misp-circl-feed/feeds/circl/misp/59a66c11-6c14-4987-b79d-430e950d210f.json

{"Event": {"info": "OSINT - Bit Paymer Ransomware Hits Scottish Hospitals", "Tag": [{"colour": "#004646", "exportable": true, "name": "type:OSINT"}, {"colour": "#ffffff", "exportable": true, "name": "tlp:white"}, {"colour": "#2c4f00", "exportable": true, "name": "malware_classification:malware-category=\"Ransomware\""}, {"colour": "#00223b", "exportable": true, "name": "osint:source-type=\"blog-post\""}], "publish_timestamp": "0", "timestamp": "1504094511", "analysis": "2", "Attribute": [{"comment": "", "category": "Payload delivery", "uuid": "59a66c26-1b6c-47ba-81a0-4d6f950d210f", "timestamp": "1504094478", "to_ids": true, "value": "1c0ffdaddec1eca9a9a5ef5192151dbce8ccd8e31a84c51d70f5a5c64f07a363", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "", "category": "Payload delivery", "uuid": "59a66c26-7d34-4151-999f-4021950d210f", "timestamp": "1504094478", "to_ids": true, "value": "d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2", "disable_correlation": false, "object_relation": null, "type": "sha256"}, {"comment": "", "category": "External analysis", "uuid": "59a66c4f-9ba8-4373-937e-4ecd950d210f", "timestamp": "1504094478", "to_ids": false, "value": "The Bit Paymer ransomware \u2014 sometimes also spelled as Bitpaymer \u2014 first came to Bleeping Computer's attention on July 11, when security researcher Michael Gillespie tweeted a link to a sample uploaded on VirusTotal, a web-based file scanning service.\r\n\r\nFellow researcher MalwareHunter told Bleeping Computer today in a private conversation that following the NHS Lanarkshire attacks, more samples were found on VirusTotal going back to June 21, 2017, hinting that more campaigns might have taken place before the NHS Lanarkshire incident.\r\n\r\nUnlike most ransomware we see today, Bit Paymer is well coded and appears to be the work of experienced programmers.", "Tag": [{"colour": "#00223b", "exportable": true, "name": "osint:source-type=\"blog-post\""}], "disable_correlation": false, "object_relation": null, "type": "comment"}, {"comment": "", "category": "External analysis", "uuid": "59a66d55-2e34-4cf6-9da0-4a0a950d210f", "timestamp": "1504094478", "to_ids": false, "value": "https://www.bleepingcomputer.com/news/security/bit-paymer-ransomware-hits-scottish-hospitals/", "Tag": [{"colour": "#00223b", "exportable": true, "name": "osint:source-type=\"blog-post\""}], "disable_correlation": false, "object_relation": null, "type": "link"}, {"comment": "- Xchecked via VT: d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2", "category": "Payload delivery", "uuid": "59a6a90e-c544-4ea6-bb53-9e4c02de0b81", "timestamp": "1504094478", "to_ids": true, "value": "5a2d799ac4cca8954fc117c7fb3e868f93c6f009", "disable_correlation": false, "object_relation": null, "type": "sha1"}, {"comment": "- Xchecked via VT: d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2", "category": "Payload delivery", "uuid": "59a6a90e-3990-4232-8c38-9e4c02de0b81", "timestamp": "1504094478", "to_ids": true, "value": "998246bd0e51f9582b998ca514317c33", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "- Xchecked via VT: d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2", "category": "External analysis", "uuid": "59a6a90e-1180-411c-a6c3-9e4c02de0b81", "timestamp": "1504094478", "to_ids": false, "value": "https://www.virustotal.com/file/d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2/analysis/1504008092/", "disable_correlation": false, "object_relation": null, "type": "link"}, {"comment": "- Xchecked via VT: 1c0ffdaddec1eca9a9a5ef5192151dbce8ccd8e31a84c51d70f5a5c64f07a363", "category": "Payload delivery", "uuid": "59a6a90e-f014-4064-9781-9e4c02de0b81", "timestamp": "1504094478", "to_ids": true, "value": "9aa00d808a205495f24909e9f78ba414f08cdb15", "disable_correlation": false, "object_relation": null, "type": "sha1"}, {"comment": "- Xchecked via VT: 1c0ffdaddec1eca9a9a5ef5192151dbce8ccd8e31a84c51d70f5a5c64f07a363", "category": "Payload delivery", "uuid": "59a6a90e-3524-477e-b706-9e4c02de0b81", "timestamp": "1504094478", "to_ids": true, "value": "0a19dd8fdd632f175f0ff0488e4cd8f2", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "- Xchecked via VT: 1c0ffdaddec1eca9a9a5ef5192151dbce8ccd8e31a84c51d70f5a5c64f07a363", "category": "External analysis", "uuid": "59a6a90e-bf58-4d84-85bd-9e4c02de0b81", "timestamp": "1504094478", "to_ids": false, "value": "https://www.virustotal.com/file/1c0ffdaddec1eca9a9a5ef5192151dbce8ccd8e31a84c51d70f5a5c64f07a363/analysis/1504008078/", "disable_correlation": false, "object_relation": null, "type": "link"}], "extends_uuid": "", "published": false, "date": "2017-08-29", "Orgc": {"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", "name": "CIRCL"}, "threat_level_id": "3", "uuid": "59a66c11-6c14-4987-b79d-430e950d210f"}}