misp-circl-feed/feeds/circl/stix-2.1/56c44d9a-a738-4a22-9306-058c950d210f.json

{
    "type": "bundle",
    "id": "bundle--56c44d9a-a738-4a22-9306-058c950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T14:42:59.000Z",
            "modified": "2016-02-17T14:42:59.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--56c44d9a-a738-4a22-9306-058c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T14:42:59.000Z",
            "modified": "2016-02-17T14:42:59.000Z",
            "name": "OSINT - Dridex Actors Get In the Ransomware Game With \"Locky\"",
            "published": "2016-02-17T16:09:30Z",
            "object_refs": [
                "observed-data--56c44e27-8b0c-481f-9f2c-659e950d210f",
                "url--56c44e27-8b0c-481f-9f2c-659e950d210f",
                "x-misp-attribute--56c44e47-c110-4aab-ad9b-659b950d210f",
                "indicator--56c44e7f-356c-4509-a371-42d5950d210f",
                "indicator--56c44e7f-c92c-4116-bed0-44e3950d210f",
                "indicator--56c44e7f-7424-4a58-b009-4a0b950d210f",
                "indicator--56c44e80-4168-4412-883a-4373950d210f",
                "indicator--56c44e80-6c6c-46db-bdf2-4377950d210f",
                "indicator--56c44ec8-ddf0-4c29-b765-42bc950d210f",
                "indicator--56c44ec8-2100-442b-9b8a-44e1950d210f",
                "indicator--56c44ec8-60b4-4512-af9e-4771950d210f",
                "indicator--56c44ec9-245c-4ef1-9ebb-4cb8950d210f",
                "indicator--56c44ec9-bc18-4f00-be97-4f40950d210f",
                "indicator--56c44ec9-d334-4804-b8aa-4780950d210f",
                "indicator--56c44eca-a00c-462a-9c72-469a950d210f",
                "indicator--56c44eed-24dc-4e71-8a5d-4167950d210f",
                "indicator--56c44eed-6f04-498d-89ad-4371950d210f",
                "indicator--56c44eee-6b80-412d-b219-4781950d210f",
                "indicator--56c44eee-d6e4-4edc-a889-459a950d210f",
                "indicator--56c44eee-07f4-452b-b63e-4091950d210f",
                "indicator--56c44eef-8e00-4b72-8271-49ee950d210f",
                "indicator--56c44eef-b904-4b5e-ac3d-4827950d210f",
                "indicator--56c44f11-3b1c-410d-9ab2-4d31950d210f",
                "indicator--56c44f11-56b4-4280-a544-470e950d210f",
                "indicator--56c44f11-960c-40ea-b988-4a98950d210f",
                "indicator--56c44f12-8278-4076-b08d-4c22950d210f",
                "indicator--56c44f6a-4084-4283-8701-659d950d210f",
                "indicator--56c44f6b-de78-4b97-b34e-659d950d210f",
                "indicator--56c44f6b-5f08-4d9f-b024-659d950d210f",
                "indicator--56c44f6b-176c-49ba-8548-659d950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56c44e27-8b0c-481f-9f2c-659e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:40:39.000Z",
            "modified": "2016-02-17T10:40:39.000Z",
            "first_observed": "2016-02-17T10:40:39Z",
            "last_observed": "2016-02-17T10:40:39Z",
            "number_observed": 1,
            "object_refs": [
                "url--56c44e27-8b0c-481f-9f2c-659e950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56c44e27-8b0c-481f-9f2c-659e950d210f",
            "value": "https://www.proofpoint.com/us/threat-insight/post/Dridex-Actors-Get-In-the-Ransomware-Game-With-Locky"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--56c44e47-c110-4aab-ad9b-659b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:46:24.000Z",
            "modified": "2016-02-17T10:46:24.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "comment",
            "x_misp_value": "Proofpoint researchers have discovered a new ransomware named \"Locky\" being distributed via MS Word documents with malicious macros. While a variety of new ransomware has appeared since the end of 2015, Locky stands out because it is being delivered by the same actor behind many of the Dridex campaigns we have tracked over the last year."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44e7f-356c-4509-a371-42d5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:42:07.000Z",
            "modified": "2016-02-17T10:42:07.000Z",
            "description": "Payment URIs (Locky asks user to click these links)",
            "pattern": "[url:value = 'http://6dtxgqam4crv6rr6.tor2web.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:42:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44e7f-c92c-4116-bed0-44e3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:42:07.000Z",
            "modified": "2016-02-17T10:42:07.000Z",
            "description": "Payment URIs (Locky asks user to click these links)",
            "pattern": "[url:value = 'http://6dtxgqam4crv6rr6.onion.to']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:42:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44e7f-7424-4a58-b009-4a0b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:42:07.000Z",
            "modified": "2016-02-17T10:42:07.000Z",
            "description": "Payment URIs (Locky asks user to click these links)",
            "pattern": "[url:value = 'http://6dtxgqam4crv6rr6.onion.cab']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:42:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44e80-4168-4412-883a-4373950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:42:08.000Z",
