352 lines
No EOL
12 KiB
JSON
352 lines
No EOL
12 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "0",
|
|
"date": "2018-05-15",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - New Bip Dharma Ransomware Variant Released",
|
|
"publish_timestamp": "1536238378",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1536238352",
|
|
"uuid": "5b84012a-f9d4-4d92-abb3-344f950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:ransomware=\"Dharma Ransomware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#2c4f00",
|
|
"local": false,
|
|
"name": "malware_classification:malware-category=\"Ransomware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1535379466",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5b840189-c774-4f4c-83b7-5fb0950d210f",
|
|
"value": "https://www.bleepingcomputer.com/news/security/new-bip-dharma-ransomware-variant-released/",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1535379476",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b8401a0-d0e4-422e-a664-33af950d210f",
|
|
"value": "Today, Michael Gillespie noticed what appeared to be a new variant of the Crysis/Dharma Ransomware uploaded to his ID-Ransomware site. Jakub Kroustek then discovered some samples to confirm that it was indeed a new Dharma variant. This new version will append the .Bip extension to encrypted files. It is not known exactly how this variant is being distributed, but in the past Dharma is typically spread by hacking into Remote Desktop Services and manually installing the ransomware.",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1536157268",
|
|
"to_ids": true,
|
|
"type": "email-src",
|
|
"uuid": "5b8fe654-8db4-444c-ad10-495f950d210f",
|
|
"value": "beamsell@qq.com"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1535379389",
|
|
"uuid": "5b8407bd-2440-40cd-80a2-5fb0950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1535379389",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5b8407bd-2e48-4d88-8dc9-5fb0950d210f",
|
|
"value": "208989df29236594c9d889d54b666041bc7df1d0b53cedd16e4f68636e036bb7"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1535379390",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b8407be-6f3c-4b13-8fea-5fb0950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1535379566",
|
|
"uuid": "5b84086e-d5ec-4ab2-b371-0716950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1535379566",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5b84086e-6970-41d9-bfac-0716950d210f",
|
|
"value": "%UserProfile%\\AppData\\Roaming\\Info.hta"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1535379566",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b84086e-8e5c-4464-88a4-0716950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1535379584",
|
|
"uuid": "5b840880-b12c-4619-be47-0716950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1535379584",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5b840880-de24-4e22-90f6-0716950d210f",
|
|
"value": "%UserProfile%\\AppData\\Roaming\\[filename.exe]"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1535379584",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b840880-8cc8-4ab0-9e7a-0716950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1535380188",
|
|
"uuid": "5b840adc-296c-4705-8c8f-0716950d210f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "filename",
|
|
"timestamp": "1535380188",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5b840adc-8bbc-402b-9974-0716950d210f",
|
|
"value": "FILES ENCRYPTED.txt"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "state",
|
|
"timestamp": "1535380188",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5b840adc-c198-4927-a4a1-0716950d210f",
|
|
"value": "Malicious"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "11",
|
|
"timestamp": "1536238344",
|
|
"uuid": "4da3496e-b9b6-48b4-9b2d-42beb59eb7ca",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "4da3496e-b9b6-48b4-9b2d-42beb59eb7ca",
|
|
"referenced_uuid": "499803fa-d2c3-4722-8fb9-f1134171354f",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "1536238355",
|
|
"uuid": "5b912313-f4cc-4292-9e24-4a3e02de0b81"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1536238343",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "6647a831-e205-4827-bd04-b92af2f8e3dc",
|
|
"value": "b84e41893fa55503a84688b36556db05"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1536238345",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5778ca06-cb45-4793-9e93-531db811a383",
|
|
"value": "94f83bfb5451383b9c7b486d05f38e1856fe62a5"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1536238347",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "f6a74a13-3854-4f00-85b6-0fe1d81a9b09",
|
|
"value": "208989df29236594c9d889d54b666041bc7df1d0b53cedd16e4f68636e036bb7"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "2",
|
|
"timestamp": "1536238349",
|
|
"uuid": "499803fa-d2c3-4722-8fb9-f1134171354f",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1536238350",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "45a6abd8-a4ca-4133-bddb-bdd48c7ac32b",
|
|
"value": "2018-08-24T17:37:17"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1536238352",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "c55fb0f7-f9ce-4a7b-9b44-e99390947433",
|
|
"value": "https://www.virustotal.com/file/208989df29236594c9d889d54b666041bc7df1d0b53cedd16e4f68636e036bb7/analysis/1535132237/"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1536238354",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "b4c4e081-c8bd-4467-8211-fc83b3779c3f",
|
|
"value": "52/68"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |