{
  "Event": {
    "analysis": "2",
    "date": "2014-03-19",
    "extends_uuid": "",
    "info": "OSINT APT Bestia used in APT attacks on Polish Government",
    "publish_timestamp": "1456870751",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1456870733",
    "uuid": "56d61087-d19c-4552-9802-48fe02de0b81",
    "Orgc": {
      "name": "CthulhuSPRL.be",
      "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "name": "type:OSINT"
      },
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1456869657",
        "to_ids": false,
        "type": "link",
        "uuid": "56d61119-760c-4b21-b93f-45e602de0b81",
        "value": "https://twitter.com/yararules/status/704613871294746625"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1456869657",
        "to_ids": false,
        "type": "link",
        "uuid": "56d61119-bb30-4d1c-b53e-45e602de0b81",
        "value": "https://zaufanatrzeciastrona.pl/post/ukierunkowany-atak-na-pracownikow-polskich-samorzadow/"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1456869716",
        "to_ids": false,
        "type": "link",
        "uuid": "56d61154-cccc-449e-9a91-49a702de0b81",
        "value": "https://github.com/Yara-Rules/rules/blob/master/malware/APT_Bestia.yar"
      },
      {
        "category": "Artifacts dropped",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1456870733",
        "to_ids": true,
        "type": "yara",
        "uuid": "56d6154d-5ec0-4699-a570-484402de0b81",
        "value": "rule APT_bestia\r\n{\r\nmeta:\r\n    author = \"Adam Ziaja <adam@adamziaja.com> http://adamziaja.com\"\r\n    date = \"2014-03-19\"\r\n    description = \"Bestia.3.02.012.07 malware used in APT attacks on Polish government\"\r\n    references = \"http://zaufanatrzeciastrona.pl/post/ukierunkowany-atak-na-pracownikow-polskich-samorzadow/\" /* PL */\r\n    hash0 = \"9bb03bb5af40d1202378f95a6485fba8\"\r\n    hash1 = \"7d9a806e0da0b869b10870dd6c7692c5\"\r\n    maltype = \"apt\"\r\n    filetype = \"exe\"\r\nstrings:\r\n    /* generated with https://github.com/Xen0ph0n/YaraGenerator */\r\n    $string0 = \"u4(UeK\"\r\n    $string1 = \"nMiq/'p\"\r\n    $string2 = \"_9pJMf\"\r\n    $string3 = \"ICMP.DLL\"\r\n    $string4 = \"EG}QAp\"\r\n    $string5 = \"tsjWj:U\"\r\n    $string6 = \"FileVersion\" wide\r\n    $string7 = \"O2nQpp\"\r\n    $string8 = \"2}W8we\"\r\n    $string9 = \"ILqkC:l\"\r\n    $string10 = \"f1yzMk\"\r\n    $string11 = \"AutoIt v3 Script: 3, 3, 8, 1\" wide\r\n    $string12 = \"wj<1uH\"\r\n    $string13 = \"6fL-uD\"\r\n    $string14 = \"B9Iavo<\"\r\n    $string15 = \"rUS)sO\"\r\n    $string16 = \"FJH{_/f\"\r\n    $string17 = \"3e 03V\"\r\ncondition:\r\n    17 of them\r\n}"
      }
    ]
  }
}