{
    "type": "bundle",
    "id": "bundle--5af412ea-4254-4668-b1ea-44bc950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:36.000Z",
            "modified": "2018-05-10T10:42:36.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5af412ea-4254-4668-b1ea-44bc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:36.000Z",
            "modified": "2018-05-10T10:42:36.000Z",
            "name": "OSINT - Botnet exploiting GPON Vulnerability",
            "published": "2018-05-10T10:50:50Z",
            "object_refs": [
                "observed-data--5af412f6-37f8-4996-8b4c-4055950d210f",
                "url--5af412f6-37f8-4996-8b4c-4055950d210f",
                "indicator--5af41315-9390-4d7f-9def-402b950d210f",
                "indicator--5af41316-1d0c-4ae9-8e42-4a83950d210f",
                "indicator--5af41316-6910-4920-bb47-4788950d210f",
                "indicator--5af41317-4ca4-419f-b092-4144950d210f",
                "indicator--5af41317-5d4c-40bb-9e4d-4c37950d210f",
                "indicator--5af41322-2c5c-487f-a025-46ec950d210f",
                "indicator--5af41348-d5a0-4482-846d-4c7f950d210f",
                "indicator--5af41349-06b0-47c3-8da5-4703950d210f",
                "indicator--5af41349-c1f0-436e-87c0-4205950d210f",
                "indicator--5af4134a-1078-43b5-a581-41bf950d210f",
                "indicator--5af4134a-2874-441f-82e0-4014950d210f",
                "indicator--5af4134a-fe74-4b74-b27f-4a30950d210f",
                "indicator--5af4134b-a0dc-48d8-ab6a-45b3950d210f",
                "indicator--5af4134b-b314-4513-a092-4162950d210f",
                "indicator--5af4134c-c124-4199-aa8a-47da950d210f",
                "vulnerability--5af42049-af54-4183-b0f9-4141950d210f",
                "vulnerability--5af4206b-3850-44de-8419-46ce950d210f",
                "x-misp-attribute--5af42165-4184-439e-ba46-4ac0950d210f",
                "indicator--dc6a8900-6a96-4f53-bdfd-0254abb3488c",
                "x-misp-object--8d13fd99-2a7c-4017-9387-2567f59daf69",
                "indicator--b6b62156-63cf-4749-a53e-0fbf146c58cc",
                "x-misp-object--18ba50c8-c137-4b81-a1e7-139dd14edb85",
                "indicator--45af68f9-c923-46f1-8109-faecfda308db",
                "x-misp-object--59cf2b7f-07e3-4edc-a259-f0a20bb7385c",
                "indicator--7a02e5c6-e5da-45ec-a657-668dac4eb660",
                "x-misp-object--de42e5e8-eaf8-46d1-8cd9-43918d19e250",
                "indicator--4a3b47dc-bdfb-4938-a0d2-eb685c5f0159",
                "x-misp-object--2ab174e4-96c0-478b-9f8a-a43c7f49341c",
                "relationship--94164872-e935-4b18-84b0-f2116c13624c",
                "relationship--f0844478-3265-44be-96b3-8895cc42f684",
                "relationship--f71c9437-5e5f-4ce6-939e-bd9baeea76ff",
                "relationship--a52500cd-6483-4217-982a-fca013d4770b",
                "relationship--13e4de0c-14a8-4e37-9204-f0a8f54e74a4"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "malware_classification:malware-category=\"Botnet\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5af412f6-37f8-4996-8b4c-4055950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "first_observed": "2018-05-10T10:42:33Z",
            "last_observed": "2018-05-10T10:42:33Z",
            "number_observed": 1,
            "object_refs": [
                "url--5af412f6-37f8-4996-8b4c-4055950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5af412f6-37f8-4996-8b4c-4055950d210f",
            "value": "https://otx.alienvault.com/pulse/5af4123acb33890af1f6e769"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af41315-9390-4d7f-9def-402b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[file:hashes.SHA256 = '1ff787d52bc9e4a6c27d75b1a427c3e5dd16d6d5f082a79227c14edf8e908ab2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af41316-1d0c-4ae9-8e42-4a83950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[file:hashes.SHA256 = '7caac9c9fa954730665d63b692119ba5f14ee6c07cf11ffc60bca7b3d25ea109']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af41316-6910-4920-bb47-4788950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[file:hashes.SHA256 = 'a79964ce5cf4b92f996bbc24230e102b94ef05fb072c0afdeabc88d28695cace']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af41317-4ca4-419f-b092-4144950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[file:hashes.SHA256 = 'bab7e9f42df88902acb00fbdf3b4b5d8ffec2a1a7ad32eb5f2fb1dbf38f3167d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af41317-5d4c-40bb-9e4d-4c37950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[file:hashes.SHA256 = 'efa4fe06e4949c0f7aedea61a79da92e379ea66b169cd1d99c47b9e93e814093']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af41322-2c5c-487f-a025-46ec950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.62.190.191']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af41348-d5a0-4482-846d-4c7f950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[url:value = 'http://185.62.190.191/arm']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af41349-06b0-47c3-8da5-4703950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[url:value = 'http://185.62.190.191/arm.shell']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af41349-c1f0-436e-87c0-4205950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[url:value = 'http://185.62.190.191/arm7']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af4134a-1078-43b5-a581-41bf950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[url:value = 