From 395dd93e0f11e879f5f404d476eb91b2b3919c26 Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Wed, 28 Aug 2019 15:40:03 +0200
Subject: [PATCH] add Asruex Backdoor

---
 clusters/backdoor.json     | 12 +++++++++++-
 clusters/threat-actor.json |  2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/clusters/backdoor.json b/clusters/backdoor.json
index 4bb7a60..ac2cc9b 100644
--- a/clusters/backdoor.json
+++ b/clusters/backdoor.json
@@ -80,7 +80,17 @@
       ],
       "uuid": "a4757e11-0837-42c0-958a-7490cff58687",
       "value": "SLUB"
+    },
+    {
+      "description": "Since it first emerged in 2015, Asruex has been known for its backdoor capabilities and connection to the spyware DarkHotel. However, when we encountered Asruex in a PDF file, we found that a variant of the malware can also act as an infector particularly through the use of old vulnerabilities CVE-2012-0158 and CVE-2010-2883, which inject code in Word and PDF files respectively.",
+      "meta": {
+        "refs": [
+          "https://blog.trendmicro.com/trendlabs-security-intelligence/asruex-backdoor-variant-infects-word-documents-and-pdfs-through-old-ms-office-and-adobe-vulnerabilities/"
+        ]
+      },
+      "uuid": "b7ad60a0-d648-4775-adec-c78b1a92fc34",
+      "value": "Asruex"
     }
   ],
-  "version": 5
+  "version": 6
 }
diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 4ebb4e1..24eb9ea 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -7689,5 +7689,5 @@
       "value": "APT41"
     }
   ],
-  "version": 126
+  "version": 128
 }