876 lines
No EOL
38 KiB
JSON
876 lines
No EOL
38 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--56dc93a4-5a6c-470d-9c9b-4e9902de0b81",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-07T08:35:30.000Z",
|
|
"modified": "2016-03-07T08:35:30.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--56dc93a4-5a6c-470d-9c9b-4e9902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-07T08:35:30.000Z",
|
|
"modified": "2016-03-07T08:35:30.000Z",
|
|
"name": "OSINT - New OS X Ransomware KeRanger Infected Transmission BitTorrent Client Installer",
|
|
"published": "2016-03-07T08:36:54Z",
|
|
"object_refs": [
|
|
"observed-data--56dc93be-d390-4377-82cb-49cf02de0b81",
|
|
"url--56dc93be-d390-4377-82cb-49cf02de0b81",
|
|
"indicator--56dc93e5-4c30-4f24-82fc-434802de0b81",
|
|
"indicator--56dc93e5-fc70-4680-aa2d-494a02de0b81",
|
|
"indicator--56dc93e6-86ac-4ac2-98f2-413c02de0b81",
|
|
"indicator--56dc93e6-adac-4282-a062-485f02de0b81",
|
|
"indicator--56dc93e6-e290-4489-803f-4b7c02de0b81",
|
|
"indicator--56dc93e7-2fd0-4b80-b378-4d4702de0b81",
|
|
"x-misp-attribute--56dc93fc-4dd4-4bfe-894e-48a102de0b81",
|
|
"indicator--56dc9420-1368-4259-8c98-489a02de0b81",
|
|
"indicator--56dc9420-f8cc-4387-bc53-450f02de0b81",
|
|
"indicator--56dc9421-1ccc-46b1-8490-4aa402de0b81",
|
|
"indicator--56dc9421-5d8c-45fb-ba7d-424e02de0b81",
|
|
"indicator--56dc9421-e5b4-4527-967d-4fe202de0b81",
|
|
"indicator--56dc9421-9300-4c6c-be38-478e02de0b81",
|
|
"indicator--56dc9443-d870-4509-9d9f-434802de0b81",
|
|
"indicator--56dc9444-7a0c-4639-bbba-4af202de0b81",
|
|
"observed-data--56dc9444-9d10-4be0-b1d0-4aa002de0b81",
|
|
"url--56dc9444-9d10-4be0-b1d0-4aa002de0b81",
|
|
"indicator--56dc9444-dc2c-4d09-81d0-40d402de0b81",
|
|
"indicator--56dc9445-499c-4bda-bcb6-4af402de0b81",
|
|
"observed-data--56dc9445-2b00-4197-b2e2-4c3f02de0b81",
|
|
"url--56dc9445-2b00-4197-b2e2-4c3f02de0b81",
|
|
"indicator--56dc9445-ce5c-44c4-a315-41cd02de0b81",
|
|
"indicator--56dc9445-24e0-46a9-b8a8-498b02de0b81",
|
|
"observed-data--56dc9446-e51c-44cc-99f8-483402de0b81",
|
|
"url--56dc9446-e51c-44cc-99f8-483402de0b81",
|
|
"indicator--56dc9446-f4cc-4f5c-8ba7-4bfc02de0b81",
|
|
"indicator--56dc9446-f628-40c4-abde-46b202de0b81",
|
|
"observed-data--56dc9447-33e4-4cd8-9ebf-4aa502de0b81",
|
|
"url--56dc9447-33e4-4cd8-9ebf-4aa502de0b81",
|
|
"indicator--56dc9447-47e8-4c94-bb95-472102de0b81",
|
|
"indicator--56dc9447-547c-4cda-9caa-478302de0b81",
|
|
"observed-data--56dc9447-0350-4947-b63f-4c5802de0b81",
|
|
"url--56dc9447-0350-4947-b63f-4c5802de0b81",
|
|
"indicator--56dc9448-9050-44a5-9e8c-4a3302de0b81",
|
|
"indicator--56dc9448-6488-4152-816e-411d02de0b81",
|
|
"observed-data--56dc9448-d060-4412-9815-4c3f02de0b81",
|
|
"url--56dc9448-d060-4412-9815-4c3f02de0b81",
|
|
"x-misp-attribute--56dc9469-a334-4c0d-9ab7-416402de0b81",
|
|
"x-misp-attribute--56dd3d52-8768-4ce1-a546-48f0950d210f"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT"
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56dc93be-d390-4377-82cb-49cf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:31:58.000Z",
|
|
"modified": "2016-03-06T20:31:58.000Z",
|
|
"first_observed": "2016-03-06T20:31:58Z",
|
|
"last_observed": "2016-03-06T20:31:58Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56dc93be-d390-4377-82cb-49cf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56dc93be-d390-4377-82cb-49cf02de0b81",
|
|
"value": "http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc93e5-4c30-4f24-82fc-434802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:32:37.000Z",
|
|
"modified": "2016-03-06T20:32:37.000Z",
|
|
"description": "Imported via the freetext import.",
|
|
"pattern": "[url:value = 'lclebb6kvohlkcml.onion.link']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:32:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc93e5-fc70-4680-aa2d-494a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:32:37.000Z",
|
|
"modified": "2016-03-06T20:32:37.000Z",
|
|
"description": "Imported via the freetext import.",
|
|
"pattern": "[domain-name:value = 'lclebb6kvohlkcml.onion.nu']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:32:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc93e6-86ac-4ac2-98f2-413c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:32:38.000Z",
|
|
"modified": "2016-03-06T20:32:38.000Z",
|
|
"description": "Imported via the freetext import.",
|
|
"pattern": "[url:value = 'bmacyzmea723xyaz.onion.link']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:32:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc93e6-adac-4282-a062-485f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:32:38.000Z",
