{
  "Event": {
    "analysis": "2",
    "date": "2015-02-18",
    "extends_uuid": "",
    "info": "OSINT Babar: espionage software finally found and put under the microscope by gdata",
    "publish_timestamp": "1456152103",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1424336012",
    "uuid": "54e590ba-cccc-46a6-87a3-3d1f950d210b",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#33FF00",
        "local": false,
        "name": "tlp:green",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424330962",
        "to_ids": false,
        "type": "link",
        "uuid": "54e590d2-26d8-4e7f-846b-b1af950d210b",
        "value": "https://blog.gdatasoftware.com/blog/article/babar-espionage-software-finally-found-and-put-under-the-microscope.html"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424330973",
        "to_ids": false,
        "type": "text",
        "uuid": "54e590dd-a174-42ae-93cc-59b1950d210b",
        "value": "Babar"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Evil Bunny",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331170",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54e591a2-22e4-4267-bb0c-59b1950d210b",
        "value": "c6a182f410b4cda0665cd792f00177c56338018fbc31bb34e41b72f8195c20cc"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Evil Bunny",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331170",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54e591a2-0f44-4be6-8702-59b1950d210b",
        "value": "7d1e5c4afb1682087d86e793b3fc5a8371dc7c28e27e7196e3b258934f6bafb5"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Evil Bunny",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331170",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54e591a2-68ac-4214-9571-59b1950d210b",
        "value": "7bfc135194d3e5b85cbe46ed1c6f5e21dbe8f62c0a3ef56245b2d6500fc3a618"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Evil Bunny",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331170",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54e591a2-4fb8-4bc1-a444-59b1950d210b",
        "value": "be14d781b85125a6074724964622ab05f89f41e6bacbda398bc7709d1d98a2ef"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Babar dropper",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331204",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54e591c4-3af0-47ed-8a08-4040950d210b",
        "value": "c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Babar dropper",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331204",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54e591c4-24b4-48b2-a7b5-49f1950d210b",
        "value": "82e6f9c10c7ba737f8c79deae4132b9ff82090ccd220eb3d3739365b5276c3c8"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Babar payload",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331233",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54e591e1-2ad0-47df-8902-b1af950d210b",
        "value": "aa73634ca325022dd6daff2df30484ec9031939044cf4c2a004cbdb66108281d"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Babar payload",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331233",
        "to_ids": true,
        "type": "sha256",
        "uuid": "54e591e1-0534-4347-bb35-b1af950d210b",
        "value": "57437a675cae8e71ac33cd2e001ca7ef1b206b028f3c810e884223a0369d2f8a"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331266",
        "to_ids": true,
        "type": "filename",
        "uuid": "54e59202-54ac-4382-adf8-3ec6950d210b",
        "value": "perf_585.dll"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331266",
        "to_ids": true,
        "type": "filename",
        "uuid": "54e59202-9084-428f-945a-3ec6950d210b",
        "value": "dump21cb.dll"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331286",
        "to_ids": false,
        "type": "text",
        "uuid": "54e59216-83a8-42c5-9b4c-3d1f950d210b",
        "value": "%USERPROFILE%\\Desktop\\bunny 2.3.2\\Release\\Transporter2.pdb"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331286",
        "to_ids": false,
        "type": "text",
        "uuid": "54e59216-86b8-457d-a0c5-3d1f950d210b",
        "value": "%USERPROFILE%\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper Release\\Release.pdb"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331319",
        "to_ids": true,
        "type": "url",
        "uuid": "54e59237-3a7c-419e-af13-59b1950d210b",
        "value": "http://1.9.32.11/bunny/test.php?rec=nvista"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331344",
        "to_ids": true,
        "type": "user-agent",
        "uuid": "54e59250-78a8-4e0e-9f89-4ca0950d210b",
        "value": "User-Agent: Mozilla/4.0 (compatible; MSI 6.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)"
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331385",
        "to_ids": false,
        "type": "comment",
        "uuid": "54e59279-7e7c-415f-82e6-b1af950d210b",
        "value": "The CSEC mentioned the locale option \u00e2\u20ac\u0153fr_FR\u00e2\u20ac\u009d during the spear-phishing attack."
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331398",
        "to_ids": false,
        "type": "comment",
        "uuid": "54e59286-b1b8-47d2-add0-ed35950d210b",
        "value": "In the EvilBunny samples, during the HTTP queries to the command and control servers the Accept-Language parameter is set to \u00e2\u20ac\u0153fr\u00e2\u20ac\u009d."
