{
  "Event": {
    "analysis": "2",
    "date": "2016-05-19",
    "extends_uuid": "",
    "info": "OSINT - Dogspectus Ransomware Analysis",
    "publish_timestamp": "1464159582",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1464159454",
    "uuid": "574549b7-23c0-4bf3-9183-466b950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": "0",
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#006c6c",
        "local": "0",
        "name": "ecsirt:malicious-code=\"ransomware\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464158696",
        "to_ids": false,
        "type": "comment",
        "uuid": "574549e8-c020-4a63-8146-4ce6950d210f",
        "value": "On April 25, 2016, Blue Coat published an article on a new Android Ransomware, called \"Dogspectus.\u00e2\u20ac\u009d On May 12, 2016, Dell SonicWALL published a separate report on the Android Lockscreen malware campaign with similar characteristics to Dogspectus. These similarities are not a coincidence. We began our own extensive investigation into this ransomware some time ago, and will share additional technical details of this malware here that have not been previously discussed."
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159269",
        "to_ids": false,
        "type": "link",
        "uuid": "57454c25-2ad4-4971-ab4b-4704950d210f",
        "value": "http://blog.fortinet.com/2016/05/19/dogspectus-ransomware-analysis"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159269",
        "to_ids": false,
        "type": "link",
        "uuid": "57454c25-a5a0-4029-af09-460d950d210f",
        "value": "https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=929"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159270",
        "to_ids": false,
        "type": "link",
        "uuid": "57454c26-e3d0-40d9-b77c-4f9d950d210f",
        "value": "https://www.bluecoat.com/security-blog/2016-04-25/android-exploit-delivers-dogspectus-ransomware"
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159307",
        "to_ids": true,
        "type": "url",
        "uuid": "57454c4b-74b8-4e8b-955e-4053950d210f",
        "value": "http://workoutplaceface.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159307",
        "to_ids": true,
        "type": "url",
        "uuid": "57454c4b-db4c-4805-a8a8-482a950d210f",
        "value": "http://orlandroot.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159308",
        "to_ids": true,
        "type": "url",
        "uuid": "57454c4c-9f3c-4f7f-be50-4a7c950d210f",
        "value": "http://daflourstmichurins.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159308",
        "to_ids": true,
        "type": "url",
        "uuid": "57454c4c-d55c-4d66-afda-4bc2950d210f",
        "value": "http://mentosjolly.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159308",
        "to_ids": true,
        "type": "url",
        "uuid": "57454c4c-3fac-47e8-bd71-4be3950d210f",
        "value": "http://belkafruitcymus.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159309",
        "to_ids": true,
        "type": "url",
        "uuid": "57454c4d-1b10-4f2a-a911-4a37950d210f",
        "value": "http://wirtualcleens.com"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159321",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57454c59-6b48-4c0a-b689-4355950d210f",
        "value": "197588be3e8ba5c779696d864121aff188901720dcda796759906c17473d46fe"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 197588be3e8ba5c779696d864121aff188901720dcda796759906c17473d46fe",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159454",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57454cde-0adc-42d8-a2a1-404702de0b81",
        "value": "392e8b90431dfe55ca03e04a49fce1514d61638e"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 197588be3e8ba5c779696d864121aff188901720dcda796759906c17473d46fe",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159454",
        "to_ids": true,
        "type": "md5",
        "uuid": "57454cde-cbcc-402d-9057-4aaa02de0b81",
        "value": "e26710a4e499a797aab62fd0ad7ac19c"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 197588be3e8ba5c779696d864121aff188901720dcda796759906c17473d46fe",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1464159455",
        "to_ids": false,
        "type": "link",
        "uuid": "57454cdf-db60-4831-8b49-452502de0b81",
        "value": "https://www.virustotal.com/file/197588be3e8ba5c779696d864121aff188901720dcda796759906c17473d46fe/analysis/1464158418/"
      }
    ]
  }
}