{
    "type": "bundle",
    "id": "bundle--5dc3249f-6ebc-44fd-b78d-448d02de0b81",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T20:00:02.000Z",
            "modified": "2019-11-06T20:00:02.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5dc3249f-6ebc-44fd-b78d-448d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T20:00:02.000Z",
            "modified": "2019-11-06T20:00:02.000Z",
            "name": "OSINT - BitPaymer Source Code Fork: Meet DoppelPaymer Ransomware and Dridex 2.0",
            "published": "2019-11-06T20:02:52Z",
            "object_refs": [
                "indicator--5dc324da-8930-4832-84ae-428102de0b81",
                "indicator--5dc324da-3aa8-4672-a5c8-461502de0b81",
                "indicator--5dc324da-4734-4603-be54-44eb02de0b81",
                "indicator--5dc324da-7284-4a03-880f-4c9d02de0b81",
                "indicator--5dc324da-eef0-4d5e-bc21-4c5402de0b81",
                "indicator--5dc324da-7f9c-4659-abea-402a02de0b81",
                "x-misp-attribute--5dc32571-aa74-4179-8f74-42bc02de0b81",
                "indicator--5dc325b9-7018-496a-b223-4b7602de0b81",
                "indicator--5dc325b9-a748-403f-abcc-428c02de0b81",
                "observed-data--5dc325e5-6214-4a8f-bf43-441102de0b81",
                "url--5dc325e5-6214-4a8f-bf43-441102de0b81",
                "indicator--bca0440a-4555-4587-b5a2-a541bd2a4dc9",
                "x-misp-object--b9af0b6b-5e5d-43a1-84c7-21e1357665f1",
                "indicator--9ae6b1c8-d364-4e47-acf7-f6730fb4465c",
                "x-misp-object--b440661e-36e3-4b91-86ff-fa8760b84317",
                "indicator--756d7b88-3347-4a0c-9fef-01dbddfd34bb",
                "x-misp-object--6d1c9b11-06c8-4813-9485-89269e343f91",
                "indicator--c04e4714-a1ca-4318-98d3-a46cf6d6ad97",
                "x-misp-object--e943e2d5-8dec-4e03-8469-ee47c09f2568",
                "indicator--2a17501a-3480-46f0-b0bd-5888c2ee8c92",
                "x-misp-object--7fb41421-37ea-4910-ac68-319d59bdcbad",
                "indicator--25d7c94e-5aad-4634-878d-15010c84f0aa",
                "x-misp-object--f10bc385-bc29-4069-8374-abc49782561a",
                "relationship--d741a727-322c-4637-930f-80edfb2ad847",
                "relationship--22408634-ee41-4ea2-b767-2f2a9879772a",
                "relationship--dbe0e066-4162-43e6-a951-89ab2e50892d",
                "relationship--c4405d26-6b1e-4c59-826a-7acb5fcf4f77",
                "relationship--c64db77e-c64d-4e88-ae51-61eb118343f9",
                "relationship--1c9e16db-d688-4121-8a64-7d72594ae13c"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "misp-galaxy:malpedia=\"Dridex\"",
                "misp-galaxy:malpedia=\"FriedEx\"",
                "misp-galaxy:ransomware=\"Bitpaymer\"",
                "misp-galaxy:threat-actor=\"INDRIK SPIDER\"",
                "type:OSINT",
                "osint:lifetime=\"perpetual\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5dc324da-8930-4832-84ae-428102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:54:02.000Z",
            "modified": "2019-11-06T19:54:02.000Z",
            "description": "Encrypted PE Files Embedded in DoppelPaymer",
            "pattern": "[file:hashes.SHA256 = '51d8618ec86159327e883615ad8989c7638172cf801f65ab0367e5b2e6af596a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:54:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5dc324da-3aa8-4672-a5c8-461502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:54:02.000Z",
            "modified": "2019-11-06T19:54:02.000Z",
            "description": "Encrypted PE Files Embedded in DoppelPaymer",
            "pattern": "[file:hashes.SHA256 = 'd4a0fe56316a2c45b9ba9ac1005363309a3edc7acf9e4df64d326a0ff273e80f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:54:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5dc324da-4734-4603-be54-44eb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:54:02.000Z",
            "modified": "2019-11-06T19:54:02.000Z",
            "description": "Encrypted PE Files Embedded in DoppelPaymer",
            "pattern": "[file:hashes.SHA256 = '0f97f6d53fff47914174bc3a05fb016e2c02ed0b43c827e5e5aadba2d244aecc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:54:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5dc324da-7284-4a03-880f-4c9d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:54:02.000Z",
            "modified": "2019-11-06T19:54:02.000Z",
            "description": "Encrypted PE Files Embedded in DoppelPaymer",
