{
    "type": "bundle",
    "id": "bundle--6b6fa46d-4a17-44a4-a234-d69487b04597",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2023-08-25T06:23:39.000Z",
            "modified": "2023-08-25T06:23:39.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--6b6fa46d-4a17-44a4-a234-d69487b04597",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2023-08-25T06:23:39.000Z",
            "modified": "2023-08-25T06:23:39.000Z",
            "name": "CISA - MAR-10459736.r1.v1 - WHIRLPOOL Variant",
            "published": "2023-08-25T06:23:46Z",
            "object_refs": [
                "indicator--3e5f8fc0-da1f-47f0-8b6e-f4c4b033ce47",
                "identity--8e112e72-aa8f-4190-a359-28a9abae2896",
                "x-misp-object--07141506-e989-4a25-b510-797383e9b01a",
                "indicator--efd3fd98-6f1b-590d-bdd4-1e0753d3a689",
                "x-misp-object--626a2549-5775-43a8-b8bb-2fe2682a6dae",
                "indicator--31532fc0-d3ee-479f-8482-a4d49732d5af",
                "x-misp-object--74888f9e-4968-4601-944d-100a179c1b88",
                "relationship--00012474-a0e7-4d07-b4f7-2a507fd15a15",
                "relationship--5905796b-7a63-42a2-a5b8-82ced29c030b"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT",
                "osint:lifetime=\"perpetual\"",
                "tlp:clear"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--3e5f8fc0-da1f-47f0-8b6e-f4c4b033ce47",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2023-08-09T21:12:59.000Z",
            "modified": "2023-08-09T21:12:59.000Z",
            "description": "The file 'ssld' is a Linux ELF reverse shell and is a variant of WHIRLPOOL malware used on the Barracuda Email Security Gateway (ESG) device (Figure 1). The file looks for an encoded string with a '.io' extension (Figure 2). The string will be decoded and the data will be passed as the C2 which will include the Internet Protocol (IP) address and port number used to establish a reverse shell.",
            "pattern": "['namespace'='CISA_Consolidated.yara' rule_name=CISA_10452108_02 rule_content=rule CISA_10452108_02 : WHIRLPOOL backdoor communicates_with_c2 installs_other_components\n{\n\tmeta:\n\t\tAuthor = \"CISA Code & Media Analysis\"\n\t\tIncident = \"10452108\"\n\t\tDate = \"2023-06-20\"\n\t\tLast_Modified = \"20230804_1730\"\n\t\tActor = \"n/a\"\n\t\tFamily = \"WHIRLPOOL\"\n\t\tCapabilities = \"communicates-with-c2 installs-other-components\"\n\t\tMalware_Type = \"backdoor\"\n\t\tTool_Type = \"unknown\"\n\t\tDescription = \"Detects malicious Linux WHIRLPOOL samples\"\n\t\tSHA256_1 = \"83ca636253fd1eb898b244855838e2281f257bbe8ead428b69528fc50b60ae9c\"\n\t\tSHA256_2 = \"8849a3273e0362c45b4928375d196714224ec22cb1d2df5d029bf57349860347\"\n\tstrings:\n\t\t$s0 = { 65 72 72 6f 72 20 2d 31 20 65 78 69 74 }\n\t\t$s1 = { 63 72 65 61 74 65 20 73 6f 63 6b 65 74 20 65 72 72 6f 72 3a 20 25 73 28 65 72 72 6f 72 3a 20 25 64 29 }\n\t\t$s2 = { c7 00 20 32 3e 26 66 c7 40 04 31 00 }\n\t\t$a3 = { 70 6c 61 69 6e 5f 63 6f 6e 6e 65 63 74 }\n\t\t$a4 = { 63 6f 6e 6e 65 63 74 20 65 72 72 6f 72 3a 20 25 73 28 65 72 72 6f 72 3a 20 25 64 29 }\n\t\t$a5 = { 73 73 6c 5f 63 6f 6e 6e 65 63 74 }\n\tcondition:\n\t\tuint32(0) == 0x464c457f and 4 of them\n}]",
            "pattern_type": "yara",
            "pattern_version": "2.1",
            "valid_from": "2023-08-17T19:19:43.944668Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload installation"
                }
            ],
            "labels": [
                "misp:type=\"yara\"",
                "misp:category=\"Payload installation\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--8e112e72-aa8f-4190-a359-28a9abae2896",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2023-04-12T17:53:09.000Z",
            "modified": "2023-04-12T17:53:09.000Z",
            "name": "GeminiProduction_CMA",
            "description": "Cybersecurity and Infrastructure Security Agency Production Identity. Code and Media Analysis.",
            "identity_class": "system",
            "labels": [
                "misp:name=\"identity\"",
                "misp:meta-category=\"misc\"",
                "misp:to_ids=\"False\"",
                "misp:confidence-level=\"completely-confident\""
            ],
            "confidence": 100
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--07141506-e989-4a25-b510-797383e9b01a",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2023-08-09T21:12:59.000Z",
            "modified": "2023-08-09T21:12:59.000Z",
            "labels": [
                "misp:name=\"malware-analysis\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "text",
                    "object_relation": "product",
                    "value": "eset",
                    "category": "Other",
                    "uuid": "42e406d8-bcb1-468d-b9d1-195810672cab"
                },
                {
                    "type": "text",
                    "object_relation": "result",
                    "value": "unknown",
                    "category": "Other",
                    "uuid": "aea648ae-f790-412a-8511-22728becdb95"
                },
                {
                    "type": "text",
                    "object_relation": "result_name",
                    "value": "a variant of Linux/WhirlPool.A trojan",
                    "category": "Other",
                    "uuid": "e2f4500e-7dea-4009-8c50-d8915623816a"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "malware-analysis"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--efd3fd98-6f1b-590d-bdd4-1e0753d3a689",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2023-08-09T21:12:59.000Z",
