{
    "type": "bundle",
    "id": "bundle--59d4e235-c71c-4d0e-8ba3-920c950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--59d4e235-c71c-4d0e-8ba3-920c950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "name": "OSINT - Malicious Chrome Extensions Stealing Roblox In-Game Currency, Sending Cookies via Discord",
            "published": "2017-10-04T17:28:38Z",
            "object_refs": [
                "observed-data--59d4e258-5a54-41aa-868e-ef0b950d210f",
                "url--59d4e258-5a54-41aa-868e-ef0b950d210f",
                "x-misp-attribute--59d4e404-be44-4e16-b6c3-b83b950d210f",
                "indicator--59d4e425-b328-4b76-b5e9-3f50950d210f",
                "indicator--59d4e425-1144-47c5-8833-3f50950d210f",
                "indicator--59d4e425-0c38-4ed1-bd79-3f50950d210f",
                "indicator--59d4e425-c98c-4588-8d41-3f50950d210f",
                "indicator--59d4e425-9594-474f-8ee1-3f50950d210f",
                "indicator--59d4e425-836c-4050-95ca-3f50950d210f",
                "indicator--59d4e425-63fc-4e16-bc14-3f50950d210f",
                "indicator--59d4e425-07ec-4e8b-960b-3f50950d210f",
                "indicator--59d4e425-5918-432e-a551-3f50950d210f",
                "indicator--59d51a40-78a4-47e6-8d7d-45d702de0b81",
                "indicator--59d51a40-f80c-419e-b758-4b6802de0b81",
                "observed-data--59d51a40-6988-4a79-8984-481b02de0b81",
                "url--59d51a40-6988-4a79-8984-481b02de0b81",
                "indicator--59d51a40-bd94-4247-bdc7-470f02de0b81",
                "indicator--59d51a40-5020-4fac-b79f-484e02de0b81",
                "observed-data--59d51a40-c028-406c-a257-45a102de0b81",
                "url--59d51a40-c028-406c-a257-45a102de0b81",
                "indicator--59d51a40-caa0-4640-8256-4c1702de0b81",
                "indicator--59d51a40-2a00-40e0-9edb-469902de0b81",
                "observed-data--59d51a41-d934-4f2c-8e76-44d802de0b81",
                "url--59d51a41-d934-4f2c-8e76-44d802de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT",
                "osint:source-type=\"blog-post\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d4e258-5a54-41aa-868e-ef0b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "first_observed": "2017-10-04T17:28:32Z",
            "last_observed": "2017-10-04T17:28:32Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d4e258-5a54-41aa-868e-ef0b950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d4e258-5a54-41aa-868e-ef0b950d210f",
            "value": "http://blog.trendmicro.com/trendlabs-security-intelligence/malicous-chrome-extensions-stealing-roblox-game-currency-sending-cookies-via-discord/"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--59d4e404-be44-4e16-b6c3-b83b950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"External analysis\"",
                "osint:source-type=\"blog-post\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "comment",
            "x_misp_value": "We recently discussed how cyber criminals are using the popular voice/chat client Discord to steal cookies from the running Roblox process on a Windows PC. Since then, we\u00e2\u20ac\u2122ve noticed another attack going after the same information, only this time it is via Chrome extensions (CRX files).\r\n\r\nWhile it currently only targets Roblox users, the same technique can be used to steal cookies from any website. The stolen information is sent via Discord, but this could also be configured to use other chat platforms. We learned this particular Chrome extension was, in fact, for sale on the Dream Market underground marketplace for only 99 cents"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4e425-b328-4b76-b5e9-3f50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "pattern": "[file:name = 'ROBLOX BOT.zip']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4e425-1144-47c5-8833-3f50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "pattern": "[file:name = 'Crm5extension.crx']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4e425-0c38-4ed1-bd79-3f50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "pattern": "[file:name = 'Roblox Enhancer.crx']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4e425-c98c-4588-8d41-3f50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "pattern": "[file:name = 'danktrades.zip']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4e425-9594-474f-8ee1-3f50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "pattern": "[file:name = 'bgWork.js']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4e425-836c-4050-95ca-3f50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "pattern": "[domain-name:value = '3rmillion.