adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5add984c-c0f0-41b0-8ff0-4f6d950d210f.json

248 lines
10 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [feed] feed updated
2023-06-14 17:31:25 +00:00
"type": "bundle",
"id": "bundle--5add984c-c0f0-41b0-8ff0-4f6d950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-05-03T17:38:11.000Z",
"modified": "2018-05-03T17:38:11.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5add984c-c0f0-41b0-8ff0-4f6d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-05-03T17:38:11.000Z",
"modified": "2018-05-03T17:38:11.000Z",
"name": "OSINT - Maktub ransomware: possibly rebranded as Iron",
"published": "2018-05-03T17:39:02Z",
"object_refs": [
"observed-data--5add9863-d254-4801-8bdb-450a950d210f",
"url--5add9863-d254-4801-8bdb-450a950d210f",
"x-misp-attribute--5add9996-2390-47f3-977f-4d52950d210f",
"indicator--5add9d5d-023c-4570-af2c-483d950d210f",
"indicator--5add9d5e-04e8-4270-b81c-4c29950d210f",
"indicator--5adda3de-ecd4-4318-8703-4692950d210f",
"indicator--5adda3fa-cc40-4e61-a1ee-4e32950d210f",
"observed-data--5adda3fb-a844-4dc0-814c-4fae950d210f",
"windows-registry-key--5adda3fb-a844-4dc0-814c-4fae950d210f",
"x-misp-object--5add9d40-8f68-4a08-874a-4872950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"malware_classification:malware-category=\"Ransomware\"",
"circl:incident-classification=\"malware\"",
"osint:source-type=\"blog-post\"",
"misp-galaxy:ransomware=\"MaktubLocker\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5add9863-d254-4801-8bdb-450a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-05-02T14:35:45.000Z",
"modified": "2018-05-02T14:35:45.000Z",
"first_observed": "2018-05-02T14:35:45Z",
"last_observed": "2018-05-02T14:35:45Z",
"number_observed": 1,
"object_refs": [
"url--5add9863-d254-4801-8bdb-450a950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5add9863-d254-4801-8bdb-450a950d210f",
"value": "https://bartblaze.blogspot.lu/2018/04/maktub-ransomware-possibly-rebranded-as.html"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5add9996-2390-47f3-977f-4d52950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-05-02T14:35:45.000Z",
"modified": "2018-05-02T14:35:45.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
],
"x_misp_category": "External analysis",
"x_misp_type": "comment",
"x_misp_value": "t is currently unknown if Iron is indeed a new variant by the same creators of Maktub, or if it was simply inspired by the latter, by copying the design for the payment portal for example.\r\n\r\nWe know the Iron ransomware has mimicked at least three ransomware families:\r\n\r\n Maktub (payment portal design)\r\n DMA Locker (Iron Unlocker, decryption tool)\r\n Satan (exclusion list)"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5add9d5d-023c-4570-af2c-483d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-05-02T14:35:45.000Z",
"modified": "2018-05-02T14:35:45.000Z",
"pattern": "[email-message:from_ref.value = 'recoverfile@mail2tor.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-02T14:35:45Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"email-src\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5add9d5e-04e8-4270-b81c-4c29950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-05-02T14:35:45.000Z",
"modified": "2018-05-02T14:35:45.000Z",
"pattern": "[file:name = '!HELP_YOUR_FILES.HTML']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-02T14:35:45Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5adda3de-ecd4-4318-8703-4692950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-05-02T14:35:46.000Z",
"modified": "2018-05-02T14:35:46.000Z",
"description": "C2",
"pattern": "[url:value = 'http://y5mogzal2w25p6bn.ml']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-02T14:35:46Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5adda3fa-cc40-4e61-a1ee-4e32950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-05-02T14:35:46.000Z",
"modified": "2018-05-02T14:35:46.000Z",
"pattern": "[email-message:from_ref.value = 'oldblackjack@outlook.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-02T14:35:46Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"email-src\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5adda3fb-a844-4dc0-814c-4fae950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-05-02T14:35:47.000Z",
"modified": "2018-05-02T14:35:47.000Z",
"first_observed": "2018-05-02T14:35:47Z",
"last_observed": "2018-05-02T14:35:47Z",
"number_observed": 1,
"object_refs": [
"windows-registry-key--5adda3fb-a844-4dc0-814c-4fae950d210f"
],
"labels": [
"misp:type=\"regkey\"",
"misp:category=\"Persistence mechanism\""
]
},
{
"type": "windows-registry-key",
"spec_version": "2.1",
"id": "windows-registry-key--5adda3fb-a844-4dc0-814c-4fae950d210f",
"key": "HKCU\\Software\\CryptoA:"
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--5add9d40-8f68-4a08-874a-4872950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-04-23T08:45:52.000Z",
"modified": "2018-04-23T08:45:52.000Z",
"labels": [
"misp:name=\"coin-address\"",
"misp:meta-category=\"financial\""
],
"x_misp_attributes": [
{
"type": "btc",
"object_relation": "address",
"value": "1cimKyzS64PRNEiG89iFU3qzckVuEQuUj",
"category": "Financial fraud",
"to_ids": true,
"uuid": "5add9d40-827c-445a-a400-4438950d210f"
},
{
"type": "text",
"object_relation": "symbol",
"value": "BTC",
"category": "Other",
"uuid": "5add9d41-2808-4b5c-a7d9-4ef2950d210f"
}
],
"x_misp_meta_category": "financial",
"x_misp_name": "coin-address"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
}
Reference in a new issue Copy permalink