|
|
"modified": "2016-03-06T20:32:38.000Z",
|
|
"description": "Imported via the freetext import.",
|
|
"pattern": "[domain-name:value = 'bmacyzmea723xyaz.onion.nu']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:32:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc93e6-e290-4489-803f-4b7c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:32:38.000Z",
|
|
"modified": "2016-03-06T20:32:38.000Z",
|
|
"description": "Imported via the freetext import.",
|
|
"pattern": "[url:value = 'nejdtkok7oz5kjoc.onion.link']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:32:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc93e7-2fd0-4b80-b378-4d4702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:32:39.000Z",
|
|
"modified": "2016-03-06T20:32:39.000Z",
|
|
"description": "Imported via the freetext import.",
|
|
"pattern": "[domain-name:value = 'nejdtkok7oz5kjoc.onion.nu']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:32:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--56dc93fc-4dd4-4bfe-894e-48a102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:33:00.000Z",
|
|
"modified": "2016-03-06T20:33:00.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"Antivirus detection\""
|
|
],
|
|
"x_misp_category": "Antivirus detection",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "Ransomware.OSX.KeRanger"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9420-1368-4259-8c98-489a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:33:36.000Z",
|
|
"modified": "2016-03-06T20:33:36.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger",
|
|
"pattern": "[file:hashes.SHA256 = 'd1ac55a4e610380f0ab239fcc1c5f5a42722e8ee1554cba8074bbae4a5f6dbe1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:33:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9420-f8cc-4387-bc53-450f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:33:36.000Z",
|
|
"modified": "2016-03-06T20:33:36.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger",
|
|
"pattern": "[file:hashes.SHA256 = 'e3ad733cea9eba29e86610050c1a15592e6c77820927b9edeb77310975393574']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:33:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9421-1ccc-46b1-8490-4aa402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:33:37.000Z",
|
|
"modified": "2016-03-06T20:33:37.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger",
|
|
"pattern": "[file:hashes.SHA256 = '31b6adb633cff2a0f34cefd2a218097f3a9a8176c9363cc70fe41fe02af810b9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:33:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9421-5d8c-45fb-ba7d-424e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:33:37.000Z",
|
|
"modified": "2016-03-06T20:33:37.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger",
|
|
"pattern": "[file:hashes.SHA256 = 'd7d765b1ddd235a57a2d13bd065f293a7469594c7e13ea7700e55501206a09b5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:33:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9421-e5b4-4527-967d-4fe202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:33:37.000Z",
|
|
"modified": "2016-03-06T20:33:37.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger",
|
|
"pattern": "[file:hashes.SHA256 = 'ddc3dbee2a8ea9d8ed93f0843400653a89350612f2914868485476a847c6484a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:33:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9421-9300-4c6c-be38-478e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:33:37.000Z",
|
|
"modified": "2016-03-06T20:33:37.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger",
|
|
"pattern": "[file:hashes.SHA256 = '6061a554f5997a43c91f49f8aaf40c80a3f547fc6187bee57cd5573641fcf153']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:33:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9443-d870-4509-9d9f-434802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:11.000Z",
|
|
"modified": "2016-03-06T20:34:11.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: 6061a554f5997a43c91f49f8aaf40c80a3f547fc6187bee57cd5573641fcf153",
|
|
"pattern": "[file:hashes.SHA1 = '260f02e7dd4a62575eca7c1a09f3e6b152733e40']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9444-7a0c-4639-bbba-4af202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:12.000Z",
|
|
"modified": "2016-03-06T20:34:12.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: 6061a554f5997a43c91f49f8aaf40c80a3f547fc6187bee57cd5573641fcf153",
|
|
