{
    "type": "bundle",
    "id": "bundle--5d5fb3ac-ae54-42d3-9fe7-4d65950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:59:16.000Z",
            "modified": "2019-08-23T09:59:16.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5d5fb3ac-ae54-42d3-9fe7-4d65950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:59:16.000Z",
            "modified": "2019-08-23T09:59:16.000Z",
            "name": "OSINT - Emotet is back",
            "published": "2019-08-23T10:00:21Z",
            "object_refs": [
                "indicator--5d5fb3c2-d6e0-4095-9993-4c97950d210f",
                "indicator--5d5fb3c2-5990-4b73-8048-4ea4950d210f",
                "indicator--5d5fb3c2-31c0-4be9-ba1e-4e88950d210f",
                "indicator--5d5fb3c2-7310-4300-a2c4-4b28950d210f",
                "indicator--5d5fb3c2-c9e0-44a3-9555-4697950d210f",
                "indicator--5d5fb3c2-d334-4057-95b6-492a950d210f",
                "indicator--5d5fb3c2-561c-42d1-bd6a-45a9950d210f",
                "indicator--5d5fb3c3-5cd0-4800-94ee-4ba9950d210f",
                "indicator--5d5fb3c3-5f68-465e-8cd0-4a51950d210f",
                "indicator--5d5fb3c3-a218-4ed7-8fdc-4335950d210f",
                "indicator--5d5fb3c3-e0c4-4972-84b4-4d0b950d210f",
                "indicator--5d5fb3c3-fc90-407f-a872-432d950d210f",
                "indicator--5d5fb3c3-b0f8-4c12-8a49-4f67950d210f",
                "indicator--5d5fb3c3-af24-45fc-a5cb-4f46950d210f",
                "indicator--5d5fb3c3-b57c-4cbb-9fd2-4656950d210f",
                "indicator--5d5fb3c4-40e0-43cf-81d5-4c7f950d210f",
                "indicator--5d5fb3c4-7894-4619-adff-4671950d210f",
                "indicator--5d5fb3c4-3e94-4a12-b058-4323950d210f",
                "indicator--5d5fb3c4-bb1c-4558-8b00-4c11950d210f",
                "indicator--5d5fb3c4-6584-4403-a760-4cd1950d210f",
                "indicator--5d5fb3c4-79e8-4334-9903-423f950d210f",
                "indicator--5d5fb3c4-138c-4d34-a862-4c82950d210f",
                "indicator--5d5fb3c4-d820-4140-a769-4718950d210f",
                "indicator--5d5fb3c4-7778-4691-9d87-4f86950d210f",
                "indicator--5d5fb3c4-0420-4c80-a6c3-42eb950d210f",
                "observed-data--5d5fb3db-706c-4b79-a949-492d950d210f",
                "url--5d5fb3db-706c-4b79-a949-492d950d210f",
                "observed-data--5d5fb403-4d9c-4908-b127-4bec950d210f",
                "url--5d5fb403-4d9c-4908-b127-4bec950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT",
                "osint:lifetime=\"perpetual\"",
                "osint:certainty=\"50\"",
                "misp-galaxy:banker=\"Geodo\"",
                "circl:topic=\"finance\"",
                "adversary:infrastructure-action=\"take-down\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c2-d6e0-4095-9993-4c97950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:06.000Z",
            "modified": "2019-08-23T09:37:06.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.131.11.150' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c2-5990-4b73-8048-4ea4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:06.000Z",
            "modified": "2019-08-23T09:37:06.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.131.208.175' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c2-31c0-4be9-ba1e-4e88950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:06.000Z",
            "modified": "2019-08-23T09:37:06.000Z",
            "description": "On port 7080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.236.151.95' AND network-traffic:dst_port = '7080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c2-7310-4300-a2c4-4b28950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:06.000Z",
            "modified": "2019-08-23T09:37:06.000Z",
            "description": "On port 443",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '142.93.88.16' AND network-traffic:dst_port = '443']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c2-c9e0-44a3-9555-4697950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:06.000Z",
            "modified": "2019-08-23T09:37:06.000Z",
            "description": "On port 80",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '144.139.247.220' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c2-d334-4057-95b6-492a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:06.000Z",
            "modified": "2019-08-23T09:37:06.000Z",
            "description": "On port 7080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '159.89.179.87' AND network-traffic:dst_port = '7080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c2-561c-42d1-bd6a-45a9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:06.000Z",
            "modified": "2019-08-23T09:37:06.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '162.144.119.216' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c3-5cd0-4800-94ee-4ba9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:07.000Z",
            "modified": "2019-08-23T09:37:07.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '162.243.125.212' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c3-5f68-465e-8cd0-4a51950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:07.000Z",
            "modified": "2019-08-23T09:37:07.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '170.150.11.245' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c3-a218-4ed7-8fdc-4335950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:07.000Z",
            "modified": "2019-08-23T09:37:07.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.31.200.130' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c3-e0c4-4972-84b4-4d0b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:07.000Z",
