{
  "Event": {
    "analysis": "0",
    "date": "2019-09-09",
    "extends_uuid": "",
    "info": "OSINT - ESET discovered an undocumented backdoor used by the infamous Stealth Falcon group",
    "publish_timestamp": "1568204241",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1568193300",
    "uuid": "5d78a50e-ba3c-40b3-a5c1-4fb1950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Stealth Falcon\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Stealth Falcon - G0038\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-intrusion-set=\"Stealth Falcon\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-intrusion-set=\"Stealth Falcon - G0038\"",
        "relationship_type": ""
      },
      {
        "colour": "#13f100",
        "local": false,
        "name": "misp-galaxy:threat-actor=\"Stealth Falcon\"",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#0087e8",
        "local": false,
        "name": "osint:certainty=\"50\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"BITS Jobs - T1197\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"BITS Jobs - T1197\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568188868",
        "to_ids": false,
        "type": "link",
        "uuid": "5d78a9c4-1108-4eb4-aca8-e76e950d210f",
        "value": "https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568188891",
        "to_ids": false,
        "type": "text",
        "uuid": "5d78a9db-1b4c-4f0b-8e96-8aaa950d210f",
        "value": "Stealth Falcon is a threat group, active since 2012, that targets political activists and journalists in the Middle East. It has been tracked by the Citizen Lab, a non-profit organization focusing on security and human rights, which published an analysis of a particular cyberattack in 2016. In January of 2019, Reuters published an investigative report into Project Raven, an initiative allegedly employing former NSA operatives and aiming at the same types of targets as Stealth Falcon."
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568189620",
        "to_ids": true,
        "type": "domain",
        "uuid": "5d78acb4-ae5c-468f-8570-e7f0950d210f",
        "value": "footballtimes.info"
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568189620",
        "to_ids": true,
        "type": "domain",
        "uuid": "5d78acb4-8a10-4a25-9981-e7f0950d210f",
        "value": "vegetableportfolio.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568189620",
        "to_ids": true,
        "type": "domain",
        "uuid": "5d78acb4-91d4-4a43-b367-e7f0950d210f",
        "value": "windowsearchcache.com"
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568189620",
        "to_ids": true,
        "type": "domain",
        "uuid": "5d78acb4-fed4-4e1a-9239-e7f0950d210f",
        "value": "electricalweb.org"
      },
      {
        "category": "Network activity",
        "comment": "C&C",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568189620",
        "to_ids": true,
        "type": "domain",
        "uuid": "5d78acb4-1f6c-43db-9dc0-e7f0950d210f",
        "value": "upnpdiscover.org"
      },
      {
        "category": "Payload delivery",
        "comment": "malware as detected by ESET",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568189662",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5d78acde-9514-4e9d-968b-c52e950d210f",
        "value": "31b54aebdaf5fbc73a66ac41ccb35943cc9b7f72"
      },
      {
        "category": "Payload delivery",
        "comment": "malware as detected by ESET",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568189662",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5d78acde-80f8-4127-81c8-c52e950d210f",
        "value": "50973a3fc57d70c7911f7a952356188b9939e56b"
      },
      {
        "category": "Payload delivery",
        "comment": "malware as detected by ESET",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568189662",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5d78acde-69bc-4b16-935d-c52e950d210f",
        "value": "244eb62b9ac30934098ca4204447440d6fc4e259"
      },
      {
        "category": "Payload delivery",
        "comment": "malware as detected by ESET",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568189662",
        "to_ids": true,
        "type": "sha1",
        "uuid": "5d78acde-d94c-48a4-9770-c52e950d210f",
        "value": "5c8f83cc4ff57e7c67925df4d9daabe5d0cc07e2"
      },
      {
        "category": "Antivirus detection",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568193151",
        "to_ids": false,
        "type": "text",
        "uuid": "5d78ba7f-97f0-4ba7-8062-95e4950d210f",
        "value": "Win32/StealthFalcon"
      },
      {
        "category": "Network activity",
        "comment": "Attribute #7611029 enriched by dns.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568193349",
        "to_ids": false,
        "type": "ip-src",
        "uuid": "5d78bb45-783c-456e-a632-4105e387cbd9",
        "value": "185.227.82.19"
      },
      {
        "category": "Network activity",
        "comment": "Attribute #7611030 enriched by dns.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568193349",
        "to_ids": false,
        "type": "ip-src",
        "uuid": "5d78bb45-5550-4792-81df-43b1e387cbd9",
        "value": "46.183.219.85"
      },
      {
        "category": "Network activity",
        "comment": "Attribute #7611032 enriched by dns.",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1568193350",
        "to_ids": false,
        "type": "ip-src",
        "uuid": "5d78bb46-8dbc-41cf-971d-431de387cbd9",
        "value": "193.105.134.75"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "Command line and option related to a software malicious or not to execute specific commands.",
        "meta-category": "misc",
        "name": "command-line",
        "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf",
        "template_version": "1",
        "timestamp": "1568189161",
        "uuid": "5d78aae9-e0fc-4efb-957e-4829950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "description",
            "timestamp": "1568189161",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78aae9-9994-4be3-90b5-4f4e950d210f",
            "value": "Uninstall itself"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "value",
            "timestamp": "1568189167",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78aaef-b248-4e75-a0eb-4453950d210f",
            "value": "K"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "Command line and option related to a software malicious or not to execute specific commands.",
        "meta-category": "misc",
        "name": "command-line",
        "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf",
        "template_version": "1",
        "timestamp": "1568189276",
        "uuid": "5d78ab5c-a620-4d62-b72b-8aa5950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "description",
            "timestamp": "1568189276",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78ab5c-a738-43f5-9441-8aa5950d210f",
