{
    "type": "bundle",
    "id": "bundle--5902f92f-c7f4-4bac-97b5-4fa6950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-01T14:06:20.000Z",
            "modified": "2017-05-01T14:06:20.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5902f92f-c7f4-4bac-97b5-4fa6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-01T14:06:20.000Z",
            "modified": "2017-05-01T14:06:20.000Z",
            "name": "OSINT - OSX Malware is Catching Up, and it wants to Read Your HTTPS Traffic",
            "published": "2017-05-01T16:00:44Z",
            "object_refs": [
                "observed-data--5902f954-0db0-4d9d-a555-4d97950d210f",
                "url--5902f954-0db0-4d9d-a555-4d97950d210f",
                "x-misp-attribute--5902f975-ae78-4b08-b64a-4b1f950d210f",
                "indicator--5902f9a0-f6f4-41d2-913c-4735950d210f",
                "indicator--5902f9a1-83bc-4b26-a3cb-4afe950d210f",
                "indicator--5902f9b8-b51c-4ac6-becc-469b950d210f",
                "indicator--5902f9b9-5a64-4066-9444-4cde950d210f",
                "x-misp-attribute--5902f9c4-2894-44b3-91f5-4543950d210f",
                "indicator--5902fa65-bddc-4ac4-bea4-03df950d210f",
                "indicator--5902fadc-82c0-438a-9296-4d6102de0b81",
                "indicator--5902fadc-0324-4206-acb1-4c1402de0b81",
                "observed-data--5902fadd-cf48-423b-8791-45c202de0b81",
                "url--5902fadd-cf48-423b-8791-45c202de0b81",
                "indicator--5902fadd-fe44-479f-a3ec-4c2802de0b81",
                "indicator--5902fade-b7f0-4e54-a31c-439802de0b81",
                "observed-data--5902fade-a3d8-4f52-908f-4ad002de0b81",
                "url--5902fade-a3d8-4f52-908f-4ad002de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "osint:source-type=\"blog-post\"",
                "ms-caro-malware:malware-platform=\"MacOS_X\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5902f954-0db0-4d9d-a555-4d97950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:33.000Z",
            "modified": "2017-04-28T08:18:33.000Z",
            "first_observed": "2017-04-28T08:18:33Z",
            "last_observed": "2017-04-28T08:18:33Z",
            "number_observed": 1,
            "object_refs": [
                "url--5902f954-0db0-4d9d-a555-4d97950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\"",
                "admiralty-scale:source-reliability=\"b\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5902f954-0db0-4d9d-a555-4d97950d210f",
            "value": "http://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5902f975-ae78-4b08-b64a-4b1f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-05-01T14:06:20.000Z",
            "modified": "2017-05-01T14:06:20.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\"",
                "misp:to_ids=\"True\"",
                "osint:source-type=\"blog-post\"",
                "admiralty-scale:source-reliability=\"b\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "People often assume that if you\u00e2\u20ac\u2122re running OSX, you\u00e2\u20ac\u2122re relatively safe from malware. But this is becoming less and less true, as evidenced by a new strain of malware encountered by the Check Point malware research team. This new malware \u00e2\u20ac\u201c dubbed OSX/Dok \u00e2\u20ac\u201d affects all versions of OSX, has 0 detections on VirusTotal (as of the writing of these words), is signed with a valid developer certificate (authenticated by Apple), and is the first major scale malware to target OSX users via a coordinated email phishing campaign.\r\n\r\nOnce OSX/Dok infection is complete, the attackers gain complete access to all victim communication, including communication encrypted by SSL. This is done by redirecting victim traffic through a malicious proxy server.\r\n\r\nThe malware mostly targets European users. For instance, one phishing message was observed to target a user in Germany by baiting the user with a message regarding supposed inconsistencies in their tax returns (see image, and translation, below)."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5902f9a0-f6f4-41d2-913c-4735950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:33.000Z",
            "modified": "2017-04-28T08:18:33.000Z",
            "description": "Sample",
            "pattern": "[file:hashes.SHA256 = '7819ae7d72fa045baa77e9c8e063a69df439146b27f9c3bb10aef52dcc77c145']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-04-28T08:18:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5902f9a1-83bc-4b26-a3cb-4afe950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:33.000Z",
            "modified": "2017-04-28T08:18:33.000Z",
            "description": "Sample",