'http://185.62.190.191/arm7.shell']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af4134a-2874-441f-82e0-4014950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[url:value = 'http://185.62.190.191/mips']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af4134a-fe74-4b74-b27f-4a30950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[url:value = 'http://185.62.190.191/mips.shell']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af4134b-a0dc-48d8-ab6a-45b3950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[url:value = 'http://185.62.190.191/mipsel']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af4134b-b314-4513-a092-4162950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[url:value = 'http://185.62.190.191/mipsel.shell']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5af4134c-c124-4199-aa8a-47da950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "pattern": "[url:value = 'http://185.62.190.191/r']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T10:42:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "vulnerability",
            "spec_version": "2.1",
            "id": "vulnerability--5af42049-af54-4183-b0f9-4141950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "name": "CVE-2018-10561",
            "labels": [
                "misp:type=\"vulnerability\"",
                "misp:category=\"External analysis\""
            ],
            "external_references": [
                {
                    "source_name": "cve",
                    "external_id": "CVE-2018-10561"
                }
            ]
        },
        {
            "type": "vulnerability",
            "spec_version": "2.1",
            "id": "vulnerability--5af4206b-3850-44de-8419-46ce950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "name": "CVE-2018-10562",
            "labels": [
                "misp:type=\"vulnerability\"",
                "misp:category=\"External analysis\""
            ],
            "external_references": [
                {
                    "source_name": "cve",
                    "external_id": "CVE-2018-10562"
                }
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5af42165-4184-439e-ba46-4ac0950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T10:42:33.000Z",
            "modified": "2018-05-10T10:42:33.000Z",
            "labels": [
                "misp:type=\"cpe\"",
                "misp:category=\"Other\""
            ],
            "x_misp_category": "Other",
            "x_misp_type": "cpe",
            "x_misp_value": "cpe:2.3:h:dasannetworks"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--dc6a8900-6a96-4f53-bdfd-0254abb3488c",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T09:39:34.000Z",
            "modified": "2018-05-10T09:39:34.000Z",
            "pattern": "[file:hashes.MD5 = 'd546bc209d315ae81869315e8d536f36' AND file:hashes.SHA1 = '06f08af784b24a55018b4489afab19f0436b90a9' AND file:hashes.SHA256 = 'efa4fe06e4949c0f7aedea61a79da92e379ea66b169cd1d99c47b9e93e814093']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T09:39:34Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--8d13fd99-2a7c-4017-9387-2567f59daf69",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T09:39:33.000Z",
            "modified": "2018-05-10T09:39:33.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2018-05-10T06:56:45",
                    "category": "Other",
                    "uuid": "45b43d13-842d-4667-8659-91fb716c6d9b"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/efa4fe06e4949c0f7aedea61a79da92e379ea66b169cd1d99c47b9e93e814093/analysis/1525935405/",
                    "category": "External analysis",
                    "uuid": "8996de04-2834-4353-8557-def8438f0b8c"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "0/58",
                    "category": "Other",
                    "uuid": "2d469a44-218a-47d4-bd14-28ceac501c0a"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--b6b62156-63cf-4749-a53e-0fbf146c58cc",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T09:39:37.000Z",
            "modified": "2018-05-10T09:39:37.000Z",
            "pattern": "[file:hashes.MD5 = '21fa1dcc069309245a8aa1c142f112a3' AND file:hashes.SHA1 = 'c724be3b4cc8b7e0fbac7d0391be0f2aea0b5b19' AND file:hashes.SHA256 = 'a79964ce5cf4b92f996bbc24230e102b94ef05fb072c0afdeabc88d28695cace']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T09:39:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--18ba50c8-c137-4b81-a1e7-139dd14edb85",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T09:39:35.000Z",
            "modified": "2018-05-10T09:39:35.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2018-05-10T08:31:41",
                    "category": "Other",
                    "uuid": "c4e03498-2663-4831-bcfb-f890f3dd4046"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/a79964ce5cf4b92f996bbc24230e102b94ef05fb072c0afdeabc88d28695cace/analysis/1525941101/",
                    "category": "External analysis",
                    "uuid": "85e41194-4be4-4c8b-9f59-688047946889"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "0/60",
                    "category": "Other",
                    "uuid": "a6c92bca-84f0-49c4-b8db-91bd00ccaa53"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--45af68f9-c923-46f1-8109-faecfda308db",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T09:39:39.000Z",
            "modified": "2018-05-10T09:39:39.000Z",
