{
    "type": "bundle",
    "id": "bundle--57174526-23d8-4895-8c08-4ed1950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T11:52:14.000Z",
            "modified": "2016-04-20T11:52:14.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--57174526-23d8-4895-8c08-4ed1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T11:52:14.000Z",
            "modified": "2016-04-20T11:52:14.000Z",
            "name": "New ransomware",
            "published": "2016-04-20T12:03:15Z",
            "object_refs": [
                "observed-data--57174536-95fc-474a-bb9f-46dc950d210f",
                "file--57174536-95fc-474a-bb9f-46dc950d210f",
                "observed-data--57174f19-f06c-4809-92b3-476d02de0b81",
                "file--57174f19-f06c-4809-92b3-476d02de0b81",
                "observed-data--57174f19-c3d8-43f0-96bb-43e402de0b81",
                "file--57174f19-c3d8-43f0-96bb-43e402de0b81",
                "observed-data--57174f1a-a47c-458d-9900-451e02de0b81",
                "url--57174f1a-a47c-458d-9900-451e02de0b81",
                "observed-data--57176bf7-4e28-4e60-88d4-4dea950d210f",
                "domain-name--57176bf7-4e28-4e60-88d4-4dea950d210f",
                "observed-data--57176c2a-2280-4f00-9208-42c1950d210f",
                "url--57176c2a-2280-4f00-9208-42c1950d210f",
                "observed-data--57176c68-3b48-47d1-a549-4f20950d210f",
                "network-traffic--57176c68-3b48-47d1-a549-4f20950d210f",
                "ipv4-addr--57176c68-3b48-47d1-a549-4f20950d210f",
                "observed-data--57176ca8-4fd8-4eac-a432-4fdb950d210f",
                "url--57176ca8-4fd8-4eac-a432-4fdb950d210f",
                "x-misp-attribute--57176d27-f044-4038-9604-49da950d210f",
                "x-misp-attribute--57176d6e-a4e8-4c08-bd9c-41d9950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57174536-95fc-474a-bb9f-46dc950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T09:00:38.000Z",
            "modified": "2016-04-20T09:00:38.000Z",
            "first_observed": "2016-04-20T09:00:38Z",
            "last_observed": "2016-04-20T09:00:38Z",
            "number_observed": 1,
            "object_refs": [
                "file--57174536-95fc-474a-bb9f-46dc950d210f"
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload installation\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--57174536-95fc-474a-bb9f-46dc950d210f",
            "hashes": {
                "MD5": "116d442d8ec5c62f32c7ba507a5569be"
            }
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57174f19-f06c-4809-92b3-476d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T09:42:49.000Z",
            "modified": "2016-04-20T09:42:49.000Z",
            "first_observed": "2016-04-20T09:42:49Z",
            "last_observed": "2016-04-20T09:42:49Z",
            "number_observed": 1,
            "object_refs": [
                "file--57174f19-f06c-4809-92b3-476d02de0b81"
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload installation\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--57174f19-f06c-4809-92b3-476d02de0b81",
            "hashes": {
                "SHA-256": "ce98e9d9900609c45c948d34153c03b490bc2067e7a742048f60ed53fe95529d"
            }
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57174f19-c3d8-43f0-96bb-43e402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T09:42:49.000Z",
            "modified": "2016-04-20T09:42:49.000Z",
            "first_observed": "2016-04-20T09:42:49Z",
            "last_observed": "2016-04-20T09:42:49Z",
            "number_observed": 1,
            "object_refs": [
                "file--57174f19-c3d8-43f0-96bb-43e402de0b81"
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload installation\""
            ]
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--57174f19-c3d8-43f0-96bb-43e402de0b81",
            "hashes": {
                "SHA-1": "fb93796afa470d87deb316823d3cd6e8d8b18596"
            }
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57174f1a-a47c-458d-9900-451e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T09:42:50.000Z",
            "modified": "2016-04-20T09:42:50.000Z",
            "first_observed": "2016-04-20T09:42:50Z",
            "last_observed": "2016-04-20T09:42:50Z",
            "number_observed": 1,
            "object_refs": [
                "url--57174f1a-a47c-458d-9900-451e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57174f1a-a47c-458d-9900-451e02de0b81",
