{
    "type": "bundle",
    "id": "bundle--28d7a5af-b0e2-40f0-8ead-6e140ff316d4",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2021-01-12T15:29:05.000Z",
            "modified": "2021-01-12T15:29:05.000Z",
            "name": "CthulhuSPRL.be",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--28d7a5af-b0e2-40f0-8ead-6e140ff316d4",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2021-01-12T15:29:05.000Z",
            "modified": "2021-01-12T15:29:05.000Z",
            "name": "Leonardo S.p.A. Data Breach Analysis blog post from Reaqta",
            "published": "2021-01-12T15:29:16Z",
            "object_refs": [
                "observed-data--ad61e666-05a3-465c-8f17-b038a2f0d8d0",
                "url--ad61e666-05a3-465c-8f17-b038a2f0d8d0",
                "indicator--07bab0af-270c-4ecb-a635-7c60e7966178",
                "indicator--b20d4cf1-df8f-4a11-beaf-f52aa2d241e9",
                "indicator--47f7d796-f6d9-42e6-94bf-508e06fbccff"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "osint:source-type=\"blog-post\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--ad61e666-05a3-465c-8f17-b038a2f0d8d0",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2021-01-12T15:28:19.000Z",
            "modified": "2021-01-12T15:28:19.000Z",
            "first_observed": "2021-01-12T15:28:19Z",
            "last_observed": "2021-01-12T15:28:19Z",
            "number_observed": 1,
            "object_refs": [
                "url--ad61e666-05a3-465c-8f17-b038a2f0d8d0"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--ad61e666-05a3-465c-8f17-b038a2f0d8d0",
            "value": "https://reaqta.com/2021/01/fujinama-analysis-leonardo-spa"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--07bab0af-270c-4ecb-a635-7c60e7966178",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2021-01-12T15:28:38.000Z",
            "modified": "2021-01-12T15:28:38.000Z",
            "pattern": "[rule Fujinama {\r\n    meta:\r\n        description = \"Fujinama RAT used by Leonardo SpA Insider Threat\"\r\n        author = \"ReaQta Threat Intelligence Team\"\r\n        ref1 = \"https://reaqta.com/2021/01/fujinama-analysis-leonardo-spa\"\r\n        date = \"2021-01-07\"\r\n        version = \"1\"   \r\n    strings:\r\n        $kaylog_1 = \"SELECT\" wide ascii nocase\r\n        $kaylog_2 = \"RIGHT\" wide ascii nocase\r\n        $kaylog_3 = \"HELP\" wide ascii nocase\r\n        $kaylog_4 = \"WINDOWS\" wide ascii nocase\r\n        $computername = \"computername\" wide ascii nocase\r\n        $useragent = \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)\" wide ascii nocase\r\n        $pattern = \"'()*+,G-./0123456789:\" wide ascii nocase\r\n        $function_1 = \"t_save\" wide ascii nocase\r\n        $cftmon = \"cftmon\" wide ascii nocase\r\n        $font = \"Tahoma\" wide ascii nocase\r\n    condition:\r\n        uint16(0) == 0x5a4d and all of them\r\n}]",
            "pattern_type": "yara",
            "pattern_version": "2.1",
            "valid_from": "2021-01-12T15:28:38Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"yara\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--b20d4cf1-df8f-4a11-beaf-f52aa2d241e9",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2021-01-12T15:29:05.000Z",
            "modified": "2021-01-12T15:29:05.000Z",
            "pattern": "[domain-name:value = 'fujinama.altervista.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-01-12T15:29:05Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--47f7d796-f6d9-42e6-94bf-508e06fbccff",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2021-01-12T15:29:05.000Z",
            "modified": "2021-01-12T15:29:05.000Z",
            "pattern": "[domain-name:value = 'xhdyeggeeefeew.000webhostapp.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-01-12T15:29:05Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}