            "pattern": "[file:hashes.SHA256 = 'bfb7e62ba4ad5975e68a1beefb045cb72e056911fd7a8b070a15029dfcbbefe1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:54:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5dc324da-eef0-4d5e-bc21-4c5402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:54:02.000Z",
            "modified": "2019-11-06T19:54:02.000Z",
            "description": "Encrypted PE Files Embedded in DoppelPaymer",
            "pattern": "[file:hashes.SHA256 = 'bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:54:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5dc324da-7f9c-4659-abea-402a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:54:02.000Z",
            "modified": "2019-11-06T19:54:02.000Z",
            "description": "Encrypted PE Files Embedded in DoppelPaymer",
            "pattern": "[file:hashes.SHA256 = '70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:54:02Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5dc32571-aa74-4179-8f74-42bc02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:56:33.000Z",
            "modified": "2019-11-06T19:56:33.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "CrowdStrike\u00c2\u00ae Intelligence has identified a new ransomware variant identifying itself as BitPaymer. This new variant was behind a series of ransomware campaigns beginning in June 2019, including attacks against the City of Edcouch, Texas and the Chilean Ministry of Agriculture. \r\n\r\nWe have dubbed this new ransomware DoppelPaymer because it shares most of its code with the BitPaymer ransomware operated by INDRIK SPIDER. However, there are a number of differences between DoppelPaymer and BitPaymer, which may signify that one or more members of INDRIK SPIDER have split from the group and forked the source code of both Dridex and BitPaymer to start their own Big Game Hunting ransomware operation."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5dc325b9-7018-496a-b223-4b7602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:57:45.000Z",
            "modified": "2019-11-06T19:57:45.000Z",
            "description": "DoppelPaymer",
            "pattern": "[file:hashes.SHA256 = '801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:57:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5dc325b9-a748-403f-abcc-428c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:57:45.000Z",
            "modified": "2019-11-06T19:57:45.000Z",
            "description": "Dridex 2.0",
            "pattern": "[file:hashes.SHA256 = '813d8020f32fefe01b66bea0ce63834adef2e725801b4b761f5ea90ac4facd3a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:57:45Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5dc325e5-6214-4a8f-bf43-441102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:58:29.000Z",
            "modified": "2019-11-06T19:58:29.000Z",
            "first_observed": "2019-11-06T19:58:29Z",
            "last_observed": "2019-11-06T19:58:29Z",
            "number_observed": 1,
            "object_refs": [
                "url--5dc325e5-6214-4a8f-bf43-441102de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5dc325e5-6214-4a8f-bf43-441102de0b81",
            "value": "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--bca0440a-4555-4587-b5a2-a541bd2a4dc9",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:15.000Z",
            "modified": "2019-11-06T19:59:15.000Z",
            "pattern": "[file:hashes.MD5 = '1b5c3c458e31bede55145d0644e88d75' AND file:hashes.SHA1 = 'a21c84c6bf2e21d69fa06daaf19b4cc34b589347' AND file:hashes.SHA256 = '70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:59:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--b9af0b6b-5e5d-43a1-84c7-21e1357665f1",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:15.000Z",
            "modified": "2019-11-06T19:59:15.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-11-05T13:32:39",
                    "category": "Other",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "590eabf8-daae-48fa-93f7-a6881b74188d"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4/analysis/1572960759/",
                    "category": "Payload delivery",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "7de0a36e-6553-4bca-b8f3-2496fa7c6ae6"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "15/71",
                    "category": "Payload delivery",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "28dc293f-7fb7-49e5-9c3e-8bee49d6f3b2"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--9ae6b1c8-d364-4e47-acf7-f6730fb4465c",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:15.000Z",
