misp-circl-feed/feeds/circl/misp/56f50e98-5804-4496-84e6-faf3950d210f.json

{
  "Event": {
    "analysis": "2",
    "date": "2016-03-25",
    "extends_uuid": "",
    "info": "OSINT - PETYA Crypto-ransomware Overwrites MBR to Lock Users Out of Their Computers",
    "publish_timestamp": "1458900802",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1458900788",
    "uuid": "56f50e98-5804-4496-84e6-faf3950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": "0",
        "name": "type:OSINT",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900684",
        "to_ids": false,
        "type": "link",
        "uuid": "56f50ecc-abf8-4148-b783-faf4950d210f",
        "value": "http://blog.trendmicro.com/trendlabs-security-intelligence/petya-crypto-ransomware-overwrites-mbr-lock-users-computers/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900714",
        "to_ids": false,
        "type": "comment",
        "uuid": "56f50eea-9814-43a6-b0af-4e81950d210f",
        "value": "As if encrypting files and holding them hostage is not enough, cybercriminals who create and spread crypto-ransomware are now resorting to causing blue screen of death (BSoD) and putting their ransom notes at system startup\u00e2\u20ac\u201das in, even before the operating system loads. Imagine turning on your computer and instead of the usual Windows icon loading, you get a flashing red and white screen with a skull-and-crossbones instead.\r\n\r\n\r\n\r\nFigure 1. Petya\u00e2\u20ac\u2122s red skulls-and-crossbones warning\r\n\r\nThis is the routine of a new crypto-ransomware variant dubbed \u00e2\u20ac\u0153Petya\u00e2\u20ac\u009d (detected by Trend Micro as RANSOM_PETYA.A). Not only does this malware have the ability to overwrite the affected system\u00e2\u20ac\u2122s master boot record (MBR) in order to lock users out, it is also interesting to note that it is delivered to victims via a legitimate cloud storage service (in this case, via Dropbox).\r\n\r\nWe do note that this isn\u00e2\u20ac\u2122t the first time that malware has abused a legitimate service for its own gain; however, this is the first time (in a long time) that leads to crypto-ransomware infection. It is also a departure from the typical infection chain, wherein the malicious files are attached to emails or hosted in malicious sites and delivered by exploit kits."
      },
      {
        "category": "Payload installation",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900739",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56f50f03-ab7c-4d3e-a3a5-faef950d210f",
        "value": "39b6d40906c7f7f080e6befa93324dddadcbd9fa"
      },
      {
        "category": "Payload installation",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900740",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56f50f04-bbb4-40ab-b2ac-faef950d210f",
        "value": "b0c5fab5d69afcc7fd013fd7aef20660bf0077c2"
      },
      {
        "category": "Payload installation",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900740",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56f50f04-2514-43df-b3c5-faef950d210f",
        "value": "755f2652638f87ab517c608a363c4aefb9dd6a5a"
      },
      {
        "category": "Payload installation",
        "comment": "- Xchecked via VT: 39b6d40906c7f7f080e6befa93324dddadcbd9fa",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900788",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56f50f34-2eb4-490b-9083-faf702de0b81",
        "value": "26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739"
      },
      {
        "category": "Payload installation",
        "comment": "- Xchecked via VT: 39b6d40906c7f7f080e6befa93324dddadcbd9fa",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900788",
        "to_ids": true,
        "type": "md5",
        "uuid": "56f50f34-76c8-410a-b52c-faf702de0b81",
        "value": "af2379cc4d607a45ac44d62135fb7015"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900789",
        "to_ids": false,
        "type": "link",
        "uuid": "56f50f35-e138-4177-bc37-faf702de0b81",
        "value": "https://www.virustotal.com/file/26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739/analysis/1458856673/"
      },
      {
        "category": "Payload installation",
        "comment": "- Xchecked via VT: b0c5fab5d69afcc7fd013fd7aef20660bf0077c2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900789",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56f50f35-467c-417e-bb1f-faf702de0b81",
        "value": "b521767f67630b74e2272ee953295ef56c8b6428da75afa5bbfb05b72b34c69d"
      },
      {
        "category": "Payload installation",
        "comment": "- Xchecked via VT: b0c5fab5d69afcc7fd013fd7aef20660bf0077c2",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900789",
        "to_ids": true,
        "type": "md5",
        "uuid": "56f50f35-a370-463a-8844-faf702de0b81",
        "value": "a2d6887d8a7b09b86a917a5c61674ab4"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900790",
        "to_ids": false,
        "type": "link",
        "uuid": "56f50f36-1f3c-4177-a3fe-faf702de0b81",
        "value": "https://www.virustotal.com/file/b521767f67630b74e2272ee953295ef56c8b6428da75afa5bbfb05b72b34c69d/analysis/1458897572/"
      },
      {
        "category": "Payload installation",
        "comment": "- Xchecked via VT: 755f2652638f87ab517c608a363c4aefb9dd6a5a",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900790",
        "to_ids": true,
        "type": "sha256",
        "uuid": "56f50f36-a6e8-48e5-ba36-faf702de0b81",
        "value": "e99eccfc1473800ea6e2e730e733c213f18e817c0c6501209f4ee40408f94951"
      },
      {
        "category": "Payload installation",
        "comment": "- Xchecked via VT: 755f2652638f87ab517c608a363c4aefb9dd6a5a",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900790",
        "to_ids": true,
        "type": "md5",
        "uuid": "56f50f36-8b14-4efa-98e8-faf702de0b81",
        "value": "f636b3471c9fda3686735223dbb0b2bd"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1458900790",
        "to_ids": false,
        "type": "link",
        "uuid": "56f50f36-514c-45de-b825-faf702de0b81",
        "value": "https://www.virustotal.com/file/e99eccfc1473800ea6e2e730e733c213f18e817c0c6501209f4ee40408f94951/analysis/1458857995/"
      }
    ]
  }
}