            "pattern": "[file:hashes.MD5 = '2adb540db754366a1aa04ccca7105c80' AND file:hashes.SHA1 = '041dcbad0ca62255129048636afec9b89b65a748' AND file:hashes.SHA256 = '1ff787d52bc9e4a6c27d75b1a427c3e5dd16d6d5f082a79227c14edf8e908ab2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T09:39:39Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--59cf2b7f-07e3-4edc-a259-f0a20bb7385c",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T09:39:37.000Z",
            "modified": "2018-05-10T09:39:37.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2018-05-10T08:31:14",
                    "category": "Other",
                    "uuid": "4f02463a-2c20-4c36-848f-4feeb763163b"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/1ff787d52bc9e4a6c27d75b1a427c3e5dd16d6d5f082a79227c14edf8e908ab2/analysis/1525941074/",
                    "category": "External analysis",
                    "uuid": "744f3382-cfa3-4a58-9f5d-7be052b795fd"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "0/52",
                    "category": "Other",
                    "uuid": "dffbc1c1-8b01-4108-b226-51be41118f85"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--7a02e5c6-e5da-45ec-a657-668dac4eb660",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T09:39:41.000Z",
            "modified": "2018-05-10T09:39:41.000Z",
            "pattern": "[file:hashes.MD5 = '20deff5786a4769b219c304965559043' AND file:hashes.SHA1 = 'dc6102418faedf4379bfc786acb216d5defe64f0' AND file:hashes.SHA256 = 'bab7e9f42df88902acb00fbdf3b4b5d8ffec2a1a7ad32eb5f2fb1dbf38f3167d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T09:39:41Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--de42e5e8-eaf8-46d1-8cd9-43918d19e250",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T09:39:40.000Z",
            "modified": "2018-05-10T09:39:40.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2018-05-10T08:31:27",
                    "category": "Other",
                    "uuid": "c79e6e09-dd54-4cbc-875c-7abdb53c2f4a"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/bab7e9f42df88902acb00fbdf3b4b5d8ffec2a1a7ad32eb5f2fb1dbf38f3167d/analysis/1525941087/",
                    "category": "External analysis",
                    "uuid": "68c1f245-9031-479f-a729-f8a227046e5b"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "0/59",
                    "category": "Other",
                    "uuid": "63eae805-0aea-4d07-9ff4-8cef4a623a81"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--4a3b47dc-bdfb-4938-a0d2-eb685c5f0159",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T09:39:44.000Z",
            "modified": "2018-05-10T09:39:44.000Z",
            "pattern": "[file:hashes.MD5 = 'a536f99aa4030efb5d44c0b4792f4e9b' AND file:hashes.SHA1 = '44e341d28d744e0b3d2fa1a8cc3481f184d155ff' AND file:hashes.SHA256 = '7caac9c9fa954730665d63b692119ba5f14ee6c07cf11ffc60bca7b3d25ea109']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-10T09:39:44Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--2ab174e4-96c0-478b-9f8a-a43c7f49341c",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-05-10T09:39:42.000Z",
            "modified": "2018-05-10T09:39:42.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2018-05-09T21:12:19",
                    "category": "Other",
                    "uuid": "37b71505-ff33-4199-a543-901564c40401"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/7caac9c9fa954730665d63b692119ba5f14ee6c07cf11ffc60bca7b3d25ea109/analysis/1525900339/",
                    "category": "External analysis",
                    "uuid": "55484663-5402-4902-b741-1165e89e8e86"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "0/60",
                    "category": "Other",
                    "uuid": "cdb5cf8b-006d-4ea6-8921-136278f3eb35"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--94164872-e935-4b18-84b0-f2116c13624c",
            "created": "2018-05-10T09:39:43.000Z",
            "modified": "2018-05-10T09:39:43.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--dc6a8900-6a96-4f53-bdfd-0254abb3488c",
            "target_ref": "x-misp-object--8d13fd99-2a7c-4017-9387-2567f59daf69"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f0844478-3265-44be-96b3-8895cc42f684",
            "created": "2018-05-10T09:39:43.000Z",
            "modified": "2018-05-10T09:39:43.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--b6b62156-63cf-4749-a53e-0fbf146c58cc",
            "target_ref": "x-misp-object--18ba50c8-c137-4b81-a1e7-139dd14edb85"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f71c9437-5e5f-4ce6-939e-bd9baeea76ff",
            "created": "2018-05-10T09:39:43.000Z",
            "modified": "2018-05-10T09:39:43.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--45af68f9-c923-46f1-8109-faecfda308db",
            "target_ref": "x-misp-object--59cf2b7f-07e3-4edc-a259-f0a20bb7385c"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a52500cd-6483-4217-982a-fca013d4770b",
            "created": "2018-05-10T09:39:43.000Z",
            "modified": "2018-05-10T09:39:43.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--7a02e5c6-e5da-45ec-a657-668dac4eb660",
            "target_ref": "x-misp-object--de42e5e8-eaf8-46d1-8cd9-43918d19e250"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--13e4de0c-14a8-4e37-9204-f0a8f54e74a4",
            "created": "2018-05-10T09:39:43.000Z",
            "modified": "2018-05-10T09:39:43.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--4a3b47dc-bdfb-4938-a0d2-eb685c5f0159",
            "target_ref": "x-misp-object--2ab174e4-96c0-478b-9f8a-a43c7f49341c"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}