{
    "type": "bundle",
    "id": "bundle--547311c0-3fdc-4968-85fa-058d950d210b",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:22:35.000Z",
            "modified": "2014-11-24T11:22:35.000Z",
            "name": "CthulhuSPRL.be",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--547311c0-3fdc-4968-85fa-058d950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:22:35.000Z",
            "modified": "2014-11-24T11:22:35.000Z",
            "name": "OSINT Roaming tiger by Anton Cherepanov from ESET",
            "published": "2014-11-24T11:25:34Z",
            "object_refs": [
                "observed-data--5473120b-b9b4-497d-9208-058d950d210b",
                "url--5473120b-b9b4-497d-9208-058d950d210b",
                "x-misp-attribute--54731216-6d44-4aa7-81c2-2ddd950d210b",
                "x-misp-attribute--54731229-549c-4d6b-a110-2ddc950d210b",
                "x-misp-attribute--54731243-f4bc-4e7f-b8f1-4181950d210b",
                "x-misp-attribute--54731243-8eb0-44c6-b2ac-4181950d210b",
                "vulnerability--54731265-fbb4-4308-b03b-141e950d210b",
                "vulnerability--54731265-f5f0-4204-9c35-141e950d210b",
                "indicator--547312e2-7dcc-49a0-b626-2dde950d210b",
                "indicator--547312e2-e0c8-4b44-9234-2dde950d210b",
                "indicator--547312e2-4a14-47c7-884c-2dde950d210b",
                "indicator--547312e3-af84-449c-9c0c-2dde950d210b",
                "indicator--547312e3-a79c-4124-afb3-2dde950d210b",
                "indicator--547312e3-4fc4-4002-a34f-2dde950d210b",
                "indicator--547312e3-e17c-4bb3-b7fb-2dde950d210b",
                "indicator--547312e3-295c-4761-b412-2dde950d210b",
                "indicator--547312e3-4b90-46e3-ba6f-2dde950d210b",
                "indicator--547312e3-041c-4c42-8323-2dde950d210b",
                "indicator--547312e3-8690-4c71-aad0-2dde950d210b",
                "indicator--547312e3-67f0-40f2-a3d7-2dde950d210b",
                "indicator--547312e3-7958-468c-ac32-2dde950d210b",
                "indicator--547312f9-b6e8-4518-9ee5-2ddd950d210b",
                "indicator--547312f9-1350-4c05-ab05-2ddd950d210b",
                "indicator--547312fa-ac54-49b8-ab2c-2ddd950d210b",
                "indicator--547312fa-9e50-4f16-b233-2ddd950d210b",
                "indicator--547312fa-3d38-4921-bc1e-2ddd950d210b",
                "indicator--54731443-49c8-4975-ba47-141e950d210b",
                "indicator--54731443-b0cc-460d-be25-141e950d210b",
                "indicator--54731444-4a34-4692-8f6d-141e950d210b",
                "indicator--54731444-749c-482d-8b65-141e950d210b",
                "indicator--54731444-3f98-46bd-9f72-141e950d210b",
                "indicator--54731451-a114-49f6-89d6-2dde950d210b",
                "indicator--54731451-67c0-41e4-80a1-2dde950d210b",
                "indicator--54731451-0540-4661-ab6f-2dde950d210b",
                "indicator--54731451-1e70-4a99-90c6-2dde950d210b",
                "indicator--54731451-fbb8-44c2-87c9-2dde950d210b",
                "indicator--54731451-67d4-4dc6-bed7-2dde950d210b",
                "indicator--54731451-0b9c-4818-9d44-2dde950d210b",
                "indicator--54731451-6530-44ab-9a9e-2dde950d210b",
                "indicator--54731452-ba84-4149-92a0-2dde950d210b",
                "indicator--54731452-de64-44ec-a669-2dde950d210b",
                "indicator--54731452-701c-4c54-87cf-2dde950d210b",
                "indicator--54731452-7178-4492-ba04-2dde950d210b",
                "x-misp-attribute--547314fb-1174-486b-a2a5-058e950d210b"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT"
            ],
            "object_marking_refs": [
                "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5473120b-b9b4-497d-9208-058d950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:10:03.000Z",
            "modified": "2014-11-24T11:10:03.000Z",
            "first_observed": "2014-11-24T11:10:03Z",
            "last_observed": "2014-11-24T11:10:03Z",
            "number_observed": 1,
            "object_refs": [
                "url--5473120b-b9b4-497d-9208-058d950d210b"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5473120b-b9b4-497d-9208-058d950d210b",
            "value": "http://2014.zeronights.ru/assets/files/slides/roaming_tiger_zeronights_2014.pdf"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--54731216-6d44-4aa7-81c2-2ddd950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:10:14.000Z",
            "modified": "2014-11-24T11:10:14.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "Roaming Tiger"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--54731229-549c-4d6b-a110-2ddc950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:10:33.000Z",
            "modified": "2014-11-24T11:10:33.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "comment",
            "x_misp_value": "Data entered by David Andr\u00c3\u00a9"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--54731243-f4bc-4e7f-b8f1-4181950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:10:59.000Z",
            "modified": "2014-11-24T11:10:59.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "Win32/Korplug"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--54731243-8eb0-44c6-b2ac-4181950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:10:59.000Z",
            "modified": "2014-11-24T11:10:59.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "Win32/Farfli.BE"
        },
        {
            "type": "vulnerability",
            "spec_version": "2.1",
