adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/54e590ba-cccc-46a6-87a3-3d1f950d210b.json

447 lines
15 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
"Event": {
"analysis": "2",
"date": "2015-02-18",
"extends_uuid": "",
"info": "OSINT Babar: espionage software finally found and put under the microscope by gdata",
"publish_timestamp": "1456152103",
"published": true,
"threat_level_id": "2",
"timestamp": "1424336012",
"uuid": "54e590ba-cccc-46a6-87a3-3d1f950d210b",
"Orgc": {
"name": "CthulhuSPRL.be",
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
},
"Tag": [
{
"colour": "#004646",
"name": "type:OSINT"
},
{
"colour": "#33FF00",
"name": "tlp:green"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424330962",
"to_ids": false,
"type": "link",
"uuid": "54e590d2-26d8-4e7f-846b-b1af950d210b",
"value": "https://blog.gdatasoftware.com/blog/article/babar-espionage-software-finally-found-and-put-under-the-microscope.html"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424330973",
"to_ids": false,
"type": "text",
"uuid": "54e590dd-a174-42ae-93cc-59b1950d210b",
"value": "Babar"
},
{
"category": "Artifacts dropped",
"comment": "Evil Bunny",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331170",
"to_ids": true,
"type": "sha256",
"uuid": "54e591a2-22e4-4267-bb0c-59b1950d210b",
"value": "c6a182f410b4cda0665cd792f00177c56338018fbc31bb34e41b72f8195c20cc"
},
{
"category": "Artifacts dropped",
"comment": "Evil Bunny",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331170",
"to_ids": true,
"type": "sha256",
"uuid": "54e591a2-0f44-4be6-8702-59b1950d210b",
"value": "7d1e5c4afb1682087d86e793b3fc5a8371dc7c28e27e7196e3b258934f6bafb5"
},
{
"category": "Artifacts dropped",
"comment": "Evil Bunny",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331170",
"to_ids": true,
"type": "sha256",
"uuid": "54e591a2-68ac-4214-9571-59b1950d210b",
"value": "7bfc135194d3e5b85cbe46ed1c6f5e21dbe8f62c0a3ef56245b2d6500fc3a618"
},
{
"category": "Artifacts dropped",
"comment": "Evil Bunny",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331170",
"to_ids": true,
"type": "sha256",
"uuid": "54e591a2-4fb8-4bc1-a444-59b1950d210b",
"value": "be14d781b85125a6074724964622ab05f89f41e6bacbda398bc7709d1d98a2ef"
},
{
"category": "Artifacts dropped",
"comment": "Babar dropper",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331204",
"to_ids": true,
"type": "sha256",
"uuid": "54e591c4-3af0-47ed-8a08-4040950d210b",
"value": "c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf"
},
{
"category": "Artifacts dropped",
"comment": "Babar dropper",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331204",
"to_ids": true,
"type": "sha256",
"uuid": "54e591c4-24b4-48b2-a7b5-49f1950d210b",
"value": "82e6f9c10c7ba737f8c79deae4132b9ff82090ccd220eb3d3739365b5276c3c8"
},
{
"category": "Artifacts dropped",
"comment": "Babar payload",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331233",
"to_ids": true,
"type": "sha256",
"uuid": "54e591e1-2ad0-47df-8902-b1af950d210b",
"value": "aa73634ca325022dd6daff2df30484ec9031939044cf4c2a004cbdb66108281d"
},
{
"category": "Artifacts dropped",
"comment": "Babar payload",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331233",
"to_ids": true,
"type": "sha256",
"uuid": "54e591e1-0534-4347-bb35-b1af950d210b",
"value": "57437a675cae8e71ac33cd2e001ca7ef1b206b028f3c810e884223a0369d2f8a"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331266",
"to_ids": true,
"type": "filename",
"uuid": "54e59202-54ac-4382-adf8-3ec6950d210b",
"value": "perf_585.dll"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331266",
"to_ids": true,
"type": "filename",
"uuid": "54e59202-9084-428f-945a-3ec6950d210b",
"value": "dump21cb.dll"
},
{
"category": "Attribution",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331286",
"to_ids": false,
"type": "text",
"uuid": "54e59216-83a8-42c5-9b4c-3d1f950d210b",
"value": "%USERPROFILE%\\Desktop\\bunny 2.3.2\\Release\\Transporter2.pdb"
},
{
"category": "Attribution",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331286",
"to_ids": false,
"type": "text",
"uuid": "54e59216-86b8-457d-a0c5-3d1f950d210b",
"value": "%USERPROFILE%\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper Release\\Release.pdb"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331319",
"to_ids": true,
"type": "url",
"uuid": "54e59237-3a7c-419e-af13-59b1950d210b",
"value": "http://1.9.32.11/bunny/test.php?rec=nvista"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331344",
"to_ids": true,
"type": "user-agent",
"uuid": "54e59250-78a8-4e0e-9f89-4ca0950d210b",
"value": "User-Agent: Mozilla/4.0 (compatible; MSI 6.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)"
},
{
"category": "Attribution",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331385",
"to_ids": false,
"type": "comment",
"uuid": "54e59279-7e7c-415f-82e6-b1af950d210b",
"value": "The CSEC mentioned the locale option \u00e2\u20ac\u0153fr_FR\u00e2\u20ac\u009d during the spear-phishing attack."
},
{
"category": "Attribution",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331398",
"to_ids": false,
"type": "comment",
"uuid": "54e59286-b1b8-47d2-add0-ed35950d210b",
"value": "In the EvilBunny samples, during the HTTP queries to the command and control servers the Accept-Language parameter is set to \u00e2\u20ac\u0153fr\u00e2\u20ac\u009d."
