{
    "type": "bundle",
    "id": "bundle--5739b34f-01ac-4e80-a403-4a1502de0b81",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:25.000Z",
            "modified": "2016-05-16T11:58:25.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5739b34f-01ac-4e80-a403-4a1502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:25.000Z",
            "modified": "2016-05-16T11:58:25.000Z",
            "name": "OSINT -  Hancitor and Ruckguv Reappear, Updated and With Vawtrak On Deck",
            "published": "2016-05-16T11:58:58Z",
            "object_refs": [
                "observed-data--5739b382-e464-4c58-bf66-44c302de0b81",
                "url--5739b382-e464-4c58-bf66-44c302de0b81",
                "x-misp-attribute--5739b397-f144-48c0-a8a7-472d02de0b81",
                "indicator--5739b3d6-068c-42fb-83f4-4b0c02de0b81",
                "indicator--5739b3d6-0940-4787-9571-44b502de0b81",
                "indicator--5739b3d6-cd9c-4e5f-b332-473502de0b81",
                "indicator--5739b3d7-b578-440d-9e5c-4db202de0b81",
                "indicator--5739b3d7-6b0c-47db-a983-4bb302de0b81",
                "indicator--5739b405-8604-4bb7-b7bc-4e6b02de0b81",
                "indicator--5739b406-b970-4bb2-afc1-416902de0b81",
                "indicator--5739b406-cbe4-490c-b81a-451502de0b81",
                "indicator--5739b406-498c-44f0-94cd-481202de0b81",
                "indicator--5739b48a-5510-41e1-952a-4fc402de0b81",
                "indicator--5739b48a-1098-4ba4-a3f6-4c0d02de0b81",
                "indicator--5739b535-745c-4fa5-b5d3-445202de0b81",
                "indicator--5739b535-3bb0-45bc-b8fc-4ebb02de0b81",
                "indicator--5739b535-28d8-47c7-be75-4af502de0b81",
                "indicator--5739b535-968c-4cd1-b88f-406402de0b81",
                "indicator--5739b59e-fbc4-4aca-9af5-4ee902de0b81",
                "indicator--5739b59e-0b48-44e9-a8aa-406d02de0b81",
                "indicator--5739b59f-3eec-4b2c-b62f-499702de0b81",
                "indicator--5739b59f-9be8-43b9-8654-4dd902de0b81",
                "indicator--5739b5e1-872c-459b-9c96-454e02de0b81",
                "indicator--5739b5e1-99c4-4e19-8650-4d0b02de0b81",
                "observed-data--5739b5e1-9d14-482a-bb1f-455f02de0b81",
                "url--5739b5e1-9d14-482a-bb1f-455f02de0b81",
                "indicator--5739b5e1-6710-4847-ba02-4d3a02de0b81",
                "indicator--5739b5e1-06e0-4766-930e-4f2802de0b81",
                "observed-data--5739b5e2-97e8-4de1-af00-42ab02de0b81",
                "url--5739b5e2-97e8-4de1-af00-42ab02de0b81",
                "indicator--5739b5e2-b92c-4d17-adaa-456502de0b81",
                "indicator--5739b5e2-53d4-4158-99c8-491002de0b81",
                "observed-data--5739b5e2-d658-4689-9c2b-4bae02de0b81",
                "url--5739b5e2-d658-4689-9c2b-4bae02de0b81",
                "indicator--5739b5e2-37c0-467d-bf51-49f102de0b81",
                "indicator--5739b5e3-8d3c-433c-9a2d-46bd02de0b81",
                "observed-data--5739b5e3-c674-487a-acf4-4f1e02de0b81",
                "url--5739b5e3-c674-487a-acf4-4f1e02de0b81",
                "indicator--5739b5e3-e9ac-441e-9069-4b2502de0b81",
                "indicator--5739b5e3-b1c8-40b6-8794-485802de0b81",
                "observed-data--5739b5e3-a94c-4d1b-8d86-4f5002de0b81",
                "url--5739b5e3-a94c-4d1b-8d86-4f5002de0b81",
                "indicator--5739b5e4-3590-4015-a1de-4a0e02de0b81",
                "indicator--5739b5e4-b2c0-4339-a778-48bb02de0b81",
                "observed-data--5739b5e4-5af8-4ccc-bd61-496202de0b81",
                "url--5739b5e4-5af8-4ccc-bd61-496202de0b81",
                "indicator--5739b5e4-3c40-40e7-84f7-474b02de0b81",
                "indicator--5739b5e4-f720-4f41-8d10-46cb02de0b81",
                "observed-data--5739b5e4-3f5c-4b59-aa26-4f1e02de0b81",
                "url--5739b5e4-3f5c-4b59-aa26-4f1e02de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5739b382-e464-4c58-bf66-44c302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:48:18.000Z",
            "modified": "2016-05-16T11:48:18.000Z",
            "first_observed": "2016-05-16T11:48:18Z",
            "last_observed": "2016-05-16T11:48:18Z",
            "number_observed": 1,
            "object_refs": [
                "url--5739b382-e464-4c58-bf66-44c302de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5739b382-e464-4c58-bf66-44c302de0b81",
            "value": "https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5739b397-f144-48c0-a8a7-472d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:48:39.000Z",
            "modified": "2016-05-16T11:48:39.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "comment",
