From 384e26a1b4bb14065d391b701fe1854c41f4fdbb Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Tue, 20 Feb 2018 15:33:24 +0100
Subject: [PATCH] create botnet galaxy

---
 clusters/botnet.json     | 22 ++++++++++++++++++++++
 clusters/ransomware.json | 15 +++++++++++++++
 galaxies/botnet.json     |  8 ++++++++
 3 files changed, 45 insertions(+)
 create mode 100644 clusters/botnet.json
 create mode 100644 galaxies/botnet.json

diff --git a/clusters/botnet.json b/clusters/botnet.json
new file mode 100644
index 0000000..ea2db8f
--- /dev/null
+++ b/clusters/botnet.json
@@ -0,0 +1,22 @@
+{
+  "values": [
+    {
+      "value": "ADB.miner",
+      "description": "A new botnet appeared over the weekend, and it's targeting Android devices by scanning for open debug ports so it can infect victims with malware that mines the Monero cryptocurrency.\n\nThe botnet came to life on Saturday, February 3, and is targeting port 5555, which on devices running the Android OS is the port used by the operating system's native Android Debug Bridge (ADB), a debugging interface that grants access to some of the operating system's most sensitive features.\n\nOnly devices running the Android OS have been infected until now, such as smartphones, smart TVs, and TV top boxes, according to security researchers from Qihoo 360's Network Security Research Lab [Netlab] division, the ones who discovered the botnet, which the named ADB.miner.",
+      "meta": {
+        "refs": [
+          "https://www.bleepingcomputer.com/news/security/android-devices-targeted-by-new-monero-mining-botnet/"
+        ]
+      }
+    }
+  ],
+  "name": "Botnet",
+  "type": "botnet",
+  "source": "MISP Project",
+  "authors": [
+    "Various"
+  ],
+  "description": "botnet galaxy",
+  "uuid": "a91732f4-164a-11e8-924a-ffd4097eb03f",
+  "version": 1
+}
diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index b351ac6..8bfe71f 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -8732,6 +8732,21 @@
         ],
         "date": "Febuary 2018"
       }
+    },
+    {
+      "value": "Cryakl",
+      "description": "ransomware",
+      "meta": {
+        "refs": [
+          "https://sensorstechforum.com/fr/fairytail-files-virus-cryakl-ransomware-remove-restore-data/",
+          "https://www.technologynews.tech/cryakl-ransomware-virus",
+          "http://www.zdnet.com/article/cryakl-ransomware-decryption-keys-now-available-for-free/"
+        ],
+        "date": "January 2018",
+        "extensions": [
+          ".fairytail"
+        ]
+      }
     }
   ],
   "source": "Various",
diff --git a/galaxies/botnet.json b/galaxies/botnet.json
new file mode 100644
index 0000000..81a2334
--- /dev/null
+++ b/galaxies/botnet.json
@@ -0,0 +1,8 @@
+{
+  "description": "Botnet galaxy.",
+  "type": "botnet",
+  "version": 1,
+  "name": "Botnet",
+  "icon": "sitemap",
+  "uuid": "90ccdf38-1649-11e8-b8bf-e7326d553087"
+}