},
{
"category": "Attribution",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331424",
"to_ids": false,
"type": "comment",
"uuid": "54e592a0-ed0c-4528-ae1e-3ec6950d210b",
"value": "We found English mistakes in EvilBunny and Babar samples, such as this example from Babar: \r\n\r\n!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331509",
"to_ids": true,
"type": "sha1",
"uuid": "54e592f5-3dec-4d81-a380-435f950d210b",
"value": "efbe18eb8a66e4b6289a5c53f22254f76e3a29db"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331509",
"to_ids": true,
"type": "sha1",
"uuid": "54e592f5-ebc0-4abb-baa2-4071950d210b",
"value": "5da5079754d975d5b04342abf9d60bd0bae181a0"
},
{
"category": "Network activity",
"comment": "Unclear if those are dedicated CnC or compromise legitimate websites.",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331587",
"to_ids": true,
"type": "hostname",
"uuid": "54e59343-c124-4ada-880a-4872950d210b",
"value": "www.alexpetro.com"
},
{
"category": "Network activity",
"comment": "Unclear if those are dedicated CnC or compromise legitimate websites.",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331587",
"to_ids": true,
"type": "hostname",
"uuid": "54e59343-45ac-4dbd-a123-4c80950d210b",
"value": "www.etehadyie.ir"
},
{
"category": "Network activity",
"comment": "Unclear if those are dedicated CnC or compromise legitimate websites.",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331587",
"to_ids": true,
"type": "hostname",
"uuid": "54e59343-f520-4fe3-a2cb-4d3e950d210b",
"value": "www.horizons-tourisme.com"
},
{
"category": "Network activity",
"comment": "Unclear if those are dedicated CnC or compromise legitimate websites.",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424331587",
"to_ids": true,
"type": "hostname",
"uuid": "54e59343-3478-436a-90dd-433d950d210b",
"value": "www.gezelimmi.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424334862",
"to_ids": true,
"type": "ip-dst",
"uuid": "54e5a00e-26ac-4a0c-99ca-4b17950d210b",
"value": "1.9.32.11"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1424336012",
"to_ids": false,
"type": "comment",
"uuid": "54e5a46a-5cd4-4f32-b417-03a7950d210b",
"value": "Data added here by Dav from Cthulhu Solutions sprl"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via 5da5079754d975d5b04342abf9d60bd0bae181a0)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838540",
"to_ids": true,
"type": "md5",
"uuid": "56c6554c-3788-4d50-aba6-c650950d210f",
"value": "4582d9d2120fb9c80ef01e2135fa3515"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via aa73634ca325022dd6daff2df30484ec9031939044cf4c2a004cbdb66108281d)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838541",
"to_ids": true,
"type": "md5",
"uuid": "56c6554d-a40c-47f4-8b23-599d950d210f",
"value": "4525141d9e6e7b5a7f4e8c3db3f0c24c"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838543",
"to_ids": true,
"type": "md5",
"uuid": "56c6554f-4dc0-4434-89d0-c650950d210f",
"value": "9fff114f15b86896d8d4978c0ad2813d"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via be14d781b85125a6074724964622ab05f89f41e6bacbda398bc7709d1d98a2ef)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838545",
"to_ids": true,
"type": "md5",
"uuid": "56c65551-91e0-4512-b931-5f51950d210f",
"value": "3bbb59afdf9bda4ffdc644d9d51c53e7"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via 7d1e5c4afb1682087d86e793b3fc5a8371dc7c28e27e7196e3b258934f6bafb5)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838547",
"to_ids": true,
"type": "md5",
"uuid": "56c65553-6740-46ff-8026-4b53950d210f",
"value": "b8ac16701c3c15b103e61b5a317692bc"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via c6a182f410b4cda0665cd792f00177c56338018fbc31bb34e41b72f8195c20cc)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838548",
"to_ids": true,
"type": "md5",
"uuid": "56c65554-b968-4704-9b03-599e950d210f",
"value": "c40e3ee23cf95d992b7cd0b7c01b8599"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via aa73634ca325022dd6daff2df30484ec9031939044cf4c2a004cbdb66108281d)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838542",
"to_ids": true,
"type": "sha1",
"uuid": "56c6554e-83c8-47a3-a52a-59a2950d210f",
"value": "efbe18eb8a66e4b6289a5c53f22254f76e3a29bd"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838544",
"to_ids": true,
"type": "sha1",
"uuid": "56c65550-3e74-4254-86b0-4db1950d210f",
"value": "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via be14d781b85125a6074724964622ab05f89f41e6bacbda398bc7709d1d98a2ef)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838546",
"to_ids": true,
"type": "sha1",
"uuid": "56c65552-ecc8-4e6d-8eba-59a1950d210f",
"value": "1798985f4cc2398a482f2232e72e5817562530de"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via 7d1e5c4afb1682087d86e793b3fc5a8371dc7c28e27e7196e3b258934f6bafb5)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838547",
"to_ids": true,
"type": "sha1",
"uuid": "56c65553-24d4-4860-a2ae-59a0950d210f",
"value": "a4226714f346c7844a9183e01961e7609d6fa241"
},
{
"category": "Artifacts dropped",
"comment": "Automatically added (via c6a182f410b4cda0665cd792f00177c56338018fbc31bb34e41b72f8195c20cc)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1455838549",
"to_ids": true,
"type": "sha1",
"uuid": "56c65555-dc5c-4066-9c9c-59a0950d210f",
"value": "1e8b4c374db03dcca026c5feba0a5c117f740233"
}
]
}
}
Reference in a new issue Copy permalink