{
    "type": "bundle",
    "id": "bundle--67a072d6-3d20-4024-a987-e8fdd226a075",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:33:15.000Z",
            "modified": "2021-09-24T11:33:15.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--67a072d6-3d20-4024-a987-e8fdd226a075",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:33:15.000Z",
            "modified": "2021-09-24T11:33:15.000Z",
            "name": "OINT - Hunting the LockBit Gang's Exfiltration Infrastructures",
            "published": "2021-09-24T11:33:58Z",
            "object_refs": [
                "indicator--e39a0bc6-1c17-4140-90e6-fb666a18656a",
                "indicator--e0ae17e9-70bd-4658-9081-e574de50c7e3",
                "indicator--52341d24-db0a-4986-8ae7-e5a41470af42",
                "indicator--5a132e8b-4c3d-465d-80ae-e0bc6ca58539",
                "indicator--1216e548-904e-4ecf-a555-7c26c252b1f5",
                "indicator--74318782-3963-4bf0-a05a-5e1b521848f4",
                "indicator--2ae99a2e-b481-4ecb-8b60-a17f27074fb2",
                "indicator--eb2d689a-8e74-4fe6-b946-c3f42662991d",
                "indicator--921f22a5-a91b-4f7b-9eb5-257bcdfefabe",
                "indicator--4f06c42c-5ae6-4784-8800-fdcc4602311c",
                "indicator--8e42a2bd-d045-4637-be61-d977ac772520",
                "x-misp-object--3bf4d3f5-1fc4-416d-82e7-1256c414d586",
                "indicator--14ee13d7-f50b-43c2-bd59-b2cee7da5e0c",
                "x-misp-object--0cc67ce9-1478-4186-b238-1b0976b5f000",
                "indicator--2a7ba125-5243-4307-832f-ed6f4e151811",
                "x-misp-object--c1cb1e2d-f442-44ab-b0cd-0c854425224d",
                "indicator--7b5ac8f0-84fd-4af7-8675-cf862b9b136d",
                "x-misp-object--22769623-8b09-4ba1-83b7-0bc2a8286bde",
                "indicator--51d2e58e-0751-46d4-9936-fddc400038a6",
                "x-misp-object--55a53192-11c2-472a-b67b-d79b60f770df",
                "indicator--1982dc46-e555-4570-a843-a60665c080a5",
                "x-misp-object--904afda5-6bce-4a55-831b-2d892d11a9c6",
                "indicator--7780679f-3c18-489d-b916-97e4a7454d41",
                "x-misp-object--761f67ec-f15e-4c8c-bada-7c3280b95569",
                "x-misp-object--163dadab-2ccf-4d97-ac79-4663b4cc73be",
                "relationship--56ff37ee-9692-45bc-85fa-1b3b81344b4d",
                "relationship--75362434-3078-4393-9b19-bc44b08a020e",
                "relationship--06998f90-ac9f-4746-a7f2-41154afcaa84",
                "relationship--4bfbaf17-81e8-47ab-b4b7-415f235edd4c",
                "relationship--93a40308-6afb-460d-9455-3dcba106f06c",
                "relationship--13da4e0e-88f1-409d-b120-50c1bc529c8f",
                "relationship--b7522c98-7e8f-4bd4-b5bd-4b6e739e720f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT",
                "osint:lifetime=\"perpetual\"",
                "osint:certainty=\"50\"",
                "misp-galaxy:malpedia=\"LockBit\"",
                "misp-galaxy:ransomware=\"LockBit\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--e39a0bc6-1c17-4140-90e6-fb666a18656a",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:16:29.000Z",
            "modified": "2021-09-24T11:16:29.000Z",
            "pattern": "[file:hashes.SHA256 = '3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:16:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--e0ae17e9-70bd-4658-9081-e574de50c7e3",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:16:29.000Z",
            "modified": "2021-09-24T11:16:29.000Z",
            "pattern": "[file:hashes.SHA256 = '2f18e61e3d9189f6ff5cc95252396bebaefe0d76596cc51cf0ade6a5156c6f66']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:16:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--52341d24-db0a-4986-8ae7-e5a41470af42",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:16:29.000Z",
            "modified": "2021-09-24T11:16:29.000Z",
            "pattern": "[file:hashes.SHA256 = '4db7eeed852946803c16373a085c1bb5f79b60d2122d6fc9a2703714cdd9dac0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:16:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a132e8b-4c3d-465d-80ae-e0bc6ca58539",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:16:29.000Z",
            "modified": "2021-09-24T11:16:29.000Z",
            "pattern": "[file:hashes.SHA256 = '07a3dcb8d9b062fb480692fa33d12da05c21f544492cbaf9207956ac647ba9ae']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:16:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--1216e548-904e-4ecf-a555-7c26c252b1f5",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:16:29.000Z",
            "modified": "2021-09-24T11:16:29.000Z",