            "modified": "2016-02-17T10:42:08.000Z",
            "description": "Payment URIs (Locky asks user to click these links)",
            "pattern": "[url:value = 'http://6dtxgqam4crv6rr6.onion.link']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:42:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44e80-6c6c-46db-bdf2-4377950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:42:08.000Z",
            "modified": "2016-02-17T10:42:08.000Z",
            "description": "Payment URIs (Locky asks user to click these links)",
            "pattern": "[url:value = 'https://6dtxgqam4crv6rr6.onion']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:42:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44ec8-ddf0-4c29-b765-42bc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:20.000Z",
            "modified": "2016-02-17T10:43:20.000Z",
            "description": "Locky C2",
            "pattern": "[url:value = 'http://109.234.38.35/main.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44ec8-2100-442b-9b8a-44e1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:20.000Z",
            "modified": "2016-02-17T10:43:20.000Z",
            "description": "Locky C2",
            "pattern": "[url:value = 'http://lneqqkvxxogomu.eu/main.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44ec8-60b4-4512-af9e-4771950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:20.000Z",
            "modified": "2016-02-17T10:43:20.000Z",
            "description": "Locky C2",
            "pattern": "[url:value = 'http://qpdar.pw/main.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44ec9-245c-4ef1-9ebb-4cb8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:21.000Z",
            "modified": "2016-02-17T10:43:21.000Z",
            "description": "Locky C2",
            "pattern": "[url:value = 'http://ydbayd.de/main.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:21Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44ec9-bc18-4f00-be97-4f40950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:21.000Z",
            "modified": "2016-02-17T10:43:21.000Z",
            "description": "Locky C2",
            "pattern": "[url:value = 'http://ssojravpf.be/main.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:21Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44ec9-d334-4804-b8aa-4780950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:21.000Z",
            "modified": "2016-02-17T10:43:21.000Z",
            "description": "Locky C2",
            "pattern": "[url:value = 'http://gioaqjklhoxf.eu/main.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:21Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44eca-a00c-462a-9c72-469a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:22.000Z",
            "modified": "2016-02-17T10:43:22.000Z",
            "description": "Locky C2",
            "pattern": "[url:value = 'http://txlmnqnunppnpuq.ru/main.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:22Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44eed-24dc-4e71-8a5d-4167950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:57.000Z",
            "modified": "2016-02-17T10:43:57.000Z",
            "description": "Payloads downloaded by macro",
            "pattern": "[url:value = 'http://www.iglobali.com/34gf5y/r34f3345g.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:57Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44eed-6f04-498d-89ad-4371950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:57.000Z",
            "modified": "2016-02-17T10:43:57.000Z",
            "description": "Payloads downloaded by macro",
            "pattern": "[url:value = 'http://www.southlife.church/34gf5y/r34f3345g.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:57Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44eee-6b80-412d-b219-4781950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:58.000Z",
            "modified": "2016-02-17T10:43:58.000Z",
            "description": "Payloads downloaded by macro",
            "pattern": "[url:value = 'http://www.villaggio.airwave.at/34gf5y/r34f3345g.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44eee-d6e4-4edc-a889-459a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:58.000Z",
            "modified": "2016-02-17T10:43:58.000Z",
            "description": "Payloads downloaded by macro",
            "pattern": "[url:value = 'http://www.jesusdenazaret.com.ve/34gf5y/r34f3345g.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44eee-07f4-452b-b63e-4091950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:58.000Z",
            "modified": "2016-02-17T10:43:58.000Z",
            "description": "Payloads downloaded by macro",
            "pattern": "[url:value = 'http://66.133.129.5/~chuckgilbert/09u8h76f/65fg67n']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44eef-8e00-4b72-8271-49ee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:59.000Z",
            "modified": "2016-02-17T10:43:59.000Z",
            "description": "Payloads downloaded by macro",
            "pattern": "[url:value = 'http://173.214.183.81/~tomorrowhope/09u8h76f/65fg67n']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44eef-b904-4b5e-ac3d-4827950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:43:59.000Z",
