{
    "type": "bundle",
    "id": "bundle--5a3d03cd-08f0-41bf-89fd-4789950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:09:05.000Z",
            "modified": "2017-12-22T13:09:05.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "grouping",
            "spec_version": "2.1",
            "id": "grouping--5a3d03cd-08f0-41bf-89fd-4789950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:09:05.000Z",
            "modified": "2017-12-22T13:09:05.000Z",
            "name": "M2M -  GlobeImposter \"..doc\" 2017-12-22 : \"Outstanding\n Statement\" - \"Customer Statement .7z\"",
            "context": "suspicious-activity",
            "object_refs": [
                "indicator--5a3d03ce-9c70-4487-bfd9-4a98950d210f",
                "indicator--5a3d03cf-40c8-4830-aea3-4290950d210f",
                "indicator--5a3d03d0-ea88-445e-9d27-4c5a950d210f",
                "observed-data--5a3d03d1-8338-4299-af98-414d950d210f",
                "network-traffic--5a3d03d1-8338-4299-af98-414d950d210f",
                "ipv4-addr--5a3d03d1-8338-4299-af98-414d950d210f",
                "indicator--5a3d03d3-1f2c-4c1b-8678-42c8950d210f",
                "indicator--5a3d03d4-5ef4-4f67-8c5d-4e4f950d210f",
                "indicator--5a3d03d6-f2d4-44e5-9f36-4a65950d210f",
                "indicator--5a3d03d7-8d78-42d7-b3be-446a950d210f",
                "observed-data--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
                "network-traffic--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
                "ipv4-addr--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
                "observed-data--5a3d03d9-7760-4433-baa3-5156950d210f",
                "network-traffic--5a3d03d9-7760-4433-baa3-5156950d210f",
                "ipv4-addr--5a3d03d9-7760-4433-baa3-5156950d210f",
                "indicator--5a3d03da-f0f0-4dcc-beef-45f7950d210f",
                "indicator--5a3d03db-a2cc-4248-8670-4dc1950d210f",
                "observed-data--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
                "network-traffic--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
                "ipv4-addr--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
                "indicator--5a3d03de-53f4-48ff-a4e4-4c52950d210f",
                "indicator--5a3d03df-2a68-46ad-989b-485a950d210f",
                "observed-data--5a3d03e0-c678-4ae6-94a2-5156950d210f",
                "network-traffic--5a3d03e0-c678-4ae6-94a2-5156950d210f",
                "ipv4-addr--5a3d03e0-c678-4ae6-94a2-5156950d210f",
                "indicator--5a3d03e1-4eac-46c6-8024-43be950d210f",
                "indicator--5a3d03e2-36f4-443b-8e5a-49ca950d210f",
                "observed-data--5a3d03e4-4144-4957-a833-46ca950d210f",
                "network-traffic--5a3d03e4-4144-4957-a833-46ca950d210f",
                "ipv4-addr--5a3d03e4-4144-4957-a833-46ca950d210f",
                "indicator--5a3d03e5-d4e0-459e-8512-443c950d210f",
                "indicator--5a3d03e6-311c-4670-9873-4e25950d210f",
                "observed-data--5a3d03e8-e890-4800-8c72-4035950d210f",
                "network-traffic--5a3d03e8-e890-4800-8c72-4035950d210f",
                "ipv4-addr--5a3d03e8-e890-4800-8c72-4035950d210f",
                "indicator--5a3d03ea-cd70-42e0-8ce9-4e4f950d210f",
                "indicator--5a3d03eb-3bb4-4934-9715-43bc950d210f",
                "observed-data--5a3d03ec-d0a8-46e7-856a-4832950d210f",
                "network-traffic--5a3d03ec-d0a8-46e7-856a-4832950d210f",
                "ipv4-addr--5a3d03ec-d0a8-46e7-856a-4832950d210f",
                "indicator--5a3d03ee-9214-4b53-94df-450f950d210f",
                "indicator--5a3d03ef-6dbc-4ac2-8493-4d8f950d210f",
                "observed-data--5a3d03f1-2f00-4e37-8317-4c39950d210f",
                "network-traffic--5a3d03f1-2f00-4e37-8317-4c39950d210f",
                "ipv4-addr--5a3d03f1-2f00-4e37-8317-4c39950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "workflow:todo=\"expansion\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03ce-9c70-4487-bfd9-4a98950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:30.000Z",
            "modified": "2017-12-22T13:08:30.000Z",
            "pattern": "[file:hashes.MD5 = 'af961493e65629c755ce0de085a10c33']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03cf-40c8-4830-aea3-4290950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:31.000Z",
            "modified": "2017-12-22T13:08:31.000Z",
            "pattern": "[url:value = 'http://www.bodyclassics.org/tOldHSYW']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03d0-ea88-445e-9d27-4c5a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:32.000Z",
            "modified": "2017-12-22T13:08:32.000Z",
            "pattern": "[domain-name:value = 'www.bodyclassics.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3d03d1-8338-4299-af98-414d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:33.000Z",
            "modified": "2017-12-22T13:08:33.000Z",
            "first_observed": "2017-12-22T13:08:33Z",
            "last_observed": "2017-12-22T13:08:33Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a3d03d1-8338-4299-af98-414d950d210f",
