175 lines
No EOL
5.9 KiB
JSON
175 lines
No EOL
5.9 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2017-07-21",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - Linux.Bew: un backdoor para el minado de Bitcoin",
|
|
"publish_timestamp": "1500651908",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1500651755",
|
|
"uuid": "59722019-3260-4062-bec5-4eea950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59722024-b7ec-415d-a9d6-4032950d210f",
|
|
"value": "https://www.securityartwork.es/2017/07/21/linux-bew-backdoor-minado-bitcoin/",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "59722036-ecec-4b53-a575-40ce950d210f",
|
|
"value": "En el siguiente art\u00c3\u00adculo vamos a analizar una muestra del binario catalogado por varias firmas antivirus como Linux.Bew. (Virustotal), malware de tipo ELF del cual hemos detectado actividad durante este \u00c3\u00baltimo mes.",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"local": false,
|
|
"name": "osint:source-type=\"blog-post\"",
|
|
"relationship_type": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5972204b-2690-47f3-b113-4dc3950d210f",
|
|
"value": "80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "59722068-7e70-418e-b27b-cf65950d210f",
|
|
"value": "/root/.config/kdeinit4"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5972207d-12d4-4674-8603-49fe950d210f",
|
|
"value": "hfir.u230.org"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "5972207d-b374-4e26-b02b-4100950d210f",
|
|
"value": "192.211.49.214"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "tcp/443",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "59722091-daf0-4356-ac59-46a7950d210f",
|
|
"value": "45.58.49.98"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": true,
|
|
"type": "yara",
|
|
"uuid": "597220a8-2828-4a80-8910-4076950d210f",
|
|
"value": "rule LinuxBew: MALW\r\n{\r\n\tmeta:\r\n\t\tdescription = \"Linux.Bew Backdoor\"\r\n\t\tauthor = \"Joan Soriano / @w0lfvan\"\r\n\t\tdate = \"2017-07-10\"\r\n\t\tversion = \"1.0\"\r\n\t\tMD5 = \"27d857e12b9be5d43f935b8cc86eaabf\"\r\n\t\tSHA256 = \"80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06\"\r\n\tstrings:\r\n\t\t$a = \"src/secp256k1.c\"\r\n\t\t$b = \"hfir.u230.org\"\r\n\t\t$c = \u00e2\u20ac\u0153tempfile-x11session\u00e2\u20ac\u009d\r\n\tcondition:\r\n\t\tall of them\r\n}"
|
|
},
|
|
{
|
|
"category": "Antivirus detection",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "597220ce-d71c-4ec0-b402-41d0950d210f",
|
|
"value": "Linux.Bew"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "597220eb-0b04-447b-9d6a-471002de0b81",
|
|
"value": "4c614317fd1686f8c865c0a8d367c8e22b94087f"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "597220eb-f6a0-4b53-8948-400802de0b81",
|
|
"value": "f42c73e5291392c4c39852670addd7f9"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: 80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1500651755",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "597220eb-8224-4341-9cf0-495d02de0b81",
|
|
"value": "https://www.virustotal.com/file/80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06/analysis/1499436533/"
|
|
}
|
|
]
|
|
}
|
|
} |