            "pattern": "[file:hashes.SHA256 = '4131d4737fe8dfe66d407bfd0a0df18a4a77b89347471cc012da8efc93c661a5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-04-28T08:18:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5902f9b8-b51c-4ac6-becc-469b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:33.000Z",
            "modified": "2017-04-28T08:18:33.000Z",
            "description": "LaunchAgent:",
            "pattern": "[file:name = '/Users/training/Library/LaunchAgents/com.apple.Safari.proxy.plist']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-04-28T08:18:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5902f9b9-5a64-4066-9444-4cde950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:33.000Z",
            "modified": "2017-04-28T08:18:33.000Z",
            "description": "LaunchAgent:",
            "pattern": "[file:name = '/Users/training/Library/LaunchAgents/com.apple.Safari.proxy.pac']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-04-28T08:18:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5902f9c4-2894-44b3-91f5-4543950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:33.000Z",
            "modified": "2017-04-28T08:18:33.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Antivirus detection\""
            ],
            "x_misp_category": "Antivirus detection",
            "x_misp_type": "text",
            "x_misp_value": "Trojan.OSX.DOK"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5902fa65-bddc-4ac4-bea4-03df950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:33.000Z",
            "modified": "2017-04-28T08:18:33.000Z",
            "pattern": "[domain-name:value = 'paoyu7gub72lykuk.onion']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-04-28T08:18:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5902fadc-82c0-438a-9296-4d6102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:36.000Z",
            "modified": "2017-04-28T08:18:36.000Z",
            "description": "Sample - Xchecked via VT: 4131d4737fe8dfe66d407bfd0a0df18a4a77b89347471cc012da8efc93c661a5",
            "pattern": "[file:hashes.SHA1 = 'd9685bea995e57ae89d10122cb76022554179ff7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-04-28T08:18:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5902fadc-0324-4206-acb1-4c1402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:36.000Z",
            "modified": "2017-04-28T08:18:36.000Z",
            "description": "Sample - Xchecked via VT: 4131d4737fe8dfe66d407bfd0a0df18a4a77b89347471cc012da8efc93c661a5",
            "pattern": "[file:hashes.MD5 = '14c1cd9c5f263d5ba988838e0c3e3cf6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-04-28T08:18:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5902fadd-cf48-423b-8791-45c202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:37.000Z",
            "modified": "2017-04-28T08:18:37.000Z",
            "first_observed": "2017-04-28T08:18:37Z",
            "last_observed": "2017-04-28T08:18:37Z",
            "number_observed": 1,
            "object_refs": [
                "url--5902fadd-cf48-423b-8791-45c202de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5902fadd-cf48-423b-8791-45c202de0b81",
            "value": "https://www.virustotal.com/file/4131d4737fe8dfe66d407bfd0a0df18a4a77b89347471cc012da8efc93c661a5/analysis/1493364891/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5902fadd-fe44-479f-a3ec-4c2802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:37.000Z",
            "modified": "2017-04-28T08:18:37.000Z",
            "description": "Sample - Xchecked via VT: 7819ae7d72fa045baa77e9c8e063a69df439146b27f9c3bb10aef52dcc77c145",
            "pattern": "[file:hashes.SHA1 = 'f5d3425482dc4f4f738277ff3ba315b496894899']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-04-28T08:18:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5902fade-b7f0-4e54-a31c-439802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:38.000Z",
            "modified": "2017-04-28T08:18:38.000Z",
            "description": "Sample - Xchecked via VT: 7819ae7d72fa045baa77e9c8e063a69df439146b27f9c3bb10aef52dcc77c145",
            "pattern": "[file:hashes.MD5 = 'e8bdde90574d5bf285d9abb0c8a113a8']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-04-28T08:18:38Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5902fade-a3d8-4f52-908f-4ad002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-04-28T08:18:38.000Z",
            "modified": "2017-04-28T08:18:38.000Z",
            "first_observed": "2017-04-28T08:18:38Z",
            "last_observed": "2017-04-28T08:18:38Z",
            "number_observed": 1,
            "object_refs": [
                "url--5902fade-a3d8-4f52-908f-4ad002de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5902fade-a3d8-4f52-908f-4ad002de0b81",
            "value": "https://www.virustotal.com/file/7819ae7d72fa045baa77e9c8e063a69df439146b27f9c3bb10aef52dcc77c145/analysis/1493364722/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}