misp-circl-feed/feeds/circl/stix-2.1/5c444228-25f4-4e85-8dfd-498302de0b81.json

{
    "type": "bundle",
    "id": "bundle--5c444228-25f4-4e85-8dfd-498302de0b81",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-25T20:18:08.000Z",
            "modified": "2019-05-25T20:18:08.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "grouping",
            "spec_version": "2.1",
            "id": "grouping--5c444228-25f4-4e85-8dfd-498302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-25T20:18:08.000Z",
            "modified": "2019-05-25T20:18:08.000Z",
            "name": "Economical analysis of the sextortion emails",
            "context": "suspicious-activity",
            "object_refs": [
                "observed-data--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
                "file--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
                "artifact--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
                "x-misp-attribute--5c444b64-f778-4ee0-83ed-4b7902de0b81",
                "observed-data--5c445819-574c-4e35-af21-a83202de0b81",
                "url--5c445819-574c-4e35-af21-a83202de0b81",
                "x-misp-attribute--5ce9a0fa-8834-4665-acb3-4500950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "adversary:infrastructure-action=\"passive-only\"",
                "circl:incident-classification=\"scam\"",
                "economical-impact:gain=\"less-than-1M-euro\"",
                "veris:action:social:variety=\"Extortion\"",
                "veris:action:social:variety=\"Scam\"",
                "type:OSINT",
                "osint:lifetime=\"perpetual\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-01-20T10:21:05.000Z",
            "modified": "2019-01-20T10:21:05.000Z",
            "first_observed": "2019-01-20T10:21:05Z",
            "last_observed": "2019-01-20T10:21:05Z",
            "number_observed": 1,
            "object_refs": [
                "file--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
                "artifact--5c444524-2b5c-4d9a-aea6-4f1f02de0b81"
            ],
            "labels": [
                "misp:type=\"attachment\"",
                "misp:category=\"Support Tool\"",
                "osint:source-type=\"automatic-analysis\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
            "name": "btc-11430.txt",
            "content_ref": "artifact--5c444524-2b5c-4d9a-aea6-4f1f02de0b81"
        },
        {
            "type": "artifact",
            "spec_version": "2.1",
            "id": "artifact--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
            "payload_bin": "cHl0aG9uMyBidGMucHkgLWUgMTE0MzANCg0KQWRkcmVzczoJMTRWcmo1NmtReThUdG5IeWltZVhteXlRendMOEhmbkxLNw0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxTGR5ZXZxU2UxdTV4MWdhQ0tBMU1kMllKMWFtUkxxVGdFDQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CTFYc2ltazhTN2dWcXlSdzZFTmdVQjc1b2c5NkhZQ2l6Sw0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxOENUS0hzWnBFaUFUeHFrcXJBZFVwc0hzUDlpZTVtTTFXDQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CTFMWTFEenZwNkNpaTR5aG96TDhSWWZCeTVuQWFoQkVQV3UNCkJhbGFuY2U6CTAuMDAwMDAwMDAwMCBCVEMgKCswLjAwMDAwMDAwMDAgQlRDIC8gLTAuMDAwMDAwMDAwMCBCVEMpDQpUcmFuc2FjdGlvbnM6CTANCg0KQWRkcmVzczoJMURDWUdpN3pidEZqR2pwaUJYZGVNRkF6NmhOZ05TY2Z1Mg0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxREhFV2VkV1p1bXkyRHZXVlZuWDZmb1BYemQ4S21Vc1VxDQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CTE5WDl6eDZFaG5MeHZKdXduUjUyY01ybW5DNXplOW9BVEINCkJhbGFuY2U6CTAuMDAwMDAwMDAwMCBCVEMgKCswLjAwMDAwMDAwMDAgQlRDIC8gLTAuMDAwMDAwMDAwMCBCVEMpDQpUcmFuc2FjdGlvbnM6CTANCg0KQWRkcmVzczoJMUNTTHdOY0ZNS3VzV1NTUmJYbzRvN3hHN3NhM2pyWUVSSA0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxRGZlQ2NDN25QRUhNMm9FVWpZWVprcVR3eW80NllZTFR4DQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