{
    "type": "bundle",
    "id": "bundle--58030b52-b52c-41e7-93f6-43ae950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:34.000Z",
            "modified": "2016-10-16T05:09:34.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--58030b52-b52c-41e7-93f6-43ae950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:34.000Z",
            "modified": "2016-10-16T05:09:34.000Z",
            "name": "Spam 2016-10-16 (mule acquisition) - probably related to Locky resources",
            "published": "2016-10-16T05:09:58Z",
            "object_refs": [
                "indicator--58030b87-8db0-460f-b10d-4da6950d210f",
                "indicator--58030b88-30e4-4f4c-8cdf-4a01950d210f",
                "indicator--58030b88-b5d0-4119-a90c-4edd950d210f",
                "indicator--58030b89-5a44-44fd-97a6-4f39950d210f",
                "indicator--58030b89-350c-41fe-a6a2-407e950d210f",
                "indicator--58030b8a-08f8-4977-91d6-4986950d210f",
                "indicator--58030b8a-aa0c-49f6-84f9-4d49950d210f",
                "indicator--58030b8b-4ba4-4d92-bb27-474f950d210f",
                "indicator--58030b8b-def8-4a45-a71a-4b40950d210f",
                "indicator--58030b8c-86fc-4621-948a-42a4950d210f",
                "indicator--58030b8d-7518-449b-8492-43d3950d210f",
                "indicator--58030b8d-c9f8-4946-8dda-462c950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b87-8db0-460f-b10d-4da6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:27.000Z",
            "modified": "2016-10-16T05:09:27.000Z",
            "description": "compromised resource",
            "pattern": "[url:value = 'http://bidprogroup.com/wp-content/plugins/contact-form-7/admin/images/']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:27Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b88-30e4-4f4c-8cdf-4a01950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:28.000Z",
            "modified": "2016-10-16T05:09:28.000Z",
            "description": "compromised resource",
            "pattern": "[domain-name:value = 'bidprogroup.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b88-b5d0-4119-a90c-4edd950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:28.000Z",
            "modified": "2016-10-16T05:09:28.000Z",
            "description": "compromised resource",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '50.62.172.113']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b89-5a44-44fd-97a6-4f39950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:29.000Z",
            "modified": "2016-10-16T05:09:29.000Z",
            "description": "compromised resource",
            "pattern": "[url:value = 'http://bigway.com/installation2/tmp/rohi5l/par/users/']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b89-350c-41fe-a6a2-407e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:29.000Z",
            "modified": "2016-10-16T05:09:29.000Z",
            "description": "compromised resource",
            "pattern": "[domain-name:value = 'bigway.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b8a-08f8-4977-91d6-4986950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:30.000Z",
            "modified": "2016-10-16T05:09:30.000Z",
            "description": "compromised resource",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '69.168.8.211']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b8a-aa0c-49f6-84f9-4d49950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:30.000Z",
            "modified": "2016-10-16T05:09:30.000Z",
            "description": "compromised resource",
            "pattern": "[url:value = 'http://bikebreeze.com/wp-content/themes/CherryFramework/admin/images/']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b8b-4ba4-4d92-bb27-474f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:31.000Z",
            "modified": "2016-10-16T05:09:31.000Z",
            "description": "compromised resource",
            "pattern": "[domain-name:value = 'bikebreeze.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b8b-def8-4a45-a71a-4b40950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:31.000Z",
            "modified": "2016-10-16T05:09:31.000Z",
            "description": "compromised resource",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '166.62.10.183']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b8c-86fc-4621-948a-42a4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:32.000Z",
            "modified": "2016-10-16T05:09:32.000Z",
            "description": "compromised resource",
            "pattern": "[url:value = 'http://billfoundation.org/wp-includes/js/tinymce/plugins/wptextpattern/']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b8d-7518-449b-8492-43d3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:33.000Z",
            "modified": "2016-10-16T05:09:33.000Z",
            "description": "compromised resource",
            "pattern": "[domain-name:value = 'billfoundation.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--58030b8d-c9f8-4946-8dda-462c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-10-16T05:09:33.000Z",
            "modified": "2016-10-16T05:09:33.000Z",
            "description": "compromised resource",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '52.202.112.204']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-10-16T05:09:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}