2023-04-21 13:25:09 +00:00
{
"Event" : {
"analysis" : "2" ,
"date" : "2017-12-01" ,
"extends_uuid" : "" ,
"info" : "OSINT - Test Cryptomix Ransomware Variant Released" ,
"publish_timestamp" : "1512391963" ,
"published" : true ,
"threat_level_id" : "3" ,
"timestamp" : "1512388614" ,
"uuid" : "5a252fea-cbdc-425d-ba82-436a950d210f" ,
"Orgc" : {
"name" : "CIRCL" ,
"uuid" : "55f6ea5e-2c60-40e5-964f-47a8950d210f"
} ,
"Tag" : [
{
"colour" : "#0088cc" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "misp-galaxy:ransomware=\"CryptoMix\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#004646" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "type:OSINT" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#ffffff" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#2c4f00" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "malware_classification:malware-category=\"Ransomware\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#00223b" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
}
] ,
"Attribute" : [
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388609" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5a253125-44a8-461e-babb-4e7f950d210f" ,
"value" : "0b2f5f6e61a81c9a872827e5ea1fd5ea05ca470b55975267b00033251dc79c1b"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388609" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5a253125-0fb8-4839-9845-43d4950d210f" ,
"value" : "_HELP_INSTRUCTION.TXT"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388609" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "5a253125-dd28-4b39-ac53-4904950d210f" ,
"value" : "%ALLUSERSPROFILE%\\[random].exe"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388609" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "5a253125-355c-44f8-b921-4831950d210f" ,
"value" : "test757@tuta.io"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388609" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "5a253125-d8d0-4831-af33-4f4a950d210f" ,
"value" : "test757@protonmail.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388609" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "5a253125-6110-487f-be6b-4668950d210f" ,
"value" : "test757xz@yandex.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388609" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "5a253125-c4c8-48c8-ad37-43ca950d210f" ,
"value" : "test757xy@yandex.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388609" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "5a253125-7184-4745-a474-4842950d210f" ,
"value" : "test757@consultant.com"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388609" ,
"to_ids" : false ,
"type" : "comment" ,
"uuid" : "5a25313e-2f3c-4233-94c9-4e2c950d210f" ,
"value" : "Today, MalwareHunterTeam discovered a new variant of the CryptoMix ransomware that appends the .TEST extension to encrypted files and changes the contact emails used by the ransomware. \r\n\r\nIn this article I will provide a brief summary of any changes that have occurred in this new variant. As we are always looking for weaknesses, if you are a victim of this variant and decide to pay the ransom, please send us the decryptor so we can take a look at it. You can also discuss or receive support for Cryptomix ransomware infections in our dedicated Cryptomix Help & Support Topic." ,
"Tag" : [
{
"colour" : "#00223b" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
}
]
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388609" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5a25314e-786c-454b-8ef6-4d30950d210f" ,
"value" : "https://www.bleepingcomputer.com/news/security/test-cryptomix-ransomware-variant-released/" ,
"Tag" : [
{
"colour" : "#00223b" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
}
]
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: 0b2f5f6e61a81c9a872827e5ea1fd5ea05ca470b55975267b00033251dc79c1b" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388610" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5a253802-01b0-4493-a57e-b6fc02de0b81" ,
"value" : "e20b53e74da470d6e36ed15ba70eb1f1658eaaaf"
} ,
{
"category" : "Payload delivery" ,
"comment" : "- Xchecked via VT: 0b2f5f6e61a81c9a872827e5ea1fd5ea05ca470b55975267b00033251dc79c1b" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388610" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "5a253802-a93c-4d1b-8988-b6fc02de0b81" ,
"value" : "74c7bec8d4949ebf2f8f6be1af2f2113"
} ,
{
"category" : "External analysis" ,
"comment" : "- Xchecked via VT: 0b2f5f6e61a81c9a872827e5ea1fd5ea05ca470b55975267b00033251dc79c1b" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1512388610" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5a253802-be14-4b6c-bef9-b6fc02de0b81" ,
"value" : "https://www.virustotal.com/file/0b2f5f6e61a81c9a872827e5ea1fd5ea05ca470b55975267b00033251dc79c1b/analysis/1512356719/"
}
]
}
}