            "modified": "2019-11-06T19:59:15.000Z",
            "pattern": "[file:hashes.MD5 = '68f9b52895f4d34e74112f3129b3b00d' AND file:hashes.SHA1 = 'c5e2018bf7c0f314fed4fd7fe7e69fa2e648359e' AND file:hashes.SHA256 = 'd4a0fe56316a2c45b9ba9ac1005363309a3edc7acf9e4df64d326a0ff273e80f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:59:15Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--b440661e-36e3-4b91-86ff-fa8760b84317",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:16.000Z",
            "modified": "2019-11-06T19:59:16.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-11-05T15:07:41",
                    "category": "Other",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "2d422e88-d201-4694-bbd7-866a38115bf8"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/d4a0fe56316a2c45b9ba9ac1005363309a3edc7acf9e4df64d326a0ff273e80f/analysis/1572966461/",
                    "category": "Payload delivery",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "3e29cdd3-6698-46ac-a2e0-37658066a1a7"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "17/71",
                    "category": "Payload delivery",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "4d55f6ac-dcd5-4ac6-8eca-d33081e4708a"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--756d7b88-3347-4a0c-9fef-01dbddfd34bb",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:16.000Z",
            "modified": "2019-11-06T19:59:16.000Z",
            "pattern": "[file:hashes.MD5 = '6365fe1d37545c71cbe2719ac7831bdd' AND file:hashes.SHA1 = '9356d660cebd2604ec4e72967f44678741331d5a' AND file:hashes.SHA256 = '0f97f6d53fff47914174bc3a05fb016e2c02ed0b43c827e5e5aadba2d244aecc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:59:16Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--6d1c9b11-06c8-4813-9485-89269e343f91",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:17.000Z",
            "modified": "2019-11-06T19:59:17.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-11-04T12:24:35",
                    "category": "Other",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "2087010a-da8e-4132-b113-308e02d41f06"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/0f97f6d53fff47914174bc3a05fb016e2c02ed0b43c827e5e5aadba2d244aecc/analysis/1572870275/",
                    "category": "Payload delivery",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "d1cd1211-5d23-4442-94c1-6973a0b3e6cf"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "14/70",
                    "category": "Payload delivery",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "72338110-8f9a-4c07-ab93-d926bbe4fe0e"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--c04e4714-a1ca-4318-98d3-a46cf6d6ad97",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:17.000Z",
            "modified": "2019-11-06T19:59:17.000Z",
            "pattern": "[file:hashes.MD5 = '47bc14f741779c3a7450adeeb66bb7e8' AND file:hashes.SHA1 = '980842b405d6df5385503044e102ad4a5d8b8573' AND file:hashes.SHA256 = '813d8020f32fefe01b66bea0ce63834adef2e725801b4b761f5ea90ac4facd3a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:59:17Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--e943e2d5-8dec-4e03-8469-ee47c09f2568",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:17.000Z",
            "modified": "2019-11-06T19:59:17.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-11-04T12:37:45",
                    "category": "Other",
                    "comment": "Dridex 2.0",
                    "uuid": "4bd2567e-f3c3-4af6-8878-5cebbb3ee30f"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/813d8020f32fefe01b66bea0ce63834adef2e725801b4b761f5ea90ac4facd3a/analysis/1572871065/",
                    "category": "Payload delivery",
                    "comment": "Dridex 2.0",
                    "uuid": "f70fc547-6175-4e7d-aa3c-09fdcae120b9"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "54/69",
                    "category": "Payload delivery",
                    "comment": "Dridex 2.0",
                    "uuid": "094fb53d-08d6-44e0-9a00-ca0890f5175d"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2a17501a-3480-46f0-b0bd-5888c2ee8c92",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:18.000Z",
            "modified": "2019-11-06T19:59:18.000Z",
