misp-circl-feed/feeds/circl/misp/57174526-23d8-4895-8c08-4ed1950d210f.json

{
  "Event": {
    "analysis": "0",
    "date": "2016-04-20",
    "extends_uuid": "",
    "info": "New ransomware",
    "publish_timestamp": "1461153795",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1461153134",
    "uuid": "57174526-23d8-4895-8c08-4ed1950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      }
    ],
    "Attribute": [
      {
        "category": "Payload installation",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461142838",
        "to_ids": false,
        "type": "md5",
        "uuid": "57174536-95fc-474a-bb9f-46dc950d210f",
        "value": "116d442d8ec5c62f32c7ba507a5569be"
      },
      {
        "category": "Payload installation",
        "comment": "- Xchecked via VT: 116d442d8ec5c62f32c7ba507a5569be",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461145369",
        "to_ids": false,
        "type": "sha256",
        "uuid": "57174f19-f06c-4809-92b3-476d02de0b81",
        "value": "ce98e9d9900609c45c948d34153c03b490bc2067e7a742048f60ed53fe95529d"
      },
      {
        "category": "Payload installation",
        "comment": "- Xchecked via VT: 116d442d8ec5c62f32c7ba507a5569be",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461145369",
        "to_ids": false,
        "type": "sha1",
        "uuid": "57174f19-c3d8-43f0-96bb-43e402de0b81",
        "value": "fb93796afa470d87deb316823d3cd6e8d8b18596"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461145370",
        "to_ids": false,
        "type": "link",
        "uuid": "57174f1a-a47c-458d-9900-451e02de0b81",
        "value": "https://www.virustotal.com/file/ce98e9d9900609c45c948d34153c03b490bc2067e7a742048f60ed53fe95529d/analysis/1461016885/"
      },
      {
        "category": "Network activity",
        "comment": "Compromised wp installation",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461152759",
        "to_ids": false,
        "type": "hostname",
        "uuid": "57176bf7-4e28-4e60-88d4-4dea950d210f",
        "value": "kentamplin.net"
      },
      {
        "category": "Network activity",
        "comment": "Compromised WP installation (fixed)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461152810",
        "to_ids": false,
        "type": "url",
        "uuid": "57176c2a-2280-4f00-9208-42c1950d210f",
        "value": "kentamplin.net/wordpress/wp-includes/oops.php"
      },
      {
        "category": "Network activity",
        "comment": "Compromised wp installation",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461152872",
        "to_ids": false,
        "type": "ip-dst",
        "uuid": "57176c68-3b48-47d1-a549-4f20950d210f",
        "value": "192.185.16.132"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461152936",
        "to_ids": false,
        "type": "url",
        "uuid": "57176ca8-4fd8-4eac-a432-4fdb950d210f",
        "value": "http://192.185.16.132/wordpress/wp-includes/oops.php?id=2886098&cname=mh6SlMrX8b&arch=0&srv=0&ver=6.1"
      },
      {
        "category": "Other",
        "comment": "Ransom text",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461153063",
        "to_ids": false,
        "type": "comment",
        "uuid": "57176d27-f044-4038-9604-49da950d210f",
        "value": "YourID: 2886098\r\n    PC: HOME\r\n    USER: user\r\n    *********\r\n    Hey\r\n\r\n    Your files are now encrypted. I have the key to decrypt them back. I will give you a decrypter if you pay me. Email me at: momsbestfriend@protonmail.com or torrenttracker@india.com\r\n\r\n    If you don\u00e2\u20ac\u2122t get a reply or if both emails die, then contact me using a guaranteed, foolproof\r\n    Bitmessage: download it form here https://github.com/mailchuck/PyBitmessage/releases/download/v0.5.8/Bitmessage-\r\n    0.5.8.exe\r\n\r\n    Run it, click New Identity and then send me a message at BM-NBvzKEY8raDBKb9Gp1xZMRQpeU5svwg2\r\n\r\n    Cheers"
      },
      {
        "category": "Other",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1461153134",
        "to_ids": false,
        "type": "comment",
        "uuid": "57176d6e-a4e8-4c08-bd9c-41d9950d210f",
        "value": "ID was seen to be same among the different infections..."
      }
    ]
  }
}