            "id": "vulnerability--54731265-fbb4-4308-b03b-141e950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:11:33.000Z",
            "modified": "2014-11-24T11:11:33.000Z",
            "name": "CVE-2012-0158",
            "labels": [
                "misp:type=\"vulnerability\"",
                "misp:category=\"Payload delivery\""
            ],
            "external_references": [
                {
                    "source_name": "cve",
                    "external_id": "CVE-2012-0158"
                }
            ]
        },
        {
            "type": "vulnerability",
            "spec_version": "2.1",
            "id": "vulnerability--54731265-f5f0-4204-9c35-141e950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:11:33.000Z",
            "modified": "2014-11-24T11:11:33.000Z",
            "name": "CVE-2014-1761",
            "labels": [
                "misp:type=\"vulnerability\"",
                "misp:category=\"Payload delivery\""
            ],
            "external_references": [
                {
                    "source_name": "cve",
                    "external_id": "CVE-2014-1761"
                }
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e2-7dcc-49a0-b626-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:38.000Z",
            "modified": "2014-11-24T11:13:38.000Z",
            "pattern": "[domain-name:value = 'systemupdate5.dtdns.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:38Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e2-e0c8-4b44-9234-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:38.000Z",
            "modified": "2014-11-24T11:13:38.000Z",
            "pattern": "[domain-name:value = 'gf.arabidc.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:38Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e2-4a14-47c7-884c-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:38.000Z",
            "modified": "2014-11-24T11:13:38.000Z",
            "pattern": "[domain-name:value = 'kkts.yeshopea.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:38Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e3-af84-449c-9c0c-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:39.000Z",
            "modified": "2014-11-24T11:13:39.000Z",
            "pattern": "[domain-name:value = 'dwm.dnsedc.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e3-a79c-4124-afb3-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:39.000Z",
            "modified": "2014-11-24T11:13:39.000Z",
            "pattern": "[domain-name:value = 'dotkang.vicp.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e3-4fc4-4002-a34f-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:39.000Z",
            "modified": "2014-11-24T11:13:39.000Z",
            "pattern": "[domain-name:value = 'adobeflashupdate.dynu.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e3-e17c-4bb3-b7fb-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:39.000Z",
            "modified": "2014-11-24T11:13:39.000Z",
            "pattern": "[domain-name:value = 'checkpdate.youdontcare.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e3-295c-4761-b412-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:39.000Z",
            "modified": "2014-11-24T11:13:39.000Z",
            "pattern": "[domain-name:value = 'news.bfinancea.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e3-4b90-46e3-ba6f-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:39.000Z",
            "modified": "2014-11-24T11:13:39.000Z",
            "pattern": "[domain-name:value = 'fsvts.vicp.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e3-041c-4c42-8323-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:39.000Z",
            "modified": "2014-11-24T11:13:39.000Z",
            "pattern": "[domain-name:value = 'nativeame2.jkub.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e3-8690-4c71-aad0-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:39.000Z",
            "modified": "2014-11-24T11:13:39.000Z",
            "pattern": "[domain-name:value = 'futuresgolda.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e3-67f0-40f2-a3d7-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:39.000Z",
            "modified": "2014-11-24T11:13:39.000Z",
            "pattern": "[domain-name:value = 'googlenewsup.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312e3-7958-468c-ac32-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:13:39.000Z",
            "modified": "2014-11-24T11:13:39.000Z",
            "pattern": "[domain-name:value = 'csrss.dnsedc.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:13:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312f9-b6e8-4518-9ee5-2ddd950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:14:01.000Z",
            "modified": "2014-11-24T11:14:01.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '103.225.196.140']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:14:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312f9-1350-4c05-ab05-2ddd950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:14:01.000Z",
            "modified": "2014-11-24T11:14:01.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.10.118.131']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:14:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312fa-ac54-49b8-ab2c-2ddd950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:14:02.000Z",
            "modified": "2014-11-24T11:14:02.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.10.118.129']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:14:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312fa-9e50-4f16-b233-2ddd950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:14:02.000Z",
