193 lines
No EOL
6.4 KiB
JSON
193 lines
No EOL
6.4 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2016-05-19",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Dogspectus Ransomware Analysis",
|
|
"publish_timestamp": "1464159582",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1464159454",
|
|
"uuid": "574549b7-23c0-4bf3-9183-466b950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#006c6c",
|
|
"local": false,
|
|
"name": "ecsirt:malicious-code=\"ransomware\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464158696",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "574549e8-c020-4a63-8146-4ce6950d210f",
|
|
"value": "On April 25, 2016, Blue Coat published an article on a new Android Ransomware, called \"Dogspectus.\u00e2\u20ac\u009d On May 12, 2016, Dell SonicWALL published a separate report on the Android Lockscreen malware campaign with similar characteristics to Dogspectus. These similarities are not a coincidence. We began our own extensive investigation into this ransomware some time ago, and will share additional technical details of this malware here that have not been previously discussed."
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159269",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57454c25-2ad4-4971-ab4b-4704950d210f",
|
|
"value": "http://blog.fortinet.com/2016/05/19/dogspectus-ransomware-analysis"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159269",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57454c25-a5a0-4029-af09-460d950d210f",
|
|
"value": "https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=929"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159270",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57454c26-e3d0-40d9-b77c-4f9d950d210f",
|
|
"value": "https://www.bluecoat.com/security-blog/2016-04-25/android-exploit-delivers-dogspectus-ransomware"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159307",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57454c4b-74b8-4e8b-955e-4053950d210f",
|
|
"value": "http://workoutplaceface.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159307",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57454c4b-db4c-4805-a8a8-482a950d210f",
|
|
"value": "http://orlandroot.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159308",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57454c4c-9f3c-4f7f-be50-4a7c950d210f",
|
|
"value": "http://daflourstmichurins.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159308",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57454c4c-d55c-4d66-afda-4bc2950d210f",
|
|
"value": "http://mentosjolly.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159308",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57454c4c-3fac-47e8-bd71-4be3950d210f",
|
|
"value": "http://belkafruitcymus.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159309",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "57454c4d-1b10-4f2a-a911-4a37950d210f",
|
|
"value": "http://wirtualcleens.com"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159321",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "57454c59-6b48-4c0a-b689-4355950d210f",
|
|
"value": "197588be3e8ba5c779696d864121aff188901720dcda796759906c17473d46fe"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 197588be3e8ba5c779696d864121aff188901720dcda796759906c17473d46fe",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159454",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "57454cde-0adc-42d8-a2a1-404702de0b81",
|
|
"value": "392e8b90431dfe55ca03e04a49fce1514d61638e"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 197588be3e8ba5c779696d864121aff188901720dcda796759906c17473d46fe",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159454",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "57454cde-cbcc-402d-9057-4aaa02de0b81",
|
|
"value": "e26710a4e499a797aab62fd0ad7ac19c"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: 197588be3e8ba5c779696d864121aff188901720dcda796759906c17473d46fe",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1464159455",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57454cdf-db60-4831-8b49-452502de0b81",
|
|
"value": "https://www.virustotal.com/file/197588be3e8ba5c779696d864121aff188901720dcda796759906c17473d46fe/analysis/1464158418/"
|
|
}
|
|
]
|
|
}
|
|
} |