{
    "type": "bundle",
    "id": "bundle--5bf26acf-d95c-4892-a05d-4db5950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T14:25:46.000Z",
            "modified": "2018-11-19T14:25:46.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5bf26acf-d95c-4892-a05d-4db5950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T14:25:46.000Z",
            "modified": "2018-11-19T14:25:46.000Z",
            "name": "OSINT - CozyBear \u00e2\u20ac\u201c In from the Cold?",
            "published": "2018-11-19T14:25:52Z",
            "object_refs": [
                "observed-data--5bf26c6f-d748-499e-a651-40e3950d210f",
                "url--5bf26c6f-d748-499e-a651-40e3950d210f",
                "indicator--5bf27aea-d798-4848-88f8-43a7950d210f",
                "indicator--5bf26eb3-588c-479a-8c42-48b6950d210f",
                "indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f",
                "indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f",
                "indicator--5bf27326-3988-4648-8349-48a8950d210f",
                "indicator--5bf27381-7984-4244-933f-402b950d210f",
                "indicator--5bf27c25-d538-45b8-be16-44f0950d210f",
                "indicator--f815afa9-6251-4258-af1c-d3c6354478f9",
                "x-misp-object--13b82a46-f0a2-4216-b6ff-f15d7e5aa85f",
                "indicator--6c5c8753-80c8-496e-8f41-0c72d76ceceb",
                "x-misp-object--4c234bd0-9fb2-4f60-9e0f-971e8746024d",
                "relationship--c543f7ec-dba6-4197-bc4e-6903a0105e77",
                "relationship--4bf0813e-d2de-421c-ae13-6524afc30861"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "misp-galaxy:threat-actor=\"APT 29\"",
                "misp-galaxy:mitre-intrusion-set=\"APT29\"",
                "misp-galaxy:mitre-malware=\"CozyCar\"",
                "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT29 - G0016\"",
                "misp-galaxy:mitre-enterprise-attack-malware=\"CozyCar\"",
                "misp-galaxy:malpedia=\"Cobalt Strike\"",
                "misp-galaxy:rat=\"Cobalt Strike\"",
                "misp-galaxy:mitre-enterprise-attack-tool=\"Cobalt Strike\"",
                "misp-galaxy:mitre-enterprise-attack-tool=\"Cobalt Strike - S0154\"",
                "misp-galaxy:mitre-tool=\"Cobalt Strike\"",
                "circl:incident-classification=\"phishing\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5bf26c6f-d748-499e-a651-40e3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T07:56:20.000Z",
            "modified": "2018-11-19T07:56:20.000Z",
            "first_observed": "2018-11-19T07:56:20Z",
            "last_observed": "2018-11-19T07:56:20Z",
            "number_observed": 1,
            "object_refs": [
                "url--5bf26c6f-d748-499e-a651-40e3950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5bf26c6f-d748-499e-a651-40e3950d210f",
            "value": "https://pylos.co/2018/11/18/cozybear-in-from-the-cold/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bf27aea-d798-4848-88f8-43a7950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T08:57:14.000Z",
            "modified": "2018-11-19T08:57:14.000Z",
            "pattern": "[domain-name:value = 'pandorasong.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-11-19T08:57:14Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bf26eb3-588c-479a-8c42-48b6950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T08:05:07.000Z",
            "modified": "2018-11-19T08:05:07.000Z",
            "description": "mail server",
            "pattern": "[domain-name:value = 'mx1.era.citon.com' AND domain-name:resolves_to_refs[*].value = '216.251.161.198']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-11-19T08:05:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "network"
                }
            ],
            "labels": [
                "misp:name=\"domain-ip\"",
                "misp:meta-category=\"network\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T08:07:47.000Z",
            "modified": "2018-11-19T08:07:47.000Z",
            "pattern": "[file:name = 'ds7002.lnk' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-11-19T08:07:47Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T08:07:58.000Z",
            "modified": "2018-11-19T08:07:58.000Z",
            "pattern": "[file:name = 'cyzfc.dat' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-11-19T08:07:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bf27326-3988-4648-8349-48a8950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T08:24:06.000Z",
            "modified": "2018-11-19T08:24:06.000Z",
            "pattern": "[file:name = '7486-the-shocking-truth-about-election-rigging-in-america.rtf.lnk' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-11-19T08:24:06Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bf27381-7984-4244-933f-402b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T08:25:37.000Z",
            "modified": "2018-11-19T08:25:37.000Z",
            "pattern": "[file:hashes.SHA256 = '2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-11-19T08:25:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5bf27c25-d538-45b8-be16-44f0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T09:02:29.000Z",
            "modified": "2018-11-19T09:02:29.000Z",
            "pattern": "[file:hashes.SHA256 = 'b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-11-19T09:02:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--f815afa9-6251-4258-af1c-d3c6354478f9",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T14:25:30.000Z",
            "modified": "2018-11-19T14:25:30.000Z",
            "pattern": "[file:hashes.MD5 = '16bbc967a8b6a365871a05c74a4f345b' AND file:hashes.SHA1 = '9858d5cb2a6614be3c48e33911bf9f7978b441bf' AND file:hashes.SHA256 = 'b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-11-19T14:25:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--13b82a46-f0a2-4216-b6ff-f15d7e5aa85f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T14:25:31.000Z",
            "modified": "2018-11-19T14:25:31.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2018-11-19T03:46:22",
                    "category": "Other",
                    "uuid": "17a08ecf-8c7a-44f0-8d62-5610b7f6016b"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05/analysis/1542599182/",
                    "category": "External analysis",
                    "uuid": "fe091e77-2656-44c2-9dba-067a12240376"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "38/65",
                    "category": "Other",
                    "uuid": "38131c5b-7a1f-432f-ae28-1d344e1b044e"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--6c5c8753-80c8-496e-8f41-0c72d76ceceb",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T14:25:32.000Z",
            "modified": "2018-11-19T14:25:32.000Z",
            "pattern": "[file:hashes.MD5 = '6ed0020b0851fb71d5b0076f4ee95f3c' AND file:hashes.SHA1 = 'e431261c63f94a174a1308defccc674dabbe3609' AND file:hashes.SHA256 = '2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-11-19T14:25:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--4c234bd0-9fb2-4f60-9e0f-971e8746024d",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-11-19T14:25:34.000Z",
            "modified": "2018-11-19T14:25:34.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2018-11-19T03:14:57",
                    "category": "Other",
                    "uuid": "fb3ad0e4-c955-44af-93d8-874ab7cd17bd"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c/analysis/1542597297/",
                    "category": "External analysis",
                    "uuid": "5f7203c2-d42b-46a5-88da-090e96f40841"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "22/55",
                    "category": "Other",
                    "uuid": "c1f98fdf-637c-4e0e-be43-b1e622dfe8cd"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c543f7ec-dba6-4197-bc4e-6903a0105e77",
            "created": "2018-11-19T08:07:46.000Z",
            "modified": "2018-11-19T08:07:46.000Z",
            "relationship_type": "dropped",
            "source_ref": "indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f",
            "target_ref": "indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4bf0813e-d2de-421c-ae13-6524afc30861",
            "created": "2018-11-19T08:07:57.000Z",
            "modified": "2018-11-19T08:07:57.000Z",
            "relationship_type": "dropped-by",
            "source_ref": "indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f",
            "target_ref": "indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}