{
  "Event": {
    "analysis": "2",
    "date": "2016-08-29",
    "extends_uuid": "",
    "info": "Ransomware - Xorist",
    "publish_timestamp": "1472548231",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1472541011",
    "uuid": "57c4445b-c548-4654-af0b-4be3950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#3a7300",
        "local": false,
        "name": "circl:incident-classification=\"malware\"",
        "relationship_type": ""
      },
      {
        "colour": "#420053",
        "local": false,
        "name": "ms-caro-malware:malware-type=\"Ransom\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c4f00",
        "local": false,
        "name": "malware_classification:malware-category=\"Ransomware\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472480394",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57c4448a-bef0-4ba7-a071-444e950d210f",
        "value": "77b0c41b7d340b8a3d903f21347bbf06aa766b5b"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472480394",
        "to_ids": true,
        "type": "filename",
        "uuid": "57c4448a-fb04-457d-87e7-4127950d210f",
        "value": "3Z4wnG9603it23y.exe"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472480395",
        "to_ids": true,
        "type": "md5",
        "uuid": "57c4448b-454c-4d17-90d1-4d2f950d210f",
        "value": "0749bae92ca336a02c83d126e04ec628"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472480395",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57c4448b-3fa4-4d65-9ccc-4afa950d210f",
        "value": "b3c4ae251f8094fa15b510051835c657eaef2a6cea46075d3aec964b14a99f68"
      },
      {
        "category": "Other",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472480448",
        "to_ids": false,
        "type": "comment",
        "uuid": "57c444c0-8004-48fa-9c33-8aca950d210f",
        "value": "UPX packed"
      },
      {
        "category": "Other",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472480840",
        "to_ids": false,
        "type": "text",
        "uuid": "57c44648-96f4-45d4-a8eb-453e950d210f",
        "value": "Key: 85350044dF4AC3518D185678A9414A7F,\r\nEncryption rounds:8,\r\nStart offset: 64,\r\nAlgorithm: TEA"
      },
      {
        "category": "External analysis",
        "comment": "Imported via the Freetext Import Tool - Xchecked via VT: b3c4ae251f8094fa15b510051835c657eaef2a6cea46075d3aec964b14a99f68",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472540684",
        "to_ids": false,
        "type": "link",
        "uuid": "57c5300c-0560-4146-bfaa-40e802de0b81",
        "value": "https://www.virustotal.com/file/b3c4ae251f8094fa15b510051835c657eaef2a6cea46075d3aec964b14a99f68/analysis/1469554268/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472541011",
        "to_ids": false,
        "type": "link",
        "uuid": "57c5310b-dc34-43cb-8b8e-4846950d210f",
        "value": "http://www.xylibox.com/2011/06/have-fun-with-trojan-ransomwin32xorist.html"
      },
      {
        "category": "Persistence mechanism",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1472547599",
        "to_ids": true,
        "type": "regkey|value",
        "uuid": "57c54b0f-27a4-458b-8e63-4455950d210f",
        "value": "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run|%TEMP%\\3Z4wnG9603it23y.exe"
      }
    ]
  }
}