{
  "Event": {
    "analysis": "2",
    "date": "2017-02-05",
    "extends_uuid": "",
    "info": "OSINT - Doctor Web detects several thousand infected Linux devices  Linux.Proxy.10",
    "publish_timestamp": "1486297675",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1486297617",
    "uuid": "589718fa-353c-411d-bbee-4c1902de0b81",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "name": "tlp:white"
      },
      {
        "colour": "#001cad",
        "name": "estimative-language:likelihood-probability=\"very-likely\""
      },
      {
        "colour": "#670080",
        "name": "ms-caro-malware:malware-platform=\"Linux\""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486297588",
        "to_ids": false,
        "type": "link",
        "uuid": "5897193a-54a0-422f-986b-4e9502de0b81",
        "value": "http://news.drweb.com/news/?i=11115&lng=en",
        "Tag": [
          {
            "colour": "#00223b",
            "name": "osint:source-type=\"blog-post\""
          },
          {
            "colour": "#075200",
            "name": "admiralty-scale:source-reliability=\"b\""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486297531",
        "to_ids": false,
        "type": "text",
        "uuid": "5897195c-7044-4bdb-816b-41d302de0b81",
        "value": "Back at the end of last year, Doctor Web security researchers noted the growing number of malicious programs for Linux. And at the end of January, they detected several thousand Linux devices infected with a new Trojan.\r\n\r\nThe Trojan, used by cybercriminals to infect numerous Linux network devices, has been named Linux.Proxy.10. As the name of this malicious program suggests, it is designed to run a SOCKS5 proxy server on the infected device on the basis of the freeware source code of the Satanic Socks Server. Cybercriminals use this Trojan to ensure that they remain anonymous online.\r\n\r\nTo distribute Linux.Proxy.10, cybercriminals log in to the vulnerable devices via the SSH protocol, and at the same time the list of devices, as well as the logins and passwords that go with them, are stored on their server. The list looks like this: \u00c2\u00abIP address:login:password\u00c2\u00bb. It is notable that users with such account details are usually created by other Linux Trojans. In other words, Linux.Proxy.10 infiltrates computers and devices that either have standard settings or are already infected with Linux malware.",
        "Tag": [
          {
            "colour": "#00223b",
            "name": "osint:source-type=\"blog-post\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Linux.Proxy.10",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486297545",
        "to_ids": true,
        "type": "sha1",
        "uuid": "58971973-6c14-41ab-9aea-442602de0b81",
        "value": "f23c4e3dd93bc54ec67dc97023c0b1251a6ca784",
        "Tag": [
          {
            "colour": "#670080",
            "name": "ms-caro-malware:malware-platform=\"Linux\""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "Port for access to proxy server is saved in the Trojan\u00e2\u20ac\u2122s body during its compilation. Examined samples use the following ports:",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486297495",
        "to_ids": false,
        "type": "text",
        "uuid": "58971997-7c34-4fb7-b0c9-4f5302de0b81",
        "value": "18902\r\n27891\r\n28910\r\n33922\r\n37912\r\n39012\r\n48944\r\n49082\r\n49098\r\n56494\r\n61092\r\n61301"
      },
      {
        "category": "Payload delivery",
        "comment": "Linux.Proxy.10 - Xchecked via VT: f23c4e3dd93bc54ec67dc97023c0b1251a6ca784",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486297617",
        "to_ids": true,
        "type": "sha256",
        "uuid": "589719db-cab0-4eb4-afd3-418602de0b81",
        "value": "b15c7445dc66cb1fe24a8f372c2a380e4969b66ae6a7f44a4bce265a6254f80e",
        "Tag": [
          {
            "colour": "#670080",
            "name": "ms-caro-malware:malware-platform=\"Linux\""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Linux.Proxy.10 - Xchecked via VT: f23c4e3dd93bc54ec67dc97023c0b1251a6ca784",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486297609",
        "to_ids": true,
        "type": "md5",
        "uuid": "589719dc-7264-434a-a1a1-4c9202de0b81",
        "value": "feb78d1ba686d5c151c3305cf5bc9675",
        "Tag": [
          {
            "colour": "#670080",
            "name": "ms-caro-malware:malware-platform=\"Linux\""
          }
        ]
      },
      {
        "category": "External analysis",
        "comment": "Linux.Proxy.10 - Xchecked via VT: f23c4e3dd93bc54ec67dc97023c0b1251a6ca784",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1486297565",
        "to_ids": false,
        "type": "link",
        "uuid": "589719dd-7200-4dbc-9b08-478202de0b81",
        "value": "https://www.virustotal.com/file/b15c7445dc66cb1fe24a8f372c2a380e4969b66ae6a7f44a4bce265a6254f80e/analysis/1486083549/"
      }
    ]
  }
}