{
    "type": "bundle",
    "id": "bundle--5c3c4a6d-15f0-4133-baff-3c2c68f8e8cf",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
            "created": "2019-01-15T20:44:35.000Z",
            "modified": "2019-01-15T20:44:35.000Z",
            "name": "VK-Intel",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5c3c4a6d-15f0-4133-baff-3c2c68f8e8cf",
            "created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
            "created": "2019-01-15T20:44:35.000Z",
            "modified": "2019-01-15T20:44:35.000Z",
            "name": "2019-01-10: North Korea Lazarus Targeting REDBANC",
            "published": "2019-01-15T20:45:39Z",
            "object_refs": [
                "indicator--5c3c4a99-8830-4833-81d5-3c3068f8e8cf",
                "indicator--5c3c4a99-9a68-4e6c-a9a4-3c3068f8e8cf",
                "indicator--5c3ca28f-cb88-44d1-a7ce-382d68f8e8cf",
                "indicator--5c3ca80f-b398-47e5-b633-124a0a640c05",
                "indicator--5c3ce1c9-39e4-4b59-90e4-5a350a640c05",
                "indicator--5c3ce1c9-4d80-470f-9cfc-5a350a640c05",
                "indicator--5c3ce207-b7f0-468f-8e5a-5a330a640c05"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "Actor: Lazarus",
                "Ruse: Job Application",
                "Powershell",
                "PowerRatankba",
                "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Trusted Relationship - T1199\"",
                "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\"",
                "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scheduled Task - T1053\"",
                "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Windows Management Instrumentation - T1047\"",
                "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"New Service - T1050\"",
                "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data from Local System - T1005\"",
                "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"",
                "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data Encoding - T1132\"",
                "report:5ZvWjgDgRhuD1zVgDT7-cg"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5c3c4a99-8830-4833-81d5-3c3068f8e8cf",
            "created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
            "created": "2019-01-14T08:38:49.000Z",
            "modified": "2019-01-14T08:38:49.000Z",
            "description": "Malware Hash",
            "pattern": "[file:hashes.SHA256 = 'f12db45c32bda3108adb8ae7363c342fdd5f10342945b115d830701f95c54fa9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-01-14T08:38:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload installation"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload installation\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5c3c4a99-9a68-4e6c-a9a4-3c3068f8e8cf",
            "created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
            "created": "2019-01-14T08:38:49.000Z",
            "modified": "2019-01-14T08:38:49.000Z",
            "description": "Malware Hash",
            "pattern": "[file:hashes.SHA256 = '0f56ebca33efe0a2755d3b380167e1f5eab4e6180518c03b28d5cffd5b675d26']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-01-14T08:38:49Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload installation"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload installation\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5c3ca28f-cb88-44d1-a7ce-382d68f8e8cf",
            "created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
            "created": "2019-01-14T14:54:07.000Z",
            "modified": "2019-01-14T14:54:07.000Z",
            "description": "C2",
            "pattern": "[url:value = 'https://ecombox.store']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-01-14T14:54:07Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5c3ca80f-b398-47e5-b633-124a0a640c05",
            "created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
            "created": "2019-01-14T15:17:35.000Z",
            "modified": "2019-01-14T15:17:35.000Z",
            "description": "apt_possible_lazarus_powerratankba_b",
            "pattern": "[rule apt_possible_lazarus_powerratankba_b {\r\n   meta:\r\n      description = \"Detects possible Lazarus PowerRatankba.B from Redbanc\"\r\n      author = \"@VK_Intel\"\r\n      date = \"2019-01-15\"\r\n      hash1 = \"db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471\"\r\n   strings:\r\n      $f0 = \"function EncryptDES\" fullword ascii\r\n      $s0 = \"$ProID = Start-Process powershell.exe -PassThru -WindowStyle Hidden -ArgumentList\" fullword ascii\r\n      $s1 = \"$respTxt = HttpRequestFunc_doprocess -szURI $szFullURL -szMethod $szMethod -contentData $contentData;\" fullword ascii\r\n      $s2 = \"$cmdSchedule = 'schtasks /create /tn \\\"ProxyServerUpdater\\\"\" ascii\r\n      $s3 = \"/tr \\\"powershell.exe -ep bypass -windowstyle hidden -file \" ascii\r\n      $s4 = \"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\tmp' + -join \" ascii\r\n      $s5 = \"$cmdResult = cmd.exe /c $cmdInst | Out-String;\" fullword ascii\r\n      $s6 = \"whoami /groups | findstr /c:\\\"S-1-5-32-544\\\"\" fullword ascii\r\n   condition:\r\n      filesize < 500KB and $f0 and 2 of ($s*) \r\n}]",
            "pattern_type": "yara",
            "pattern_version": "2.1",
            "valid_from": "2019-01-14T15:17:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload installation"
                }
            ],
            "labels": [
                "misp:type=\"yara\"",
                "misp:category=\"Payload installation\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5c3ce1c9-39e4-4b59-90e4-5a350a640c05",
            "created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
            "created": "2019-01-14T19:23:53.000Z",
            "modified": "2019-01-14T19:23:53.000Z",
            "description": "Powershell Agent & PowerRatankba",
            "pattern": "[file:hashes.SHA256 = 'a1f06d69bd6379e310b10a364d689f21499953fa1118ec699a25072779de5d9b']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-01-14T19:23:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload installation"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload installation\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5c3ce1c9-4d80-470f-9cfc-5a350a640c05",
            "created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
            "created": "2019-01-14T19:23:53.000Z",
            "modified": "2019-01-14T19:23:53.000Z",
            "description": "Powershell Agent & PowerRatankba",
            "pattern": "[file:hashes.SHA256 = '20d94f7d8ee2c4367443a930370d5685789762b1d11794810dc0ac6c626ad78e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-01-14T19:23:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload installation"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload installation\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5c3ce207-b7f0-468f-8e5a-5a330a640c05",
            "created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
            "created": "2019-01-14T19:24:55.000Z",
            "modified": "2019-01-14T19:24:55.000Z",
            "description": "URL C2 backup",
            "pattern": "[url:value = 'https://bodyshoppechiropractic.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2019-01-14T19:24:55Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"url\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        }
    ]
}