{
    "type": "bundle",
    "id": "bundle--57b585fe-ae40-42d8-bdd7-49d9950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2017-06-22T20:11:19.000Z",
            "modified": "2017-06-22T20:11:19.000Z",
            "name": "CthulhuSPRL.be",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--57b585fe-ae40-42d8-bdd7-49d9950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2017-06-22T20:11:19.000Z",
            "modified": "2017-06-22T20:11:19.000Z",
            "name": "OSINT Vawtrak C2 \u00e2\u20ac\u201c Pin it by Threat Geek",
            "published": "2017-06-22T20:12:45Z",
            "object_refs": [
                "observed-data--57b58612-033c-4c94-a90a-402b950d210f",
                "url--57b58612-033c-4c94-a90a-402b950d210f",
                "indicator--57b5866b-63ec-4650-8f9f-4909950d210f",
                "indicator--57b5866b-aec0-41ff-b3ac-43b4950d210f",
                "indicator--57b5866b-dd50-4a19-90b5-42a9950d210f",
                "indicator--57b5866b-c8fc-4efc-ab3d-440a950d210f",
                "indicator--57b5866c-261c-487a-80ea-4700950d210f",
                "indicator--57b5866c-bd6c-4a3a-9f80-4ca7950d210f",
                "indicator--57b5866c-0e50-4bce-839a-4df0950d210f",
                "indicator--57b5866c-941c-4845-b172-4572950d210f",
                "indicator--57b5866c-da14-4533-903f-4572950d210f",
                "indicator--57b5866d-37c4-4dd4-9d53-4b42950d210f",
                "indicator--57b5866d-4e7c-4acc-8fd2-42b1950d210f",
                "indicator--57b5866d-9ff0-471d-9189-428c950d210f",
                "indicator--57b5866d-9f04-4bab-8ade-444e950d210f",
                "indicator--57b5866d-3b20-44af-a739-4029950d210f",
                "indicator--57b5866d-1e6c-4529-b605-497e950d210f",
                "indicator--57b5866e-da18-45e8-a258-4cc2950d210f",
                "indicator--57b5866e-c158-4caf-8b07-40a7950d210f",
                "indicator--57b5866e-31ac-41cd-b396-4b3f950d210f",
                "observed-data--57b58685-57d4-49f6-8587-4f8c950d210f",
                "url--57b58685-57d4-49f6-8587-4f8c950d210f",
                "observed-data--57b58685-76c8-47d1-ba90-4d86950d210f",
                "url--57b58685-76c8-47d1-ba90-4d86950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "OSINT",
                "misp-galaxy:tool=\"Vawtrak\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57b58612-033c-4c94-a90a-402b950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:55:30.000Z",
            "modified": "2016-08-18T09:55:30.000Z",
            "first_observed": "2016-08-18T09:55:30Z",
            "last_observed": "2016-08-18T09:55:30Z",
            "number_observed": 1,
            "object_refs": [
                "url--57b58612-033c-4c94-a90a-402b950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57b58612-033c-4c94-a90a-402b950d210f",
            "value": "http://www.threatgeek.com/2016/08/vawtrak-trojan-variant-https-c2.html"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866b-63ec-4650-8f9f-4909950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:56:59.000Z",
            "modified": "2016-08-18T09:56:59.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'rsojnear.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:56:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866b-aec0-41ff-b3ac-43b4950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:56:59.000Z",
            "modified": "2016-08-18T09:56:59.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'dmugmwbu.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:56:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866b-dd50-4a19-90b5-42a9950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:56:59.000Z",
            "modified": "2016-08-18T09:56:59.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'kmosszts.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:56:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866b-c8fc-4efc-ab3d-440a950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:56:59.000Z",
            "modified": "2016-08-18T09:56:59.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'xdpnchon.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:56:59Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866c-261c-487a-80ea-4700950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:00.000Z",
            "modified": "2016-08-18T09:57:00.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'hstqothv.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866c-bd6c-4a3a-9f80-4ca7950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:00.000Z",
            "modified": "2016-08-18T09:57:00.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'xafmolog.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866c-0e50-4bce-839a-4df0950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:00.000Z",
            "modified": "2016-08-18T09:57:00.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'hvnmwvdt.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866c-941c-4845-b172-4572950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:00.000Z",
            "modified": "2016-08-18T09:57:00.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'gdxwlrat.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866c-da14-4533-903f-4572950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:00.000Z",
            "modified": "2016-08-18T09:57:00.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'jhxrkeuh.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866d-37c4-4dd4-9d53-4b42950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:01.000Z",
            "modified": "2016-08-18T09:57:01.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'sgtxgkbi.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866d-4e7c-4acc-8fd2-42b1950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:01.000Z",
            "modified": "2016-08-18T09:57:01.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'hzvmnpug.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866d-9ff0-471d-9189-428c950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:01.000Z",
            "modified": "2016-08-18T09:57:01.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'nevlomzj.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866d-9f04-4bab-8ade-444e950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:01.000Z",
            "modified": "2016-08-18T09:57:01.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'ybqojmpa.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866d-3b20-44af-a739-4029950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:01.000Z",
            "modified": "2016-08-18T09:57:01.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'qkgpedwe.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866d-1e6c-4529-b605-497e950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:01.000Z",
            "modified": "2016-08-18T09:57:01.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'xyigqlfc.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:01Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866e-da18-45e8-a258-4cc2950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:02.000Z",
            "modified": "2016-08-18T09:57:02.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'ttliiubl.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866e-c158-4caf-8b07-40a7950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:02.000Z",
            "modified": "2016-08-18T09:57:02.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'qrqlyhfc.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5866e-31ac-41cd-b396-4b3f950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:02.000Z",
            "modified": "2016-08-18T09:57:02.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'enhicefv.ru']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T09:57:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57b58685-57d4-49f6-8587-4f8c950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:25.000Z",
            "modified": "2016-08-18T09:57:25.000Z",
            "first_observed": "2016-08-18T09:57:25Z",
            "last_observed": "2016-08-18T09:57:25Z",
            "number_observed": 1,
            "object_refs": [
                "url--57b58685-57d4-49f6-8587-4f8c950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57b58685-57d4-49f6-8587-4f8c950d210f",
            "value": "https://github.com/fideliscyber/indicators/tree/master/Blogs/Vawtrak%20C2%20-%20Pin%20it"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57b58685-76c8-47d1-ba90-4d86950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T09:57:25.000Z",
            "modified": "2016-08-18T09:57:25.000Z",
            "first_observed": "2016-08-18T09:57:25Z",
            "last_observed": "2016-08-18T09:57:25Z",
            "number_observed": 1,
            "object_refs": [
                "url--57b58685-76c8-47d1-ba90-4d86950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57b58685-76c8-47d1-ba90-4d86950d210f",
            "value": "https://github.com/fideliscyber/indicators/blob/master/dga-scripts/vawtrak-dga.py"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}