            "value": "Update configuration data"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "value",
            "timestamp": "1568189282",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78ab62-3fd8-49d7-9c2e-8aa5950d210f",
            "value": "CFG"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "Command line and option related to a software malicious or not to execute specific commands.",
        "meta-category": "misc",
        "name": "command-line",
        "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf",
        "template_version": "1",
        "timestamp": "1568189713",
        "uuid": "5d78ad11-8e74-4fda-92f9-e7f0950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "description",
            "timestamp": "1568189713",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78ad11-5028-48f2-a2d7-e7f0950d210f",
            "value": "Execute the specified application"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "value",
            "timestamp": "1568189713",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78ad11-deb8-4372-a92a-e7f0950d210f",
            "value": "RC"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "Command line and option related to a software malicious or not to execute specific commands.",
        "meta-category": "misc",
        "name": "command-line",
        "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf",
        "template_version": "1",
        "timestamp": "1568189734",
        "uuid": "5d78ad26-4fbc-4e8e-a634-ca95950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "description",
            "timestamp": "1568189734",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78ad26-9728-4f7e-b0d1-ca95950d210f",
            "value": "Write downloaded data to file"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "value",
            "timestamp": "1568189734",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78ad26-84c0-4df6-884e-ca95950d210f",
            "value": "DL"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "Command line and option related to a software malicious or not to execute specific commands.",
        "meta-category": "misc",
        "name": "command-line",
        "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf",
        "template_version": "1",
        "timestamp": "1568189754",
        "uuid": "5d78ad3a-5f28-4ba2-a5c6-8aa5950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "description",
            "timestamp": "1568189754",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78ad3a-3c64-4abb-917a-8aa5950d210f",
            "value": "Prepare a file for exfiltration"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "value",
            "timestamp": "1568189754",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78ad3a-4e10-403d-8aac-8aa5950d210f",
            "value": "CF"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "Command line and option related to a software malicious or not to execute specific commands.",
        "meta-category": "misc",
        "name": "command-line",
        "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf",
        "template_version": "1",
        "timestamp": "1568189792",
        "uuid": "5d78ad60-53c4-4617-b7c0-8aa9950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "description",
            "timestamp": "1568189792",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78ad60-b23c-4624-9dbe-8aa9950d210f",
            "value": "Not implemented/no operation"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "value",
            "timestamp": "1568189792",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78ad60-44bc-474a-b925-8aa9950d210f",
            "value": "CFWD"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "Command line and option related to a software malicious or not to execute specific commands.",
        "meta-category": "misc",
        "name": "command-line",
        "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf",
        "template_version": "1",
        "timestamp": "1568189869",
        "uuid": "5d78adad-d90c-4b7f-b37c-8aaa950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "description",
            "timestamp": "1568189869",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78adad-02d8-4d3d-8e80-8aaa950d210f",
            "value": "Exfiltrate and delete files"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "value",
            "timestamp": "1568189869",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78adad-0394-46aa-8539-8aaa950d210f",
            "value": "CFW"
          }
        ]
      },
      {
        "comment": "RC4 keys",
        "deleted": false,
        "description": "Credential describes one or more credential(s) including password(s), api key(s) or decryption key(s).",
        "meta-category": "misc",
        "name": "credential",
        "template_uuid": "a27e98c9-9b0e-414c-8076-d201e039ca09",
        "template_version": "3",
        "timestamp": "1568190180",
        "uuid": "5d78aee4-c290-488a-a73c-e7f0950d210f",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "format",
            "timestamp": "1568190180",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78aee4-f13c-4d4b-9ecb-e7f0950d210f",
            "value": "clear-text"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "origin",
            "timestamp": "1568190180",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78aee4-c7ac-489b-af60-e7f0950d210f",
            "value": "malware-analysis"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "type",
            "timestamp": "1568190180",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78aee4-3d40-455a-84f5-e7f0950d210f",
            "value": "encryption-key"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "password",
            "timestamp": "1568190180",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78aee4-d974-4836-9831-e7f0950d210f",
            "value": "258A4A9D139823F55D7B9DA1825D101107FBF88634A870DE9800580DAD556BA3"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "password",
            "timestamp": "1568190180",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78aee4-a068-4554-96ac-e7f0950d210f",
            "value": "2519DB0FFEC604D6C9A655CF56B98EDCE10405DE36810BC3DCF125CDE30BA5A2"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "password",
            "timestamp": "1568190180",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78aee4-fbf0-4a90-86a8-e7f0950d210f",
            "value": "3EDB6EA77CD0987668B360365D5F39FDCF6B366D0DEAC9ECE5ADC6FFD20227F6"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "password",
            "timestamp": "1568190180",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78aee4-a99c-4333-b7dd-e7f0950d210f",
            "value": "8DFFDE77A39F3AF46D0CE0B84A189DB25A2A0FEFD71A0CD0054D8E0D60AB08DE"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1568190180",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78aee4-1c2c-4f50-858f-e7f0950d210f",
            "value": "Note: Malware derives a second RC4 key by XORing each byte of the hardcoded key with 0x3D."