            "modified": "2019-08-23T09:37:07.000Z",
            "description": "On port 80",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '177.242.214.30' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c3-fc90-407f-a872-432d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:07.000Z",
            "modified": "2019-08-23T09:37:07.000Z",
            "description": "On port 22",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '187.163.180.243' AND network-traffic:dst_port = '22']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c3-b0f8-4c12-8a49-4f67950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:07.000Z",
            "modified": "2019-08-23T09:37:07.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.242.117.231' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c3-af24-45fc-a5cb-4f46950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:07.000Z",
            "modified": "2019-08-23T09:37:07.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '216.98.148.156' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c3-b57c-4cbb-9fd2-4656950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:07.000Z",
            "modified": "2019-08-23T09:37:07.000Z",
            "description": "On port 7080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '217.13.106.160' AND network-traffic:dst_port = '7080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c4-40e0-43cf-81d5-4c7f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:08.000Z",
            "modified": "2019-08-23T09:37:08.000Z",
            "description": "On port 7080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.12.67.62' AND network-traffic:dst_port = '7080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c4-7894-4619-adff-4671950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:08.000Z",
            "modified": "2019-08-23T09:37:08.000Z",
            "description": "On port 443",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '45.123.3.54' AND network-traffic:dst_port = '443']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c4-3e94-4a12-b058-4323950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:08.000Z",
            "modified": "2019-08-23T09:37:08.000Z",
            "description": "On port 7080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '45.32.158.232' AND network-traffic:dst_port = '7080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c4-bb1c-4558-8b00-4c11950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:08.000Z",
            "modified": "2019-08-23T09:37:08.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.101.142.115' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c4-6584-4403-a760-4cd1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:08.000Z",
            "modified": "2019-08-23T09:37:08.000Z",
            "description": "On port 443",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.105.131.69' AND network-traffic:dst_port = '443']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c4-79e8-4334-9903-423f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:08.000Z",
            "modified": "2019-08-23T09:37:08.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '64.13.225.150' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c4-138c-4d34-a862-4c82950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:08.000Z",
            "modified": "2019-08-23T09:37:08.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '69.45.19.145' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c4-d820-4140-a769-4718950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:08.000Z",
            "modified": "2019-08-23T09:37:08.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '70.32.84.74' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c4-7778-4691-9d87-4f86950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:08.000Z",
            "modified": "2019-08-23T09:37:08.000Z",
            "description": "On port 8080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '75.127.14.170' AND network-traffic:dst_port = '8080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5d5fb3c4-0420-4c80-a6c3-42eb950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:08.000Z",
            "modified": "2019-08-23T09:37:08.000Z",
            "description": "On port 7080",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.83.93.103' AND network-traffic:dst_port = '7080']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-08-23T09:37:08Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5d5fb3db-706c-4b79-a949-492d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:37:31.000Z",
            "modified": "2019-08-23T09:37:31.000Z",
            "first_observed": "2019-08-23T09:37:31Z",
            "last_observed": "2019-08-23T09:37:31Z",
            "number_observed": 1,
            "object_refs": [
                "url--5d5fb3db-706c-4b79-a949-492d950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5d5fb3db-706c-4b79-a949-492d950d210f",
            "value": "https://pastebin.com/raw/7Kq2e1ik"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5d5fb403-4d9c-4908-b127-4bec950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-08-23T09:38:11.000Z",
            "modified": "2019-08-23T09:38:11.000Z",
            "first_observed": "2019-08-23T09:38:11Z",
            "last_observed": "2019-08-23T09:38:11Z",
            "number_observed": 1,
            "object_refs": [
                "url--5d5fb403-4d9c-4908-b127-4bec950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5d5fb403-4d9c-4908-b127-4bec950d210f",
            "value": "https://github.com/blacklotuslabs/Research/blob/master/Emotet_Active_C2_08_22_19.txt"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}