{
  "Event": {
    "analysis": "2",
    "date": "2017-07-21",
    "extends_uuid": "",
    "info": "OSINT - Linux.Bew: un backdoor para el minado de Bitcoin",
    "publish_timestamp": "1500651908",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1500651755",
    "uuid": "59722019-3260-4062-bec5-4eea950d210f",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": "0",
        "name": "tlp:white",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": false,
        "type": "link",
        "uuid": "59722024-b7ec-415d-a9d6-4032950d210f",
        "value": "https://www.securityartwork.es/2017/07/21/linux-bew-backdoor-minado-bitcoin/",
        "Tag": [
          {
            "colour": "#00223b",
            "local": "0",
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": false,
        "type": "text",
        "uuid": "59722036-ecec-4b53-a575-40ce950d210f",
        "value": "En el siguiente art\u00c3\u00adculo vamos a analizar una muestra del binario catalogado por varias firmas antivirus como Linux.Bew. (Virustotal), malware de tipo ELF del cual hemos detectado actividad durante este \u00c3\u00baltimo mes.",
        "Tag": [
          {
            "colour": "#00223b",
            "local": "0",
            "name": "osint:source-type=\"blog-post\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": true,
        "type": "sha256",
        "uuid": "5972204b-2690-47f3-b113-4dc3950d210f",
        "value": "80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": true,
        "type": "filename",
        "uuid": "59722068-7e70-418e-b27b-cf65950d210f",
        "value": "/root/.config/kdeinit4"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": true,
        "type": "hostname",
        "uuid": "5972207d-12d4-4674-8603-49fe950d210f",
        "value": "hfir.u230.org"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5972207d-b374-4e26-b02b-4100950d210f",
        "value": "192.211.49.214"
      },
      {
        "category": "Network activity",
        "comment": "tcp/443",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "59722091-daf0-4356-ac59-46a7950d210f",
        "value": "45.58.49.98"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": true,
        "type": "yara",
        "uuid": "597220a8-2828-4a80-8910-4076950d210f",
        "value": "rule LinuxBew: MALW\r\n{\r\n\tmeta:\r\n\t\tdescription = \"Linux.Bew Backdoor\"\r\n\t\tauthor = \"Joan Soriano / @w0lfvan\"\r\n\t\tdate = \"2017-07-10\"\r\n\t\tversion = \"1.0\"\r\n\t\tMD5 = \"27d857e12b9be5d43f935b8cc86eaabf\"\r\n\t\tSHA256 = \"80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06\"\r\n\tstrings:\r\n\t\t$a = \"src/secp256k1.c\"\r\n\t\t$b = \"hfir.u230.org\"\r\n\t\t$c = \u00e2\u20ac\u0153tempfile-x11session\u00e2\u20ac\u009d\r\n\tcondition:\r\n\t\tall of them\r\n}"
      },
      {
        "category": "Antivirus detection",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": false,
        "type": "text",
        "uuid": "597220ce-d71c-4ec0-b402-41d0950d210f",
        "value": "Linux.Bew"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": true,
        "type": "sha1",
        "uuid": "597220eb-0b04-447b-9d6a-471002de0b81",
        "value": "4c614317fd1686f8c865c0a8d367c8e22b94087f"
      },
      {
        "category": "Payload delivery",
        "comment": "- Xchecked via VT: 80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": true,
        "type": "md5",
        "uuid": "597220eb-f6a0-4b53-8948-400802de0b81",
        "value": "f42c73e5291392c4c39852670addd7f9"
      },
      {
        "category": "External analysis",
        "comment": "- Xchecked via VT: 80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1500651755",
        "to_ids": false,
        "type": "link",
        "uuid": "597220eb-8224-4341-9cf0-495d02de0b81",
        "value": "https://www.virustotal.com/file/80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06/analysis/1499436533/"
      }
    ]
  }
}