misp-circl-feed/feeds/circl/misp/5b718bda-8d9c-477f-bcd5-4634950d210f.json

{
  "Event": {
    "analysis": "2",
    "date": "2018-08-10",
    "extends_uuid": "",
    "info": "OSINT - New KeyPass Ransomware Campaign Underway",
    "publish_timestamp": "1536846760",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1536842677",
    "uuid": "5b718bda-8d9c-477f-bcd5-4634950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "name": "misp-galaxy:ransomware=\"KEYPASS\""
      },
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      },
      {
        "colour": "#00223b",
        "name": "osint:source-type=\"blog-post\""
      },
      {
        "colour": "#3b7500",
        "name": "circl:incident-classification=\"malware\""
      },
      {
        "colour": "#2c4f00",
        "name": "malware_classification:malware-category=\"Ransomware\""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1534168336",
        "to_ids": false,
        "type": "link",
        "uuid": "5b718d07-ac14-4b23-9a09-4837950d210f",
        "value": "https://www.bleepingcomputer.com/news/security/new-keypass-ransomware-campaign-underway/",
        "Tag": [
          {
            "colour": "#00223b",
            "name": "osint:source-type=\"blog-post\""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1536842335",
        "to_ids": false,
        "type": "text",
        "uuid": "5b718d35-5110-4e9a-b084-4c45950d210f",
        "value": "A new distribution campaign is underway for a STOP Ransomware variant called KeyPass based on the amount of victims that have been seen. Unfortunately, how the ransomware is being distributed is unknown at this time.\r\n\r\nNot much is known regarding how this ransomware is being distributed other than what people have posted in the BleepingComputer forums. According to some of the posts, the ransomware appeared after the user downloaded and installed cracks such as KMSpico. Other reports state that it appeared on its own and that the victim did not install anything.",
        "Tag": [
          {
            "colour": "#00223b",
            "name": "osint:source-type=\"blog-post\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1536841994",
        "to_ids": true,
        "type": "email-src",
        "uuid": "5b9a590a-61b8-48b0-b5d0-5c6d950d210f",
        "value": "keypass@bitmessage.ch"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1536841994",
        "to_ids": true,
        "type": "email-src",
        "uuid": "5b9a590a-e45c-4a9c-953d-5c6d950d210f",
        "value": "keypass@india.com"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "14",
        "timestamp": "1536841968",
        "uuid": "5b9a58f0-5ba8-4bd6-b7c4-3055950d210f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1536841969",
            "to_ids": true,
            "type": "filename",
            "uuid": "5b9a58f1-ef90-4258-b4ff-3055950d210f",
            "value": "!!!KEYPASS_DECRYPTION_INFO!!!.txt"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1536841969",
            "to_ids": false,
            "type": "text",
            "uuid": "5b9a58f1-b5c4-4a26-acf3-3055950d210f",
            "value": "Attention! \r\n\r\nAll your files, documents, photos, databases and other important files are encrypted and have the extension: .KEYPASS\r\n\r\nThe only method of recovering files is to purchase an decrypt software and unique private key.\r\n\r\nAfter purchase you will start decrypt software, enter your unique private key and it will decrypt all your data.\r\n\r\nOnly we can give you this key and only we can recover your files.\r\n\r\nYou need to contact us by e-mail keypass@bitmessage.ch send us your personal ID and wait for further instructions.\r\n\r\nFor you to be sure, that we can decrypt your files - you can send us a 1-3 any not very big encrypted files and we will send you back it in a original form FREE.\r\n\r\nPrice for decryption $300. \r\n\r\nThis price avaliable if you contact us first 72 hours.\r\n\r\nE-mail address to contact us:\r\n\r\nkeypass@bitmessage.ch\r\n\r\n\r\n\r\nReserve e-mail address to contact us:\r\n\r\nkeypass@india.com\r\n\r\n\r\n\r\nYour personal id:\r\n[id]"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "state",
            "timestamp": "1536841969",
            "to_ids": false,
            "type": "text",
            "uuid": "5b9a58f1-3060-4b93-9f4e-3055950d210f",
            "value": "Malicious"
          }
        ]
      }
    ]
  }
}