From cab60a02e26c9c4f9f216885991477093cfcd88f Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Fri, 22 Nov 2019 14:15:29 +0100 Subject: [PATCH] jq --- clusters/ransomware.json | 5 +++-- clusters/tool.json | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/clusters/ransomware.json b/clusters/ransomware.json index 635b4b94..266896ab 100644 --- a/clusters/ransomware.json +++ b/clusters/ransomware.json @@ -13574,13 +13574,14 @@ "value": "Maze" }, { - "value": "Cyborg Ransomware", "description": "Ransomware delivered using fake Windows Update spam", "meta": { "refs": [ "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/" ] - } + }, + "uuid": "0a0b9311-8cbc-4d97-b337-42c9a018ebe0", + "value": "Cyborg Ransomware" } ], "version": 73 diff --git a/clusters/tool.json b/clusters/tool.json index 5da87499..b4b3be55 100644 --- a/clusters/tool.json +++ b/clusters/tool.json @@ -7878,14 +7878,15 @@ "value": "ShadowHammer" }, { - "value": "DePriMon", "description": "DePriMon is a malicious downloader, with several stages and using many non-traditional techniques. To achieve persistence, the malware registers a new local port monitor – a trick falling under the “Port Monitors” technique in the MITRE ATT&CK knowledgebase. For that, the malware uses the “Windows Default Print Monitor” name; that’s why we have named it DePriMon. Due to its complexity and modular architecture, we consider it to be a framework.", "meta": { "refs": [ "https://www.bleepingcomputer.com/news/security/deprimon-malware-registers-itself-as-a-windows-print-monitor/", "https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader/" ] - } + }, + "uuid": "c76874cd-0d73-4cbf-8d39-a066900dd4ce", + "value": "DePriMon" } ], "version": 128