            "x_misp_value": "Proofpoint researchers have recently observed the re-emergence of two malware downloaders that had largely disappeared for several months. Hancitor (also known as Tordal and Chanitor) and Ruckguv have reappeared in campaigns distributing Pony and Vawtrak with significant updates and increased functionality. We have also been tracking an actor experimenting with various loaders, providing insights into these evolving components of malware ecosystems."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b3d6-068c-42fb-83f4-4b0c02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:49:42.000Z",
            "modified": "2016-05-16T11:49:42.000Z",
            "description": "Ruckguv downloading Pony",
            "pattern": "[url:value = 'http://logimax.net.in/ii.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:49:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b3d6-0940-4787-9571-44b502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:49:42.000Z",
            "modified": "2016-05-16T11:49:42.000Z",
            "description": "Ruckguv downloading Pony",
            "pattern": "[url:value = 'http://tourjacket.me/ii.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:49:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b3d6-cd9c-4e5f-b332-473502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:49:42.000Z",
            "modified": "2016-05-16T11:49:42.000Z",
            "description": "Ruckguv downloading Pony",
            "pattern": "[url:value = 'http://urbanrecreation.eu/ii.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:49:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b3d7-b578-440d-9e5c-4db202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:49:43.000Z",
            "modified": "2016-05-16T11:49:43.000Z",
            "description": "Ruckguv downloading Pony",
            "pattern": "[url:value = 'http://tantrix.com.tr/pm.dll']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:49:43Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b3d7-6b0c-47db-a983-4bb302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:49:43.000Z",
            "modified": "2016-05-16T11:49:43.000Z",
            "description": "Ruckguv downloading Pony",
            "pattern": "[url:value = 'http://therapeutica.com.br/pm.dll']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:49:43Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b405-8604-4bb7-b7bc-4e6b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:50:29.000Z",
            "modified": "2016-05-16T11:50:29.000Z",
            "description": "Hancitor C2",
            "pattern": "[url:value = 'http://hadfanawass.com/sl/gate.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:50:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b406-b970-4bb2-afc1-416902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:50:30.000Z",
            "modified": "2016-05-16T11:50:30.000Z",
            "description": "Hancitor C2",
            "pattern": "[url:value = 'http://rophenreswi.ru/sl/gate.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:50:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b406-cbe4-490c-b81a-451502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:50:30.000Z",
            "modified": "2016-05-16T11:50:30.000Z",
            "description": "Hancitor C2",
            "pattern": "[url:value = 'http://mihesfitons.ru/sl/gate.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:50:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b406-498c-44f0-94cd-481202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:50:30.000Z",
            "modified": "2016-05-16T11:50:30.000Z",
            "description": "Hancitor C2",
            "pattern": "[url:value = 'https://krrewiaog3u4npcg.onion.to/sl/gate.php']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:50:30Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b48a-5510-41e1-952a-4fc402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:52:42.000Z",
            "modified": "2016-05-16T11:52:42.000Z",
            "description": "Hancitor downloading Pony",
            "pattern": "[url:value = 'http://quoapps.es/pm.dll']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:52:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b48a-1098-4ba4-a3f6-4c0d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:52:42.000Z",
            "modified": "2016-05-16T11:52:42.000Z",
            "description": "Hancitor downloading Pony",
            "pattern": "[url:value = 'http://posturepals.es/inst1.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:52:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b535-745c-4fa5-b5d3-445202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:55:33.000Z",
