Merge pull request #482 from Delta-Sierra/master

add DePriMon malicious downloader & Cyborg ransomware

clusters/ransomware.json

@@ -13572,7 +13572,26 @@
       },
       "uuid": "7cea8846-1f3d-331a-3ebf-055d452351b6",
       "value": "Maze"
+    },
+    {
+      "description": "Ransomware delivered using fake Windows Update spam",
+      "meta": {
+        "extensions": [
+          ".777"
+        ],
+        "ransomnotes-filenames": [
+          "Cyborg_DECRYPT.txt"
+        ],
+        "ransomnotes-refs": [
+          "https://npercoco.typepad.com/.a/6a0133f264aa62970b0240a4ebff1b200b-pi"
+        ],
+        "refs": [
+          "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/"
+        ]
+      },
+      "uuid": "0a0b9311-8cbc-4d97-b337-42c9a018ebe0",
+      "value": "Cyborg Ransomware"
     }
   ],
-  "version": 72
+  "version": 73
 }

clusters/tool.json

@@ -7876,7 +7876,18 @@
       },
       "uuid": "c1815516-aa2a-43d2-9136-78a8feb054b6",
       "value": "ShadowHammer"
+    },
+    {
+      "description": "DePriMon is a malicious downloader, with several stages and using many non-traditional techniques. To achieve persistence, the malware registers a new local port monitor – a trick falling under the “Port Monitors” technique in the MITRE ATT&CK knowledgebase. For that, the malware uses the “Windows Default Print Monitor” name; that’s why we have named it DePriMon. Due to its complexity and modular architecture, we consider it to be a framework.",
+      "meta": {
+        "refs": [
+          "https://www.bleepingcomputer.com/news/security/deprimon-malware-registers-itself-as-a-windows-print-monitor/",
+          "https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader/"
+        ]
+      },
+      "uuid": "c76874cd-0d73-4cbf-8d39-a066900dd4ce",
+      "value": "DePriMon"
     }
   ],
-  "version": 127
+  "version": 128
 }