{
    "type": "bundle",
    "id": "bundle--5a3bd35f-7140-48d0-8b88-4555950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:55:42.000Z",
            "modified": "2018-10-26T13:55:42.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5a3bd35f-7140-48d0-8b88-4555950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:55:42.000Z",
            "modified": "2018-10-26T13:55:42.000Z",
            "name": "OSINT - Locky Ransomware Pushed Alongside FakeGlobe in Upgraded Spam Campaigns",
            "published": "2018-10-28T08:58:19Z",
            "object_refs": [
                "observed-data--5a3bd36b-b630-478e-a75e-4746950d210f",
                "url--5a3bd36b-b630-478e-a75e-4746950d210f",
                "x-misp-attribute--5bd31462-8b84-4a33-9161-482d950d210f",
                "indicator--5bd315c6-b0c4-4f4f-988d-4ada950d210f",
                "indicator--5bd315c7-3898-4af5-b731-495a950d210f",
                "indicator--5bd315c7-5868-414f-9f7b-424c950d210f",
                "indicator--5bd315c8-6c8c-4a3b-8a41-44f7950d210f",
                "indicator--5bd31728-42ac-43a6-97e3-467b950d210f",
                "indicator--5bd3175a-c93c-443e-b60a-4ba7950d210f",
                "indicator--5bd31784-2454-4dbf-8f89-453f950d210f",
                "indicator--5bd31799-3030-4f6a-a36c-4818950d210f",
                "indicator--5bd317b3-b98c-4655-9b12-4137950d210f",
                "indicator--5bd31883-a8e4-4dc7-863f-4f86950d210f",
                "indicator--5bd318b4-844c-4ddb-b452-40b1950d210f",
                "indicator--5bd31bee-8f4c-4393-8f1b-4e60950d210f",
                "indicator--5bd31c00-3d08-4882-8269-433b950d210f",
                "indicator--5bd31c16-5978-48e0-a441-4722950d210f",
                "indicator--5bd31c31-bba0-47bc-b92b-4b39950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "misp-galaxy:ransomware=\"Locky\"",
                "misp-galaxy:ransomware=\"Fake Globe Ransomware\"",
                "workflow:state=\"complete\"",
                "malware_classification:malware-category=\"Ransomware\"",
                "circl:incident-classification=\"malware\"",
                "osint:source-type=\"blog-post\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3bd36b-b630-478e-a75e-4746950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:55:31.000Z",
            "modified": "2018-10-26T13:55:31.000Z",
            "first_observed": "2018-10-26T13:55:31Z",
            "last_observed": "2018-10-26T13:55:31Z",
            "number_observed": 1,
            "object_refs": [
                "url--5a3bd36b-b630-478e-a75e-4746950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5a3bd36b-b630-478e-a75e-4746950d210f",
            "value": "http://blog.trendmicro.com/trendlabs-security-intelligence/locky-ransomware-pushed-alongside-fakeglobe-upgraded-spam-campaigns/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5bd31462-8b84-4a33-9161-482d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:55:42.000Z",
            "modified": "2018-10-26T13:55:42.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "n the beginning of September, a sizeable spam campaign was detected distributing the latest Locky variant. Locky is a notorious ransomware that was first detected in the early months of 2016 and has continued to evolve and spread through different methods, particularly spam mail. A thorough look at samples from recent campaigns shows that cybercriminals are using sophisticated distribution methods, affecting users in more than 70 countries."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd315c6-b0c4-4f4f-988d-4ada950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:25:26.000Z",
            "modified": "2018-10-26T13:25:26.000Z",
            "pattern": "[url:value = 'http://qolseaboomdog.top/support.php?f=1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:25:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd315c7-3898-4af5-b731-495a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:25:27.000Z",
            "modified": "2018-10-26T13:25:27.000Z",
            "pattern": "[url:value = 'http://newhostrcm.top/admin.php?f=1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:25:27Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd315c7-5868-414f-9f7b-424c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:25:27.000Z",
            "modified": "2018-10-26T13:25:27.000Z",
            "pattern": "[url:value = 'http://qolseaboomdog.top/support.php?f=2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:25:27Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd315c8-6c8c-4a3b-8a41-44f7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:25:28.000Z",
            "modified": "2018-10-26T13:25:28.000Z",
            "pattern": "[url:value = 'http://newhostrcm.top/admin.php?f=2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:25:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd31728-42ac-43a6-97e3-467b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:31:20.000Z",
