MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2025-03-01 14:59:46 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions1

cryptomix - update

Browse source
This commit is contained in:
Deborah Servili 2017-11-22 13:46:50 +01:00
parent 1bd8293901
commit 1cb62212ca
1 changed files with 6 additions and 3 deletions

9
clusters/ransomware.json
View file

@ -5020,7 +5020,8 @@
".email[supl0@post.com]id[\\[[a-z0-9]{16}\\]].lesli", ".email[supl0@post.com]id[\\[[a-z0-9]{16}\\]].lesli",
"*filename*.email[*email*]_id[*id*].rdmk", "*filename*.email[*email*]_id[*id*].rdmk",
".EMPTY", ".EMPTY",
".0000" ".0000",
".XZZX"
], ],
"ransomnotes": [ "ransomnotes": [
"HELP_YOUR_FILES.html (CryptXXX)", "HELP_YOUR_FILES.html (CryptXXX)",
@ -5030,14 +5031,16 @@
"_HELP_INSTRUCTION.TXT", "_HELP_INSTRUCTION.TXT",
"C:\\ProgramData\\[random].exe", "C:\\ProgramData\\[random].exe",
"Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\nempty01@techmail.info\n\nempty02@yahooweb.co\n\nempty003@protonmail.com\n\nWe will help You as soon as possible!\n\nDECRYPT-ID-[id] number", "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\nempty01@techmail.info\n\nempty02@yahooweb.co\n\nempty003@protonmail.com\n\nWe will help You as soon as possible!\n\nDECRYPT-ID-[id] number",
"Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\ny0000@tuta.io\n\ny0000@protonmail.com\n\ny0000z@yandex.com\n\ny0000s@yandex.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nDECRYPT-ID-[id]" "Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\ny0000@tuta.io\n\ny0000@protonmail.com\n\ny0000z@yandex.com\n\ny0000s@yandex.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nDECRYPT-ID-[id]",
"Hello!\n\nAttention! All Your data was encrypted!\n\nFor specific informartion, please send us an email with Your ID number:\n\nxzzx@tuta.io\n\nxzzx1@protonmail.com\n\nxzzx10@yandex.com\n\nxzzx101@yandex.com\n\nPlease send email to all email addresses! We will help You as soon as possible!\n\nDECRYPT-ID-[id] number"
], ],
"refs": [ "refs": [
"http://www.nyxbone.com/malware/CryptoMix.html", "http://www.nyxbone.com/malware/CryptoMix.html",
"https://www.cert.pl/en/news/single/technical-analysis-of-cryptomixcryptfile2-ransomware/", "https://www.cert.pl/en/news/single/technical-analysis-of-cryptomixcryptfile2-ransomware/",
"https://twitter.com/JakubKroustek/status/804009831518572544", "https://twitter.com/JakubKroustek/status/804009831518572544",
"https://www.bleepingcomputer.com/news/security/new-empty-cryptomix-ransomware-variant-released/", "https://www.bleepingcomputer.com/news/security/new-empty-cryptomix-ransomware-variant-released/",
"https://www.bleepingcomputer.com/news/security/0000-cryptomix-ransomware-variant-released/" "https://www.bleepingcomputer.com/news/security/0000-cryptomix-ransomware-variant-released/",
"https://www.bleepingcomputer.com/news/security/xzzx-cryptomix-ransomware-variant-released/"
] ]
} }
}, },