217 lines
No EOL
7.9 KiB
JSON
217 lines
No EOL
7.9 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "0",
|
|
"date": "2021-01-05",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Babuk Ransomware",
|
|
"publish_timestamp": "1609871090",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1609871056",
|
|
"uuid": "86836f20-44df-443f-9ee4-6fcf0e554883",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#0088cc",
|
|
"name": "misp-galaxy:ransomware=\"Babuk Ranomsware\""
|
|
},
|
|
{
|
|
"colour": "#004646",
|
|
"name": "type:OSINT"
|
|
},
|
|
{
|
|
"colour": "#0071c3",
|
|
"name": "osint:lifetime=\"perpetual\""
|
|
},
|
|
{
|
|
"colour": "#0087e8",
|
|
"name": "osint:certainty=\"50\""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1609870799",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "ebd69067-3b22-492a-a8be-dbd69e6e697b",
|
|
"value": "http://chuongdong.com//reverse%20engineering/2021/01/03/BabukRansomware/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Babuk Ransomwarecomes in the form of a 32-bit .exe file.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1609870833",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "f189012c-b250-4f62-9a12-abfaaba0d75f",
|
|
"value": "e10713a4a5f635767dcd54d609bed977"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Babuk Ransomwarecomes in the form of a 32-bit .exe file.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1609870833",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "e5366890-5bac-4795-9c46-c29adbe4f0d9",
|
|
"value": "8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1609870953",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "7c2d2d04-2acc-4baf-a283-b9eb9a0760ca",
|
|
"value": "https://bazaar.abuse.ch/sample/8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9/"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1609870999",
|
|
"to_ids": true,
|
|
"type": "yara",
|
|
"uuid": "2d93f1e4-e6a2-462f-9d98-1b580e925a53",
|
|
"value": "rule BabukSabelt {\r\n\tmeta:\r\n\t \tdescription = \"YARA rule for Babuk Ransomware\"\r\n\t\treference = \"http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/\"\r\n\t\tauthor = \"@cPeterr\"\r\n\t\tdate = \"2021-01-03\"\r\n\t\trule_version = \"v1\"\r\n\t\tmalware_type = \"ransomware\"\r\n\t\ttlp = \"white\"\r\n\tstrings:\r\n\t\t$lanstr1 = \"-lanfirst\"\r\n\t\t$lanstr2 = \"-lansecond\"\r\n\t\t$lanstr3 = \"-nolan\"\r\n\t\t$str1 = \"BABUK LOCKER\"\r\n\t\t$str2 = \".__NIST_K571__\" wide\r\n\t\t$str3 = \"How To Restore Your Files.txt\" wide\r\n\t\t$str4 = \"ecdh_pub_k.bin\" wide\r\n\tcondition:\r\n\t\tall of ($str*) and all of ($lanstr*)\r\n}"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1609871033",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "e19fda56-fa9a-4e68-a836-a288a4e1cfa1",
|
|
"value": "https://twitter.com/Arkbird_SOLG/status/1345569395725242373"
|
|
}
|
|
],
|
|
"Object": [
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "File object describing a file with meta-information",
|
|
"meta-category": "file",
|
|
"name": "file",
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
|
"template_version": "22",
|
|
"timestamp": "1609870852",
|
|
"uuid": "028f19e2-8c42-4488-94ea-9f445ea27a8c",
|
|
"ObjectReference": [
|
|
{
|
|
"comment": "",
|
|
"object_uuid": "028f19e2-8c42-4488-94ea-9f445ea27a8c",
|
|
"referenced_uuid": "878b0966-2524-4cde-8fe6-d938d33b0659",
|
|
"relationship_type": "analysed-with",
|
|
"timestamp": "0",
|
|
"uuid": "4abe37f7-f5d3-4357-8393-01e0b9f505e6"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Babuk Ransomwarecomes in the form of a 32-bit .exe file.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "md5",
|
|
"timestamp": "1609870833",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "69f13bd6-4c9e-4608-b459-aca722d7ccf9",
|
|
"value": "e10713a4a5f635767dcd54d609bed977"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Babuk Ransomwarecomes in the form of a 32-bit .exe file.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha1",
|
|
"timestamp": "1609870833",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5e7ae909-5b82-4a01-adff-e0a710e374e4",
|
|
"value": "320d799beef673a98481757b2ff7e3463ce67916"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Babuk Ransomwarecomes in the form of a 32-bit .exe file.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "sha256",
|
|
"timestamp": "1609870833",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "fbbd78cc-62b8-4760-b91d-3cfe01915fbe",
|
|
"value": "8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"comment": "",
|
|
"deleted": false,
|
|
"description": "VirusTotal report",
|
|
"meta-category": "misc",
|
|
"name": "virustotal-report",
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
|
"template_version": "3",
|
|
"timestamp": "1609870852",
|
|
"uuid": "878b0966-2524-4cde-8fe6-d938d33b0659",
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "Babuk Ransomwarecomes in the form of a 32-bit .exe file.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "last-submission",
|
|
"timestamp": "1609870833",
|
|
"to_ids": false,
|
|
"type": "datetime",
|
|
"uuid": "73073b9a-3a5c-467a-9b50-9e36d22e0af8",
|
|
"value": "2021-01-05T08:13:52+00:00"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Babuk Ransomwarecomes in the form of a 32-bit .exe file.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"object_relation": "permalink",
|
|
"timestamp": "1609870833",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "bf5076a9-f57f-4626-b1ee-a03c950cb65a",
|
|
"value": "https://www.virustotal.com/gui/file/8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9/detection/f-8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9-1609834432"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Babuk Ransomwarecomes in the form of a 32-bit .exe file.",
|
|
"deleted": false,
|
|
"disable_correlation": true,
|
|
"object_relation": "detection-ratio",
|
|
"timestamp": "1609870833",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5fb73878-5607-4271-9126-c04868b5364f",
|
|
"value": "48/70"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |