/security/honda-investigates-possible-ransomware-attack-networks-impacted/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1772247019",
        "to_ids": false,
        "type": "link",
        "uuid": "a71f5054-da30-4ac5-b246-6fe85636fe7d",
        "value": "https://x.com/milkr3am/status/1270019326976786432"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1772348233",
        "uuid": "567838fb-a868-49b8-8945-c65a74d36218",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1772348233",
            "to_ids": true,
            "type": "md5",
            "uuid": "1e2aeac4-09d6-4811-9dd6-8729962dc42b",
            "value": "ed3c05bde9f0ea0f1321355b03ac42d0",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1772347447",
            "to_ids": true,
            "type": "sha1",
            "uuid": "151f8756-66a1-452e-ae6e-611506a72318",
            "value": "e2e14949d0cbc14cd3893da035cc13b509e70a18",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1772347447",
            "to_ids": true,
            "type": "sha256",
            "uuid": "cc44d6aa-68af-490d-833f-0a6017244636",
            "value": "d4da69e424241c291c173c8b3756639c654432706e7def5025a649730868c4a1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1772347209",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b42eb6e2-7c8d-471d-ad58-e87fee8c5ffb",
            "value": "49152:NLpNltFlwVK8sD4ZS22aHKjzF/3ODd8L9AKyyXP02+:ntrwkMKfF"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1772347209",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "15f29571-28bb-4fcc-9ca3-3941cdbc8f83",
            "value": "3965952"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1772347209",
            "to_ids": true,
            "type": "vhash",
            "uuid": "66b83c58-2b0c-4b06-b1ee-df7d24d573f1",
            "value": "0360475d5d141az1dtz2017z"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1772347209",
            "to_ids": true,
            "type": "filename",
            "uuid": "8d199c76-c977-489e-8c26-7af0a2819f50",
            "value": "ntdll.dll"
          },
          {
            "category": "Other",
            "comment": "Checked: 01/03/2026\nLast-scan\t:  26/02/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1772347209",
            "to_ids": false,
            "type": "text",
            "uuid": "055ea639-004c-4c1d-a2be-ffb075753cc7",
            "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win32/Snake!MSR\nVT Total Detection:59/72\nFirst Submission:2020-06-08T01:36:39.000000+00:00\nLast Submission:2025-07-03T01:37:58.000000+00:00"
          }
        ]
      }
    ]
  }
}