            "modified": "2023-08-09T21:12:59.000Z",
            "pattern": "[file:hashes.MD5 = '77e1e9bf69b09ed0840534adb8258540' AND file:hashes.SHA1 = 'deadca9bd85ee5c4e086fd81eee09407b769e9b6' AND file:hashes.SHA256 = '0af253e60456b03af49cc675f71d47b2dd9a48f50a927e43b9d8116985c06459' AND file:hashes.SHA512 = '3ad6bd00c4195c9b1757a9d697196e8beffb343c331509c2eda24bbbd009cc1af552a1900ab04d169a22d273e6359cb2ff149050a7f792b9630108a4af226e2d' AND file:hashes.SSDEEP = '98304:1z2EGoxipg0NPbuqbVxbNgqE+Q+F4YGZLx4BAFm/CyU:LLXYGNFLj' AND file:name = 'ssld' AND file:size = '5034648']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2023-08-09T21:12:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--626a2549-5775-43a8-b8bb-2fe2682a6dae",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2023-08-09T21:12:59.000Z",
            "modified": "2023-08-09T21:12:59.000Z",
            "labels": [
                "misp:name=\"malware\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "text",
                    "object_relation": "description",
                    "value": "The file 'ssld' is a Linux ELF reverse shell and is a variant of WHIRLPOOL malware used on the Barracuda Email Security Gateway (ESG) device (Figure 1). The file looks for an encoded string with a '.io' extension (Figure 2). The string will be decoded and the data will be passed as the C2 which will include the Internet Protocol (IP) address and port number used to establish a reverse shell.",
                    "category": "Other",
                    "uuid": "2d538923-b375-4471-b5f4-69f653cf572e"
                },
                {
                    "type": "boolean",
                    "object_relation": "is_family",
                    "value": "0",
                    "category": "Other",
                    "uuid": "2b74c868-0c2e-4e1f-bb81-7cf1cc9d2c0b"
                },
                {
                    "type": "text",
                    "object_relation": "malware_type",
                    "value": "trojan",
                    "category": "Other",
                    "uuid": "be1cbecb-8dd5-4cf9-899f-a58169012721"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "malware"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--31532fc0-d3ee-479f-8482-a4d49732d5af",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2023-08-09T21:12:59.000Z",
            "modified": "2023-08-09T21:12:59.000Z",
