{
  "Event": {
    "analysis": "2",
    "date": "2023-11-21",
    "extends_uuid": "",
    "info": "BiBi-Linux: A New Wiper Dropped By Pro-Hamas Hacktivist Group",
    "publish_timestamp": "1700581522",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1700581494",
    "uuid": "276f7055-c5e0-4b14-8645-c7028d0c74aa",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#0087e8",
        "local": false,
        "name": "osint:certainty=\"50\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"israel\"",
        "relationship_type": "targets"
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1700580272",
        "to_ids": true,
        "type": "sha256",
        "uuid": "c00c5b6f-29b8-447f-a3f0-030ff96853aa",
        "value": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
      }
    ],
    "Object": [
      {
        "comment": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad: Enriched via the virustotal module",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "4",
        "timestamp": "1700580284",
        "uuid": "6b711ec1-b53c-48f5-8436-50388d503f55",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "permalink",
            "timestamp": "1700580284",
            "to_ids": false,
            "type": "link",
            "uuid": "c9e9a95d-26dd-404e-a526-c6494f963be3",
            "value": "https://www.virustotal.com/gui/file/23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1700580284",
            "to_ids": false,
            "type": "text",
            "uuid": "c1ccaba3-d7cb-4275-be5b-48976a54104c",
            "value": "38/63"
          }
        ]
      },
      {
        "comment": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad: Enriched via the virustotal module",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "24",
        "timestamp": "1700580284",
        "uuid": "b9746ab6-34ac-4d64-9a17-f42c542ecb5f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1700580284",
            "to_ids": true,
            "type": "md5",
            "uuid": "8a202419-2ef5-453a-8215-fb12460d9b37",
            "value": "de9da4fcfb8320b9d34239effce1871a"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1700580284",
            "to_ids": true,
            "type": "sha1",
            "uuid": "4ac3e468-aa65-420e-9c20-e72e66f2f586",
            "value": "0dbabdc1ae8c3c8a48224ee3c3e8b6a17f41d6e7"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1700580284",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a70c149b-1e87-4118-9b42-cfed404722a5",
            "value": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "tlsh",
            "timestamp": "1700580284",
            "to_ids": true,
            "type": "tlsh",
            "uuid": "e31b3abf-c66e-40d1-874a-aded1fea7a77",
            "value": "t1e8452a17bea354fdc1a6d4344b5bc5f3ac2478944321393b3295db312ea6e200b6dbb9"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1700580284",
            "to_ids": true,
            "type": "vhash",
            "uuid": "fa28bec1-a8f8-46aa-82ee-5234bbcc4b5b",
            "value": "e55425d7c7ad5e18ddaa4e29cf9aa676"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1700580284",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "0e374fc4-fd1d-4564-9b66-1f2c05e59f70",
            "value": "12288:S9Xgj1wC07PZOqLNj6rcTl9VZynUG6HHWxDMG4sTcaQNS8DfYX:SWj6R7PZOqLN8cTl9VZYUbgqfY"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An object describing a YARA rule (or a YARA rule name) along with its version.",
        "meta-category": "misc",
        "name": "yara",
        "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
        "template_version": "6",
        "timestamp": "1700580437",
        "uuid": "6219119e-914a-4bb2-b30e-422fed8d3f4b",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "context",
            "timestamp": "1700580437",
            "to_ids": false,
            "type": "text",
            "uuid": "6f396c0f-fc92-438f-9cb9-6090e0baa87e",
            "value": "all"
          },
          {
            "category": "Payload installation",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara",
            "timestamp": "1700580437",
            "to_ids": true,
            "type": "yara",
            "uuid": "3bf820ba-bf26-4833-a4d7-e47ca110b839",
            "value": "rule MAL_WIPER_BiBi_Oct23 {\r\n   meta:\r\n      description = \"Detects BiBi wiper samples for Windows and Linux\"\r\n      author = \"Florian Roth\"\r\n      reference = \"https://x.com/ESETresearch/status/1719437301900595444?s=20\"\r\n      date = \"2023-11-01\"\r\n      hash1 = \"23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad\"\r\n      hash2 = \"40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17\"\r\n   strings:\r\n      $s1 = \"send attempt while closed\" ascii fullword\r\n      $s2 = \"[+] CPU cores: %d, Threads: %d\" ascii fullword\r\n      $s3 = \"[+] Stats: %d | %d\" ascii fullword\r\n\r\n      $opw1 = { 33 c0 88 45 48 b8 01 00 00 00 86 45 48 45 8b f5 48 8d 3d de f5 ff ff 0f 57 c9 f3 0f 7f 4d b8 }\r\n      $opw2 = { 2d ce b5 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 26 b4 00 00 44 8b 05 5f b6 00 00 e8 ca 0d 00 00 }\r\n\r\n      $opl1 = { 4c 8d 44 24 08 48 89 f7 48 ff c2 48 83 c6 04 e8 c7 fb ff ff 41 89 c1 0f b6 42 ff 41 0f af c1 }\r\n      $opl2 = { e8 6f fb ff ff 49 8d 78 f8 89 c0 48 01 c2 48 89 15 09 fb 24 00 e8 5a fb ff ff 49 8d 78 fc 6b f0 06 } \r\n   condition:\r\n      ( uint16(0) == 0x5a4d or uint16(0) == 0x457f )\r\n      and filesize < 4000KB\r\n      and 2 of them\r\n}"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "yara-rule-name",
            "timestamp": "1700580437",
            "to_ids": false,
            "type": "text",
            "uuid": "b30d85f5-2a31-4206-97c9-3d6a9ed85370",
            "value": "MAL_WIPER_BiBi_Oct23"
          }
        ]
      }
    ]
  }
}