            "pattern": "[file:hashes.SHA256 = 'bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:16:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--74318782-3963-4bf0-a05a-5e1b521848f4",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:16:29.000Z",
            "modified": "2021-09-24T11:16:29.000Z",
            "pattern": "[file:hashes.SHA256 = 'ced3de74196b2fac18e010d2e575335e2af320110d3fdaff09a33165edb43ca2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:16:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2ae99a2e-b481-4ecb-8b60-a17f27074fb2",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:16:29.000Z",
            "modified": "2021-09-24T11:16:29.000Z",
            "pattern": "[file:hashes.SHA256 = '107d9fce05ff8296d0417a5a830d180cd46aa120ced8360df3ebfd15cb550636']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:16:29Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--eb2d689a-8e74-4fe6-b946-c3f42662991d",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:16:43.000Z",
            "modified": "2021-09-24T11:16:43.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '139.60.160.200']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:16:43Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--921f22a5-a91b-4f7b-9eb5-257bcdfefabe",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:16:43.000Z",
            "modified": "2021-09-24T11:16:43.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '168.100.11.72']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:16:43Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--4f06c42c-5ae6-4784-8800-fdcc4602311c",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:16:43.000Z",
            "modified": "2021-09-24T11:16:43.000Z",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '174.138.62.35']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:16:43Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--8e42a2bd-d045-4637-be61-d977ac772520",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:09.000Z",
            "modified": "2021-09-24T11:18:09.000Z",
            "pattern": "[file:hashes.MD5 = '15a6d62854e3e7221589b9b6e8e395af' AND file:hashes.SHA1 = '635e321bcab27f22e0303da26198ac90381608a4' AND file:hashes.SHA256 = 'bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:18:09Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--3bf4d3f5-1fc4-416d-82e7-1256c414d586",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:09.000Z",
            "modified": "2021-09-24T11:18:09.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2021-09-07T15:08:37+00:00",
                    "category": "Other",
                    "uuid": "2825847a-a8f5-4a69-b14a-6429116fdabd"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/gui/file/bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e/detection/f-bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e-1631027317",
                    "category": "Payload delivery",
                    "uuid": "8558603d-e1fc-425f-ae3a-d8541bcf4c18"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "50/68",
                    "category": "Payload delivery",
                    "uuid": "f97bc646-3448-4f89-93c4-239c8de531f9"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--14ee13d7-f50b-43c2-bd59-b2cee7da5e0c",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:09.000Z",
            "modified": "2021-09-24T11:18:09.000Z",
            "pattern": "[file:hashes.MD5 = '9b905a490a98cd8edf2e4b09ac8676ab' AND file:hashes.SHA1 = '63632224f977aaaa1c7d88be65cf16878b4bef56' AND file:hashes.SHA256 = '3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:18:09Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--0cc67ce9-1478-4186-b238-1b0976b5f000",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:09.000Z",
            "modified": "2021-09-24T11:18:09.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2021-09-17T07:49:48+00:00",
                    "category": "Other",
                    "uuid": "66961aff-b661-41c1-a48a-deec362f44b5"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/gui/file/3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d/detection/f-3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d-1631864988",
                    "category": "Payload delivery",
                    "uuid": "54a1ca39-a9d2-4ed6-be2d-034814ab9817"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "51/67",
                    "category": "Payload delivery",
                    "uuid": "1d36d653-cdd7-430e-a863-3e8901b4cb1e"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2a7ba125-5243-4307-832f-ed6f4e151811",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:09.000Z",
