554 lines
No EOL
19 KiB
JSON
554 lines
No EOL
19 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2017-09-18",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Locky Ransomware Pushed Alongside FakeGlobe in Upgraded Spam Campaigns",
|
|
"publish_timestamp": "1540717099",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1540562142",
|
|
"uuid": "5a3bd35f-7140-48d0-8b88-4555950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:ransomware=\"Locky\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:ransomware=\"Fake Globe Ransomware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#e2007a",
|
|
"local": false,
|
|
"name": "workflow:state=\"complete\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#2c4f00",
|
|
"local": false,
|
|
"name": "malware_classification:malware-category=\"Ransomware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#3a7300",
|
|
"local": false,
|
|
"name": "circl:incident-classification=\"malware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1540562131",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5a3bd36b-b630-478e-a75e-4746950d210f",
|
|
"value": "http://blog.trendmicro.com/trendlabs-security-intelligence/locky-ransomware-pushed-alongside-fakeglobe-upgraded-spam-campaigns/",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1540562142",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd31462-8b84-4a33-9161-482d950d210f",
|
|
"value": "n the beginning of September, a sizeable spam campaign was detected distributing the latest Locky variant. Locky is a notorious ransomware that was first detected in the early months of 2016 and has continued to evolve and spread through different methods, particularly spam mail. A thorough look at samples from recent campaigns shows that cybercriminals are using sophisticated distribution methods, affecting users in more than 70 countries.",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1540560326",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5bd315c6-b0c4-4f4f-988d-4ada950d210f",
|
|
"value": "http://qolseaboomdog.top/support.php?f=1"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1540560327",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5bd315c7-3898-4af5-b731-495a950d210f",
|
|
"value": "http://newhostrcm.top/admin.php?f=1"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1540560327",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5bd315c7-5868-414f-9f7b-424c950d210f",
|
|
"value": "http://qolseaboomdog.top/support.php?f=2"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1540560328",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5bd315c8-6c8c-4a3b-8a41-44f7950d210f",
|
|
"value": "http://newhostrcm.top/admin.php?f=2"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "VBScript files (downloaders) detected as VBS_NEMUCOD.ELDSAUO",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540560680",
|
|
"uuid": "5bd31728-42ac-43a6-97e3-467b950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540560680",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd31728-0460-4960-8b24-4ebf950d210f",
|
|
"value": "39256f126bba17770310c2115586b9f22b858cf15c43ab36bd7cfb18ad63a0c2"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540560683",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd3172b-47d0-4893-8808-4d52950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "VBScript files (downloaders) detected as VBS_NEMUCOD.ELDSAUO",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540560730",
|
|
"uuid": "5bd3175a-c93c-443e-b60a-4ba7950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540560731",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd3175b-44e4-4979-8f44-4de7950d210f",
|
|
"value": "a299f3de0c9277c0ce7dd3f7dc9aee57a7abe78b155919b1ecced1896c69653b"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540560735",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd3175f-a3e0-437f-aa7d-4be6950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "VBScript files (downloaders) detected as VBS_NEMUCOD.ELDSAUO",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540560772",
|
|
"uuid": "5bd31784-2454-4dbf-8f89-453f950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540560772",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd31784-b428-45eb-ab0b-45c9950d210f",
|
|
"value": "4d4a0e1d7218180452e22e6b52a7f9a0db1e0c0aa51a48f9a79c600b51030050"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540560773",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd31785-d030-480d-b208-4d3f950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "VBScript files (downloaders) detected as VBS_NEMUCOD.ELDSAUO",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540560793",
|
|
"uuid": "5bd31799-3030-4f6a-a36c-4818950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540560793",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd31799-c204-46d3-8fdc-465e950d210f",
|
|
"value": "0f6ae637a9d15503a0af42be649388f01f8637ca16b15526e318a94b7f34bf6e"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540560794",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd3179a-a460-47ad-be3b-4dad950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "LOCKY from VBS detected as RANSOM_FAKEGLOBE.ASUUB",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540560819",
|
|
"uuid": "5bd317b3-b98c-4655-9b12-4137950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540560819",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd317b3-45d8-4a28-a656-4340950d210f",
|
|
"value": "bb1df4a93fc27c54c78f84323e0ea7bb2b54469893150e3ea991826c81b56f47"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540560825",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd317b9-518c-49a2-a162-49e1950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "FAKEGLOBE from VBS detected as RANSOM_LOCKY.TH905",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540561027",
|
|
"uuid": "5bd31883-a8e4-4dc7-863f-4f86950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540561028",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd31884-c480-42dc-ba8b-4c9f950d210f",
|
|
"value": "e75e5d374f20c386b1114252647cca7bd407190cafb26c6cfbd42c5f9223fe6c"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540561032",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd31888-b0b4-42e0-9398-42c7950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "FAKEGLOBE from DOC detected as RANSOM_FAKEGLOBE.ASUUG",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540561076",
|
|
"uuid": "5bd318b4-844c-4ddb-b452-40b1950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540561076",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd318b4-1008-4b44-aa8a-41ba950d210f",
|
|
"value": "12e75bdbc3f0b489a89104c646aee10a71277c22b6abbc6e346d1ba6f17edf6d"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540561084",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd318bc-2d74-4c82-9549-471b950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "DOC files (downloaders) detected as W2KM_POWLOAD.AUSJST",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540561902",
|
|
"uuid": "5bd31bee-8f4c-4393-8f1b-4e60950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540561902",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd31bee-bd50-4f67-8701-4808950d210f",
|
|
"value": "067eb2754a823953a6efa1dfe9353eeabf699f171d21ffbff8e2303f7f678139"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540561904",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd31bf0-7894-4947-b5e1-4b93950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "DOC files (downloaders) detected as W2KM_POWLOAD.AUSJST",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540561920",
|
|
"uuid": "5bd31c00-3d08-4882-8269-433b950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540561921",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd31c01-73c4-43e8-bb7a-46ed950d210f",
|
|
"value": "6bdf46209fda582d7af5b74770b0eccf6abd3dbeabce3bdfb88db2f252ee778a"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540561924",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd31c04-f90c-4f3c-8f90-4d73950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "DOC files (downloaders) detected as W2KM_POWLOAD.AUSJSP",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540561942",
|
|
"uuid": "5bd31c16-5978-48e0-a441-4722950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540561942",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd31c16-ee80-459a-b17a-4ce4950d210f",
|
|
"value": "efb154bccff1e9a0f090a6afd7a08bf2c1fffea745b575a0bf31f22998688973"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540561947",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd31c1b-a920-48be-abca-41c7950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "LOCKY from DOC detected as RANSOM_LOCKY.TH908",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "15",
|
|
"timestamp": "1540561969",
|
|
"uuid": "5bd31c31-bba0-47bc-b92b-4b39950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1540561970",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5bd31c32-2164-4426-8110-473e950d210f",
|
|
"value": "3cb4484976676ac043fae870addaa57e858c1286cdb17d01ef8c973c5ec5b015"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1540561975",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5bd31c37-1414-4718-8ae9-4a1a950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |