adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5a3797c2-e770-4722-9435-4350950d210f.json

243 lines
8.1 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
"Event": {
"analysis": "2",
"date": "2017-08-31",
"extends_uuid": "",
"info": "OSINT - RIG exploit kit distributes Princess ransomware",
"publish_timestamp": "1514467877",
"published": true,
"threat_level_id": "3",
"timestamp": "1513738831",
"uuid": "5a3797c2-e770-4722-9435-4350950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#0088cc",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"local": "0",
"name": "misp-galaxy:ransomware=\"Princess Locker\"",
"relationship_type": ""
chg: [feed] added
2023-04-21 13:25:09 +00:00
},
{
"colour": "#004646",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"local": "0",
"name": "type:OSINT",
"relationship_type": ""
chg: [feed] added
2023-04-21 13:25:09 +00:00
},
{
"colour": "#ffffff",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"local": "0",
"name": "tlp:white",
"relationship_type": ""
chg: [feed] added
2023-04-21 13:25:09 +00:00
},
{
"colour": "#2c4f00",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"local": "0",
"name": "malware_classification:malware-category=\"Ransomware\"",
"relationship_type": ""
chg: [feed] added
2023-04-21 13:25:09 +00:00
},
{
"colour": "#00223b",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"local": "0",
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
chg: [feed] added
2023-04-21 13:25:09 +00:00
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1513594183",
"to_ids": false,
"type": "link",
"uuid": "5a3797dd-f168-4087-b939-4ceb950d210f",
"value": "https://blog.malwarebytes.com/cybercrime/2017/08/rig-exploit-kit-distributes-princess-ransomware/",
"Tag": [
{
"colour": "#00223b",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"local": "0",
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
chg: [feed] added
2023-04-21 13:25:09 +00:00
}
]
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1513594183",
"to_ids": false,
"type": "comment",
"uuid": "5a3797e9-6a14-49f6-939e-4b36950d210f",
"value": "We have identified a new drive-by download campaign that distributes the Princess ransomware (AKA PrincessLocker), leveraging compromised websites and the RIG exploit kit. This is somewhat of a change for those tracking malvertising campaigns and their payloads.\r\n\r\nWe had analyzed the PrincessLocker ransomware last November and pointed out that despite similarities with Cerber\u00e2\u20ac\u2122s onion page, the actual code was much different. A new payment page seemed to have been seen in underground forums and is now being used with attacks in the wild.",
"Tag": [
{
"colour": "#00223b",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"local": "0",
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
chg: [feed] added
2023-04-21 13:25:09 +00:00
}
]
},
{
"category": "Network activity",
"comment": "RIG EK gate",
"deleted": false,
"disable_correlation": false,
"timestamp": "1513594183",
"to_ids": true,
"type": "ip-dst",
"uuid": "5a3798b2-f484-4eec-9213-4d50950d210f",
"value": "185.198.164.152"
},
{
"category": "Network activity",
"comment": "RIG EK IP address",
"deleted": false,
"disable_correlation": false,
"timestamp": "1513594183",
"to_ids": true,
"type": "ip-dst",
"uuid": "5a3798b2-4c88-45c5-8a28-4832950d210f",
"value": "188.225.84.28"
},
{
"category": "Payload delivery",
"comment": "PrincessLocker binary",
"deleted": false,
"disable_correlation": false,
"timestamp": "1513593010",
"to_ids": true,
"type": "sha256",
"uuid": "5a3798b2-25d0-43a4-b9b8-4064950d210f",
"value": "c61f4c072bb1e3c6281a9799c1a3902f35dba652756fe96a97e60d0097a3f9b7"
},
{
"category": "Network activity",
"comment": "PrincessLocker payment page",
"deleted": false,
"disable_correlation": false,
"timestamp": "1513594183",
"to_ids": true,
"type": "domain",
"uuid": "5a3798b2-c160-4334-bfa2-4c41950d210f",
"value": "royall6qpvndxlsj.onion"
}
],
"Object": [
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1513594186",
"uuid": "65a56413-80b7-49b7-83e7-1766f5fcb8f4",
"ObjectReference": [
{
"comment": "",
"object_uuid": "65a56413-80b7-49b7-83e7-1766f5fcb8f4",
"referenced_uuid": "fb3dcb25-eb21-42c9-9dbd-011d260655cd",
"relationship_type": "analysed-with",
"timestamp": "1514467877",
"uuid": "5a379d48-07b0-4c47-a615-459f02de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "PrincessLocker binary",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1513594184",
"to_ids": true,
"type": "sha1",
"uuid": "5a379d48-e4fc-4cd8-ac5a-483902de0b81",
"value": "5e30397f36df1e828ce705b7ec0ce62916451aae"
},
{
"category": "Payload delivery",
"comment": "PrincessLocker binary",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1513594184",
"to_ids": true,
"type": "md5",
"uuid": "5a379d48-9184-4583-b5da-4bbf02de0b81",
"value": "e7412ad8301456f3f4e32ab2d2c6f3f7"
},
{
"category": "Payload delivery",
"comment": "PrincessLocker binary",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1513594184",
"to_ids": true,
"type": "sha256",
"uuid": "5a379d48-f208-4aeb-8a24-4eaa02de0b81",
"value": "c61f4c072bb1e3c6281a9799c1a3902f35dba652756fe96a97e60d0097a3f9b7"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1513594184",
"uuid": "fb3dcb25-eb21-42c9-9dbd-011d260655cd",
"Attribute": [
{
"category": "External analysis",
"comment": "PrincessLocker binary",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1513594184",
"to_ids": false,
"type": "link",
"uuid": "5a379d48-c620-4291-9f33-4d4d02de0b81",
"value": "https://www.virustotal.com/file/c61f4c072bb1e3c6281a9799c1a3902f35dba652756fe96a97e60d0097a3f9b7/analysis/1505118111/"
},
{
"category": "Other",
"comment": "PrincessLocker binary",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1513594184",
"to_ids": false,
"type": "text",
"uuid": "5a379d48-d8d8-4102-8582-45e402de0b81",
"value": "48/63"
},
{
"category": "Other",
"comment": "PrincessLocker binary",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1513594184",
"to_ids": false,
"type": "datetime",
"uuid": "5a379d48-f06c-4180-b1b1-40be02de0b81",
"value": "2017-09-11T08:21:51"
}
]
}
]
}
}
Reference in a new issue Copy permalink