            "pattern": "[file:hashes.MD5 = '9141d1d189afc2e300121e71a211c925' AND file:hashes.SHA1 = 'ee5ac27425616878a932516000c04dedbde5b715' AND file:hashes.SHA256 = '801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:59:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--7fb41421-37ea-4910-ac68-319d59bdcbad",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:18.000Z",
            "modified": "2019-11-06T19:59:18.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-11-04T23:59:41",
                    "category": "Other",
                    "comment": "DoppelPaymer",
                    "uuid": "0bb87c96-21b6-4b12-997c-d8e329e3678d"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b/analysis/1572911981/",
                    "category": "Payload delivery",
                    "comment": "DoppelPaymer",
                    "uuid": "556bfa2e-6a6d-405a-a050-051f2ba65972"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "54/68",
                    "category": "Payload delivery",
                    "comment": "DoppelPaymer",
                    "uuid": "26ceb39d-61ca-4f10-a6d9-d565989705e2"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--25d7c94e-5aad-4634-878d-15010c84f0aa",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:18.000Z",
            "modified": "2019-11-06T19:59:18.000Z",
            "pattern": "[file:hashes.MD5 = 'b365af317ae730a67c936f21432b9c71' AND file:hashes.SHA1 = 'a0bdfac3ce1880b32ff9b696458327ce352e3b1d' AND file:hashes.SHA256 = 'bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-11-06T19:59:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--f10bc385-bc29-4069-8374-abc49782561a",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2019-11-06T19:59:18.000Z",
            "modified": "2019-11-06T19:59:18.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2019-11-05T08:08:47",
                    "category": "Other",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "35be71bd-7536-4d04-8ef0-608d868fe3ce"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4/analysis/1572941327/",
                    "category": "Payload delivery",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "5d316b72-97a1-4935-bf13-366b77f8c6fd"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "17/71",
                    "category": "Payload delivery",
                    "comment": "Encrypted PE Files Embedded in DoppelPaymer",
                    "uuid": "1d009b4d-d054-4cbe-bef2-6d8b6d5e9112"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d741a727-322c-4637-930f-80edfb2ad847",
            "created": "2019-11-06T19:59:18.000Z",
            "modified": "2019-11-06T19:59:18.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--bca0440a-4555-4587-b5a2-a541bd2a4dc9",
            "target_ref": "x-misp-object--b9af0b6b-5e5d-43a1-84c7-21e1357665f1"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--22408634-ee41-4ea2-b767-2f2a9879772a",
            "created": "2019-11-06T19:59:19.000Z",
            "modified": "2019-11-06T19:59:19.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--9ae6b1c8-d364-4e47-acf7-f6730fb4465c",
            "target_ref": "x-misp-object--b440661e-36e3-4b91-86ff-fa8760b84317"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--dbe0e066-4162-43e6-a951-89ab2e50892d",
            "created": "2019-11-06T19:59:19.000Z",
            "modified": "2019-11-06T19:59:19.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--756d7b88-3347-4a0c-9fef-01dbddfd34bb",
            "target_ref": "x-misp-object--6d1c9b11-06c8-4813-9485-89269e343f91"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c4405d26-6b1e-4c59-826a-7acb5fcf4f77",
            "created": "2019-11-06T19:59:19.000Z",
            "modified": "2019-11-06T19:59:19.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--c04e4714-a1ca-4318-98d3-a46cf6d6ad97",
            "target_ref": "x-misp-object--e943e2d5-8dec-4e03-8469-ee47c09f2568"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c64db77e-c64d-4e88-ae51-61eb118343f9",
            "created": "2019-11-06T19:59:19.000Z",
            "modified": "2019-11-06T19:59:19.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--2a17501a-3480-46f0-b0bd-5888c2ee8c92",
            "target_ref": "x-misp-object--7fb41421-37ea-4910-ac68-319d59bdcbad"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1c9e16db-d688-4121-8a64-7d72594ae13c",
            "created": "2019-11-06T19:59:20.000Z",
            "modified": "2019-11-06T19:59:20.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--25d7c94e-5aad-4634-878d-15010c84f0aa",
            "target_ref": "x-misp-object--f10bc385-bc29-4069-8374-abc49782561a"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}