adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/276f7055-c5e0-4b14-8645-c7028d0c74aa.json

241 lines
No EOL
8.9 KiB
JSON
Raw Blame History

{
"Event": {
"analysis": "2",
"date": "2023-11-21",
"extends_uuid": "",
"info": "BiBi-Linux: A New Wiper Dropped By Pro-Hamas Hacktivist Group",
"publish_timestamp": "1700581522",
"published": true,
"threat_level_id": "2",
"timestamp": "1700581494",
"uuid": "276f7055-c5e0-4b14-8645-c7028d0c74aa",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#004646",
"local": "0",
"name": "type:OSINT",
"relationship_type": ""
},
{
"colour": "#0071c3",
"local": "0",
"name": "osint:lifetime=\"perpetual\"",
"relationship_type": ""
},
{
"colour": "#0087e8",
"local": "0",
"name": "osint:certainty=\"50\"",
"relationship_type": ""
},
{
"colour": "#ffffff",
"local": "0",
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#ffffff",
"local": "0",
"name": "tlp:clear",
"relationship_type": ""
},
{
"colour": "#0088cc",
"local": "0",
"name": "misp-galaxy:country=\"israel\"",
"relationship_type": "targets"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1700580272",
"to_ids": true,
"type": "sha256",
"uuid": "c00c5b6f-29b8-447f-a3f0-030ff96853aa",
"value": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
}
],
"Object": [
{
"comment": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad: Enriched via the virustotal module",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "4",
"timestamp": "1700580284",
"uuid": "6b711ec1-b53c-48f5-8436-50388d503f55",
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "permalink",
"timestamp": "1700580284",
"to_ids": false,
"type": "link",
"uuid": "c9e9a95d-26dd-404e-a526-c6494f963be3",
"value": "https://www.virustotal.com/gui/file/23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1700580284",
"to_ids": false,
"type": "text",
"uuid": "c1ccaba3-d7cb-4275-be5b-48976a54104c",
"value": "38/63"
}
]
},
{
"comment": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad: Enriched via the virustotal module",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "24",
"timestamp": "1700580284",
"uuid": "b9746ab6-34ac-4d64-9a17-f42c542ecb5f",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1700580284",
"to_ids": true,
"type": "md5",
"uuid": "8a202419-2ef5-453a-8215-fb12460d9b37",
"value": "de9da4fcfb8320b9d34239effce1871a"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1700580284",
"to_ids": true,
"type": "sha1",
"uuid": "4ac3e468-aa65-420e-9c20-e72e66f2f586",
"value": "0dbabdc1ae8c3c8a48224ee3c3e8b6a17f41d6e7"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1700580284",
"to_ids": true,
"type": "sha256",
"uuid": "a70c149b-1e87-4118-9b42-cfed404722a5",
"value": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "tlsh",
"timestamp": "1700580284",
"to_ids": true,
"type": "tlsh",
"uuid": "e31b3abf-c66e-40d1-874a-aded1fea7a77",
"value": "t1e8452a17bea354fdc1a6d4344b5bc5f3ac2478944321393b3295db312ea6e200b6dbb9"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "vhash",
"timestamp": "1700580284",
"to_ids": true,
"type": "vhash",
"uuid": "fa28bec1-a8f8-46aa-82ee-5234bbcc4b5b",
"value": "e55425d7c7ad5e18ddaa4e29cf9aa676"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ssdeep",
"timestamp": "1700580284",
"to_ids": true,
"type": "ssdeep",
"uuid": "0e374fc4-fd1d-4564-9b66-1f2c05e59f70",
"value": "12288:S9Xgj1wC07PZOqLNj6rcTl9VZynUG6HHWxDMG4sTcaQNS8DfYX:SWj6R7PZOqLN8cTl9VZYUbgqfY"
}
]
},
{
"comment": "",
"deleted": false,
"description": "An object describing a YARA rule (or a YARA rule name) along with its version.",
"meta-category": "misc",
"name": "yara",
"template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",
"template_version": "6",
"timestamp": "1700580437",
"uuid": "6219119e-914a-4bb2-b30e-422fed8d3f4b",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "context",
"timestamp": "1700580437",
"to_ids": false,
"type": "text",
"uuid": "6f396c0f-fc92-438f-9cb9-6090e0baa87e",
"value": "all"
},
{
"category": "Payload installation",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "yara",
"timestamp": "1700580437",
"to_ids": true,
"type": "yara",
"uuid": "3bf820ba-bf26-4833-a4d7-e47ca110b839",
"value": "rule MAL_WIPER_BiBi_Oct23 {\r\n meta:\r\n description = \"Detects BiBi wiper samples for Windows and Linux\"\r\n author = \"Florian Roth\"\r\n reference = \"https://x.com/ESETresearch/status/1719437301900595444?s=20\"\r\n date = \"2023-11-01\"\r\n hash1 = \"23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad\"\r\n hash2 = \"40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17\"\r\n strings:\r\n $s1 = \"send attempt while closed\" ascii fullword\r\n $s2 = \"[+] CPU cores: %d, Threads: %d\" ascii fullword\r\n $s3 = \"[+] Stats: %d | %d\" ascii fullword\r\n\r\n $opw1 = { 33 c0 88 45 48 b8 01 00 00 00 86 45 48 45 8b f5 48 8d 3d de f5 ff ff 0f 57 c9 f3 0f 7f 4d b8 }\r\n $opw2 = { 2d ce b5 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 26 b4 00 00 44 8b 05 5f b6 00 00 e8 ca 0d 00 00 }\r\n\r\n $opl1 = { 4c 8d 44 24 08 48 89 f7 48 ff c2 48 83 c6 04 e8 c7 fb ff ff 41 89 c1 0f b6 42 ff 41 0f af c1 }\r\n $opl2 = { e8 6f fb ff ff 49 8d 78 f8 89 c0 48 01 c2 48 89 15 09 fb 24 00 e8 5a fb ff ff 49 8d 78 fc 6b f0 06 } \r\n condition:\r\n ( uint16(0) == 0x5a4d or uint16(0) == 0x457f )\r\n and filesize < 4000KB\r\n and 2 of them\r\n}"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "yara-rule-name",
"timestamp": "1700580437",
"to_ids": false,
"type": "text",
"uuid": "b30d85f5-2a31-4206-97c9-3d6a9ed85370",
"value": "MAL_WIPER_BiBi_Oct23"
}
]
}
]
}
}
Reference in a new issue View git blame Copy permalink