135 lines
No EOL
4.8 KiB
JSON
135 lines
No EOL
4.8 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "0",
|
|
"date": "2016-04-20",
|
|
"extends_uuid": "",
|
|
"info": "New ransomware",
|
|
"publish_timestamp": "1461153795",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1461153134",
|
|
"uuid": "57174526-23d8-4895-8c08-4ed1950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461142838",
|
|
"to_ids": false,
|
|
"type": "md5",
|
|
"uuid": "57174536-95fc-474a-bb9f-46dc950d210f",
|
|
"value": "116d442d8ec5c62f32c7ba507a5569be"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "- Xchecked via VT: 116d442d8ec5c62f32c7ba507a5569be",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461145369",
|
|
"to_ids": false,
|
|
"type": "sha256",
|
|
"uuid": "57174f19-f06c-4809-92b3-476d02de0b81",
|
|
"value": "ce98e9d9900609c45c948d34153c03b490bc2067e7a742048f60ed53fe95529d"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "- Xchecked via VT: 116d442d8ec5c62f32c7ba507a5569be",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461145369",
|
|
"to_ids": false,
|
|
"type": "sha1",
|
|
"uuid": "57174f19-c3d8-43f0-96bb-43e402de0b81",
|
|
"value": "fb93796afa470d87deb316823d3cd6e8d8b18596"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461145370",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57174f1a-a47c-458d-9900-451e02de0b81",
|
|
"value": "https://www.virustotal.com/file/ce98e9d9900609c45c948d34153c03b490bc2067e7a742048f60ed53fe95529d/analysis/1461016885/"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Compromised wp installation",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461152759",
|
|
"to_ids": false,
|
|
"type": "hostname",
|
|
"uuid": "57176bf7-4e28-4e60-88d4-4dea950d210f",
|
|
"value": "kentamplin.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Compromised WP installation (fixed)",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461152810",
|
|
"to_ids": false,
|
|
"type": "url",
|
|
"uuid": "57176c2a-2280-4f00-9208-42c1950d210f",
|
|
"value": "kentamplin.net/wordpress/wp-includes/oops.php"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Compromised wp installation",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461152872",
|
|
"to_ids": false,
|
|
"type": "ip-dst",
|
|
"uuid": "57176c68-3b48-47d1-a549-4f20950d210f",
|
|
"value": "192.185.16.132"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461152936",
|
|
"to_ids": false,
|
|
"type": "url",
|
|
"uuid": "57176ca8-4fd8-4eac-a432-4fdb950d210f",
|
|
"value": "http://192.185.16.132/wordpress/wp-includes/oops.php?id=2886098&cname=mh6SlMrX8b&arch=0&srv=0&ver=6.1"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "Ransom text",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461153063",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "57176d27-f044-4038-9604-49da950d210f",
|
|
"value": "YourID: 2886098\r\n PC: HOME\r\n USER: user\r\n *********\r\n Hey\r\n\r\n Your files are now encrypted. I have the key to decrypt them back. I will give you a decrypter if you pay me. Email me at: momsbestfriend@protonmail.com or torrenttracker@india.com\r\n\r\n If you don\u00e2\u20ac\u2122t get a reply or if both emails die, then contact me using a guaranteed, foolproof\r\n Bitmessage: download it form here https://github.com/mailchuck/PyBitmessage/releases/download/v0.5.8/Bitmessage-\r\n 0.5.8.exe\r\n\r\n Run it, click New Identity and then send me a message at BM-NBvzKEY8raDBKb9Gp1xZMRQpeU5svwg2\r\n\r\n Cheers"
|
|
},
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461153134",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "57176d6e-a4e8-4c08-bd9c-41d9950d210f",
|
|
"value": "ID was seen to be same among the different infections..."
|
|
}
|
|
]
|
|
}
|
|
} |