misp-circl-feed/feeds/circl/misp/5846b21a-e1b8-473c-b82d-456c950d210f.json

{"Event": {"info": "OSINT - Kelihos botnet delivering CryptFlle2 Ransomware with theme AmericanAirlines", "Tag": [{"colour": "#004646", "exportable": true, "name": "type:OSINT"}, {"colour": "#ffffff", "exportable": true, "name": "tlp:white"}, {"colour": "#2c4f00", "exportable": true, "name": "malware_classification:malware-category=\"Ransomware\""}, {"colour": "#006c6c", "exportable": true, "name": "ecsirt:malicious-code=\"ransomware\""}, {"colour": "#420053", "exportable": true, "name": "ms-caro-malware:malware-type=\"Ransom\""}], "publish_timestamp": "1481029387", "timestamp": "1481215602", "analysis": "2", "Attribute": [{"comment": "", "category": "External analysis", "uuid": "5846b22d-e61c-4563-b63f-4ad1950d210f", "timestamp": "1481028141", "to_ids": false, "value": "http://garwarner.blogspot.lu/2016/08/american-airlines-spam-from-kelihos.html", "disable_correlation": false, "object_relation": null, "type": "link"}, {"comment": "", "category": "External analysis", "uuid": "5846b25a-f08c-4dff-8e92-418b950d210f", "timestamp": "1481028186", "to_ids": false, "value": "When we saw the Kelihos botnet delivering ransomware last month on July 8th, we sat up and took notice.  The Kelihos botnet has a long history of delivering pharma spam and stock market manipulation spam (pump-n-dump), but now it was spamming the WildFire ransomware. ( See: http://garwarner.blogspot.com/2016/07/kelihos-botnet-delivering-dutch.html )  I was under the impression that it was one of the occasional gimmicks observed with Kelihos where they try something a single time and then move on.  I assumed that some script kiddies were testing new ransomware techniques. Unfortunately, I was wrong and Kelihos hit back with CryptFIle2 encryption ransomware.", "disable_correlation": false, "object_relation": null, "type": "comment"}, {"comment": "", "category": "Payload delivery", "uuid": "5846b291-723c-4f42-beec-31ad950d210f", "timestamp": "1481028241", "to_ids": false, "value": "Bonus from AmericanAirlines", "disable_correlation": false, "object_relation": null, "type": "email-subject"}, {"comment": "", "category": "Payload delivery", "uuid": "5846b291-1d70-4e89-aa04-31ad950d210f", "timestamp": "1481028241", "to_ids": false, "value": "AmericanAirlines free 100$", "disable_correlation": false, "object_relation": null, "type": "email-subject"}, {"comment": "", "category": "Payload delivery", "uuid": "5846b291-417c-4d19-ab9a-31ad950d210f", "timestamp": "1481028241", "to_ids": false, "value": "AmericanAirlines discount", "disable_correlation": false, "object_relation": null, "type": "email-subject"}, {"comment": "", "category": "Payload delivery", "uuid": "5846b292-61dc-4db8-b5e4-31ad950d210f", "timestamp": "1481028242", "to_ids": false, "value": "Free fly with AmericanAirlines", "disable_correlation": false, "object_relation": null, "type": "email-subject"}, {"comment": "", "category": "Network activity", "uuid": "5846b34b-5314-4292-a7ff-4370950d210f", "timestamp": "1481028427", "to_ids": true, "value": "http://dataupllinks.top/nfdk/ticket1845.doc", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5846b34b-d860-4263-82ff-47a5950d210f", "timestamp": "1481028427", "to_ids": true, "value": "http://ftp.dataupllinks.top/edsf/tick-873.doc", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5846b34c-6e50-4082-af0e-4bc9950d210f", "timestamp": "1481028428", "to_ids": true, "value": "http://ftp.filesgigastor.top/23tf/disc_tick-235.doc", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5846b34c-d918-477e-9688-4f72950d210f", "timestamp": "1481028428", "to_ids": true, "value": "http://www.webdataupllinks.net/rety/tick-834.doc", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Payload delivery", "uuid": "5846b399-f940-4a5d-932d-443e950d210f", "timestamp": "1481028505", "to_ids": true, "value": "westbors@oath.com", "disable_correlation": false, "object_relation": null, "type": "email-src"}, {"comment": "", "category": "Payload delivery", "uuid": "5846b399-0f44-4e50-b671-4b7e950d210f", "timestamp": "1481028505", "to_ids": true, "value": "gobas@inorbit.com", "disable_correlation": false, "object_relation": null, "type": "email-src"}, {"comment": "MD5 hash of the Word document", "category": "Payload delivery", "uuid": "5846b542-74b8-4247-87a8-45aa950d210f", "timestamp": "1481028930", "to_ids": true, "value": "4fde04b25ea20b6ab30c5e4984e01afc", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "Website mentioned in the Word document", "category": "Network activity", "uuid": "5846b542-6d54-478c-854e-4699950d210f", "timestamp": "1481028930", "to_ids": true, "value": "english.ctrip.com", "disable_correlation": false, "object_relation": null, "type": "hostname"}, {"comment": "Payload location", "category": "Network activity", "uuid": "5846b542-73f0-4e63-b152-4600950d210f", "timestamp": "1481028930", "to_ids": true, "value": "http://216.170.126.3/wfil/file.exe", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "Payload location", "category": "Network activity", "uuid": "5846b542-2804-4576-bf31-4123950d210f", "timestamp": "1481028930", "to_ids": true, "value": "http://216.170.118.4/default.jpg", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "Command & Control Center", "category": "Network activity", "uuid": "5846b543-3c78-4963-b36d-4a45950d210f", "timestamp": "1481028931", "to_ids": true, "value": "http://216.170.118.4/wes/offers.php", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "MD5 hash of the Word document - Xchecked via VT: 4fde04b25ea20b6ab30c5e4984e01afc", "category": "Payload delivery", "uuid": "5846b6c8-e324-402c-97c2-45b702de0b81", "timestamp": "1481029320", "to_ids": true, "value": "a5e14eecf6beb956732790b05df001ce4fe0f001022f75dd1952d529d2eb9c11", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "MD5 hash of the Word document - Xchecked via VT: 4fde04b25ea20b6ab30c5e4984e01afc", "category": "Payload delivery", "uuid": "5846b6c8-0ce8-44c4-a89a-420502de0b81", "timestamp": "1481029320", "to_ids": true, "value": "7a35907df3ac0693be55a218be8d5b5b85673f45", "disable_correlation": false, "object_relation": null, "type": "sha1"}, {"comment": "MD5 hash of the Word document - Xchecked via VT: 4fde04b25ea20b6ab30c5e4984e01afc", "category": "External analysis", "uuid": "5846b6c8-c734-4b15-95cd-4ce002de0b81", "timestamp": "1481029320", "to_ids": false, "value": "https://www.virustotal.com/file/a5e14eecf6beb956732790b05df001ce4fe0f001022f75dd1952d529d2eb9c11/analysis/1472201806/", "disable_correlation": false, "object_relation": null, "type": "link"}], "extends_uuid": "", "published": false, "date": "2016-08-04", "Orgc": {"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", "name": "CIRCL"}, "threat_level_id": "3", "uuid": "5846b21a-e1b8-473c-b82d-456c950d210f"}}