2023-04-21 13:25:09 +00:00
{
"Event" : {
"analysis" : "2" ,
"date" : "2015-02-18" ,
"extends_uuid" : "" ,
"info" : "OSINT Babar: espionage software finally found and put under the microscope by gdata" ,
"publish_timestamp" : "1456152103" ,
"published" : true ,
"threat_level_id" : "2" ,
"timestamp" : "1424336012" ,
"uuid" : "54e590ba-cccc-46a6-87a3-3d1f950d210b" ,
"Orgc" : {
"name" : "CthulhuSPRL.be" ,
"uuid" : "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
} ,
"Tag" : [
{
"colour" : "#004646" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "type:OSINT" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#33FF00" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "tlp:green" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
}
] ,
"Attribute" : [
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424330962" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "54e590d2-26d8-4e7f-846b-b1af950d210b" ,
"value" : "https://blog.gdatasoftware.com/blog/article/babar-espionage-software-finally-found-and-put-under-the-microscope.html"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424330973" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "54e590dd-a174-42ae-93cc-59b1950d210b" ,
"value" : "Babar"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Evil Bunny" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331170" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "54e591a2-22e4-4267-bb0c-59b1950d210b" ,
"value" : "c6a182f410b4cda0665cd792f00177c56338018fbc31bb34e41b72f8195c20cc"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Evil Bunny" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331170" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "54e591a2-0f44-4be6-8702-59b1950d210b" ,
"value" : "7d1e5c4afb1682087d86e793b3fc5a8371dc7c28e27e7196e3b258934f6bafb5"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Evil Bunny" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331170" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "54e591a2-68ac-4214-9571-59b1950d210b" ,
"value" : "7bfc135194d3e5b85cbe46ed1c6f5e21dbe8f62c0a3ef56245b2d6500fc3a618"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Evil Bunny" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331170" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "54e591a2-4fb8-4bc1-a444-59b1950d210b" ,
"value" : "be14d781b85125a6074724964622ab05f89f41e6bacbda398bc7709d1d98a2ef"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Babar dropper" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331204" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "54e591c4-3af0-47ed-8a08-4040950d210b" ,
"value" : "c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Babar dropper" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331204" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "54e591c4-24b4-48b2-a7b5-49f1950d210b" ,
"value" : "82e6f9c10c7ba737f8c79deae4132b9ff82090ccd220eb3d3739365b5276c3c8"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Babar payload" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331233" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "54e591e1-2ad0-47df-8902-b1af950d210b" ,
"value" : "aa73634ca325022dd6daff2df30484ec9031939044cf4c2a004cbdb66108281d"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Babar payload" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331233" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "54e591e1-0534-4347-bb35-b1af950d210b" ,
"value" : "57437a675cae8e71ac33cd2e001ca7ef1b206b028f3c810e884223a0369d2f8a"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331266" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "54e59202-54ac-4382-adf8-3ec6950d210b" ,
"value" : "perf_585.dll"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331266" ,
"to_ids" : true ,
"type" : "filename" ,
"uuid" : "54e59202-9084-428f-945a-3ec6950d210b" ,
"value" : "dump21cb.dll"
} ,
{
"category" : "Attribution" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331286" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "54e59216-83a8-42c5-9b4c-3d1f950d210b" ,
"value" : "%USERPROFILE%\\Desktop\\bunny 2.3.2\\Release\\Transporter2.pdb"
} ,
{
"category" : "Attribution" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331286" ,
"to_ids" : false ,
"type" : "text" ,
"uuid" : "54e59216-86b8-457d-a0c5-3d1f950d210b" ,
"value" : "%USERPROFILE%\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper Release\\Release.pdb"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331319" ,
"to_ids" : true ,
"type" : "url" ,
"uuid" : "54e59237-3a7c-419e-af13-59b1950d210b" ,
"value" : "http://1.9.32.11/bunny/test.php?rec=nvista"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331344" ,
"to_ids" : true ,
"type" : "user-agent" ,
"uuid" : "54e59250-78a8-4e0e-9f89-4ca0950d210b" ,
"value" : "User-Agent: Mozilla/4.0 (compatible; MSI 6.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)"
} ,
{
"category" : "Attribution" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331385" ,
"to_ids" : false ,
"type" : "comment" ,
"uuid" : "54e59279-7e7c-415f-82e6-b1af950d210b" ,
"value" : "The CSEC mentioned the locale option \u00e2\u20ac\u0153fr_FR\u00e2\u20ac\u009d during the spear-phishing attack."
} ,
{
"category" : "Attribution" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331398" ,
"to_ids" : false ,
"type" : "comment" ,
"uuid" : "54e59286-b1b8-47d2-add0-ed35950d210b" ,
"value" : "In the EvilBunny samples, during the HTTP queries to the command and control servers the Accept-Language parameter is set to \u00e2\u20ac\u0153fr\u00e2\u20ac\u009d."
} ,
{
"category" : "Attribution" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331424" ,
"to_ids" : false ,
"type" : "comment" ,
"uuid" : "54e592a0-ed0c-4528-ae1e-3ec6950d210b" ,
"value" : "We found English mistakes in EvilBunny and Babar samples, such as this example from Babar: \r\n\r\n!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331509" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "54e592f5-3dec-4d81-a380-435f950d210b" ,
"value" : "efbe18eb8a66e4b6289a5c53f22254f76e3a29db"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331509" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "54e592f5-ebc0-4abb-baa2-4071950d210b" ,
"value" : "5da5079754d975d5b04342abf9d60bd0bae181a0"
} ,
{
"category" : "Network activity" ,
"comment" : "Unclear if those are dedicated CnC or compromise legitimate websites." ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331587" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "54e59343-c124-4ada-880a-4872950d210b" ,
"value" : "www.alexpetro.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Unclear if those are dedicated CnC or compromise legitimate websites." ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331587" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "54e59343-45ac-4dbd-a123-4c80950d210b" ,
"value" : "www.etehadyie.ir"
} ,
{
"category" : "Network activity" ,
"comment" : "Unclear if those are dedicated CnC or compromise legitimate websites." ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331587" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "54e59343-f520-4fe3-a2cb-4d3e950d210b" ,
"value" : "www.horizons-tourisme.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Unclear if those are dedicated CnC or compromise legitimate websites." ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424331587" ,
"to_ids" : true ,
"type" : "hostname" ,
"uuid" : "54e59343-3478-436a-90dd-433d950d210b" ,
"value" : "www.gezelimmi.com"
} ,
{
"category" : "Network activity" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424334862" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "54e5a00e-26ac-4a0c-99ca-4b17950d210b" ,
"value" : "1.9.32.11"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1424336012" ,
"to_ids" : false ,
"type" : "comment" ,
"uuid" : "54e5a46a-5cd4-4f32-b417-03a7950d210b" ,
"value" : "Data added here by Dav from Cthulhu Solutions sprl"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via 5da5079754d975d5b04342abf9d60bd0bae181a0)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838540" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "56c6554c-3788-4d50-aba6-c650950d210f" ,
"value" : "4582d9d2120fb9c80ef01e2135fa3515"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via aa73634ca325022dd6daff2df30484ec9031939044cf4c2a004cbdb66108281d)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838541" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "56c6554d-a40c-47f4-8b23-599d950d210f" ,
"value" : "4525141d9e6e7b5a7f4e8c3db3f0c24c"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838543" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "56c6554f-4dc0-4434-89d0-c650950d210f" ,
"value" : "9fff114f15b86896d8d4978c0ad2813d"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via be14d781b85125a6074724964622ab05f89f41e6bacbda398bc7709d1d98a2ef)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838545" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "56c65551-91e0-4512-b931-5f51950d210f" ,
"value" : "3bbb59afdf9bda4ffdc644d9d51c53e7"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via 7d1e5c4afb1682087d86e793b3fc5a8371dc7c28e27e7196e3b258934f6bafb5)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838547" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "56c65553-6740-46ff-8026-4b53950d210f" ,
"value" : "b8ac16701c3c15b103e61b5a317692bc"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via c6a182f410b4cda0665cd792f00177c56338018fbc31bb34e41b72f8195c20cc)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838548" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "56c65554-b968-4704-9b03-599e950d210f" ,
"value" : "c40e3ee23cf95d992b7cd0b7c01b8599"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via aa73634ca325022dd6daff2df30484ec9031939044cf4c2a004cbdb66108281d)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838542" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "56c6554e-83c8-47a3-a52a-59a2950d210f" ,
"value" : "efbe18eb8a66e4b6289a5c53f22254f76e3a29bd"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838544" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "56c65550-3e74-4254-86b0-4db1950d210f" ,
"value" : "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via be14d781b85125a6074724964622ab05f89f41e6bacbda398bc7709d1d98a2ef)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838546" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "56c65552-ecc8-4e6d-8eba-59a1950d210f" ,
"value" : "1798985f4cc2398a482f2232e72e5817562530de"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via 7d1e5c4afb1682087d86e793b3fc5a8371dc7c28e27e7196e3b258934f6bafb5)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838547" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "56c65553-24d4-4860-a2ae-59a0950d210f" ,
"value" : "a4226714f346c7844a9183e01961e7609d6fa241"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Automatically added (via c6a182f410b4cda0665cd792f00177c56338018fbc31bb34e41b72f8195c20cc)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1455838549" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "56c65555-dc5c-4066-9c9c-59a0950d210f" ,
"value" : "1e8b4c374db03dcca026c5feba0a5c117f740233"
}
]
}
}