            "modified": "2021-09-24T11:18:09.000Z",
            "pattern": "[file:hashes.MD5 = '96076497841f73da57d4d69dd9cc2f8a' AND file:hashes.SHA1 = '87a14a0464e55581748d3396881aa36a57383132' AND file:hashes.SHA256 = '2f18e61e3d9189f6ff5cc95252396bebaefe0d76596cc51cf0ade6a5156c6f66']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:18:09Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--c1cb1e2d-f442-44ab-b0cd-0c854425224d",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:09.000Z",
            "modified": "2021-09-24T11:18:09.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2021-08-25T14:22:39+00:00",
                    "category": "Other",
                    "uuid": "f3328bf9-81fe-49c6-b198-33bc0d9c9fc5"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/gui/file/2f18e61e3d9189f6ff5cc95252396bebaefe0d76596cc51cf0ade6a5156c6f66/detection/f-2f18e61e3d9189f6ff5cc95252396bebaefe0d76596cc51cf0ade6a5156c6f66-1629901359",
                    "category": "Payload delivery",
                    "uuid": "53a6ac33-f31b-4ff6-8f3d-5acab324ed6d"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "46/68",
                    "category": "Payload delivery",
                    "uuid": "77974b56-a53c-4985-b12b-fd968dd478a4"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--7b5ac8f0-84fd-4af7-8675-cf862b9b136d",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:09.000Z",
            "modified": "2021-09-24T11:18:09.000Z",
            "pattern": "[file:hashes.MD5 = 'b776a331c15131ff66ae7df73968e023' AND file:hashes.SHA1 = '419a7631f06ed78a711f18323f5dee882daaa409' AND file:hashes.SHA256 = '07a3dcb8d9b062fb480692fa33d12da05c21f544492cbaf9207956ac647ba9ae']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:18:09Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--22769623-8b09-4ba1-83b7-0bc2a8286bde",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:09.000Z",
            "modified": "2021-09-24T11:18:09.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2021-08-25T10:15:50+00:00",
                    "category": "Other",
                    "uuid": "18c0c756-0e9a-4077-84d0-6c95cdd3bcd3"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/gui/file/07a3dcb8d9b062fb480692fa33d12da05c21f544492cbaf9207956ac647ba9ae/detection/f-07a3dcb8d9b062fb480692fa33d12da05c21f544492cbaf9207956ac647ba9ae-1629886550",
                    "category": "Payload delivery",
                    "uuid": "456d8abc-e903-443e-ba6d-4563b72b5f07"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "51/68",
                    "category": "Payload delivery",
                    "uuid": "0836a9ed-fb1b-4074-8cee-2983e9002cce"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--51d2e58e-0751-46d4-9936-fddc400038a6",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "pattern": "[file:hashes.MD5 = '4d7bc02fe04b87e4369f97b3918fff9b' AND file:hashes.SHA1 = 'dfc86741de088efc27b954f62db8a7e53842d179' AND file:hashes.SHA256 = 'ced3de74196b2fac18e010d2e575335e2af320110d3fdaff09a33165edb43ca2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:18:10Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--55a53192-11c2-472a-b67b-d79b60f770df",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2021-08-21T07:19:02+00:00",
                    "category": "Other",
                    "uuid": "5c573df6-9cfe-489c-9be4-283dc6b2fa56"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/gui/file/ced3de74196b2fac18e010d2e575335e2af320110d3fdaff09a33165edb43ca2/detection/f-ced3de74196b2fac18e010d2e575335e2af320110d3fdaff09a33165edb43ca2-1629530342",
                    "category": "Payload delivery",
                    "uuid": "f10ab816-ccc4-48cf-b4a2-658f6fbd0a94"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "39/67",
                    "category": "Payload delivery",
                    "uuid": "1742237f-5d1d-4f38-aafb-d5365c3f1709"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--1982dc46-e555-4570-a843-a60665c080a5",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "pattern": "[file:hashes.MD5 = '1e2e2f39ab6988a9f3852f1ec02ab05a' AND file:hashes.SHA1 = 'ed61f731ae7f3d238a28e90ff0b4c7d52cea508e' AND file:hashes.SHA256 = '107d9fce05ff8296d0417a5a830d180cd46aa120ced8360df3ebfd15cb550636']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:18:10Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--904afda5-6bce-4a55-831b-2d892d11a9c6",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2021-09-09T05:05:25+00:00",
                    "category": "Other",
                    "uuid": "84ab5968-fe4c-4ffe-b8bd-0391124f57bb"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/gui/file/107d9fce05ff8296d0417a5a830d180cd46aa120ced8360df3ebfd15cb550636/detection/f-107d9fce05ff8296d0417a5a830d180cd46aa120ced8360df3ebfd15cb550636-1631163925",
