2023-04-21 14:44:17 +00:00
{
"type" : "bundle" ,
"id" : "bundle--5a8aea46-0ad4-4b8a-9cfd-445b950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:44.000Z" ,
"modified" : "2018-02-20T10:07:44.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5a8aea46-0ad4-4b8a-9cfd-445b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:44.000Z" ,
"modified" : "2018-02-20T10:07:44.000Z" ,
"name" : "OSINT - GandCrab Ransomware Distributed by Exploit Kits, Appends GDCB Extension" ,
"published" : "2018-02-20T10:07:56Z" ,
"object_refs" : [
"observed-data--5a8aea94-20d8-420b-a52b-4155950d210f" ,
"url--5a8aea94-20d8-420b-a52b-4155950d210f" ,
"indicator--5a8aebb2-8d38-4b51-8a0f-49bf950d210f" ,
"indicator--5a8aebb3-46cc-4143-bc91-4a17950d210f" ,
"indicator--5a8aebb3-909c-4690-9520-4e50950d210f" ,
"indicator--5a8aebb3-6b9c-4da9-b7d7-4c08950d210f" ,
"indicator--5a8aebb4-97e8-480d-be52-4cd7950d210f" ,
"indicator--5a8aec25-f770-4bdf-a543-4f23950d210f" ,
"indicator--5a8aec34-8204-4027-9e22-4d3c950d210f" ,
"indicator--5a8aec34-1638-4675-872a-4e64950d210f" ,
"indicator--5a8aec35-1e64-4c86-b38d-4890950d210f" ,
"x-misp-attribute--5a8bd3ad-2570-4490-bfe3-4ec0950d210f" ,
"indicator--fdc7c223-2171-45ac-b03d-9aaf289e0612" ,
"x-misp-object--7c7e6c58-6dbb-4189-982d-3aa8636c352f" ,
"indicator--cd7071df-c409-4094-968c-c3c144a2a380" ,
"x-misp-object--1317f7cd-64b0-471b-be2d-fc2cd3fd851b" ,
2024-08-07 08:13:15 +00:00
"relationship--693999f1-cdb5-440b-8796-de735fa0b3d5" ,
"relationship--f5926c71-b9aa-4efd-b52b-9debf5a6dded"
2023-04-21 14:44:17 +00:00
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"osint:source-type=\"blog-post\"" ,
"malware_classification:malware-category=\"Ransomware\"" ,
"workflow:todo=\"create-missing-misp-galaxy-cluster\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a8aea94-20d8-420b-a52b-4155950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:28.000Z" ,
"modified" : "2018-02-20T10:07:28.000Z" ,
"first_observed" : "2018-02-20T10:07:28Z" ,
"last_observed" : "2018-02-20T10:07:28Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a8aea94-20d8-420b-a52b-4155950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a8aea94-20d8-420b-a52b-4155950d210f" ,
"value" : "https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-distributed-by-exploit-kits-appends-gdcb-extension/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a8aebb2-8d38-4b51-8a0f-49bf950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:29.000Z" ,
"modified" : "2018-02-20T10:07:29.000Z" ,
"pattern" : "[file:name = 'bleepingcomputer.bit']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-20T10:07:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a8aebb3-46cc-4143-bc91-4a17950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:29.000Z" ,
"modified" : "2018-02-20T10:07:29.000Z" ,
"pattern" : "[file:name = 'nomoreransom.bit']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-20T10:07:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a8aebb3-909c-4690-9520-4e50950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:30.000Z" ,
"modified" : "2018-02-20T10:07:30.000Z" ,
"pattern" : "[file:name = 'esetnod32.bit']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-20T10:07:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a8aebb3-6b9c-4da9-b7d7-4c08950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:30.000Z" ,
"modified" : "2018-02-20T10:07:30.000Z" ,
"pattern" : "[file:name = 'emsisoft.bit']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-20T10:07:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a8aebb4-97e8-480d-be52-4cd7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:30.000Z" ,
"modified" : "2018-02-20T10:07:30.000Z" ,
"pattern" : "[file:name = 'gandcrab.bit']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-20T10:07:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a8aec25-f770-4bdf-a543-4f23950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:31.000Z" ,
"modified" : "2018-02-20T10:07:31.000Z" ,
"description" : "ransomnote" ,
"pattern" : "[file:name = 'GDCB-DECRYPT.txt']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-20T10:07:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a8aec34-8204-4027-9e22-4d3c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-19T15:24:36.000Z" ,
"modified" : "2018-02-19T15:24:36.000Z" ,
"pattern" : "[file:hashes.MD5 = 'aedf80c426fb649bb258e430a3830d85']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-19T15:24:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a8aec34-1638-4675-872a-4e64950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-19T15:24:36.000Z" ,
"modified" : "2018-02-19T15:24:36.000Z" ,
"pattern" : "[file:hashes.MD5 = '6866d8d8bf8565d94e0e1479978cf1e5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-19T15:24:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a8aec35-1e64-4c86-b38d-4890950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-19T15:24:37.000Z" ,
"modified" : "2018-02-19T15:24:37.000Z" ,
"pattern" : "[file:hashes.MD5 = '379e149517f4119f2edb9676ec456ed4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-19T15:24:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5a8bd3ad-2570-4490-bfe3-4ec0950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:31.000Z" ,
"modified" : "2018-02-20T10:07:31.000Z" ,
"labels" : [
"misp:type=\"comment\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "comment" ,
"x_misp_value" : "A new ransomware called GandCrab was released towards the end of last week that is currently being distributed via exploit kits. GandCrab has some interesting features not seen before in a ransomware, such as being the first to accept the DASH currency and the first to utilize the Namecoin powered .BIT tld."
