{
    "type": "bundle",
    "id": "bundle--5b0438ad-6d20-4a53-9a8b-2c1c0acd0835",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2021-05-24T09:48:49.000Z",
            "modified": "2021-05-24T09:48:49.000Z",
            "name": "Synovus Financial",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5b0438ad-6d20-4a53-9a8b-2c1c0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2021-05-24T09:48:49.000Z",
            "modified": "2021-05-24T09:48:49.000Z",
            "name": "Emotet 5-18-2018",
            "published": "2020-05-11T07:55:59Z",
            "object_refs": [
                "indicator--5b0438c4-c7ac-49a6-b78f-2c420acd0835",
                "indicator--5b0438c4-20f0-4baa-b9ad-2c420acd0835",
                "indicator--5b0438c4-1464-4a92-bcd8-2c420acd0835",
                "indicator--5b0438c4-6724-4133-9846-2c420acd0835",
                "indicator--5b0438c4-caf4-4260-a33f-2c420acd0835",
                "indicator--5b0438c4-6944-4ac5-bb83-2c420acd0835",
                "indicator--5b0438c4-fa54-4b42-a740-2c420acd0835",
                "indicator--5b0438c4-6978-4f21-8e03-2c420acd0835",
                "indicator--5b0438c4-5114-4463-aac3-2c420acd0835",
                "indicator--5b0438c4-a450-43be-80a9-2c420acd0835",
                "indicator--5b0438c4-b090-4a74-bec9-2c420acd0835",
                "indicator--5b0438c4-7ed0-41b4-aa42-2c420acd0835",
                "indicator--5b0438c4-7444-4a71-a9d9-2c420acd0835",
                "indicator--5b0438c4-f0a0-46ed-8938-2c420acd0835",
                "indicator--5b0438c4-9548-496f-96fb-2c420acd0835",
                "indicator--5b0438c4-2c44-4426-895e-2c420acd0835",
                "indicator--5b0438c4-4c8c-4d5e-b966-2c420acd0835",
                "indicator--5b0438c4-b078-43e2-9d5d-2c420acd0835",
                "indicator--5b0438c5-fbd8-4d17-bb11-2c420acd0835",
                "indicator--5b0438d9-9b24-475a-9eb1-08ef0acd0835",
                "indicator--5b0438d9-ae60-4a28-b202-08ef0acd0835",
                "observed-data--5b0438e9-88c4-4681-aa0b-2c060acd0835",
                "url--5b0438e9-88c4-4681-aa0b-2c060acd0835",
                "indicator--5b043a2d-d2e0-4a3a-a20f-2ade0acd0835",
                "indicator--5b043a2d-6a18-4b90-b690-2ade0acd0835",
                "indicator--5b043a2d-cc18-4e88-95f6-2ade0acd0835",
                "indicator--5b043a2d-6720-440e-a5c4-2ade0acd0835",
                "indicator--5b043a2e-b2f8-4984-9875-2ade0acd0835",
                "indicator--5b043a2e-ba3c-44c1-8389-2ade0acd0835",
                "indicator--5b043a2e-c00c-4b03-9b9d-2ade0acd0835",
                "indicator--5b043a2e-aeac-4727-aa52-2ade0acd0835",
                "indicator--5b043a2e-1968-4be5-a86d-2ade0acd0835",
                "indicator--5b043935-825c-49d4-b93c-08ef0acd0835"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "misp-galaxy:tool=\"Emotet\"",
                "osint:source-type=\"pastie-website\"",
                "osint:source-type=\"microblog-post\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-c7ac-49a6-b78f-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:41.000Z",
            "modified": "2018-05-22T15:47:41.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '50.37.10.78' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:41Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-20f0-4baa-b9ad-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '50.84.214.74' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-1464-4a92-bcd8-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '65.25.17.131' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-6724-4133-9846-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '67.20.224.109' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-caf4-4260-a33f-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '69.129.91.38' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-6944-4ac5-bb83-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '70.167.17.7' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-fa54-4b42-a740-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '72.49.55.42' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-6978-4f21-8e03-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '86.209.63.166' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-5114-4463-aac3-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '105.228.39.7' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-a450-43be-80a9-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '119.18.8.51' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-b090-4a74-bec9-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:41.000Z",
