253 lines
No EOL
9.2 KiB
JSON
253 lines
No EOL
9.2 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2016-02-13",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - A Look Into Fysbis: Sofacy\u00e2\u20ac\u2122s Linux Backdoor",
|
|
"publish_timestamp": "1455369699",
|
|
"published": true,
|
|
"threat_level_id": "2",
|
|
"timestamp": "1455369626",
|
|
"uuid": "56bf2c35-198c-40be-adba-6cf602de0b81",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369383",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "56bf2ca7-5b68-4354-9c49-6cf202de0b81",
|
|
"value": "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369401",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "56bf2cb9-5ae4-4d06-a484-6cf502de0b81",
|
|
"value": "The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia. Their targets have spanned all across the world, with a focus on government, defense organizations and various Eastern European governments. There have been numerous reports on their activities, to the extent that a Wikipedia entry has even been created for them.\r\nFrom these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems \u00e2\u20ac\u201c Windows, OSX, Linux, even mobile iOS.\r\nThe Linux malware Fysbis is a preferred tool of Sofacy, and though it is not particularly sophisticated, Linux security in general is still a maturing area, especially in regards to malware. In short, it is entirely plausible that this tool has contributed to the success of associated attacks by this group. This blog post focuses specifically on this Linux tool preferred by Sofacy and describes considerations and implications when it comes to Linux malware."
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369422",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56bf2cce-066c-48f0-8683-6cf702de0b81",
|
|
"value": "364ff454dcf00420cff13a57bcb78467"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "- Xchecked via VT: 364ff454dcf00420cff13a57bcb78467",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369444",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56bf2ce4-4694-489b-ac8a-6cf402de0b81",
|
|
"value": "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "- Xchecked via VT: 364ff454dcf00420cff13a57bcb78467",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369444",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56bf2ce4-f9f0-472d-9a2f-6cf402de0b81",
|
|
"value": "9444d2b29c6401bc7c2d14f071b11ec9014ae040"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369444",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "56bf2ce4-a178-430d-a972-6cf402de0b81",
|
|
"value": "https://www.virustotal.com/file/8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb/analysis/1443639905/"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369497",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56bf2d19-73b4-49e4-a51e-6cf702de0b81",
|
|
"value": "075b6695ab63f36af65f7ffd45cccd39"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "- Xchecked via VT: 075b6695ab63f36af65f7ffd45cccd39",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369511",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56bf2d27-c7e0-4910-88b6-6cef02de0b81",
|
|
"value": "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "- Xchecked via VT: 075b6695ab63f36af65f7ffd45cccd39",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369511",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56bf2d27-fe94-44e9-a0c3-6cef02de0b81",
|
|
"value": "f080e509c988a9578862665b4fcf1e4bf8d77c3e"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369511",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "56bf2d27-0f34-45fc-bd0b-6cef02de0b81",
|
|
"value": "https://www.virustotal.com/file/02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592/analysis/1450364865/"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369532",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "56bf2d3c-b274-4ab9-853c-6cf202de0b81",
|
|
"value": "e107c5c84ded6cd9391aede7f04d64c8"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "- Xchecked via VT: e107c5c84ded6cd9391aede7f04d64c8",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369540",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "56bf2d44-6d80-4ae4-9592-fd7f02de0b81",
|
|
"value": "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "- Xchecked via VT: e107c5c84ded6cd9391aede7f04d64c8",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369540",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "56bf2d44-0ec0-4236-b4d5-fd7f02de0b81",
|
|
"value": "ecdda7aca5c805e5be6e0ab2017592439de7e32c"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369540",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "56bf2d44-404c-41ec-adca-fd7f02de0b81",
|
|
"value": "https://www.virustotal.com/file/fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61/analysis/1450713631/"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369592",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "56bf2d78-5fa8-4c1f-8c0c-4c1702de0b81",
|
|
"value": "azureon-line.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369592",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "56bf2d78-a108-4636-8e8e-4eb202de0b81",
|
|
"value": "198.105.125.74"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369592",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "56bf2d78-23c4-41cb-b90c-499702de0b81",
|
|
"value": "mozilla-plugins.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "C&C",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369593",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "56bf2d79-8720-4d1d-890f-452302de0b81",
|
|
"value": "mozillaplagins.com"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369626",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "56bf2d9a-2e64-40b2-a50c-d9bb02de0b81",
|
|
"value": "~/.config/ksysdef/ksysdefd"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1455369627",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "56bf2d9b-b7e8-4dad-9ae0-d9bb02de0b81",
|
|
"value": "~/.config/dbus-notifier/dbus-inotifier"
|
|
}
|
|
]
|
|
}
|
|
} |