{ "type": "bundle", "id": "bundle--276f7055-c5e0-4b14-8645-c7028d0c74aa", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2023-11-21T15:44:54.000Z", "modified": "2023-11-21T15:44:54.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--276f7055-c5e0-4b14-8645-c7028d0c74aa", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2023-11-21T15:44:54.000Z", "modified": "2023-11-21T15:44:54.000Z", "name": "BiBi-Linux: A New Wiper Dropped By Pro-Hamas Hacktivist Group", "published": "2023-11-21T15:45:22Z", "object_refs": [ "indicator--c00c5b6f-29b8-447f-a3f0-030ff96853aa", "x-misp-object--6b711ec1-b53c-48f5-8436-50388d503f55", "indicator--b9746ab6-34ac-4d64-9a17-f42c542ecb5f", "indicator--6219119e-914a-4bb2-b30e-422fed8d3f4b" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "type:OSINT", "osint:lifetime=\"perpetual\"", "osint:certainty=\"50\"", "tlp:clear", "misp-galaxy:country=\"israel\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c00c5b6f-29b8-447f-a3f0-030ff96853aa", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2023-11-21T15:24:32.000Z", "modified": "2023-11-21T15:24:32.000Z", "pattern": "[file:hashes.SHA256 = '23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2023-11-21T15:24:32Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--6b711ec1-b53c-48f5-8436-50388d503f55", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2023-11-21T15:24:44.000Z", "modified": "2023-11-21T15:24:44.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/gui/file/23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad", "category": "External analysis", "uuid": "c9e9a95d-26dd-404e-a526-c6494f963be3" }, { "type": "text", "object_relation": "detection-ratio", "value": "38/63", "category": "Other", "uuid": "c1ccaba3-d7cb-4275-be5b-48976a54104c" } ], "x_misp_comment": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad: Enriched via the virustotal module", "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b9746ab6-34ac-4d64-9a17-f42c542ecb5f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2023-11-21T15:24:44.000Z", "modified": "2023-11-21T15:24:44.000Z", "description": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad: Enriched via the virustotal module", "pattern": "[file:hashes.MD5 = 'de9da4fcfb8320b9d34239effce1871a' AND file:hashes.SHA1 = '0dbabdc1ae8c3c8a48224ee3c3e8b6a17f41d6e7' AND file:hashes.SHA256 = '23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad' AND file:hashes.SSDEEP = '12288:S9Xgj1wC07PZOqLNj6rcTl9VZynUG6HHWxDMG4sTcaQNS8DfYX:SWj6R7PZOqLN8cTl9VZYUbgqfY' AND file:hashes.VHASH = 'e55425d7c7ad5e18ddaa4e29cf9aa676' AND file:x_misp_tlsh = 't1e8452a17bea354fdc1a6d4344b5bc5f3ac2478944321393b3295db312ea6e200b6dbb9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2023-11-21T15:24:44Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6219119e-914a-4bb2-b30e-422fed8d3f4b", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2023-11-21T15:27:17.000Z", "modified": "2023-11-21T15:27:17.000Z", "name": "MAL_WIPER_BiBi_Oct23", "pattern": "rule MAL_WIPER_BiBi_Oct23 {\r\n meta:\r\n description = \\\\\"Detects BiBi wiper samples for Windows and Linux\\\\\"\r\n author = \\\\\"Florian Roth\\\\\"\r\n reference = \\\\\"https://x.com/ESETresearch/status/1719437301900595444?s=20\\\\\"\r\n date = \\\\\"2023-11-01\\\\\"\r\n hash1 = \\\\\"23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad\\\\\"\r\n hash2 = \\\\\"40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17\\\\\"\r\n strings:\r\n $s1 = \\\\\"send attempt while closed\\\\\" ascii fullword\r\n $s2 = \\\\\"[+] CPU cores: \\\\%d, Threads: \\\\%d\\\\\" ascii fullword\r\n $s3 = \\\\\"[+] Stats: \\\\%d | \\\\%d\\\\\" ascii fullword\r\n\r\n $opw1 = { 33 c0 88 45 48 b8 01 00 00 00 86 45 48 45 8b f5 48 8d 3d de f5 ff ff 0f 57 c9 f3 0f 7f 4d b8 }\r\n $opw2 = { 2d ce b5 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 26 b4 00 00 44 8b 05 5f b6 00 00 e8 ca 0d 00 00 }\r\n\r\n $opl1 = { 4c 8d 44 24 08 48 89 f7 48 ff c2 48 83 c6 04 e8 c7 fb ff ff 41 89 c1 0f b6 42 ff 41 0f af c1 }\r\n $opl2 = { e8 6f fb ff ff 49 8d 78 f8 89 c0 48 01 c2 48 89 15 09 fb 24 00 e8 5a fb ff ff 49 8d 78 fc 6b f0 06 } \r\n condition:\r\n ( uint16(0) == 0x5a4d or uint16(0) == 0x457f )\r\n and filesize < 4000KB\r\n and 2 of them\r\n}", "pattern_type": "yara", "pattern_version": "2.1", "valid_from": "2023-11-21T15:27:17Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "misc" } ], "labels": [ "misp:name=\"yara\"", "misp:meta-category=\"misc\"", "misp:to_ids=\"True\"" ], "x_misp_context": "all" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }