{
    "type": "bundle",
    "id": "bundle--be8c3307-4b09-4ddf-af24-41c2385d8036",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T08:40:12.000Z",
            "modified": "2022-08-31T08:40:12.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--be8c3307-4b09-4ddf-af24-41c2385d8036",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T08:40:12.000Z",
            "modified": "2022-08-31T08:40:12.000Z",
            "name": "Remcos RAT New TTPS \u2013 Detection & Response",
            "published": "2022-10-24T13:56:05Z",
            "object_refs": [
                "indicator--df994929-4233-49d8-8ee1-fe74efa43e04",
                "indicator--9968fbe6-da06-43b8-a264-f972a350bc74",
                "indicator--3276f7e4-03a3-4c09-9d4d-e8a0dcd39e05",
                "indicator--5510130e-924e-4efc-9b33-76ac8c0b5495",
                "indicator--54ec8646-3bba-4695-85be-3399b0294058",
                "indicator--da77edf5-854d-4a5c-ae31-cdc72e63c2ab",
                "indicator--0116dee7-8bb3-44d5-89ee-0e48099ec265",
                "indicator--e47a293f-bb9c-486d-8d1d-1ababb321a9e",
                "indicator--43213f12-3d3d-4e84-9304-ad3e97814c35",
                "indicator--ca123a03-e340-441a-aa28-ab5fd1284558",
                "indicator--2eb72bd3-77a7-4040-aae7-2879896ca54e",
                "indicator--640fee1c-2637-4c90-bf25-ef1563fcca05",
                "x-misp-object--53d47357-bc5c-4c53-b3d5-fca18380b817",
                "x-misp-object--06ec68ed-5627-4d27-b9c0-3fe3e0b9e50a"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT",
                "osint:lifetime=\"perpetual\"",
                "osint:certainty=\"50\"",
                "misp-galaxy:malpedia=\"Remcos\"",
                "misp-galaxy:mitre-tool=\"Remcos - S0332\"",
                "misp-galaxy:rat=\"Remcos\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--df994929-4233-49d8-8ee1-fe74efa43e04",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T07:13:02.000Z",
            "modified": "2022-08-31T07:13:02.000Z",
            "pattern": "[file:hashes.MD5 = '6d25e04e66cccb61648f34728af7c2f2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T07:13:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--9968fbe6-da06-43b8-a264-f972a350bc74",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T07:13:02.000Z",
            "modified": "2022-08-31T07:13:02.000Z",
            "pattern": "[file:hashes.MD5 = 'f331c18c3f685d245d40911d3bd20519']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T07:13:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--3276f7e4-03a3-4c09-9d4d-e8a0dcd39e05",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T07:13:02.000Z",
            "modified": "2022-08-31T07:13:02.000Z",
            "pattern": "[file:hashes.MD5 = '8cea687c5c02c9b71303c53dc2641f03']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T07:13:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5510130e-924e-4efc-9b33-76ac8c0b5495",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T07:13:17.000Z",
            "modified": "2022-08-31T07:13:17.000Z",
            "pattern": "[url:value = 'http://geoplugin.net/json.gp']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T07:13:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--54ec8646-3bba-4695-85be-3399b0294058",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T07:13:17.000Z",
            "modified": "2022-08-31T07:13:17.000Z",
            "pattern": "[domain-name:value = 'falimore001.hopto.org']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T07:13:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--da77edf5-854d-4a5c-ae31-cdc72e63c2ab",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T07:13:17.000Z",
            "modified": "2022-08-31T07:13:17.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.237.33.50']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T07:13:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--0116dee7-8bb3-44d5-89ee-0e48099ec265",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T07:13:17.000Z",
            "modified": "2022-08-31T07:13:17.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '194.147.140.29']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T07:13:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--e47a293f-bb9c-486d-8d1d-1ababb321a9e",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T07:14:48.000Z",
            "modified": "2022-08-31T07:14:48.000Z",
            "pattern": "[file:hashes.SHA256 = 'bf7212910de7bff455c3b3fe4b3a1a05059fe0da0c29e69b3aef492fe2a66fc0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T07:14:48Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--43213f12-3d3d-4e84-9304-ad3e97814c35",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T07:14:48.000Z",
            "modified": "2022-08-31T07:14:48.000Z",
            "pattern": "[file:hashes.SHA256 = 'af9596cf630f0f3e6e453ac8bdd6671f84feb65a057483ec5f620d04f4068209']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T07:14:48Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--ca123a03-e340-441a-aa28-ab5fd1284558",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T07:14:48.000Z",
            "modified": "2022-08-31T07:14:48.000Z",
            "pattern": "[file:hashes.SHA256 = 'e2816883a7a514fe1a3fbce95c04c2fc735f0c7ab872f7c23978388c42aea5c2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T07:14:48Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2eb72bd3-77a7-4040-aae7-2879896ca54e",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T08:40:12.000Z",
            "modified": "2022-08-31T08:40:12.000Z",
            "pattern": "[file:name = '\\\\%WINDIR\\\\%\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\vbc.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T08:40:12Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--640fee1c-2637-4c90-bf25-ef1563fcca05",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-31T08:40:12.000Z",
            "modified": "2022-08-31T08:40:12.000Z",
            "pattern": "[file:name = '\\\\%WINDIR\\\\%\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\vbc.exe.config']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-08-31T08:40:12Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--53d47357-bc5c-4c53-b3d5-fca18380b817",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-30T12:42:47.000Z",
            "modified": "2022-08-30T12:42:47.000Z",
            "labels": [
                "misp:name=\"report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "link",
                    "object_relation": "link",
                    "value": "https://www.socinvestigation.com/remcos-rat-new-ttps-detection-response/",
                    "category": "External analysis",
                    "uuid": "7bbed825-6ab9-4612-887e-1623b04429bb"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "report"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--06ec68ed-5627-4d27-b9c0-3fe3e0b9e50a",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2022-08-30T14:03:29.000Z",
            "modified": "2022-08-30T14:03:29.000Z",
            "labels": [
                "misp:name=\"report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "link",
                    "object_relation": "link",
                    "value": "https://otx.alienvault.com/pulse/630cbb6eb1975f82211a702f",
                    "category": "External analysis",
                    "uuid": "c51bbd6b-ba7a-4370-97fb-09972c3b3b0d"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "report"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}