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--fdc7c223-2171-45ac-b03d-9aaf289e0612" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:37.000Z" ,
"modified" : "2018-02-20T10:07:37.000Z" ,
"pattern" : "[file:hashes.MD5 = '6866d8d8bf8565d94e0e1479978cf1e5' AND file:hashes.SHA1 = '2245bd90b753b7fd29b7218a0ef50435c64f8767' AND file:hashes.SHA256 = '3e2e881ec6fcfb6329cad95c15de4a90aef1032550176c7c7729c0a0e383c615']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-20T10:07:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--7c7e6c58-6dbb-4189-982d-3aa8636c352f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:35.000Z" ,
"modified" : "2018-02-20T10:07:35.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/3e2e881ec6fcfb6329cad95c15de4a90aef1032550176c7c7729c0a0e383c615/analysis/1518976209/" ,
"category" : "External analysis" ,
"uuid" : "5a8bf367-52dc-44ee-9641-4b8a02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "55/67" ,
"category" : "Other" ,
"uuid" : "5a8bf368-5744-4b42-9759-444302de0b81"
} ,
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-02-18T17:50:09" ,
"category" : "Other" ,
"uuid" : "5a8bf368-c0ac-437c-b853-431f02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--cd7071df-c409-4094-968c-c3c144a2a380" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:40.000Z" ,
"modified" : "2018-02-20T10:07:40.000Z" ,
"pattern" : "[file:hashes.MD5 = 'aedf80c426fb649bb258e430a3830d85' AND file:hashes.SHA1 = '0876ad729d79da65ed4e72966d9f9d209394ebfa' AND file:hashes.SHA256 = '03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-02-20T10:07:40Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--1317f7cd-64b0-471b-be2d-fc2cd3fd851b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-02-20T10:07:38.000Z" ,
"modified" : "2018-02-20T10:07:38.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28/analysis/1518976703/" ,
"category" : "External analysis" ,
"uuid" : "5a8bf36a-16d0-4cb0-a81e-4c2f02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "49/68" ,
"category" : "Other" ,
"uuid" : "5a8bf36b-fd30-42a3-b727-4db202de0b81"
} ,
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-02-18T17:58:23" ,
"category" : "Other" ,
"uuid" : "5a8bf36b-b100-45cf-8bdb-40ee02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--693999f1-cdb5-440b-8796-de735fa0b3d5" ,
2023-04-21 14:44:17 +00:00
"created" : "2018-02-20T10:07:39.000Z" ,
"modified" : "2018-02-20T10:07:39.000Z" ,
"relationship_type" : "analysed-with" ,
"source_ref" : "indicator--fdc7c223-2171-45ac-b03d-9aaf289e0612" ,
"target_ref" : "x-misp-object--7c7e6c58-6dbb-4189-982d-3aa8636c352f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-08-07 08:13:15 +00:00
"id" : "relationship--f5926c71-b9aa-4efd-b52b-9debf5a6dded" ,
2023-04-21 14:44:17 +00:00
"created" : "2018-02-20T10:07:39.000Z" ,
"modified" : "2018-02-20T10:07:39.000Z" ,
"relationship_type" : "analysed-with" ,
"source_ref" : "indicator--cd7071df-c409-4094-968c-c3c144a2a380" ,
"target_ref" : "x-misp-object--1317f7cd-64b0-471b-be2d-fc2cd3fd851b"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
]
}
