161 lines
No EOL
6 KiB
JSON
161 lines
No EOL
6 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2016-06-30",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Satana ransomware \u00e2\u20ac\u201c threat coming soon?",
|
|
"publish_timestamp": "1467286823",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1467286805",
|
|
"uuid": "57750408-3784-4dfd-a7c7-c82a950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"local": "0",
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#3b7500",
|
|
"local": "0",
|
|
"name": "circl:incident-classification=\"malware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#006c6c",
|
|
"local": "0",
|
|
"name": "ecsirt:malicious-code=\"ransomware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#2c4f00",
|
|
"local": "0",
|
|
"name": "malware_classification:malware-category=\"Ransomware\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467286602",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5775044a-7274-476f-ab3a-d08c950d210f",
|
|
"value": "https://blog.malwarebytes.com/threat-analysis/2016/06/satana-ransomware/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467286622",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "5775045e-8550-43c6-bbdc-c829950d210f",
|
|
"value": "Petya ransomware is quickly becoming a household name and in typical cyber-criminal fashion, copycat families are starting to emerge.\r\n\r\nIn this post, we have the benefit of analyzing \u00e2\u20ac\u0153malware-in-development\u00e2\u20ac\u009d and can observe its growth over the coming weeks. The ransomware is called Satana (devil/satan in Italian) and similar to the Petya and Mischa bundle, Satana works in two modes.\r\n\r\nThe first mode behaves like Petya, a dropper (that is a typical PE file) writes to the beginning of the infected disk a low-level module which is a bootloader with a tiny custom kernel.\r\n\r\nThe second mode behaves like typical ransomware and encrypts files one by one (just like Mischa).\r\n\r\nContrary to the Petya and Mischa bundle, these modes are not used as alternatives, but are both utilized, one after the other, to infect the system."
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "main sample",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467286646",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "57750476-4d04-42a9-9282-c823950d210f",
|
|
"value": "46bfd4f1d581d7c0121d2b19a005d3df"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "unpacked",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467286666",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5775048a-ed78-4ea4-bccd-4552950d210f",
|
|
"value": "d236fcc8789f94f085137058311e848b"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "unpacked - Xchecked via VT: d236fcc8789f94f085137058311e848b",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467286806",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "57750516-e764-4744-8cd9-c82702de0b81",
|
|
"value": "ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "unpacked - Xchecked via VT: d236fcc8789f94f085137058311e848b",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467286806",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "57750516-ed2c-47cb-a6c3-c82702de0b81",
|
|
"value": "808061052c9efc7c7255ffeb92c77b02bbb8cfee"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "unpacked - Xchecked via VT: d236fcc8789f94f085137058311e848b",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467286806",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57750516-fe34-42ad-88a4-c82702de0b81",
|
|
"value": "https://www.virustotal.com/file/ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d/analysis/1467267018/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "main sample - Xchecked via VT: 46bfd4f1d581d7c0121d2b19a005d3df",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467286807",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "57750517-9c38-4c37-8e76-c82702de0b81",
|
|
"value": "683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "main sample - Xchecked via VT: 46bfd4f1d581d7c0121d2b19a005d3df",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467286807",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "57750517-fec4-4984-a119-c82702de0b81",
|
|
"value": "5b063298bbd1670b4d39e1baef67f854b8dcba9d"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "main sample - Xchecked via VT: 46bfd4f1d581d7c0121d2b19a005d3df",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1467286808",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57750518-959c-4a94-bde0-c82702de0b81",
|
|
"value": "https://www.virustotal.com/file/683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96/analysis/1467247188/"
|
|
}
|
|
]
|
|
}
|
|
} |