"pattern": "[file:hashes.MD5 = '861c3da2bbce6c09eda2709c8994f34c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56dc9444-9d10-4be0-b1d0-4aa002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:12.000Z",
|
|
"modified": "2016-03-06T20:34:12.000Z",
|
|
"first_observed": "2016-03-06T20:34:12Z",
|
|
"last_observed": "2016-03-06T20:34:12Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56dc9444-9d10-4be0-b1d0-4aa002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56dc9444-9d10-4be0-b1d0-4aa002de0b81",
|
|
"value": "https://www.virustotal.com/file/6061a554f5997a43c91f49f8aaf40c80a3f547fc6187bee57cd5573641fcf153/analysis/1457131054/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9444-dc2c-4d09-81d0-40d402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:12.000Z",
|
|
"modified": "2016-03-06T20:34:12.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: ddc3dbee2a8ea9d8ed93f0843400653a89350612f2914868485476a847c6484a",
|
|
"pattern": "[file:hashes.SHA1 = 'f2fe3ff6da97a5adfc9278c475536883adcef93b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9445-499c-4bda-bcb6-4af402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:13.000Z",
|
|
"modified": "2016-03-06T20:34:13.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: ddc3dbee2a8ea9d8ed93f0843400653a89350612f2914868485476a847c6484a",
|
|
"pattern": "[file:hashes.MD5 = '3151d9a085d14508fa9f10d48afc7016']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56dc9445-2b00-4197-b2e2-4c3f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:13.000Z",
|
|
"modified": "2016-03-06T20:34:13.000Z",
|
|
"first_observed": "2016-03-06T20:34:13Z",
|
|
"last_observed": "2016-03-06T20:34:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56dc9445-2b00-4197-b2e2-4c3f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56dc9445-2b00-4197-b2e2-4c3f02de0b81",
|
|
"value": "https://www.virustotal.com/file/ddc3dbee2a8ea9d8ed93f0843400653a89350612f2914868485476a847c6484a/analysis/1457131063/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9445-ce5c-44c4-a315-41cd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:13.000Z",
|
|
"modified": "2016-03-06T20:34:13.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: d7d765b1ddd235a57a2d13bd065f293a7469594c7e13ea7700e55501206a09b5",
|
|
"pattern": "[file:hashes.SHA1 = 'e2f6d5912565ad3a2c9b3393cf7aff0110738f5c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9445-24e0-46a9-b8a8-498b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:13.000Z",
|
|
"modified": "2016-03-06T20:34:13.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: d7d765b1ddd235a57a2d13bd065f293a7469594c7e13ea7700e55501206a09b5",
|
|
"pattern": "[file:hashes.MD5 = '24a8f01cfdc4228b4fc9bb87fedf6eb7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56dc9446-e51c-44cc-99f8-483402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:14.000Z",
|
|
"modified": "2016-03-06T20:34:14.000Z",
|
|
"first_observed": "2016-03-06T20:34:14Z",
|
|
"last_observed": "2016-03-06T20:34:14Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56dc9446-e51c-44cc-99f8-483402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56dc9446-e51c-44cc-99f8-483402de0b81",
|
|
"value": "https://www.virustotal.com/file/d7d765b1ddd235a57a2d13bd065f293a7469594c7e13ea7700e55501206a09b5/analysis/1457294776/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9446-f4cc-4f5c-8ba7-4bfc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:14.000Z",
|
|
"modified": "2016-03-06T20:34:14.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: 31b6adb633cff2a0f34cefd2a218097f3a9a8176c9363cc70fe41fe02af810b9",
|
|
"pattern": "[file:hashes.SHA1 = 'fd1f246ee9effafba0811fd692e2e76947e82687']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9446-f628-40c4-abde-46b202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:14.000Z",
|
|
"modified": "2016-03-06T20:34:14.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: 31b6adb633cff2a0f34cefd2a218097f3a9a8176c9363cc70fe41fe02af810b9",
|
|
"pattern": "[file:hashes.MD5 = '14a4df1df622562b3bf5bc9a94e6a783']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56dc9447-33e4-4cd8-9ebf-4aa502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:15.000Z",
|
|
"modified": "2016-03-06T20:34:15.000Z",
|
|
"first_observed": "2016-03-06T20:34:15Z",
|
|
"last_observed": "2016-03-06T20:34:15Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56dc9447-33e4-4cd8-9ebf-4aa502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56dc9447-33e4-4cd8-9ebf-4aa502de0b81",
|
|
"value": "https://www.virustotal.com/file/31b6adb633cff2a0f34cefd2a218097f3a9a8176c9363cc70fe41fe02af810b9/analysis/1457127744/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9447-47e8-4c94-bb95-472102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:15.000Z",