      },
      {
        "category": "Attribution",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331424",
        "to_ids": false,
        "type": "comment",
        "uuid": "54e592a0-ed0c-4528-ae1e-3ec6950d210b",
        "value": "We found English mistakes in EvilBunny and Babar samples, such as this example from Babar: \r\n\r\n!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331509",
        "to_ids": true,
        "type": "sha1",
        "uuid": "54e592f5-3dec-4d81-a380-435f950d210b",
        "value": "efbe18eb8a66e4b6289a5c53f22254f76e3a29db"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331509",
        "to_ids": true,
        "type": "sha1",
        "uuid": "54e592f5-ebc0-4abb-baa2-4071950d210b",
        "value": "5da5079754d975d5b04342abf9d60bd0bae181a0"
      },
      {
        "category": "Network activity",
        "comment": "Unclear if those are dedicated CnC or compromise legitimate websites.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331587",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54e59343-c124-4ada-880a-4872950d210b",
        "value": "www.alexpetro.com"
      },
      {
        "category": "Network activity",
        "comment": "Unclear if those are dedicated CnC or compromise legitimate websites.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331587",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54e59343-45ac-4dbd-a123-4c80950d210b",
        "value": "www.etehadyie.ir"
      },
      {
        "category": "Network activity",
        "comment": "Unclear if those are dedicated CnC or compromise legitimate websites.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331587",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54e59343-f520-4fe3-a2cb-4d3e950d210b",
        "value": "www.horizons-tourisme.com"
      },
      {
        "category": "Network activity",
        "comment": "Unclear if those are dedicated CnC or compromise legitimate websites.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424331587",
        "to_ids": true,
        "type": "hostname",
        "uuid": "54e59343-3478-436a-90dd-433d950d210b",
        "value": "www.gezelimmi.com"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424334862",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "54e5a00e-26ac-4a0c-99ca-4b17950d210b",
        "value": "1.9.32.11"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1424336012",
        "to_ids": false,
        "type": "comment",
        "uuid": "54e5a46a-5cd4-4f32-b417-03a7950d210b",
        "value": "Data added here by Dav from Cthulhu Solutions sprl"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via 5da5079754d975d5b04342abf9d60bd0bae181a0)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838540",
        "to_ids": true,
        "type": "md5",
        "uuid": "56c6554c-3788-4d50-aba6-c650950d210f",
        "value": "4582d9d2120fb9c80ef01e2135fa3515"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via aa73634ca325022dd6daff2df30484ec9031939044cf4c2a004cbdb66108281d)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838541",
        "to_ids": true,
        "type": "md5",
        "uuid": "56c6554d-a40c-47f4-8b23-599d950d210f",
        "value": "4525141d9e6e7b5a7f4e8c3db3f0c24c"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838543",
        "to_ids": true,
        "type": "md5",
        "uuid": "56c6554f-4dc0-4434-89d0-c650950d210f",
        "value": "9fff114f15b86896d8d4978c0ad2813d"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via be14d781b85125a6074724964622ab05f89f41e6bacbda398bc7709d1d98a2ef)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838545",
        "to_ids": true,
        "type": "md5",
        "uuid": "56c65551-91e0-4512-b931-5f51950d210f",
        "value": "3bbb59afdf9bda4ffdc644d9d51c53e7"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via 7d1e5c4afb1682087d86e793b3fc5a8371dc7c28e27e7196e3b258934f6bafb5)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838547",
        "to_ids": true,
        "type": "md5",
        "uuid": "56c65553-6740-46ff-8026-4b53950d210f",
        "value": "b8ac16701c3c15b103e61b5a317692bc"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via c6a182f410b4cda0665cd792f00177c56338018fbc31bb34e41b72f8195c20cc)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838548",
        "to_ids": true,
        "type": "md5",
        "uuid": "56c65554-b968-4704-9b03-599e950d210f",
        "value": "c40e3ee23cf95d992b7cd0b7c01b8599"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via aa73634ca325022dd6daff2df30484ec9031939044cf4c2a004cbdb66108281d)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838542",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c6554e-83c8-47a3-a52a-59a2950d210f",
        "value": "efbe18eb8a66e4b6289a5c53f22254f76e3a29bd"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838544",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c65550-3e74-4254-86b0-4db1950d210f",
        "value": "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via be14d781b85125a6074724964622ab05f89f41e6bacbda398bc7709d1d98a2ef)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838546",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c65552-ecc8-4e6d-8eba-59a1950d210f",
        "value": "1798985f4cc2398a482f2232e72e5817562530de"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via 7d1e5c4afb1682087d86e793b3fc5a8371dc7c28e27e7196e3b258934f6bafb5)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838547",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c65553-24d4-4860-a2ae-59a0950d210f",
        "value": "a4226714f346c7844a9183e01961e7609d6fa241"
      },
      {
        "category": "Artifacts dropped",
        "comment": "Automatically added (via c6a182f410b4cda0665cd792f00177c56338018fbc31bb34e41b72f8195c20cc)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1455838549",
        "to_ids": true,
        "type": "sha1",
        "uuid": "56c65555-dc5c-4066-9c9c-59a0950d210f",
        "value": "1e8b4c374db03dcca026c5feba0a5c117f740233"
      }
    ]
  }
}