            "value": "https://www.virustotal.com/file/ce98e9d9900609c45c948d34153c03b490bc2067e7a742048f60ed53fe95529d/analysis/1461016885/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57176bf7-4e28-4e60-88d4-4dea950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T11:45:59.000Z",
            "modified": "2016-04-20T11:45:59.000Z",
            "first_observed": "2016-04-20T11:45:59Z",
            "last_observed": "2016-04-20T11:45:59Z",
            "number_observed": 1,
            "object_refs": [
                "domain-name--57176bf7-4e28-4e60-88d4-4dea950d210f"
            ],
            "labels": [
                "misp:type=\"hostname\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--57176bf7-4e28-4e60-88d4-4dea950d210f",
            "value": "kentamplin.net"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57176c2a-2280-4f00-9208-42c1950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T11:46:50.000Z",
            "modified": "2016-04-20T11:46:50.000Z",
            "first_observed": "2016-04-20T11:46:50Z",
            "last_observed": "2016-04-20T11:46:50Z",
            "number_observed": 1,
            "object_refs": [
                "url--57176c2a-2280-4f00-9208-42c1950d210f"
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57176c2a-2280-4f00-9208-42c1950d210f",
            "value": "kentamplin.net/wordpress/wp-includes/oops.php"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57176c68-3b48-47d1-a549-4f20950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T11:47:52.000Z",
            "modified": "2016-04-20T11:47:52.000Z",
            "first_observed": "2016-04-20T11:47:52Z",
            "last_observed": "2016-04-20T11:47:52Z",
            "number_observed": 1,
            "object_refs": [
                "network-traffic--57176c68-3b48-47d1-a549-4f20950d210f",
                "ipv4-addr--57176c68-3b48-47d1-a549-4f20950d210f"
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "network-traffic",
            "spec_version": "2.1",
            "id": "network-traffic--57176c68-3b48-47d1-a549-4f20950d210f",
            "dst_ref": "ipv4-addr--57176c68-3b48-47d1-a549-4f20950d210f",
            "protocols": [
                "tcp"
            ]
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--57176c68-3b48-47d1-a549-4f20950d210f",
            "value": "192.185.16.132"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57176ca8-4fd8-4eac-a432-4fdb950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T11:48:56.000Z",
            "modified": "2016-04-20T11:48:56.000Z",
            "first_observed": "2016-04-20T11:48:56Z",
            "last_observed": "2016-04-20T11:48:56Z",
            "number_observed": 1,
            "object_refs": [
                "url--57176ca8-4fd8-4eac-a432-4fdb950d210f"
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57176ca8-4fd8-4eac-a432-4fdb950d210f",
            "value": "http://192.185.16.132/wordpress/wp-includes/oops.php?id=2886098&cname=mh6SlMrX8b&arch=0&srv=0&ver=6.1"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--57176d27-f044-4038-9604-49da950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T11:51:03.000Z",
            "modified": "2016-04-20T11:51:03.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"Other\""
            ],
            "x_misp_category": "Other",
            "x_misp_comment": "Ransom text",
            "x_misp_type": "comment",
            "x_misp_value": "YourID: 2886098\r\n    PC: HOME\r\n    USER: user\r\n    *********\r\n    Hey\r\n\r\n    Your files are now encrypted. I have the key to decrypt them back. I will give you a decrypter if you pay me. Email me at: momsbestfriend@protonmail.com or torrenttracker@india.com\r\n\r\n    If you don\u00e2\u20ac\u2122t get a reply or if both emails die, then contact me using a guaranteed, foolproof\r\n    Bitmessage: download it form here https://github.com/mailchuck/PyBitmessage/releases/download/v0.5.8/Bitmessage-\r\n    0.5.8.exe\r\n\r\n    Run it, click New Identity and then send me a message at BM-NBvzKEY8raDBKb9Gp1xZMRQpeU5svwg2\r\n\r\n    Cheers"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--57176d6e-a4e8-4c08-bd9c-41d9950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-04-20T11:52:14.000Z",
            "modified": "2016-04-20T11:52:14.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"Other\""
            ],
            "x_misp_category": "Other",
            "x_misp_type": "comment",
            "x_misp_value": "ID was seen to be same among the different infections..."
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}