            "pattern": "[file:hashes.MD5 = '77e1e9bf69b09ed0840534adb8258540' AND file:hashes.SHA1 = 'deadca9bd85ee5c4e086fd81eee09407b769e9b6' AND file:hashes.SHA256 = '0af253e60456b03af49cc675f71d47b2dd9a48f50a927e43b9d8116985c06459' AND file:hashes.SHA512 = '3ad6bd00c4195c9b1757a9d697196e8beffb343c331509c2eda24bbbd009cc1af552a1900ab04d169a22d273e6359cb2ff149050a7f792b9630108a4af226e2d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2023-08-17T19:19:43.953009Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--74888f9e-4968-4601-944d-100a179c1b88",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2023-08-25T06:18:58.000Z",
            "modified": "2023-08-25T06:18:58.000Z",
            "labels": [
                "misp:name=\"original-imported-file\"",
                "misp:meta-category=\"file\""
            ],
            "x_misp_attributes": [
                {
                    "type": "attachment",
                    "object_relation": "imported-sample",
                    "value": "MAR-10459736.r1.v1.CLEAR_stix2.json",
                    "category": "External analysis",
                    "uuid": "3cebdcfe-65ce-4b62-b622-aa56867ef744",
                    "data": "ewogICAgInR5cGUiOiAiYnVuZGxlIiwKICAgICJpZCI6ICJidW5kbGUtLTc4ZDc0MDVkLWM3NjktNGVmYi05NTUwLTQwNWEzNThhMmQ3NiIsCiAgICAib2JqZWN0cyI6IFsKICAgICAgICB7CiAgICAgICAgICAgICJ0eXBlIjogImlkZW50aXR5IiwKICAgICAgICAgICAgInNwZWNfdmVyc2lvbiI6ICIyLjEiLAogICAgICAgICAgICAiaWQiOiAiaWRlbnRpdHktLThlMTEyZTcyLWFhOGYtNDE5MC1hMzU5LTI4YTlhYmFlMjg5NiIsCiAgICAgICAgICAgICJjcmVhdGVkX2J5X3JlZiI6ICJpZGVudGl0eS0tNDJhYzNjOTItNjBkMi00MThmLWJhOGUtODM4OTQ0ZTYxMTBiIiwKICAgICAgICAgICAgImNyZWF0ZWQiOiAiMjAyMy0wNC0xMlQxNzo1MzowOS42NDZaIiwKICAgICAgICAgICAgIm1vZGlmaWVkIjogIjIwMjMtMDQtMTJUMTc6NTM6MDkuNjQ2WiIsCiAgICAgICAgICAgICJuYW1lIjogIkdlbWluaVByb2R1Y3Rpb25fQ01BIiwKICAgICAgICAgICAgImRlc2NyaXB0aW9uIjogIkN5YmVyc2VjdXJpdHkgYW5kIEluZnJhc3RydWN0dXJlIFNlY3VyaXR5IEFnZW5jeSBQcm9kdWN0aW9uIElkZW50aXR5LiBDb2RlIGFuZCBNZWRpYSBBbmFseXNpcy4iLAogICAgICAgICAgICAiaWRlbnRpdHlfY2xhc3MiOiAic3lzdGVtIiwKICAgICAgICAgICAgImNvbmZpZGVuY2UiOiAxMDAsCiAgICAgICAgICAgICJsYW5nIjogImVuIiwKICAgICAgICAgICAgIm9iamVjdF9tYXJraW5nX3JlZnMiOiBbCiAgICAgICAgICAgICAgICAibWFya2luZy1kZWZpbml0aW9uLS1iYWI0YTYzYy1hZWQ5LTRjZjUtYTc2Ni1kZmNhNWFiYWMyYmIiCiAgICAgICAgICAgIF0KICAgICAgICB9LAogICAgICAgIHsKICAgICAgICAgICAgInR5cGUiOiAiZmlsZSIsCiAgICAgICAgICAgICJzcGVjX3ZlcnNpb24iOiAiMi4xIiwKICAgICAgICAgICAgImlkIjogImZpbGUtLWVmZDNmZDk4LTZmMWItNTkwZC1iZGQ0LTFlMDc1M2QzYTY4OSIsCiAgICAgICAgICAgICJoYXNoZXMiOiB7CiAgICAgICAgICAgICAgICAiTUQ1IjogIjc3ZTFlOWJmNjliMDllZDA4NDA1MzRhZGI4MjU4NTQwIiwKICAgICAgICAgICAgICAgICJTSEEtMSI6ICJkZWFkY2E5YmQ4NWVlNWM0ZTA4NmZkODFlZWUwOTQwN2I3NjllOWI2IiwKICAgICAgICAgICAgICAgICJTSEEtMjU2IjogIjBhZjI1M2U2MDQ1NmIwM2FmNDljYzY3NWY3MWQ0N2IyZGQ5YTQ4ZjUwYTkyN2U0M2I5ZDgxMTY5ODVjMDY0NTkiLAogICAgICAgICAgICAgICAgIlNIQS01MTIiOiAiM2FkNmJkMDBjNDE5NWM5YjE3NTdhOWQ2OTcxOTZlOGJlZmZiMzQzYzMzMTUwOWMyZWRhMjRiYmJkMDA5Y2MxYWY1NTJhMTkwMGFiMDRkMTY5YTIyZDI3M2U2MzU5Y2IyZmYxNDkwNTBhN2Y3OTJiOTYzMDEwOGE0YWYyMjZlMmQiLAogICAgICAgICAgICAgICAgIlNTREVFUCI6ICI5ODMwNDoxejJFR294aXBnME5QYnVxYlZ4Yk5ncUUrUStGNFlHWkx4NEJBRm0vQ3lVOkxMWFlHTkZMaiIKICAgICAgICAgICAgfSwKICAgICAgICAgICAgInNpemUiOiA1MDM0NjQ4LAogICAgICAgICAgICAibmFtZSI6ICJzc2xkIiwKICAgICAgICAgICAgIm9iamVjdF9tYXJraW5nX3JlZnMiOiBbCiAgICAgICAgICAgICAgICAibWFya2luZy1kZWZpbml0aW9uLS05NDg2OGM4OS04M2MyLTQ2NGItOTI5Yi1hMWE4YWEzYzg0ODciCiAgICAgICAgICAgIF0KICAgICAgICB9LAogICAgICAgIHsKICAgICAgICAgICAgInR5cGUiOiAiaW5kaWNhdG9yIiwKICAgICAgICAgICAgInNwZWNfdmVyc2lvbiI6ICIyLjEiLAogICAgICAgICAgICAiaWQiOiAiaW5kaWNhdG9yLS0zZTVmOGZjMC1kYTFmLTQ3ZjAtOGI2ZS1mNGM0YjAzM2NlNDciLAogICAgICAgICAgICAiY3JlYXRlZF9ieV9yZWYiOiAiaWRlbnRpdHktLThlMTEyZTcyLWFhOGYtNDE5MC1hMzU5LTI4YTlhYmFlMjg5NiIsCiAgICAgICAgICAgICJjcmVhdGVkIjogIjIwMjMtMDgtMDlUMjE6MTI6NTkuMDAwWiIsCiAgICAgICAgICAgICJtb2RpZmllZCI6ICIyMDIzLTA4LTA5VDIxOjEyOjU5LjAwMFoiLAogICAgICAgICAgICAibmFtZSI6ICJzc2xkIiwKICAgICAgICAgICAgIm9iamVjdF9tYXJraW5nX3JlZnMiOiBbCiAgICAgICAgICAgICAgICAibWFya2luZy1kZWZpbml0aW9uLS05NDg2OGM4OS04M2MyLTQ2NGItOTI5Yi1hMWE4YWEzYzg0ODciCiAgICAgICAgICAgIF0sCiAgICAgICAgICAgICJkZXNjcmlwdGlvbiI6ICJUaGUgZmlsZSAnc3NsZCcgaXMgYSBMaW51eCBFTEYgcmV2ZXJzZSBzaGVsbCBhbmQgaXMgYSB2YXJpYW50IG9mIFdISVJMUE9PTCBtYWx3YXJlIHVzZWQgb24gdGhlIEJhcnJhY3VkYSBFbWFpbCBTZWN1cml0eSBHYXRld2F5IChFU0cpIGRldmljZSAoRmlndXJlIDEpLiBUaGUgZmlsZSBsb29rcyBmb3IgYW4gZW5jb2RlZCBzdHJpbmcgd2l0aCBhICcuaW8nIGV4dGVuc2lvbiAoRmlndXJlIDIpLiBUaGUgc3RyaW5nIHdpbGwgYmUgZGVjb2RlZCBhbmQgdGhlIGRhdGEgd2lsbCBiZSBwYXNzZWQgYXMgdGhlIEMyIHdoaWNoIHdpbGwgaW5jbHVkZSB0aGUgSW50ZXJuZXQgUHJvdG9jb2wgKElQKSBhZGRyZXNzIGFuZCBwb3J0IG51bWJlciB1c2VkIHRvIGVzdGFibGlzaCBhIHJldmVyc2Ugc2hlbGwuIiwKICAgICAgICAgICAgImluZGljYXRvcl90eXBlcyI6IFsKICAgICAgICAgICAgICAgICJtYWxpY2lvdXMtYWN0aXZpdHkiCiAgICAgICAgICAgIF0sCiAgICAgICAgICAgICJwYXR0ZXJuIjogIiAnbmFtZXNwYWNlJz0nQ0lTQV9Db25zb2xpZGF0ZWQueWFyYScgcnVsZV9uYW1lPUNJU0FfMTA0NTIxMDhfMDIgcnVsZV9jb250ZW50PXJ1bGUgQ0lTQV8xMDQ1MjEwOF8wMiA6IFdISVJMUE9PTCBiYWNrZG9vciBjb21tdW5pY2F0ZXNfd2l0aF9jMiBpbnN0YWxsc19vdGhlcl9jb21wb25lbnRzXG57XG5cdG1ldGE6XG5cdFx0QXV0aG9yID0gXCJDSVNBIENvZGUgJiBNZWRpYSBBbmFseXNpc1wiXG5cdFx0SW5jaWRlbnQgPSBcIjEwNDUyMTA4XCJcblx0XHREYXRlID0gXCIyMDIzLTA2LTIwXCJcblx0XHRMYXN0X01vZGlmaWVkID0gXCIyMDIzMDgwNF8xNzMwXCJcblx0XHRBY3RvciA9IFwibi9hXCJcblx0XHRGYW1pbHkgPSBcIldISVJMUE9PTFwiXG5cdFx0Q2FwYWJpbGl0aWVzID0gXCJjb21tdW5pY2F0ZXMtd2l0aC1jMiBpbnN0YWxscy1vdGhlci1jb21wb25lbnRzXCJcblx0XHRNYWx3YXJlX1R5cGUgPSBcImJhY2tkb29yXCJcblx0XHRUb29sX1R5cGUgPSBcInVua25vd25cIlxuXHRcdERlc2NyaXB0aW9uID0gXCJEZXRlY3RzIG1hbGljaW91cyBMaW51eCBXSElSTFBPT0wgc2FtcGxlc1wiXG5cdFx0U0hBMjU2XzEgPSBcIjgzY2E2MzYyNTNmZDFlYjg5OGIyNDQ4NTU4MzhlMjI4MWYyNTdiYmU4ZWFkNDI4YjY5NTI4ZmM1MGI2MGFlOWNcIlxuXHRcdFNIQTI1Nl8yID0gXCI4ODQ5YTMyNzNlMDM2MmM0NWI0OTI4Mzc1ZDE5NjcxNDIyNGVjMjJjYjFkMmRmNWQwMjliZjU3MzQ5ODYwMzQ3XCJcblx0c3RyaW5nczpcblx0XHQkczAgPSB7IDY1IDcyIDcyIDZmIDcyIDIwIDJkIDMxIDIwIDY1IDc4IDY5IDc0IH1cblx0XHQkczEgPSB7IDYzIDcyIDY1IDYxIDc0IDY1IDIwIDczIDZmIDYzIDZiIDY1IDc0IDIwIDY1IDcyIDcyIDZmIDcyIDNhIDIwIDI1IDczIDI4IDY1IDcyIDcyIDZmIDcyIDNhIDIwIDI1IDY0IDI5IH1cblx0XHQkczIgPSB7IGM3IDAwIDIwIDMyIDNlIDI2IDY2IGM3IDQwIDA0IDMxIDAwIH1cblx0XHQkYTMgPSB7IDcwIDZjIDYxIDY5IDZlIDVmIDYzIDZmIDZlIDZlIDY1IDYzIDc0IH1cblx0XHQkYTQgPSB7IDYzIDZmIDZlIDZlIDY1IDYzIDc0IDIwIDY1IDcyIDcyIDZmIDcyIDNhIDIwIDI1IDczIDI4IDY1IDcyIDcyIDZmIDcyIDNhIDIwIDI1IDY0IDI5IH1cblx0XHQkYTUgPSB7IDczIDczIDZjIDVmIDYzIDZmIDZlIDZlIDY1IDYzIDc0IH1cblx0Y29uZGl0aW9uOlxuXHRcdHVpbnQzMigwKSA9PSAweDQ2NGM0NTdmIGFuZCA0IG9mIHRoZW1cbn1cbiIsCiAgICAgICAgICAgICJwYXR0ZXJuX3R5cGUiOiAieWFyYSIsCiAgICAgICAgICAgICJ2YWxpZF9mcm9tIjogIjIwMjMtMDgtMTdUMTk6MTk6NDMuOTQ0NjY4WiIKICAgICAgICB9LAogICAgICAgIHsKICAgICAgICAgICAgInR5cGUiOiAibWFsd2FyZS1hbmFseXNpcyIsCiAgICAgICAgICAgICJzcGVjX3ZlcnNpb24iOiAiMi4xIiwKICAgICAgICAgICAgImlkIjogIm1hbHdhcmUtYW5hbHlzaXMtLTA3MTQxNTA2LWU5ODktNGEyNS1iNTEwLTc5NzM4M2U5YjAxYSIsCiAgICAgICAgICAgICJjcmVhdGVkX2J5X3JlZiI6ICJpZGVudGl0eS0tOGUxMTJlNzItYWE4Zi00MTkwLWEzNTktMjhhOWFiYWUyODk2IiwKICAgICAgICAgICAgImNyZWF0ZWQiOiAiMjAyMy0wOC0wOVQyMToxMjo1OS4wMDBaIiwKICAgICAgICAgICAgIm1vZGlmaWVkIjogIjIwMjMtMDgtMDlUMjE6MTI6NTkuMDAwWiIsCiAgICAgICAgICAgICJwcm9kdWN0IjogImVzZXQiLAogICAgICAgICAgICAib2JqZWN0X21hcmtpbmdfcmVmcyI6IFsKICAgICAgICAgICAgICAgICJtYXJraW5nLWRlZmluaXRpb24tLTk0ODY4Yzg5LTgzYzItNDY0Yi05MjliLWExYThhYTNjODQ4NyIKICAgICAgICAgICAgXSwKICAgICAgICAgICAgInJlc3VsdF9uYW1lIjogImEgdmFyaWFudCBvZiBMaW51eC9XaGlybFBvb2wuQSB0cm9qYW4iLAogICAgICAgICAgICAicmVzdWx0IjogInVua25vd24iLAogICAgICAgICAgICAic2FtcGxlX3JlZiI6ICJmaWxlLS1lZmQzZmQ5OC02ZjFiLTU5MGQtYmRkNC0xZTA3NTNkM2E2ODkiCiAgICAgICAgfSwKICAgICAgICB7CiAgICAgICAgICAgICJ0eXBlIjogIm1hbHdhcmUiLAogICAgICAgICAgICAic3BlY192ZXJzaW9uIjogIjIuMSIsCiAgICAgICAgICAgICJpZCI6ICJtYWx3YXJlLS02MjZhMjU0OS01Nzc1LTQzYTgtYjhiYi0yZmUyNjgyYTZkYWUiLAogICAgICAgICAgICAiY3JlYXRlZF9ieV9yZWYiOiAiaWRlbnRpdHktLThlMTEyZTcyLWFhOGYtNDE5MC1hMzU5LTI4YTlhYmFlMjg5NiIsCiAgICAgICAgICAgICJjcmVhdGVkIjogIjIwMjMtMDgtMDlUMjE6MTI6NTkuMDAwWiIsCiAgICAgICAgICAgICJtb2RpZmllZCI6ICIyMDIzLTA4LTA5VDIxOjEyOjU5LjAwMFoiLAogICAgICAgICAgICAib2JqZWN0X21hcmtpbmdfcmVmcyI6IFsKICAgICAgICAgICAgICAgICJtYXJraW5nLWRlZmluaXRpb24tLTk0ODY4Yzg5LTgzYzItNDY0Yi05MjliLWExYThhYTNjODQ4NyIKICAgICAgICAgICAgXSwKICAgICAgICAgICAgImRlc2NyaXB0aW9uIjogIlRoZSBmaWxlICdzc2xkJyBpcyBhIExpbnV4IEVMRiByZXZlcnNlIHNoZWxsIGFuZCBpcyBhIHZhcmlhbnQgb2YgV0hJUkxQT09MIG1hbHdhcmUgdXNlZCBvbiB0aGUgQmFycmFjdWRhIEVtYWlsIFNlY3VyaXR5IEdhdGV3YXkgKEVTRykgZGV2aWNlIChGaWd1cmUgMSkuIFRoZSBmaWxlIGxvb2tzIGZvciBhbiBlbmNvZGVkIHN0cmluZyB3aXRoIGEgJy5pbycgZXh0ZW5zaW9uIChGaWd1cmUgMikuIFRoZSBzdHJpbmcgd2lsbCBiZSBkZWNvZGVkIGFuZCB0aGUgZGF0YSB3aWxsIGJlIHBhc3NlZCBhcyB0aGUgQzIgd2hpY2ggd2lsbCBpbmNsdWRlIHRoZSBJbnRlcm5ldCBQcm90b2NvbCAoSVApIGFkZHJlc3MgYW5kIHBvcnQgbnVtYmVyIHVzZWQgdG8gZXN0YWJsaXNoIGEgcmV2ZXJzZSBzaGVsbC4iLAogICAgICAgICAgICAibWFsd2FyZV90eXBlcyI6IFsKICAgICAgICAgICAgICAgICJ0cm9qYW4iCiAgICAgICAgICAgIF0sCiAgICAgICAgICAgICJpc19mYW1pbHkiOiBmYWxzZSwKICAgICAgICAgICAgInNhbXBsZV9yZWZzIjogWwogICAgICAgICAgICAgICAgImZpbGUtLWVmZDNmZDk4LTZmMWItNTkwZC1iZGQ0LTFlMDc1M2QzYTY4OSIKICAgICAgICAgICAgXQogICAgICAgIH0sCiAgICAgICAgewogICAgICAgICAgICAidHlwZSI6ICJpbmRpY2F0b3IiLAogICAgICAgICAgICAic3BlY192ZXJzaW9uIjogIjIuMSIsCiAgICAgICAgICAgICJpZCI6ICJpbmRpY2F0b3ItLTMxNTMyZmMwLWQzZWUtNDc5Zi04NDgyLWE0ZDQ5NzMyZDVhZiIsCiAgICAgICAgICAgICJjcmVhdGVkX2J5X3JlZiI6ICJpZGVudGl0eS0tOGUxMTJlNzItYWE4Zi00MTkwLWEzNTktMjhhOWFiYWUyODk2IiwKICAgICAgICAgICAgImNyZWF0ZWQiOiAiMjAyMy0wOC0wOVQyMToxMjo1OS4wMDBaIiwKICAgICAgICAgICAgIm1vZGlmaWVkIjogIjIwMjMtMDgtMDlUMjE6MTI6NTkuMDAwWiIsCiAgICAgICAgICAgICJuYW1lIjogInNzbGQiLAogICAgICAgICAgICAib2JqZWN0X21hcmtpbmdfcmVmcyI6IFsKICAgICAgICAgICAgICAgICJtYXJraW5nLWRlZmluaXRpb24tLTk0ODY4Yzg5LTgzYzItNDY0Yi05MjliLWExYThhYTNjODQ4NyIKICAgICAgICAgICAgXSwKICAgICAgICAgICAgImluZGljYXRvcl90eXBlcyI6IFsKICAgICAgICAgICAgICAgICJtYWxpY2lvdXMtYWN0aXZpdHkiCiAgICAgICAgICAgIF0sCiAgICAgICAgICAgICJwYXR0ZXJuIjogIltmaWxlOmhhc2hlcy4nTUQ1Jz0nNzdlMWU5YmY2OWIwOWVkMDg0MDUzNGFkYjgyNTg1NDAnIE9SIGZpbGU6aGFzaGVzLidTSEEtMSc9J2RlYWRjYTliZDg1ZWU1YzRlMDg2ZmQ4MWVlZTA5NDA3Yjc2OWU5YjYnIE9SIGZpbGU6aGFzaGVzLidTSEEtMjU2Jz0nMGFmMjUzZTYwNDU2YjAzYWY0OWNjNjc1ZjcxZDQ3YjJkZDlhNDhmNTBhOTI3ZTQzYjlkODExNjk4NWMwNjQ1OScgT1IgZmlsZTpoYXNoZXMuJ1NIQS01MTInPSczYWQ2YmQwMGM0MTk1YzliMTc1N2E5ZDY5NzE5NmU4YmVmZmIzNDNjMzMxNTA5YzJlZGEyNGJiYmQwMDljYzFhZjU1MmExOTAwYWIwNGQxNjlhMjJkMjczZTYzNTljYjJmZjE0OTA1MGE3Zjc5MmI5NjMwMTA4YTRhZjIyNmUyZCddIiwKICAgICAgICAgICAgInBhdHRlcm5fdHlwZSI6ICJzdGl4IiwKICAgICAgICAgICAgInBhdHRlcm5fdmVyc2lvbiI6ICIyLjEiLAogICAgICAgICAgICAidmFsaWRfZnJvbSI6ICIyMDIzLTA4LTE3VDE5OjE5OjQzLjk1MzAwOVoiCiAgICAgICAgfSwKICAgICAgICB7CiAgICAgICAgICAgICJ0eXBlIjogInJlcG9ydCIsCiAgICAgICAgICAgICJzcGVjX3ZlcnNpb24iOiAiMi4xIiwKICAgICAgICAgICAgImlkIjogInJlcG9ydC0tNmI2ZmE0NmQtNGExNy00NGE0LWEyMzQtZDY5NDg3YjA0NTk3IiwKICAgICAgICAgICAgImNyZWF0ZWRfYnlfcmVmIjogImlkZW50aXR5LS04ZTExMmU3Mi1hYThmLTQxOTAtYTM1OS0yOGE5YWJhZTI4OTYiLAogICAgICAgICAgICAiY3JlYXRlZCI6ICIyMDIzLTA4LTA5VDIxOjEyOjU5LjAwMFoiLAogICAgICAgICAgICAibW9kaWZpZWQiOiAiMjAyMy0wOC0xN1QxOToxOTo0My45ODk0MjlaIiwKICAgICAgICAgICAgIm5hbWUiOiAiTUFSLTEwNDU5NzM2LnIxLnYxIC0gV0hJUkxQT09MIFZhcmlhbnQiLAogICAgICAgICAgICAib2JqZWN0X21hcmtpbmdfcmVmcyI6IFsKICAgICAgICAgICAgICAgICJtYXJraW5nLWRlZmluaXRpb24tLTk0ODY4Yzg5LTgzYzItNDY0Yi05MjliLWExYThhYTNjODQ4NyIKICAgICAgICAgICAgXSwKICAgICAgICAgICAgImRlc2NyaXB0aW9uIjogIkNJU0Egb2J0YWluZWQgYSB2YXJpYW50IG9mIHRoZSBXSElSTFBPT0wgYmFja2Rvb3IuIFRoZSBtYWx3YXJlIHdhcyB1c2VkIGJ5IHRocmVhdCBhY3