{
  "Event": {
    "analysis": "2",
    "date": "2020-01-24",
    "extends_uuid": "",
    "info": "OSINT - First Node.js-based Ransomware : Nodera",
    "publish_timestamp": "1579854880",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1579854868",
    "uuid": "5e2a9dc9-adb4-49bc-9be1-4304950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": "0",
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": "0",
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#0087e8",
        "local": "0",
        "name": "osint:certainty=\"50\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": "0",
        "name": "misp-galaxy:ransomware=\"Nodera Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#000000",
        "local": "0",
        "name": "dnc:malware-type=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#39b300",
        "local": "0",
        "name": "enisa:nefarious-activity-abuse=\"ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#006c6c",
        "local": "0",
        "name": "ecsirt:malicious-code=\"ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#2c4f00",
        "local": "0",
        "name": "malware_classification:malware-category=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#00acd1",
        "local": "0",
        "name": "veris:action:malware:variety=\"Ransomware\"",
        "relationship_type": ""
      },
      {
        "colour": "#000000",
        "local": "0",
        "name": "Ransomware",
        "relationship_type": ""
      },
      {
        "colour": "#420053",
        "local": "0",
        "name": "ms-caro-malware:malware-type=\"Ransom\"",
        "relationship_type": ""
      },
      {
        "colour": "#001739",
        "local": "0",
        "name": "ms-caro-malware-full:malware-type=\"Ransom\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1579854418",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5e2aaa52-d230-4bc6-ab9f-2090950d210f",
        "value": "7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366"
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1579854420",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5e2aaa54-d280-4e74-bd88-2090950d210f",
        "value": "53a95c9126be8262afb0821da4d7137e6c8a4d9b363f91298249ca134d394bf4"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1579854557",
        "to_ids": false,
        "type": "link",
        "uuid": "5e2aaadd-e758-49f9-825e-2091950d210f",
        "value": "https://blogs.quickheal.com/first-node-js-based-ransomware-nodera/"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "17",
        "timestamp": "1579854471",
        "uuid": "5f8af945-8a3d-4504-b607-7ddfdf6deb75",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "5f8af945-8a3d-4504-b607-7ddfdf6deb75",
            "referenced_uuid": "51ba9d61-5380-4585-b0c0-b7fe0bc36bc9",
            "relationship_type": "analysed-with",
            "timestamp": "1579854472",
            "uuid": "5e2aaa88-56e4-42f3-803a-2099950d210f"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1579854420",
            "to_ids": true,
            "type": "md5",
            "uuid": "407f409e-9f07-457a-97a0-2f4a8240ca10",
            "value": "976b17845289d9f8a5ee1c8a9e9c4173"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1579854420",
            "to_ids": true,
            "type": "sha1",
            "uuid": "48e0218b-35d8-4603-901d-b53bacc138cc",
            "value": "c458e4c32e3ebb1fca331ef235fe3f96e505e066"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1579854420",
            "to_ids": true,
            "type": "sha256",
            "uuid": "3dea2c06-6ef4-405a-8fb5-31e47c44b2a8",
            "value": "53a95c9126be8262afb0821da4d7137e6c8a4d9b363f91298249ca134d394bf4"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "2",
        "timestamp": "1579854471",
        "uuid": "51ba9d61-5380-4585-b0c0-b7fe0bc36bc9",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "last-submission",
            "timestamp": "1579854420",
            "to_ids": false,
            "type": "datetime",
            "uuid": "97ad26f4-976d-44ea-9c7e-9ce0894ba133",
            "value": "2020-01-24T07:09:56"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "permalink",
            "timestamp": "1579854420",
            "to_ids": false,
            "type": "link",
            "uuid": "bac4b8ec-8e41-42ca-bf06-cf214c10ffa8",
            "value": "https://www.virustotal.com/file/53a95c9126be8262afb0821da4d7137e6c8a4d9b363f91298249ca134d394bf4/analysis/1579849796/"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1579854420",
            "to_ids": false,
            "type": "text",
            "uuid": "30db4ce2-0d52-4e48-8df2-8afb47f8f6b9",
            "value": "11/56"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "17",
        "timestamp": "1579854472",
        "uuid": "cc3072d2-9476-47dd-8aa5-820487dea369",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "cc3072d2-9476-47dd-8aa5-820487dea369",
            "referenced_uuid": "b9cfdf21-9bd5-4e25-8006-51f1643b713f",
            "relationship_type": "analysed-with",
            "timestamp": "1579854472",
            "uuid": "5e2aaa88-5b4c-4fd1-8ea0-2099950d210f"
          }
        ],
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1579854418",
            "to_ids": true,
            "type": "md5",
            "uuid": "644ba2b5-d1b2-40ae-9ce2-e5fa56193bb5",
            "value": "e8cfee97467d4006257afdaabf945565"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1579854418",
            "to_ids": true,
            "type": "sha1",
            "uuid": "78c2cd4f-1f68-4907-b42c-2d422575efef",
            "value": "7879bbaf9bd6de58a7b318d013cd479d4a24ffae"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1579854418",
            "to_ids": true,
            "type": "sha256",
            "uuid": "f6fe0b9a-e17c-4124-8da6-adbb8052b8c6",
            "value": "7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "2",
        "timestamp": "1579854472",
        "uuid": "b9cfdf21-9bd5-4e25-8006-51f1643b713f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "last-submission",
            "timestamp": "1579854418",
            "to_ids": false,
            "type": "datetime",
            "uuid": "e384fb38-468a-4e7a-b1d3-e112b4037604",
            "value": "2020-01-24T05:46:08"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "permalink",
            "timestamp": "1579854418",
            "to_ids": false,
            "type": "link",
            "uuid": "3a80a603-65cb-4fb0-91c1-15dbf8fc3e71",
            "value": "https://www.virustotal.com/file/7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366/analysis/1579844768/"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1579854418",
            "to_ids": false,
            "type": "text",
            "uuid": "c09bba97-5263-4b7d-8139-0b86b92333e0",
            "value": "23/57"
          }
        ]
      }
    ]
  }
}