{
    "type": "bundle",
    "id": "bundle--5ab38840-3960-4b05-b391-4dd7950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:33:42.000Z",
            "modified": "2018-03-23T09:33:42.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "grouping",
            "spec_version": "2.1",
            "id": "grouping--5ab38840-3960-4b05-b391-4dd7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:33:42.000Z",
            "modified": "2018-03-23T09:33:42.000Z",
            "name": "OSINT - Malicious applications stayed at Google Appstore for months",
            "context": "suspicious-activity",
            "object_refs": [
                "observed-data--5ab38865-2bf4-47ff-bed8-4cd4950d210f",
                "url--5ab38865-2bf4-47ff-bed8-4cd4950d210f",
                "x-misp-attribute--5ab4c44e-68e0-4c6b-a64b-4e95950d210f",
                "indicator--5ab4c654-02e8-4593-a7b0-469e950d210f",
                "indicator--5ab4c66d-2c44-4d7b-ac13-442f950d210f",
                "indicator--5ab4c7f7-a8e0-4032-a804-4d10950d210f",
                "indicator--5ab4c7f7-4b34-447f-b729-490a950d210f",
                "indicator--5ab4c7f7-e1d0-4f47-87b0-4aff950d210f",
                "indicator--5ab4c7f7-b048-4be2-a6a6-406b950d210f",
                "indicator--5ab4c7f7-81e0-4f35-ab10-44ea950d210f",
                "indicator--5ab4c7f7-6d40-409f-be23-47bd950d210f",
                "indicator--5ab4c7f7-e5a4-4492-bf54-4556950d210f",
                "indicator--5ab4c7f7-64ac-4a3e-846f-42a5950d210f",
                "indicator--5ab4c7f7-1854-4560-b54d-4b2e950d210f",
                "indicator--5ab4c7f7-5be0-413c-94e7-431b950d210f",
                "indicator--5ab4c7f7-4934-4ff5-b997-4c18950d210f",
                "indicator--5ab4c7f7-5884-4c0c-94f1-4c8d950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "Android Malware",
                "ms-caro-malware-full:malware-platform=\"AndroidOS\"",
                "osint:source-type=\"blog-post\"",
                "workflow:todo=\"create-missing-misp-galaxy-cluster-values\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5ab38865-2bf4-47ff-bed8-4cd4950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:09:57.000Z",
            "modified": "2018-03-23T09:09:57.000Z",
            "first_observed": "2018-03-23T09:09:57Z",
            "last_observed": "2018-03-23T09:09:57Z",
            "number_observed": 1,
            "object_refs": [
                "url--5ab38865-2bf4-47ff-bed8-4cd4950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5ab38865-2bf4-47ff-bed8-4cd4950d210f",
            "value": "https://blog.fosec.vn/malicious-applications-stayed-at-google-appstore-for-months-d8834ff4de59"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5ab4c44e-68e0-4c6b-a64b-4e95950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:09:48.000Z",
            "modified": "2018-03-23T09:09:48.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "comment",
            "x_misp_value": "According to estimates from downloads, at least 640,000 and at most 2.6 million Android subscribers have been infected with this malicious code. If the subscription price is just 0.1$/day, then every day the subscriber was hooked 64.000$-260.000$, so no one knows how many USD a year."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c654-02e8-4593-a7b0-469e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:18:12.000Z",
            "modified": "2018-03-23T09:18:12.000Z",
            "description": "C&C",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '139.162.12.9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:18:12Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c66d-2c44-4d7b-ac13-442f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:18:37.000Z",
            "modified": "2018-03-23T09:18:37.000Z",
            "pattern": "[url:value = 'gamestore.vn/?page=wapreg&mm=2201']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:18:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-a8e0-4032-a804-4d10950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'vn.lichvannien.lichamduongvietnam']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-4b34-447f-b729-490a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.antivirus.virusremover.security']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-e1d0-4f47-87b0-4aff950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.weatherforecast.weatherwidget']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-b048-4be2-a6a6-406b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.captain.qrcodescanner.barcodescannerreader']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-81e0-4f35-ab10-44ea950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.captainstudio.musicplayerandvideoplayer']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-6d40-409f-be23-47bd950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.captain.lovebyte.lovedaycounter']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-e5a4-4492-bf54-4556950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.captain.callrecorder']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-64ac-4a3e-846f-42a5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.crackscreen.prankscreencrack']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-1854-4560-b54d-4b2e950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.weed.assistivetouch.easytouch']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-5be0-413c-94e7-431b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.hidepicturesandvideos.applocker']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-4934-4ff5-b997-4c18950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.cameraselfie.filtercamera']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ab4c7f7-5884-4c0c-94f1-4c8d950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-03-23T09:25:11.000Z",
            "modified": "2018-03-23T09:25:11.000Z",
            "pattern": "[file:name = 'com.memorycleaner.speedbooster.memorybooster']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-03-23T09:25:11Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}