RvcnMgZXhwbG9pdGluZyBDVkUtMjAyMy0yODY4LCBhIGZvcm1lciB6ZXJvLWRheSB2dWxuZXJhYmlsaXR5IGFmZmVjdGluZyB2ZXJzaW9ucyA1LjEuMy4wMDEtOS4yLjAuMDA2IG9mIEJhcnJhY3VkYSBFbWFpbCBTZWN1cml0eSBHYXRld2F5IChFU0cpLlxyXG5cclxuV0hJUkxQT09MIGlzIGEgYmFja2Rvb3IgdGhhdCBlc3RhYmxpc2hlcyBhIFRyYW5zcG9ydCBMYXllciBTZWN1cml0eSAoVExTKSByZXZlcnNlIHNoZWxsIHRvIHRoZSBDb21tYW5kLWFuZC1Db250cm9sIChDMikgc2VydmVyLlxyXG5cclxuRm9yIGluZm9ybWF0aW9uIGFib3V0IHJlbGF0ZWQgbWFsd2FyZSwgc3BlY2lmaWNhbGx5IGluZm9ybWF0aW9uIG9uIHRoZSBpbml0aWFsIGV4cGxvaXQgcGF5bG9hZCBhbmQgb3RoZXIgYmFja2Rvb3JzLCBzZWUgQ0lTQSBBbGVydDogQ0lTQSBSZWxlYXNlcyBNYWx3YXJlIEFuYWx5c2lzIFJlcG9ydHMgb24gQmFycmFjdWRhIEJhY2tkb29ycy4gICIsCiAgICAgICAgICAgICJyZXBvcnRfdHlwZXMiOiBbCiAgICAgICAgICAgICAgICAib2JzZXJ2ZWQtZGF0YSIsCiAgICAgICAgICAgICAgICAibWFsd2FyZSIsCiAgICAgICAgICAgICAgICAiaW5kaWNhdG9yIgogICAgICAgICAgICBdLAogICAgICAgICAgICAicHVibGlzaGVkIjogIjIwMjMtMDgtMDlUMjE6MTI6NTlaIiwKICAgICAgICAgICAgIm9iamVjdF9yZWZzIjogWwogICAgICAgICAgICAgICAgImlkZW50aXR5LS04ZTExMmU3Mi1hYThmLTQxOTAtYTM1OS0yOGE5YWJhZTI4OTYiLAogICAgICAgICAgICAgICAgImZpbGUtLWVmZDNmZDk4LTZmMWItNTkwZC1iZGQ0LTFlMDc1M2QzYTY4OSIsCiAgICAgICAgICAgICAgICAiaW5kaWNhdG9yLS0zZTVmOGZjMC1kYTFmLTQ3ZjAtOGI2ZS1mNGM0YjAzM2NlNDciLAogICAgICAgICAgICAgICAgIm1hbHdhcmUtYW5hbHlzaXMtLTA3MTQxNTA2LWU5ODktNGEyNS1iNTEwLTc5NzM4M2U5YjAxYSIsCiAgICAgICAgICAgICAgICAibWFsd2FyZS0tNjI2YTI1NDktNTc3NS00M2E4LWI4YmItMmZlMjY4MmE2ZGFlIiwKICAgICAgICAgICAgICAgICJpbmRpY2F0b3ItLTMxNTMyZmMwLWQzZWUtNDc5Zi04NDgyLWE0ZDQ5NzMyZDVhZiIKICAgICAgICAgICAgXQogICAgICAgIH0KICAgIF0KfQ=="
                },
                {
                    "type": "text",
                    "object_relation": "format",
                    "value": "STIX 2.1",
                    "category": "Other",
                    "uuid": "5c4002e7-7313-479e-911e-eb4920d76fc7"
                }
            ],
            "x_misp_meta_category": "file",
            "x_misp_name": "original-imported-file"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--00012474-a0e7-4d07-b4f7-2a507fd15a15",
            "created": "2023-08-25T06:18:51.000Z",
            "modified": "2023-08-25T06:18:51.000Z",
            "relationship_type": "analyses",
            "source_ref": "x-misp-object--07141506-e989-4a25-b510-797383e9b01a",
            "target_ref": "indicator--efd3fd98-6f1b-590d-bdd4-1e0753d3a689"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5905796b-7a63-42a2-a5b8-82ced29c030b",
            "created": "2023-08-25T06:18:51.000Z",
            "modified": "2023-08-25T06:18:51.000Z",
            "relationship_type": "associated-with",
            "source_ref": "indicator--efd3fd98-6f1b-590d-bdd4-1e0753d3a689",
            "target_ref": "x-misp-object--626a2549-5775-43a8-b8bb-2fe2682a6dae"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}