            "modified": "2016-05-16T11:55:33.000Z",
            "description": "Document that dropped Ruckguv on May 4",
            "pattern": "[file:hashes.SHA256 = 'b1ba251cf4f494a00ff0d64a50004d839928dac816afb81c33af51622baf2c12']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:55:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b535-3bb0-45bc-b8fc-4ebb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:55:33.000Z",
            "modified": "2016-05-16T11:55:33.000Z",
            "description": "Ruckguv",
            "pattern": "[file:hashes.SHA256 = '0b6e868c196c7ad80fac72a7d02159cfa4f72ad657604cd3e5eb03c796df01ba']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:55:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b535-28d8-47c7-be75-4af502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:55:33.000Z",
            "modified": "2016-05-16T11:55:33.000Z",
            "description": "Pony (Ruckguv module)",
            "pattern": "[file:hashes.SHA256 = '2ccebf5fee30073e849895c6e43f6519017f226281c80177d72febcfbaf1f0d3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:55:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b535-968c-4cd1-b88f-406402de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:55:33.000Z",
            "modified": "2016-05-16T11:55:33.000Z",
            "description": "Vawtrak (Ruckguv payload)",
            "pattern": "[file:hashes.SHA256 = '9b11304e4362a8fbe2ee91d8e31d7ae5774019aaeef9240c6878da78bdf0bfa9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:55:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b59e-fbc4-4aca-9af5-4ee902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:57:18.000Z",
            "modified": "2016-05-16T11:57:18.000Z",
            "description": "Document that dropped Hancitor on April 28",
            "pattern": "[file:hashes.SHA256 = '9b3fa5dc3b340e0df08d26dd53cd3aa83212950b2d41cf1b1e5a6dd1acd0e4df']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:57:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b59e-0b48-44e9-a8aa-406d02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:57:18.000Z",
            "modified": "2016-05-16T11:57:18.000Z",
            "description": "Hancitor",
            "pattern": "[file:hashes.SHA256 = '5ec4ba1a97500e664af6896f4c02846ca6777e671bb600103dc8d49224e38f48']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:57:18Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b59f-3eec-4b2c-b62f-499702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:57:19.000Z",
            "modified": "2016-05-16T11:57:19.000Z",
            "description": "Pony (Hancitor module)",
            "pattern": "[file:hashes.SHA256 = 'b19ec186f59b1f72c768ed2fcd8344d75821e527870b71e8123db96f683f1b68']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:57:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b59f-9be8-43b9-8654-4dd902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:57:19.000Z",
            "modified": "2016-05-16T11:57:19.000Z",
            "description": "Vawtrak (Hancitor payload)",
            "pattern": "[file:hashes.SHA256 = 'ec9a14f442bbb549388c7a36f8f221fab4f8d3578540ad528f9cb12d35e73fa5']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:57:19Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e1-872c-459b-9c96-454e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:25.000Z",
            "modified": "2016-05-16T11:58:25.000Z",
            "description": "Vawtrak (Hancitor payload) - Xchecked via VT: ec9a14f442bbb549388c7a36f8f221fab4f8d3578540ad528f9cb12d35e73fa5",
            "pattern": "[file:hashes.SHA1 = 'a35698fe9ef3c6215f50c06d3ef398e5bdeb8c6f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e1-99c4-4e19-8650-4d0b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:25.000Z",
            "modified": "2016-05-16T11:58:25.000Z",
            "description": "Vawtrak (Hancitor payload) - Xchecked via VT: ec9a14f442bbb549388c7a36f8f221fab4f8d3578540ad528f9cb12d35e73fa5",
            "pattern": "[file:hashes.MD5 = '68793f7cc760048ba97eb1cc97252461']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5739b5e1-9d14-482a-bb1f-455f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:25.000Z",
            "modified": "2016-05-16T11:58:25.000Z",
            "first_observed": "2016-05-16T11:58:25Z",
            "last_observed": "2016-05-16T11:58:25Z",
            "number_observed": 1,
            "object_refs": [
                "url--5739b5e1-9d14-482a-bb1f-455f02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5739b5e1-9d14-482a-bb1f-455f02de0b81",