            "modified": "2018-05-22T15:47:41.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '169.0.250.138' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:41Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-7ed0-41b4-aa42-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '179.52.46.11' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-7444-4a71-a9d9-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '192.227.112.57' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-f0a0-46ed-8938-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '199.167.209.11' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-9548-496f-96fb-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '222.112.169.133' AND network-traffic:dst_port = '80']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-2c44-4426-895e-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '37.120.170.231' AND network-traffic:dst_port = '443']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-4c8c-4d5e-b966-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '174.140.167.85' AND network-traffic:dst_port = '443']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c4-b078-43e2-9d5d-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.226.223.31' AND network-traffic:dst_port = '443']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438c5-fbd8-4d17-bb11-2c420acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:47:42.000Z",
            "modified": "2018-05-22T15:47:42.000Z",
            "description": "Emotet",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '217.160.93.187' AND network-traffic:dst_port = '443']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:47:42Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst|port\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "veris:action:malware:variety=\"C2\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438d9-9b24-475a-9eb1-08ef0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://lemat.sk/YQJHmA']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b0438d9-ae60-4a28-b202-08ef0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://columbiainstitute.org/O/YBC4RQ/']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5b0438e9-88c4-4681-aa0b-2c060acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:42:18.000Z",
            "modified": "2018-05-22T15:42:18.000Z",
            "first_observed": "2018-05-22T15:42:18Z",
            "last_observed": "2018-05-22T15:42:18Z",
            "number_observed": 1,
            "object_refs": [
                "url--5b0438e9-88c4-4681-aa0b-2c060acd0835"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"Support Tool\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5b0438e9-88c4-4681-aa0b-2c060acd0835",
            "value": "https://www.virustotal.com/#/file/1b9e1f248b3dd13e0c8668117caa7f8af1e34918f1e9ac6f71d619e50fd91538/detection"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b043a2d-d2e0-4a3a-a20f-2ade0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://emulsiflex.com/Wz51Bq1/']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b043a2d-6a18-4b90-b690-2ade0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://e-muhr.de/IcS1A5z/']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b043a2d-cc18-4e88-95f6-2ade0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://emulsiflex.com/Wz51Bq1']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b043a2d-6720-440e-a5c4-2ade0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://lemat.sk/YQJHmA/']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b043a2e-b2f8-4984-9875-2ade0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://columbiainstitute.org/O/YBC4RQ']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b043a2e-ba3c-44c1-8389-2ade0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://sweatshop.org/dnqN0nl']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b043a2e-c00c-4b03-9b9d-2ade0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://www.gardonyrefhir.hu/gmQuF9x']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b043a2e-aeac-4727-aa52-2ade0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://sweatshop.org/dnqN0nl/']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b043a2e-1968-4be5-a86d-2ade0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:48:33.000Z",
            "modified": "2018-05-22T15:48:33.000Z",
            "description": "Emotet",
            "pattern": "[url:value = 'http://e-muhr.de/IcS1A5z']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:48:33Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\"",
                "adversary:infrastructure-status=\"compromised\"",
                "diamond-model:Infrastructure"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5b043935-825c-49d4-b93c-08ef0acd0835",
            "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
            "created": "2018-05-22T15:37:25.000Z",
            "modified": "2018-05-22T15:37:25.000Z",
            "pattern": "[file:hashes.MD5 = '923a8d46eca1e77e020e0ac0951226d8' AND file:hashes.SHA1 = '45ef0de6aa324ebebdf9ba61129cd316e19973ae' AND file:hashes.SHA256 = '1b9e1f248b3dd13e0c8668117caa7f8af1e34918f1e9ac6f71d619e50fd91538' AND file:hashes.SSDEEP = '3072:8ZL3fu/kIS5c7+iMfmGkV1C5o63qaGymSUO:G0fac7Kflgao63qaGLS' AND file:name = '22468.exe' AND file:x_misp_text = 'Emotet' AND file:x_misp_state = 'Malicious']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-05-22T15:37:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}