            "modified": "2016-02-17T10:43:59.000Z",
            "description": "Payloads downloaded by macro",
            "pattern": "[url:value = 'http://iynus.net/~test/09u8h76f/65fg67n']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:43:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44f11-3b1c-410d-9ab2-4d31950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T14:42:59.000Z",
            "modified": "2016-02-17T14:42:59.000Z",
            "pattern": "[windows-registry-key:key = 'HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Locky']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T14:42:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Persistence mechanism"
                }
            ],
            "labels": [
                "misp:type=\"regkey\"",
                "misp:category=\"Persistence mechanism\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44f11-56b4-4280-a544-470e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T14:42:58.000Z",
            "modified": "2016-02-17T14:42:58.000Z",
            "pattern": "[windows-registry-key:key = 'HKCU\\\\Software\\\\Locky\\\\id']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T14:42:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Persistence mechanism"
                }
            ],
            "labels": [
                "misp:type=\"regkey\"",
                "misp:category=\"Persistence mechanism\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44f11-960c-40ea-b988-4a98950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T14:42:58.000Z",
            "modified": "2016-02-17T14:42:58.000Z",
            "pattern": "[windows-registry-key:key = 'HKCU\\\\Software\\\\Locky\\\\pubkey']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T14:42:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Persistence mechanism"
                }
            ],
            "labels": [
                "misp:type=\"regkey\"",
                "misp:category=\"Persistence mechanism\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44f12-8278-4076-b08d-4c22950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T14:42:58.000Z",
            "modified": "2016-02-17T14:42:58.000Z",
            "pattern": "[windows-registry-key:key = 'HKCU\\\\Software\\\\Locky\\\\paytext']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T14:42:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Persistence mechanism"
                }
            ],
            "labels": [
                "misp:type=\"regkey\"",
                "misp:category=\"Persistence mechanism\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44f6a-4084-4283-8701-659d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:46:30.000Z",
            "modified": "2016-02-17T10:46:30.000Z",
            "description": "Locky also appears to generate DGA traffic for command and control (the list of domains below were unregistered at the time of investigation) - See more at: https://www.proofpoint.com/us/threat-insight/post/Dridex-Actors-Get-In-the-Ransomware-Game-With-Locky#sthash.MoLx2rvu.dpuf",
            "pattern": "[domain-name:value = 'vkrdbsrqpi.de']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:46:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44f6b-de78-4b97-b34e-659d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:46:03.000Z",
            "modified": "2016-02-17T10:46:03.000Z",
            "description": "Locky also appears to generate DGA traffic for command and control (the list of domains below were unregistered at the time of investigation) - See more at: https://www.proofpoint.com/us/threat-insight/post/Dridex-Actors-Get-In-the-Ransomware-Game-With-Locky#sthash.MoLx2rvu.dpuf",
            "pattern": "[domain-name:value = 'jaomjlyvwxgdt.fr']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:46:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44f6b-5f08-4d9f-b024-659d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:46:03.000Z",
            "modified": "2016-02-17T10:46:03.000Z",
            "description": "Locky also appears to generate DGA traffic for command and control (the list of domains below were unregistered at the time of investigation) - See more at: https://www.proofpoint.com/us/threat-insight/post/Dridex-Actors-Get-In-the-Ransomware-Game-With-Locky#sthash.MoLx2rvu.dpuf",
            "pattern": "[domain-name:value = 'wpogw.it']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:46:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56c44f6b-176c-49ba-8548-659d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-02-17T10:46:03.000Z",
            "modified": "2016-02-17T10:46:03.000Z",
            "description": "Locky also appears to generate DGA traffic for command and control (the list of domains below were unregistered at the time of investigation) - See more at: https://www.proofpoint.com/us/threat-insight/post/Dridex-Actors-Get-In-the-Ransomware-Game-With-Locky#sthash.MoLx2rvu.dpuf",
            "pattern": "[domain-name:value = 'ofhhoowfmnuihyd.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-02-17T10:46:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}