          }
        ]
      },
      {
        "comment": "Backdoor commands",
        "deleted": false,
        "description": "Command functionalities related to a software malicious or not to execute specific commands. Command-line are attached to this object for the related commands.",
        "meta-category": "misc",
        "name": "command",
        "template_uuid": "21ad70d8-d397-11e9-9ea7-43b2d5f6a6e3",
        "template_version": "1",
        "timestamp": "1568193120",
        "uuid": "5d78b6f6-9ae4-4260-a284-c534950d210f",
        "ObjectReference": [
          {
            "comment": "",
            "object_uuid": "5d78b6f6-9ae4-4260-a284-c534950d210f",
            "referenced_uuid": "5d78aae9-e0fc-4efb-957e-4829950d210f",
            "relationship_type": "contains",
            "timestamp": "1568192298",
            "uuid": "5d78b72a-b5e8-4e20-b1b1-c52e950d210f"
          },
          {
            "comment": "",
            "object_uuid": "5d78b6f6-9ae4-4260-a284-c534950d210f",
            "referenced_uuid": "5d78ab5c-a620-4d62-b72b-8aa5950d210f",
            "relationship_type": "contains",
            "timestamp": "1568192716",
            "uuid": "5d78b8cc-0c68-4192-ab7c-95e4950d210f"
          },
          {
            "comment": "",
            "object_uuid": "5d78b6f6-9ae4-4260-a284-c534950d210f",
            "referenced_uuid": "5d78ad11-8e74-4fda-92f9-e7f0950d210f",
            "relationship_type": "contains",
            "timestamp": "1568192728",
            "uuid": "5d78b8d8-75a4-477e-b497-95e4950d210f"
          },
          {
            "comment": "",
            "object_uuid": "5d78b6f6-9ae4-4260-a284-c534950d210f",
            "referenced_uuid": "5d78ad26-4fbc-4e8e-a634-ca95950d210f",
            "relationship_type": "contains",
            "timestamp": "1568192739",
            "uuid": "5d78b8e3-8ab8-4ad0-b6bf-95e4950d210f"
          },
          {
            "comment": "",
            "object_uuid": "5d78b6f6-9ae4-4260-a284-c534950d210f",
            "referenced_uuid": "5d78ad3a-5f28-4ba2-a5c6-8aa5950d210f",
            "relationship_type": "contains",
            "timestamp": "1568192797",
            "uuid": "5d78b91d-6d90-46a2-b159-e7f0950d210f"
          },
          {
            "comment": "",
            "object_uuid": "5d78b6f6-9ae4-4260-a284-c534950d210f",
            "referenced_uuid": "5d78ad60-53c4-4617-b7c0-8aa9950d210f",
            "relationship_type": "contains",
            "timestamp": "1568192809",
            "uuid": "5d78b929-5b9c-47e5-85d2-e7f0950d210f"
          },
          {
            "comment": "",
            "object_uuid": "5d78b6f6-9ae4-4260-a284-c534950d210f",
            "referenced_uuid": "5d78adad-d90c-4b7f-b37c-8aaa950d210f",
            "relationship_type": "contains",
            "timestamp": "1568192831",
            "uuid": "5d78b93f-3854-4613-9a16-e7f0950d210f"
          }
        ],
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "description",
            "timestamp": "1568193120",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78b6f7-b7a4-49ac-9369-c534950d210f",
            "value": "Win32/StealthFalcon is a DLL file which, after execution, schedules itself as a task running on each user login. It only supports basic commands but displays a systematic approach to data collection, data exfiltration, employing further malicious tools, and updating its configuration."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "trigger",
            "timestamp": "1568193120",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78b6f7-17a8-4b54-8725-c534950d210f",
            "value": "Network"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "location",
            "timestamp": "1568193120",
            "to_ids": false,
            "type": "text",
            "uuid": "5d78b6f7-be18-4e99-add1-c534950d210f",
            "value": "Bundled"
          }
        ]
      }
    ]
  }
}