CTFMc2VkbnZDR3N5eHg2VGJjQlNtQTFGYUJNb0JmVmVjODQNCkJhbGFuY2U6CTAuMDAwMDAwMDAwMCBCVEMgKCswLjAwMDAwMDAwMDAgQlRDIC8gLTAuMDAwMDAwMDAwMCBCVEMpDQpUcmFuc2FjdGlvbnM6CTANCg0KQWRkcmVzczoJMTR2Sm9iOUZnY1FrWERlblRtR3d6WGdxclE5Z29mRll5Ug0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxNG5CcWtkNDhxSjhXTG5pOEtTZ3dFeDNBaVpXejUzU0FkDQpCYWxhbmNlOgkwLjkzNTI0NzczMDAgQlRDICgrMC45MzUyNDc3MzAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgk2DQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KIzYJMzAgSnVsIDIwMTggMTU6MjE6NTQgQ0VTVAkgMC4wNDk3MjIyNiBCVEMgICAgIDQwNi41MyBVU0QJICAgIDM0Ni45MyBFVVINCiM1CTMwIEp1bCAyMDE4IDAxOjI2OjExIENFU1QJIDAuMjMxNTY4MzggQlRDICAgIDE4OTMuMzIgVVNECSAgIDE2MTUuNzMgRVVSDQojNAkyOSBKdWwgMjAxOCAxMDo1NjozMiBDRVNUCSAwLjA4NTI5NDI5IEJUQyAgICAgNzAwLjg0IFVTRAkgICAgNjAwLjUxIEVVUg0KIzMJMjggSnVsIDIwMTggMjE6NTY6MDMgQ0VTVAkgMC4wODU0MTY5MCBCVEMgICAgIDcwMy4wNiBVU0QJICAgIDYwMi41NyBFVVINCiMyCTI4IEp1bCAyMDE4IDE1OjQ0OjA2IENFU1QJIDAuMDEyMjQ1OTAgQlRDICAgICAxMDAuNzkgVVNECSAgICAgODYuMzkgRVVSDQojMQkxNSBKdWwgMjAxOCAxNzo0NzoyMyBDRVNUCSAwLjQ3MTAwMDAwIEJUQyAgICAyOTk3LjU3IFVTRAkgICAyNTYzLjY2IEVVUg0KDQpBZGRyZXNzOgkxUTl1M3NQVldMTFVSYmdQWDF4YjdwcTFHa0drU1RIWmRoDQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CThRb3hoYzhRd1hXZDNCNlI4UXdIUjdEQ0Y1MUhiREtvOA0KQ2hlY2tzdW0gZG9lcyBub3QgdmFsaWRhdGUNCkJhbGFuY2U6CTAuMDAwMDAwMDAwMCBCVEMgKCswLjAwMDAwMDAwMDAgQlRDIC8gLTAuMDAwMDAwMDAwMCBCVEMpDQpUcmFuc2FjdGlvbnM6CTANCg0KQWRkcmVzczoJMURlWlVpOFh1bnplVXBFUkdvTVVNYTJYamY5YWVNRURldg0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxNFdDQUNjTjNGYnMyR1p6amljcFJHUzM3TUNhMVBnSDZCDQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CTFHM0hwSGFuU1J2NDl3QzZzcTNrVzRjVGlBUllHeWNNTnoNCkJhbGFuY2U6CTAuMDAwMDAwMDAwMCBCVEMgKCswLjAwMDAwMDAwMDAgQlRDIC8gLTAuMDAwMDAwMDAwMCBCVEMpDQpUcmFuc2FjdGlvbnM6CTANCg0KQWRkcmVzczoJMTZUMWlVV2RSNXZXTUNLdUtiYXdySGFrdjlyWHNXa1pOYQ0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5c444b64-f778-4ee0-83ed-4b7902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-01-20T10:20:20.000Z",
            "modified": "2019-01-20T10:20:20.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Financial fraud\""
            ],
            "x_misp_category": "Financial fraud",
            "x_misp_comment": "Total BTC received and cashed out from the known BTC addresses gathered from extortions",
            "x_misp_type": "text",
            "x_misp_value": "Total received:\t164.20879967 BTC  930489.07 USD\t 804322.59 EUR\r\nTotal spent:\t131.84920417 BTC  688650.07 USD\t 598495.89 EUR"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5c445819-574c-4e35-af21-a83202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-01-20T11:14:33.000Z",
            "modified": "2019-01-20T11:14:33.000Z",
            "first_observed": "2019-01-20T11:14:33Z",
            "last_observed": "2019-01-20T11:14:33Z",
            "number_observed": 1,
            "object_refs": [
                "url--5c445819-574c-4e35-af21-a83202de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5c445819-574c-4e35-af21-a83202de0b81",
            "value": "https://twitter.com/circl_lu/status/1086939051658264576"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5ce9a0fa-8834-4665-acb3-4500950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-05-25T20:09:30.000Z",
            "modified": "2019-05-25T20:09:30.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Financial fraud\""
            ],
            "x_misp_category": "Financial fraud",
            "x_misp_comment": "Total BTC received and cashed out from the known BTC addresses gathered from extortions (2019-05-25)",
            "x_misp_type": "text",
            "x_misp_value": "Total received:\t 274.34008846 BTC 1405178.94 USD\t1221847.10 EUR\r\nTotal spent:\t 246.44414303 BTC 1208662.78 USD\t1057750.02 EUR"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}