            "value": "https://www.virustotal.com/file/ec9a14f442bbb549388c7a36f8f221fab4f8d3578540ad528f9cb12d35e73fa5/analysis/1462606723/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e1-6710-4847-ba02-4d3a02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:25.000Z",
            "modified": "2016-05-16T11:58:25.000Z",
            "description": "Pony (Hancitor module) - Xchecked via VT: b19ec186f59b1f72c768ed2fcd8344d75821e527870b71e8123db96f683f1b68",
            "pattern": "[file:hashes.SHA1 = '3a7ad22bb6f4953c7bbcaec85680c6a9be03af46']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e1-06e0-4766-930e-4f2802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:25.000Z",
            "modified": "2016-05-16T11:58:25.000Z",
            "description": "Pony (Hancitor module) - Xchecked via VT: b19ec186f59b1f72c768ed2fcd8344d75821e527870b71e8123db96f683f1b68",
            "pattern": "[file:hashes.MD5 = '21eb66fd849c57ce2c69e3e1ad1b064c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5739b5e2-97e8-4de1-af00-42ab02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:26.000Z",
            "modified": "2016-05-16T11:58:26.000Z",
            "first_observed": "2016-05-16T11:58:26Z",
            "last_observed": "2016-05-16T11:58:26Z",
            "number_observed": 1,
            "object_refs": [
                "url--5739b5e2-97e8-4de1-af00-42ab02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5739b5e2-97e8-4de1-af00-42ab02de0b81",
            "value": "https://www.virustotal.com/file/b19ec186f59b1f72c768ed2fcd8344d75821e527870b71e8123db96f683f1b68/analysis/1463121357/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e2-b92c-4d17-adaa-456502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:26.000Z",
            "modified": "2016-05-16T11:58:26.000Z",
            "description": "Hancitor - Xchecked via VT: 5ec4ba1a97500e664af6896f4c02846ca6777e671bb600103dc8d49224e38f48",
            "pattern": "[file:hashes.SHA1 = 'dbb61c1e21440dd671eeb76576aa293ae1ef117c']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e2-53d4-4158-99c8-491002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:26.000Z",
            "modified": "2016-05-16T11:58:26.000Z",
            "description": "Hancitor - Xchecked via VT: 5ec4ba1a97500e664af6896f4c02846ca6777e671bb600103dc8d49224e38f48",
            "pattern": "[file:hashes.MD5 = '2c1e65962b41bcd1ffef977870f083fa']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5739b5e2-d658-4689-9c2b-4bae02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:26.000Z",
            "modified": "2016-05-16T11:58:26.000Z",
            "first_observed": "2016-05-16T11:58:26Z",
            "last_observed": "2016-05-16T11:58:26Z",
            "number_observed": 1,
            "object_refs": [
                "url--5739b5e2-d658-4689-9c2b-4bae02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5739b5e2-d658-4689-9c2b-4bae02de0b81",
            "value": "https://www.virustotal.com/file/5ec4ba1a97500e664af6896f4c02846ca6777e671bb600103dc8d49224e38f48/analysis/1463383176/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e2-37c0-467d-bf51-49f102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:26.000Z",
            "modified": "2016-05-16T11:58:26.000Z",
            "description": "Document that dropped Hancitor on April 28 - Xchecked via VT: 9b3fa5dc3b340e0df08d26dd53cd3aa83212950b2d41cf1b1e5a6dd1acd0e4df",
            "pattern": "[file:hashes.SHA1 = '64d8f9d5c127a53c124ba4aef48662cbf3919ea6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e3-8d3c-433c-9a2d-46bd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:27.000Z",
            "modified": "2016-05-16T11:58:27.000Z",
            "description": "Document that dropped Hancitor on April 28 - Xchecked via VT: 9b3fa5dc3b340e0df08d26dd53cd3aa83212950b2d41cf1b1e5a6dd1acd0e4df",
            "pattern": "[file:hashes.MD5 = '50be8add4e5a01175808893af56468bd']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:27Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5739b5e3-c674-487a-acf4-4f1e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:27.000Z",
            "modified": "2016-05-16T11:58:27.000Z",
            "first_observed": "2016-05-16T11:58:27Z",
            "last_observed": "2016-05-16T11:58:27Z",
            "number_observed": 1,
            "object_refs": [
                "url--5739b5e3-c674-487a-acf4-4f1e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5739b5e3-c674-487a-acf4-4f1e02de0b81",