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4e425-63fc-4e16-bc14-3f50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "pattern": "[file:hashes.SHA256 = '0061a5f52c5b577f679e81da3ab3ad3803c20e345c16ffc4dbc8b76386d42a00']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4e425-07ec-4e8b-960b-3f50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "pattern": "[file:hashes.SHA256 = '4c4af30a94cd25b23579e12b64191a056bda3c51b6e531a2202d3863b19432b3']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d4e425-5918-432e-a551-3f50950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "pattern": "[file:hashes.SHA256 = 'd9f21e401ef0197a2af66133e3f7fc3a4ea3efb4437884a4383076bad4060b02']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d51a40-78a4-47e6-8d7d-45d702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "description": "- Xchecked via VT: d9f21e401ef0197a2af66133e3f7fc3a4ea3efb4437884a4383076bad4060b02",
            "pattern": "[file:hashes.SHA1 = '92d2ac44f7b11749fe040ab438ee736866edeafb']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d51a40-f80c-419e-b758-4b6802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "description": "- Xchecked via VT: d9f21e401ef0197a2af66133e3f7fc3a4ea3efb4437884a4383076bad4060b02",
            "pattern": "[file:hashes.MD5 = '98f2e06a90a8d762a05fc7deeb74093f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d51a40-6988-4a79-8984-481b02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "first_observed": "2017-10-04T17:28:32Z",
            "last_observed": "2017-10-04T17:28:32Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d51a40-6988-4a79-8984-481b02de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d51a40-6988-4a79-8984-481b02de0b81",
            "value": "https://www.virustotal.com/file/d9f21e401ef0197a2af66133e3f7fc3a4ea3efb4437884a4383076bad4060b02/analysis/1503970956/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d51a40-bd94-4247-bdc7-470f02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "description": "- Xchecked via VT: 4c4af30a94cd25b23579e12b64191a056bda3c51b6e531a2202d3863b19432b3",
            "pattern": "[file:hashes.SHA1 = 'aef1f023f744bb3fe1ab8616d9d44391d6a0a03e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d51a40-5020-4fac-b79f-484e02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "description": "- Xchecked via VT: 4c4af30a94cd25b23579e12b64191a056bda3c51b6e531a2202d3863b19432b3",
            "pattern": "[file:hashes.MD5 = '178e598baf688ca318482751d38b5f33']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d51a40-c028-406c-a257-45a102de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "first_observed": "2017-10-04T17:28:32Z",
            "last_observed": "2017-10-04T17:28:32Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d51a40-c028-406c-a257-45a102de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d51a40-c028-406c-a257-45a102de0b81",
            "value": "https://www.virustotal.com/file/4c4af30a94cd25b23579e12b64191a056bda3c51b6e531a2202d3863b19432b3/analysis/1503951674/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d51a40-caa0-4640-8256-4c1702de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "description": "- Xchecked via VT: 0061a5f52c5b577f679e81da3ab3ad3803c20e345c16ffc4dbc8b76386d42a00",
            "pattern": "[file:hashes.SHA1 = '1bbf468286a00175ef032063f6b01c4c958a6b3a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha1\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--59d51a40-2a00-40e0-9edb-469902de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:32.000Z",
            "modified": "2017-10-04T17:28:32.000Z",
            "description": "- Xchecked via VT: 0061a5f52c5b577f679e81da3ab3ad3803c20e345c16ffc4dbc8b76386d42a00",
            "pattern": "[file:hashes.MD5 = '0574437b0e697cf884726bb5e321be80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2017-10-04T17:28:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--59d51a41-d934-4f2c-8e76-44d802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2017-10-04T17:28:33.000Z",
            "modified": "2017-10-04T17:28:33.000Z",
            "first_observed": "2017-10-04T17:28:33Z",
            "last_observed": "2017-10-04T17:28:33Z",
            "number_observed": 1,
            "object_refs": [
                "url--59d51a41-d934-4f2c-8e76-44d802de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--59d51a41-d934-4f2c-8e76-44d802de0b81",
            "value": "https://www.virustotal.com/file/0061a5f52c5b577f679e81da3ab3ad3803c20e345c16ffc4dbc8b76386d42a00/analysis/1504020369/"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}