                    "category": "Payload delivery",
                    "uuid": "b82d5f68-fe0d-4b05-b647-4183be1c0b92"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "37/68",
                    "category": "Payload delivery",
                    "uuid": "5e44ddc0-83fb-472a-b8bc-3230290a9c6d"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--7780679f-3c18-489d-b916-97e4a7454d41",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "pattern": "[file:hashes.MD5 = 'f05af511670dba679d845e3d477e789d' AND file:hashes.SHA1 = '199d193f31fd7d117070a66e89c4839dddd513b2' AND file:hashes.SHA256 = '4db7eeed852946803c16373a085c1bb5f79b60d2122d6fc9a2703714cdd9dac0']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2021-09-24T11:18:10Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--761f67ec-f15e-4c8c-bada-7c3280b95569",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2021-08-19T03:53:10+00:00",
                    "category": "Other",
                    "uuid": "8bd35604-8b8a-436d-b369-b8f8df90767e"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/gui/file/4db7eeed852946803c16373a085c1bb5f79b60d2122d6fc9a2703714cdd9dac0/detection/f-4db7eeed852946803c16373a085c1bb5f79b60d2122d6fc9a2703714cdd9dac0-1629345190",
                    "category": "Payload delivery",
                    "uuid": "ca5d88be-f595-4578-a53f-3adaf452fdd9"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "42/69",
                    "category": "Payload delivery",
                    "uuid": "870020b9-0895-469f-a742-371e472f3bc5"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--163dadab-2ccf-4d97-ac79-4663b4cc73be",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-09-24T11:19:28.000Z",
            "modified": "2021-09-24T11:19:28.000Z",
            "labels": [
                "misp:name=\"report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "text",
                    "object_relation": "summary",
                    "value": "Yoroi analyzes the StealBit tool. A malicious tool used by the LockBit gang to exfiltrate data on infected systems.",
                    "category": "Other",
                    "uuid": "479e8059-6d48-420b-b125-97e75d0b6988"
                },
                {
                    "type": "link",
                    "object_relation": "link",
                    "value": "https://otx.alienvault.com/pulse/614da70c04133b145bebfdb0",
                    "category": "External analysis",
                    "uuid": "f83af3e9-1a08-41f3-b463-21c78df93ffd"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "report"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--56ff37ee-9692-45bc-85fa-1b3b81344b4d",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--8e42a2bd-d045-4637-be61-d977ac772520",
            "target_ref": "x-misp-object--3bf4d3f5-1fc4-416d-82e7-1256c414d586"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--75362434-3078-4393-9b19-bc44b08a020e",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--14ee13d7-f50b-43c2-bd59-b2cee7da5e0c",
            "target_ref": "x-misp-object--0cc67ce9-1478-4186-b238-1b0976b5f000"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--06998f90-ac9f-4746-a7f2-41154afcaa84",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--2a7ba125-5243-4307-832f-ed6f4e151811",
            "target_ref": "x-misp-object--c1cb1e2d-f442-44ab-b0cd-0c854425224d"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4bfbaf17-81e8-47ab-b4b7-415f235edd4c",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--7b5ac8f0-84fd-4af7-8675-cf862b9b136d",
            "target_ref": "x-misp-object--22769623-8b09-4ba1-83b7-0bc2a8286bde"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--93a40308-6afb-460d-9455-3dcba106f06c",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--51d2e58e-0751-46d4-9936-fddc400038a6",
            "target_ref": "x-misp-object--55a53192-11c2-472a-b67b-d79b60f770df"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--13da4e0e-88f1-409d-b120-50c1bc529c8f",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--1982dc46-e555-4570-a843-a60665c080a5",
            "target_ref": "x-misp-object--904afda5-6bce-4a55-831b-2d892d11a9c6"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b7522c98-7e8f-4bd4-b5bd-4b6e739e720f",
            "created": "2021-09-24T11:18:10.000Z",
            "modified": "2021-09-24T11:18:10.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--7780679f-3c18-489d-b916-97e4a7454d41",
            "target_ref": "x-misp-object--761f67ec-f15e-4c8c-bada-7c3280b95569"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}