            "value": "https://www.virustotal.com/file/9b3fa5dc3b340e0df08d26dd53cd3aa83212950b2d41cf1b1e5a6dd1acd0e4df/analysis/1462606671/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e3-e9ac-441e-9069-4b2502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:27.000Z",
            "modified": "2016-05-16T11:58:27.000Z",
            "description": "Vawtrak (Ruckguv payload) - Xchecked via VT: 9b11304e4362a8fbe2ee91d8e31d7ae5774019aaeef9240c6878da78bdf0bfa9",
            "pattern": "[file:hashes.SHA1 = '375133988496954a4e59083f4e8510a26ab394e3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:27Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e3-b1c8-40b6-8794-485802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:27.000Z",
            "modified": "2016-05-16T11:58:27.000Z",
            "description": "Vawtrak (Ruckguv payload) - Xchecked via VT: 9b11304e4362a8fbe2ee91d8e31d7ae5774019aaeef9240c6878da78bdf0bfa9",
            "pattern": "[file:hashes.MD5 = '8dc5fd222426538698ab5b7975ada717']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:27Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5739b5e3-a94c-4d1b-8d86-4f5002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:27.000Z",
            "modified": "2016-05-16T11:58:27.000Z",
            "first_observed": "2016-05-16T11:58:27Z",
            "last_observed": "2016-05-16T11:58:27Z",
            "number_observed": 1,
            "object_refs": [
                "url--5739b5e3-a94c-4d1b-8d86-4f5002de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5739b5e3-a94c-4d1b-8d86-4f5002de0b81",
            "value": "https://www.virustotal.com/file/9b11304e4362a8fbe2ee91d8e31d7ae5774019aaeef9240c6878da78bdf0bfa9/analysis/1463212109/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e4-3590-4015-a1de-4a0e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:28.000Z",
            "modified": "2016-05-16T11:58:28.000Z",
            "description": "Pony (Ruckguv module) - Xchecked via VT: 2ccebf5fee30073e849895c6e43f6519017f226281c80177d72febcfbaf1f0d3",
            "pattern": "[file:hashes.SHA1 = 'e5884dbd7b4504a95f7fe0c6db1b2f62b3cb96d2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e4-b2c0-4339-a778-48bb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:28.000Z",
            "modified": "2016-05-16T11:58:28.000Z",
            "description": "Pony (Ruckguv module) - Xchecked via VT: 2ccebf5fee30073e849895c6e43f6519017f226281c80177d72febcfbaf1f0d3",
            "pattern": "[file:hashes.MD5 = 'e7f103eacd306f9fa7484f3783ca40f0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5739b5e4-5af8-4ccc-bd61-496202de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:28.000Z",
            "modified": "2016-05-16T11:58:28.000Z",
            "first_observed": "2016-05-16T11:58:28Z",
            "last_observed": "2016-05-16T11:58:28Z",
            "number_observed": 1,
            "object_refs": [
                "url--5739b5e4-5af8-4ccc-bd61-496202de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5739b5e4-5af8-4ccc-bd61-496202de0b81",
            "value": "https://www.virustotal.com/file/2ccebf5fee30073e849895c6e43f6519017f226281c80177d72febcfbaf1f0d3/analysis/1463383601/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e4-3c40-40e7-84f7-474b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:28.000Z",
            "modified": "2016-05-16T11:58:28.000Z",
            "description": "Ruckguv - Xchecked via VT: 0b6e868c196c7ad80fac72a7d02159cfa4f72ad657604cd3e5eb03c796df01ba",
            "pattern": "[file:hashes.SHA1 = 'd7895d3b24fb1e4e4d62361fcd365ca3062acf62']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5739b5e4-f720-4f41-8d10-46cb02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:28.000Z",
            "modified": "2016-05-16T11:58:28.000Z",
            "description": "Ruckguv - Xchecked via VT: 0b6e868c196c7ad80fac72a7d02159cfa4f72ad657604cd3e5eb03c796df01ba",
            "pattern": "[file:hashes.MD5 = 'aebefd65569920aa7ae61171ebc65af6']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-05-16T11:58:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5739b5e4-3f5c-4b59-aa26-4f1e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2016-05-16T11:58:28.000Z",
            "modified": "2016-05-16T11:58:28.000Z",
            "first_observed": "2016-05-16T11:58:28Z",
            "last_observed": "2016-05-16T11:58:28Z",
            "number_observed": 1,
            "object_refs": [
                "url--5739b5e4-3f5c-4b59-aa26-4f1e02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5739b5e4-3f5c-4b59-aa26-4f1e02de0b81",
            "value": "https://www.virustotal.com/file/0b6e868c196c7ad80fac72a7d02159cfa4f72ad657604cd3e5eb03c796df01ba/analysis/1463383560/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}