            "modified": "2014-11-24T11:14:02.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.10.83.51']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:14:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--547312fa-3d38-4921-bc1e-2ddd950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:14:02.000Z",
            "modified": "2014-11-24T11:14:02.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.10.92.14']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:14:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731443-49c8-4975-ba47-141e950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:31.000Z",
            "modified": "2014-11-24T11:19:31.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.10.83.62']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731443-b0cc-460d-be25-141e950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:31.000Z",
            "modified": "2014-11-24T11:19:31.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '103.20.222.170']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731444-4a34-4692-8f6d-141e950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:32.000Z",
            "modified": "2014-11-24T11:19:32.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.10.92.15']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731444-749c-482d-8b65-141e950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:32.000Z",
            "modified": "2014-11-24T11:19:32.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.112.2.14']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731444-3f98-46bd-9f72-141e950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:32.000Z",
            "modified": "2014-11-24T11:19:32.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '123.254.109.166']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731451-a114-49f6-89d6-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:45.000Z",
            "modified": "2014-11-24T11:19:45.000Z",
            "pattern": "[domain-name:value = 'adobeupdate1.dtdns.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731451-67c0-41e4-80a1-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:45.000Z",
            "modified": "2014-11-24T11:19:45.000Z",
            "pattern": "[domain-name:value = 'niisvt.f3322.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731451-0540-4661-ab6f-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:45.000Z",
            "modified": "2014-11-24T11:19:45.000Z",
            "pattern": "[domain-name:value = 'note.wikaba.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731451-1e70-4a99-90c6-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:45.000Z",
            "modified": "2014-11-24T11:19:45.000Z",
            "pattern": "[domain-name:value = 'spacecorp.sizn-ru.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731451-fbb8-44c2-87c9-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:45.000Z",
            "modified": "2014-11-24T11:19:45.000Z",
            "pattern": "[domain-name:value = 'systemupdate1.suroot.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731451-67d4-4dc6-bed7-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:45.000Z",
            "modified": "2014-11-24T11:19:45.000Z",
            "pattern": "[domain-name:value = 'systemupdate2.etowns.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731451-0b9c-4818-9d44-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:45.000Z",
            "modified": "2014-11-24T11:19:45.000Z",
            "pattern": "[domain-name:value = 'systemupdate3.suroot.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731451-6530-44ab-9a9e-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:45.000Z",
            "modified": "2014-11-24T11:19:45.000Z",
            "pattern": "[domain-name:value = 'transactiona.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731452-ba84-4149-92a0-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:46.000Z",
            "modified": "2014-11-24T11:19:46.000Z",
            "pattern": "[domain-name:value = 'vk.newsupdatea.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731452-de64-44ec-a669-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:46.000Z",
            "modified": "2014-11-24T11:19:46.000Z",
            "pattern": "[domain-name:value = 'www.dnsqaz.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731452-701c-4c54-87cf-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:46.000Z",
            "modified": "2014-11-24T11:19:46.000Z",
            "pattern": "[domain-name:value = 'www.sizn-ru.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54731452-7178-4492-ba04-2dde950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:19:46.000Z",
            "modified": "2014-11-24T11:19:46.000Z",
            "pattern": "[domain-name:value = 'yahoomessenger.flnet.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2014-11-24T11:19:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--547314fb-1174-486b-a2a5-058e950d210b",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2014-11-24T11:22:35.000Z",
            "modified": "2014-11-24T11:22:35.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Attribution\""
            ],
            "x_misp_category": "Attribution",
            "x_misp_comment": "Registrant",
            "x_misp_type": "text",
            "x_misp_value": "yuminga1@126.com"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:GREEN",
            "definition": {
                "tlp": "green"
            }
        }
    ]
}