            "modified": "2018-10-26T13:31:20.000Z",
            "description": "VBScript files (downloaders) detected as VBS_NEMUCOD.ELDSAUO",
            "pattern": "[file:hashes.SHA256 = '39256f126bba17770310c2115586b9f22b858cf15c43ab36bd7cfb18ad63a0c2' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:31:20Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd3175a-c93c-443e-b60a-4ba7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:32:10.000Z",
            "modified": "2018-10-26T13:32:10.000Z",
            "description": "VBScript files (downloaders) detected as VBS_NEMUCOD.ELDSAUO",
            "pattern": "[file:hashes.SHA256 = 'a299f3de0c9277c0ce7dd3f7dc9aee57a7abe78b155919b1ecced1896c69653b' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:32:10Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd31784-2454-4dbf-8f89-453f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:32:52.000Z",
            "modified": "2018-10-26T13:32:52.000Z",
            "description": "VBScript files (downloaders) detected as VBS_NEMUCOD.ELDSAUO",
            "pattern": "[file:hashes.SHA256 = '4d4a0e1d7218180452e22e6b52a7f9a0db1e0c0aa51a48f9a79c600b51030050' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:32:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd31799-3030-4f6a-a36c-4818950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:33:13.000Z",
            "modified": "2018-10-26T13:33:13.000Z",
            "description": "VBScript files (downloaders) detected as VBS_NEMUCOD.ELDSAUO",
            "pattern": "[file:hashes.SHA256 = '0f6ae637a9d15503a0af42be649388f01f8637ca16b15526e318a94b7f34bf6e' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:33:13Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd317b3-b98c-4655-9b12-4137950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:33:39.000Z",
            "modified": "2018-10-26T13:33:39.000Z",
            "description": "LOCKY from VBS detected as RANSOM_FAKEGLOBE.ASUUB",
            "pattern": "[file:hashes.SHA256 = 'bb1df4a93fc27c54c78f84323e0ea7bb2b54469893150e3ea991826c81b56f47' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:33:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd31883-a8e4-4dc7-863f-4f86950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:37:07.000Z",
            "modified": "2018-10-26T13:37:07.000Z",
            "description": "FAKEGLOBE from VBS detected as RANSOM_LOCKY.TH905",
            "pattern": "[file:hashes.SHA256 = 'e75e5d374f20c386b1114252647cca7bd407190cafb26c6cfbd42c5f9223fe6c' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:37:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd318b4-844c-4ddb-b452-40b1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:37:56.000Z",
            "modified": "2018-10-26T13:37:56.000Z",
            "description": "FAKEGLOBE from DOC detected as RANSOM_FAKEGLOBE.ASUUG",
            "pattern": "[file:hashes.SHA256 = '12e75bdbc3f0b489a89104c646aee10a71277c22b6abbc6e346d1ba6f17edf6d' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:37:56Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd31bee-8f4c-4393-8f1b-4e60950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:51:42.000Z",
            "modified": "2018-10-26T13:51:42.000Z",
            "description": "DOC files (downloaders) detected as W2KM_POWLOAD.AUSJST",
            "pattern": "[file:hashes.SHA256 = '067eb2754a823953a6efa1dfe9353eeabf699f171d21ffbff8e2303f7f678139' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:51:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd31c00-3d08-4882-8269-433b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:52:00.000Z",
            "modified": "2018-10-26T13:52:00.000Z",
            "description": "DOC files (downloaders) detected as W2KM_POWLOAD.AUSJST",
            "pattern": "[file:hashes.SHA256 = '6bdf46209fda582d7af5b74770b0eccf6abd3dbeabce3bdfb88db2f252ee778a' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:52:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd31c16-5978-48e0-a441-4722950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:52:22.000Z",
            "modified": "2018-10-26T13:52:22.000Z",
            "description": "DOC files (downloaders) detected as W2KM_POWLOAD.AUSJSP",
            "pattern": "[file:hashes.SHA256 = 'efb154bccff1e9a0f090a6afd7a08bf2c1fffea745b575a0bf31f22998688973' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:52:22Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bd31c31-bba0-47bc-b92b-4b39950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-10-26T13:52:49.000Z",
            "modified": "2018-10-26T13:52:49.000Z",
            "description": "LOCKY from DOC detected as RANSOM_LOCKY.TH908",
            "pattern": "[file:hashes.SHA256 = '3cb4484976676ac043fae870addaa57e858c1286cdb17d01ef8c973c5ec5b015' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-10-26T13:52:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}