8000 UPdate Ransomware Galaxy by Delta-Sierra · Pull Request #528 · MISP/misp-galaxy · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

UPdate Ransomware Galaxy #528

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 3, 2020
Merged

UPdate Ransomware Galaxy #528

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c566c89
add pyza ransomware
Delta-Sierra Mar 27, 2020
8a3422a
add Pyta ransomnotes
Delta-Sierra Apr 3, 2020
7859c8d
Add coronavirus ransomware
Delta-Sierra Apr 3, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 40 additions & 1 deletion clusters/ransomware.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13752,7 +13752,46 @@
],
"uuid": "42148074-196b-4f8c-b149-12163fc385fa",
"value": "Wadhrama"
},
{
"description": "Mespinoza ransomware is used at least since october 2018. First versions used the common extension \".locked\". SInce december 2019 a new version in open sourced and documented, this new version uses the \".pyza\" extension.",
"meta": {
"extensions": [
".pyza",
".locked"
],
"ransomnotes-filenames": [
"RECOVER_YOUR_DATA.txt"
],
"refs": [
"https://www.cert.ssi.gouv.fr/cti/CERTFR-2020-CTI-002/",
"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-002.pdf"
],
"synonyms": [
"Pyza"
]
},
"uuid": "deed3c10-93b6-41b9-b150-f4dd1b665d87",
"value": "Mespinoza"
},
{
"description": "A new ransomware called CoronaVirus has been distributed through a fake web site pretending to promote the system optimization software and utilities from WiseCleaner.\nWith the increasing fears and anxiety of the Coronavirus (COVID-19) outbreak, an attacker has started to build a campaign to distribute a malware cocktail consisting of the CoronaVirus Ransomware and the Kpot information-stealing Trojan.\nThis new ransomware was discovered by MalwareHunterTeam and after further digging into the source of the file, we have been able to determine how the threat actor plans on distributing the ransomware and possible clues suggesting that it may actually be a wiper.",
"meta": {
"ransomnotes-filenames": [
"CoronaVirus.txt"
],
"ransomnotes-refs": [
"https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/ransom-note.jpg",
"https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/mbr-locker.jpg",
"https://www.bleepstatic.com/images/news/ransomware/c/coronavirus-ransomware/changed-mbrlocker-screen.jpg"
],
"refs": [
"https://www.bleepingcomputer.com/news/security/new-coronavirus-ransomware-acts-as-cover-for-kpot-infostealer/"
]
},
"uuid": "575b2b3c-d762-4ba6-acbd-51ecdb57249f",
"value": "CoronaVirus"
}
],
"version": 83
"version": 85
}
0