                "ipv4-addr--5a3d03d1-8338-4299-af98-414d950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a3d03d1-8338-4299-af98-414d950d210f",
            "dst_ref": "ipv4-addr--5a3d03d1-8338-4299-af98-414d950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a3d03d1-8338-4299-af98-414d950d210f",
            "value": "67.59.136.100"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03d3-1f2c-4c1b-8678-42c8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:35.000Z",
            "modified": "2017-12-22T13:08:35.000Z",
            "pattern": "[url:value = 'http://www.erpbizsolutions.com/tOldHSYW']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03d4-5ef4-4f67-8c5d-4e4f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:36.000Z",
            "modified": "2017-12-22T13:08:36.000Z",
            "pattern": "[domain-name:value = 'www.erpbizsolutions.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03d6-f2d4-44e5-9f36-4a65950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:38.000Z",
            "modified": "2017-12-22T13:08:38.000Z",
            "pattern": "[url:value = 'http://www.shopstation.com.au/tOldHSYW']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:38Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03d7-8d78-42d7-b3be-446a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:39.000Z",
            "modified": "2017-12-22T13:08:39.000Z",
            "pattern": "[domain-name:value = 'www.shopstation.com.au']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:40.000Z",
            "modified": "2017-12-22T13:08:40.000Z",
            "first_observed": "2017-12-22T13:08:40Z",
            "last_observed": "2017-12-22T13:08:40Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
                "ipv4-addr--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
            "dst_ref": "ipv4-addr--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
            "value": "104.27.175.50"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3d03d9-7760-4433-baa3-5156950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:41.000Z",
            "modified": "2017-12-22T13:08:41.000Z",
            "first_observed": "2017-12-22T13:08:41Z",
            "last_observed": "2017-12-22T13:08:41Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a3d03d9-7760-4433-baa3-5156950d210f",
                "ipv4-addr--5a3d03d9-7760-4433-baa3-5156950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a3d03d9-7760-4433-baa3-5156950d210f",
            "dst_ref": "ipv4-addr--5a3d03d9-7760-4433-baa3-5156950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a3d03d9-7760-4433-baa3-5156950d210f",
            "value": "104.27.174.50"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03da-f0f0-4dcc-beef-45f7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:42.000Z",
            "modified": "2017-12-22T13:08:42.000Z",
            "pattern": "[url:value = 'http://www.sigmahydraulics.com/tOldHSYW']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03db-a2cc-4248-8670-4dc1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:43.000Z",
            "modified": "2017-12-22T13:08:43.000Z",
            "pattern": "[domain-name:value = 'www.sigmahydraulics.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:43Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:44.000Z",
            "modified": "2017-12-22T13:08:44.000Z",
            "first_observed": "2017-12-22T13:08:44Z",
            "last_observed": "2017-12-22T13:08:44Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
                "ipv4-addr--5a3d03dc-af4c-46ef-9ca8-4529950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
            "dst_ref": "ipv4-addr--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
            "value": "103.235.105.64"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03de-53f4-48ff-a4e4-4c52950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:46.000Z",
            "modified": "2017-12-22T13:08:46.000Z",
            "pattern": "[url:value = 'http://www.topcareerguide.info/tOldHSYW']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:46Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03df-2a68-46ad-989b-485a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:47.000Z",
            "modified": "2017-12-22T13:08:47.000Z",
            "pattern": "[domain-name:value = 'www.topcareerguide.info']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3d03e0-c678-4ae6-94a2-5156950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:48.000Z",
            "modified": "2017-12-22T13:08:48.000Z",
            "first_observed": "2017-12-22T13:08:48Z",
            "last_observed": "2017-12-22T13:08:48Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a3d03e0-c678-4ae6-94a2-5156950d210f",
                "ipv4-addr--5a3d03e0-c678-4ae6-94a2-5156950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a3d03e0-c678-4ae6-94a2-5156950d210f",
            "dst_ref": "ipv4-addr--5a3d03e0-c678-4ae6-94a2-5156950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a3d03e0-c678-4ae6-94a2-5156950d210f",
            "value": "50.62.25.129"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03e1-4eac-46c6-8024-43be950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:49.000Z",
            "modified": "2017-12-22T13:08:49.000Z",
            "pattern": "[url:value = 'http://www.upperlensmagazine.com/tOldHSYW']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03e2-36f4-443b-8e5a-49ca950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:50.000Z",
            "modified": "2017-12-22T13:08:50.000Z",
            "pattern": "[domain-name:value = 'www.upperlensmagazine.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:50Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3d03e4-4144-4957-a833-46ca950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:52.000Z",
            "modified": "2017-12-22T13:08:52.000Z",
            "first_observed": "2017-12-22T13:08:52Z",
            "last_observed": "2017-12-22T13:08:52Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a3d03e4-4144-4957-a833-46ca950d210f",
                "ipv4-addr--5a3d03e4-4144-4957-a833-46ca950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a3d03e4-4144-4957-a833-46ca950d210f",
            "dst_ref": "ipv4-addr--5a3d03e4-4144-4957-a833-46ca950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a3d03e4-4144-4957-a833-46ca950d210f",
            "value": "45.126.209.154"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03e5-d4e0-459e-8512-443c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:53.000Z",
            "modified": "2017-12-22T13:08:53.000Z",
            "pattern": "[url:value = 'http://www.vayvonvietcombank24h.net/tOldHSYW']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03e6-311c-4670-9873-4e25950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:54.000Z",
            "modified": "2017-12-22T13:08:54.000Z",
            "pattern": "[domain-name:value = 'www.vayvonvietcombank24h.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:54Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3d03e8-e890-4800-8c72-4035950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:56.000Z",
            "modified": "2017-12-22T13:08:56.000Z",
            "first_observed": "2017-12-22T13:08:56Z",
            "last_observed": "2017-12-22T13:08:56Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a3d03e8-e890-4800-8c72-4035950d210f",
                "ipv4-addr--5a3d03e8-e890-4800-8c72-4035950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a3d03e8-e890-4800-8c72-4035950d210f",
            "dst_ref": "ipv4-addr--5a3d03e8-e890-4800-8c72-4035950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a3d03e8-e890-4800-8c72-4035950d210f",
            "value": "198.143.137.42"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03ea-cd70-42e0-8ce9-4e4f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:58.000Z",
            "modified": "2017-12-22T13:08:58.000Z",
            "pattern": "[url:value = 'https://topyzscsu5poprxy.onion.link/shfgealjh.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03eb-3bb4-4934-9715-43bc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:08:59.000Z",
            "modified": "2017-12-22T13:08:59.000Z",
            "pattern": "[domain-name:value = 'topyzscsu5poprxy.onion.link']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:08:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3d03ec-d0a8-46e7-856a-4832950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:09:00.000Z",
            "modified": "2017-12-22T13:09:00.000Z",
            "first_observed": "2017-12-22T13:09:00Z",
            "last_observed": "2017-12-22T13:09:00Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a3d03ec-d0a8-46e7-856a-4832950d210f",
                "ipv4-addr--5a3d03ec-d0a8-46e7-856a-4832950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a3d03ec-d0a8-46e7-856a-4832950d210f",
            "dst_ref": "ipv4-addr--5a3d03ec-d0a8-46e7-856a-4832950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a3d03ec-d0a8-46e7-856a-4832950d210f",
            "value": "103.198.0.2"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03ee-9214-4b53-94df-450f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:09:02.000Z",
            "modified": "2017-12-22T13:09:02.000Z",
            "pattern": "[url:value = 'http://psoeiras.net/js/count.php?nu=105&fb=110']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:09:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a3d03ef-6dbc-4ac2-8493-4d8f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:09:03.000Z",
            "modified": "2017-12-22T13:09:03.000Z",
            "pattern": "[domain-name:value = 'psoeiras.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-12-22T13:09:03Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a3d03f1-2f00-4e37-8317-4c39950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-12-22T13:09:05.000Z",
            "modified": "2017-12-22T13:09:05.000Z",
            "first_observed": "2017-12-22T13:09:05Z",
            "last_observed": "2017-12-22T13:09:05Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--5a3d03f1-2f00-4e37-8317-4c39950d210f",
                "ipv4-addr--5a3d03f1-2f00-4e37-8317-4c39950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--5a3d03f1-2f00-4e37-8317-4c39950d210f",
            "dst_ref": "ipv4-addr--5a3d03f1-2f00-4e37-8317-4c39950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a3d03f1-2f00-4e37-8317-4c39950d210f",
            "value": "74.220.219.67"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}