From 838bbc4a5872605a5a1066a09270a428f2f272c1 Mon Sep 17 00:00:00 2001 From: Vatsal Jagani Date: Wed, 2 Jun 2021 16:26:02 +0530 Subject: [PATCH] JSWorm ransomware notes and extensions added. --- lookups/ransomware_extensions.csv | 10 +++++++++- lookups/ransomware_extensions_lookup.yml | 1 + lookups/ransomware_notes.csv | 10 +++++++++- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv index 9e8fe7eff6..c50ec5dc9b 100644 --- a/lookups/ransomware_extensions.csv +++ b/lookups/ransomware_extensions.csv @@ -287,4 +287,12 @@ Extensions,Name .WNCRYT,WannaCry .RYK,Ryuk .Clop,Clop -.Cllp,Clop \ No newline at end of file +.Cllp,Clop +.JSWORM,JSWorm +.NEMTY_*,Nemty +.NEFILIM,Nefilim +.OFFWHITE,Offwhite +.TELEGRAM,Telegram +.FUSION,Fusion +.MILIHPEN,Milihpen +.GANGBANG,Gangbang \ No newline at end of file diff --git a/lookups/ransomware_extensions_lookup.yml b/lookups/ransomware_extensions_lookup.yml index eed0adad33..58bc6fde38 100644 --- a/lookups/ransomware_extensions_lookup.yml +++ b/lookups/ransomware_extensions_lookup.yml @@ -1,6 +1,7 @@ default_match: 'false' description: A list of file extensions that are associated with ransomware filename: ransomware_extensions.csv +match_type: WILDCARD(Extensions) min_matches: 1 name: ransomware_extensions_lookup case_sensitive_match: 'false' \ No newline at end of file diff --git a/lookups/ransomware_notes.csv b/lookups/ransomware_notes.csv index ecdfd2479d..04bf840433 100644 --- a/lookups/ransomware_notes.csv +++ b/lookups/ransomware_notes.csv @@ -58,4 +58,12 @@ HELP_DECRYPT_YOUR_FILES.HTML,True *-READ-FOR-HELLPP.html,True RyukReadMe.html,True ClopReadMe.txt,True -README_README.txt,True \ No newline at end of file +README_README.txt,True +JSWORM-DECRYPT.html,True +NEMTY_*-DECRYPT.txt,True +NEFILIM-DECRYPT.txt,True +OFFWHITE-MANUAL.txt,True +TELEGRAM-RECOVER.txt,True +FUSION-README.txt,True +MILIHPEN-INSTRUCT.txt,True +GANGBANG-NOTE.txt,True \ No newline at end of file