|
|
"modified": "2016-03-06T20:34:15.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: e3ad733cea9eba29e86610050c1a15592e6c77820927b9edeb77310975393574",
|
|
"pattern": "[file:hashes.SHA1 = 'f4c95047938cd66368f1f0fe7cbf87de8378a1fd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9447-547c-4cda-9caa-478302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:15.000Z",
|
|
"modified": "2016-03-06T20:34:15.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: e3ad733cea9eba29e86610050c1a15592e6c77820927b9edeb77310975393574",
|
|
"pattern": "[file:hashes.MD5 = '56b1d956112b0b7bd3e44f20cf1f2c19']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56dc9447-0350-4947-b63f-4c5802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:15.000Z",
|
|
"modified": "2016-03-06T20:34:15.000Z",
|
|
"first_observed": "2016-03-06T20:34:15Z",
|
|
"last_observed": "2016-03-06T20:34:15Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56dc9447-0350-4947-b63f-4c5802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56dc9447-0350-4947-b63f-4c5802de0b81",
|
|
"value": "https://www.virustotal.com/file/e3ad733cea9eba29e86610050c1a15592e6c77820927b9edeb77310975393574/analysis/1457127757/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9448-9050-44a5-9e8c-4a3302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:16.000Z",
|
|
"modified": "2016-03-06T20:34:16.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: d1ac55a4e610380f0ab239fcc1c5f5a42722e8ee1554cba8074bbae4a5f6dbe1",
|
|
"pattern": "[file:hashes.SHA1 = '5f8ae46ae82e346000f366c3eabdafbec76e99e9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56dc9448-6488-4152-816e-411d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:16.000Z",
|
|
"modified": "2016-03-06T20:34:16.000Z",
|
|
"description": "Samples of Ransomware.OSX.KeRanger - Xchecked via VT: d1ac55a4e610380f0ab239fcc1c5f5a42722e8ee1554cba8074bbae4a5f6dbe1",
|
|
"pattern": "[file:hashes.MD5 = '1d6297e2427f1d00a5b355d6d50809cb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-03-06T20:34:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56dc9448-d060-4412-9815-4c3f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:16.000Z",
|
|
"modified": "2016-03-06T20:34:16.000Z",
|
|
"first_observed": "2016-03-06T20:34:16Z",
|
|
"last_observed": "2016-03-06T20:34:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56dc9448-d060-4412-9815-4c3f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56dc9448-d060-4412-9815-4c3f02de0b81",
|
|
"value": "https://www.virustotal.com/file/d1ac55a4e610380f0ab239fcc1c5f5a42722e8ee1554cba8074bbae4a5f6dbe1/analysis/1457294749/"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--56dc9469-a334-4c0d-9ab7-416402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-06T20:34:49.000Z",
|
|
"modified": "2016-03-06T20:34:49.000Z",
|
|
"labels": [
|
|
"misp:type=\"comment\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "comment",
|
|
"x_misp_value": "On March 4, we detected that the Transmission BitTorrent client installer for OS X was infected with ransomware, just a few hours after installers were initially posted. We have named this Ransomware \u00e2\u20ac\u0153KeRanger.\u00e2\u20ac\u009d The only previous ransomware for OS X we are aware of is FileCoder, discovered by Kaspersky Lab in 2014. As FileCoder was incomplete at the time of its discovery, we believe KeRanger is the first fully functional ransomware seen on the OS X platform.\r\n\r\nAttackers infected two installers of Transmission version 2.90 with KeRanger on the morning of March 4. When we identified the issue, the infected DMG files were still available for downloading from the Transmission site (https://download.transmissionbt.com/files/Transmission-2.90.dmg) Transmission is an open source project. It\u00e2\u20ac\u2122s possible that Transmission\u00e2\u20ac\u2122s official website was compromised and the files were replaced by re-compiled malicious versions, but we can\u00e2\u20ac\u2122t confirm how this infection occurred."
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--56dd3d52-8768-4ce1-a546-48f0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-03-07T08:35:30.000Z",
|
|
"modified": "2016-03-07T08:35:30.000Z",
|
|
"labels": [
|
|
"misp:type=\"btc\"",
|
|
"misp:category=\"Financial fraud\""
|
|
],
|
|
"x_misp_category": "Financial fraud",
|
|
"x_misp_type": "btc",
|
|
"x_misp_value": "1PGAUBqHNcwSHYKnpHgzCrPkyxNxvsmEof"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |