155 lines
100 KiB
JSON
155 lines
100 KiB
JSON
|
{
|
||
|
|
"Event": {
|
||
|
|
"analysis": "0",
|
||
|
|
"date": "2016-03-11",
|
||
|
|
"extends_uuid": "",
|
||
|
|
"info": "'Surprise' Ransomware (2016-03-11)",
|
||
|
|
"publish_timestamp": "1457709051",
|
||
|
|
"published": true,
|
||
|
|
"threat_level_id": "3",
|
||
|
|
"timestamp": "1457708105",
|
||
|
|
"uuid": "56e2d5fc-4238-4b3a-9d7b-4539950d210f",
|
||
|
|
"Orgc": {
|
||
|
|
"name": "CIRCL",
|
||
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
||
|
|
},
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#ffffff",
|
||
|
|
"name": "tlp:white"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#3b7500",
|
||
|
|
"name": "circl:incident-classification=\"malware\""
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#2c4f00",
|
||
|
|
"name": "malware_classification:malware-category=\"Ransomware\""
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "C&C (down)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457706780",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "url",
|
||
|
|
"uuid": "56e2d71c-af30-4ac8-9fbc-4e49950d210f",
|
||
|
|
"value": "http://pulseaudio.duckdns.org/pull.php"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "Email to request payment info",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457708098",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "email-dst",
|
||
|
|
"uuid": "56e2d71d-89cc-4680-ae77-4a86950d210f",
|
||
|
|
"value": "nowayout@protonmail.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "Email to request payment info",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457708105",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "email-dst",
|
||
|
|
"uuid": "56e2d71d-4fb4-4b25-997e-49e6950d210f",
|
||
|
|
"value": "nowayout@sigaint.org"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "File displaying information",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457706781",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "filename",
|
||
|
|
"uuid": "56e2d71d-79dc-4caa-8432-453a950d210f",
|
||
|
|
"value": "DECRYPTION_HOWTO.Notepad"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "Imported via the freetext import.",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457706793",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "hostname",
|
||
|
|
"uuid": "56e2d729-5444-4dc8-a042-48f4950d210f",
|
||
|
|
"value": "pulseaudio.duckdns.org"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"data": "UEsDBBQACQAIADF0a0hTELHf2BkBAABAAgAgABwAYzM0ZmIxNWM1ZjkzYzJiZDFiOGExYmEyOTU2NjgzN2ZVVAkAAz3X4lY91+JWdXgLAAEEIQAAAAQhAAAAmW2z+XzWuerAC1uiIPcueUaSEKAy23rPTQ3BBDMTlPNHeIiKZb47e/uFh/ZiMQeLnSuXGx4TUq1cNfGIxnxX/LFORj7zPihbuaj0QvpFW+1CjoITfe8i/bYDKugMYOeSV/2gm/yhli9pMckE3AAEiwndMo48CmDCP7XTGmftzQKqX4/rAYXQeqeVTmb1xOSkZp1kCJ+8fS+1+x8FArZ5QNzGgNdcHAvLkvDM8WHd9soESX/8ShslgnZAUSDC0WtuPHjTH4bnaYTPfeqzUGdg2PO3CUc0xt2+9JbaktxiS/vMzrhe10ntyI+/o+mZWkSEkr/JZU321OKPjviDdjkYG7lbOS1BVNjZtnJDkULpsRmTFtHPJpaFzc4a3DCSTqjnRBc5gTisp4BY5oZJxfaxRVINB5N+X/fgodUSQb1OjiB/KUdSS/2OJ8OTBBl2PpGbOjk5msb9ysaroASXvf4h1P2E0btJR3X07gimjyC7kJ5hs/qZD+abIv7bkgskKBX2wQ89+ww7RiesICyZvni2d5xfv6Sfg/R6kIkA4OPfSflbamjcV+zDFD1H3p4FrcQ0zhCGajmhDlwI89xcolIpIK6tSV3OmeyaAXXoBEv2g1zMRFyCZH7mxaR/2/AlEA96jWFsuSpOZppFmdaG0QeR3CoDOjvwu+4PDXwUqapnIH8RdUlhWNjelPHmgpqstLzXJ/6+V8udVregfot8KwRt+AzSXQG1HW7/AiEu6wM3GdI5muUteAY/ZqfEnphwOK0UbAJPTBPs2cn7H9NvaPpJ40cvdXYOWCTDhc2nhiEzy2/YXjF0/Q1FBPEZX6Tbdb0FVgVeOd70RPJg1hsmOfme6ZW57GsRAiIIwk4l6Mz99sz3b3q1uGydsendZIqIzMEJnOQwL6v1/+tdlyZys3sWNuRPlo3ID4+IILy/107mkHzEUKkqiXff9KFrbP1yNl11xSFvj3O54NGPI9tdF1x3b48DIIa1OBU8nwOC25kz+/kfUF5AYD9Xg4x/vEDO7/lGw5O54VEP0BBhmp8jN6PC+gs0d6bNWedTQ5oy6t/8ueHs+V6dZnMSq9d0RsY73g3In0pIPWARPxXllIr5kHmFC3fqCxTLZawmsZYXmcIe2aXijX2+TipTfXrQiTB39IeeMg3uY/DR3elW3JJFhTwlaHVDyVSt9j3omxhI8fNpxiID+Ua/oRgN8yLrFcNGOV9KB7jDgIC5m3yO9r0Xt/LT9MUB4AAwdNNhtGd02kpKb2H1XAGSNvs0yAdFjslhjZogxxoOYUcVUNo5WEokAuvzioV87/G2U4m8t5AxMQ2HuJJa7qbYxoHyRQP0QvZElgWyw19X1PC+KagZ7RuTZsZt6pxTHv/ontwrlPdr6LMBDejeDqA3qBlVd6Xv0E9T7Rqo9+RG1SJHNFUCa4ZMz3COGMZv/n+XhgJrEP+wNGSuEu182mdDqtgoSMRnIacY3h+xXXfV8mMcq0M2aBN9zcMvxzfd+sHZWNHgK4DCYfqG0wtqHF+jOarRojbdBFDhiDghqrBVWjPdRd1EjbvHjjyo4LolwiOm2/6YsYz9RK5lZAb5688Lofev9vHTHAa+Y6q4EneNovBHS6eFlGhKXBF3GpHsWGvNuXhHXo1M4mKPzmycwpIT/yBQCOfbQL+4EITh7ZgRUa+Vi0R7dELewtq/Diuh7/zuLJ/a++EQUXNPdq3ZshxbRsAf98smfx1YRqvCJYUUvewcWfykxLFDDHFWJ8/ooDf9WQIEq9t7wWOQ3Oesj3P02Jyf9UQvFEnA6W8xgk2rPB/pcjo3hUmFAgqyjfy6cz0yESKi3yvv1ZbIkTkGV207sZtJL6Y4A9MnAh7+S2/MprweIVAPLSbBrJsb3mtP3P8Rm1Uljj3MV+EOZWE5HxUmIvE1hLaG3aSkIrC2PFILfLuzo6bcVzLhKB3vqWSNuQyoibTpv2yAb2Iih8/6S5sWMfikTzwRSQAZvLoo6xBbCo83rhn7bk2qR1Za4WPuOtG6AldcpXRPDiYzh5x7D6ROT/+P6ME25+oSrUbScw6XFz6s8Hc6ZtJQG9mJSu7nnH1da7uzzfFn5Ye1v55Os62mFzHuTEn3ndEBzatSMxXnVPs14sVw//YVHdvZfyJVMaD8vR5bN0NL6bgH3Y/A0PkIX0E9aiUYnEKB0vkpfO7c/ytmJhlFoDROW9YSlGb3HCeogqkb+iYLR8qxvk0SWS2TQSA6VGzJHqnVnu49LqznPDyOEQRnIi7sUacMPkKuPcy2+neY1QT0a07/sIkePzam/hgcE4sQrXkyk+iIHCIdkblo0VHUFuEzESh4Kdo7rb4Ouo3O9F9v+msKrbcijl45Z4aXZT1o7RS3wnffQ3wYrOPKfw3dOsbNWaUA8jfkI+0N5NQsOC6kmvKD73uYPETC6qqC30y901B6sTuH3ECOabAdYWxGdwbCWxdD4U6o2B3LRC+ua7nwTEVmXdJX7s3EWqZnw76+czCJRvcMBIbEyPJcv4rhokoVv2/klK9azhZWeqdeYmaSRiADhJQBRTrP9JYVnRi8i8gw2cJ8RI8kwgHlK3uANXz2Cgkfk/K4TT4EvINrGI0y3GIxYCWsSmYxdES4DO7MtEOZUHR8q8bZ75E0P9mOfmw/ecjO8x9jjGgkg9a503Knm15T0rFnT4pgGc/7Ab8XqJeDNAYNpPbK/vfCoHDRXBOkdAU6pDU/V+aLRE9l6SaVC3A2/kcoYjiJDuVdhzeH8m/paXq0hXD1qe+YypwPzPqKTl7vJY8zINt+pORHW3clg7dM9b7phcLJWUOzjQfcshu9tlMERdfPl53KYv3uhhqbUXGWgiEpENF6Cf3Cs6BDi3AzB6xQGRN0iL67wCzPK/cnTh41LY61S/CuD/NKrUfLNNp/dIfw0uP6ckvqd5nxh7Jl1AKRmQLdUaLhwB/gi4MLQUWMPi/QsgNK5zT+UgPrOpzvMAiMxJ+ffxrzYssyU1iwdzntX7JbB86StpAzW3VPJVpJ5W6V0Dg3Rc2mf3OqmXXylPKYKTw+vI0ydmvp4mGdePICrfugpPk0TSEexlsMtKcSZ7u4PkEGoyTDoDbsWsDr6ZPA9P9nq1aVv4II6svHy7dkFjbJNyMGHzjf1N8k/VrSjjHOCh8KFkQ3sx7wRHDeVduuu/WgCPMUelkJEmM12upIcZ0elcK+L2bAkAnid4OS2EH5Qk6wf5FCqWFPlTzEArFqZyAdDuFKAfekiDMpVZl6w52YvhYPAfsc7pSSsbdMceGP/ZhL+b2TY0rJjz5OE4qkn3GEHYVNW14hOjWzFJ2s0IEIekpV6zMhJcMmedrsPxs0ZyzqOi3nR7wUsV5Rc2qs/NKaIWT28UciQnj/863/0Y0n6W/oKbjVEij4r0rMQ0at8Sn0I9/8dv+o267WpUPY8ILrI3Y0LTcLCrpI33/xLdjPEG3lGOMJzZQ3wBPVg4HizTJXuIo99WVBH0042rTaSfh+R+HqHqfPlHeGhcaEZ3zd60UR9BRJ6ugK3TOwmz7hLzC46xTEWn0eUvibC+kYaYW9lYbJnxnA5XUHaBLrE7uQvQnKRS0trDPDdJDOqaAN4e+NJ7u+7ylcQsFxiWHxSK5Ls97p/Z1YC59CPUCT852Bw4hDw+F8nc8H1uiX6K2o7h5co35qNsub4IDQw5WOinoimUdkF0oj16gKK2VyeJXejM4lEtmeYZKV1pgkBMCpnhE+qbnlzf0L7GwoeQWFPjwrha3oZwsBKJ4xYErL2bMjr7KnaJFA1kfstzYWJxXM9WUp4W5lwKNiZIw3YcOkoY29mxjjPlmaedcQTsmZcc6ysp9haiuYMaxcRyPD7n0oV2jb3cTjrALZ4X5VrKH2ArE9UcmCvOGcvGKUxh38TCiiIpFUKKjyv69R3BnmFqb1YS6VthIh00VomLuKVpb2hnOnnpDid53PXrms+rYAitvKELA0uy
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457706813",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "malware-sample",
|
||
|
|
"uuid": "56e2d73d-3838-4a28-9bd1-414a950d210f",
|
||
|
|
"value": "surprise.exe|c34fb15c5f93c2bd1b8a1ba29566837f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457706814",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "filename|sha1",
|
||
|
|
"uuid": "56e2d73e-cfc4-4c5c-93cb-405b950d210f",
|
||
|
|
"value": "surprise.exe|bee22913ad9d6c9a37152aa65daa6bd9beca00eb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457706814",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "filename|sha256",
|
||
|
|
"uuid": "56e2d73e-6d5c-4891-b2c5-4b1b950d210f",
|
||
|
|
"value": "surprise.exe|ddb0c54759fada5cff7bb60237ace601fcbd526208627fdee170d9ed41e91c7a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload installation",
|
||
|
|
"comment": "DECRYPTION_HOWTO.Notepad",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457707414",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "56e2d848-0f6c-41cc-b03f-6599950d210f",
|
||
|
|
"value": "What happened to your files ?\r\nAll of your files were protected by a strong encryption.\r\nThere is no way to decrypt your files without the key.\r\nIf your files not important for you just reinstall your system.\r\nIf your files is important just email us to discuss the price and how to decrypt your files.\r\nYou can email us to nowayout@protonmail.com and nowayout@sigaint.org \r\nWrite your Email to both email addresses PLS\r\nWe accept just BITCOIN if you dont know what it is just google it.\r\nWe will give instructions where and how you buy bitcoin in your country.\r\nPrice depends on how important your files and network is.it could be 0.5 bitcoin to 25 bitcoin.\r\nYou can send us a 1 encrypted file for decryption.\r\nFeel free to email us with your country and computer name and username of the infected system."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457707851",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "56e2db4b-2904-45ab-a9c0-4ac702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ddb0c54759fada5cff7bb60237ace601fcbd526208627fdee170d9ed41e91c7a/analysis/1457588432/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Automatically added (via surprise.exe|bee22913ad9d6c9a37152aa65daa6bd9beca00eb)",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1457708314",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "filename|md5",
|
||
|
|
"uuid": "56e2dd1a-1830-4809-9765-4f01950d210f",
|
||
|
|
"value": "surprise.exe|c34fb15c5f93c2bd1b8a1ba29566837f"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|