Rewterz Threat Alert – Active Exploitation of Firefox 0-Day Targets Cryptocurrency

Tuesday, November 19, 2019



Analysis Summary

An attack is detected utilizing a recent Firefox zero-day and malware payloads in order to gain access to victim’s computers, networks, and sensitive information. Mozilla released an emergency Firefox update to fix a critical remote execution vulnerability that was actively used in targeted attacks in the wild. This bug was given a CVE ID of CVE-2019-11707 while the vulnerability could be exploited for remote code execution, it would need to be chained with a sandbox escape vulnerability CVE-2019-11708 in order to affect the host operating system.

Cryptocurrency firms were the target of attacks utilizing this exploit. Their goal was most likely to gain access to corporate information, stored cryptocurrency funds, or their networks. The phishing email that allegedly initiated these attacks claimed to be an “Adam Prize Organizer” named Neil Morris who was requesting assistance from the target. This email contained a now defunct url of When a user visited this URL with Firefox, the exploit would drop a malicious payload on the computer. This trojan is a Remote Access Trojan, or RAT, that would allow an attacker to gain full access to the infected computer. In addition to RAT capabilities, Netwire is designed to steal information from browsers and other applications.


  • Unauthorized Access
  • Information Theft
  • Remote Code Execution
  • System Takeover
  • Financial loss

Indicators of Compromise

Domain Name

  • athlon4free2updates1[.]com
  • analyticsfit[.]com


  • de3a8b1e149312dac5b8584a33c3f3c6
  • af10aad603fe227ca27077b83b26543b
  • 5030422b3428c0f938e3ad03720ca9e8
  • 8b2b7537c792ecf24d8ee7b9fbb942f8
  • 70286abc22eca9a9cbea24e551c891cd
  • b6f92b20816f23c147445bd5eec86a06
  • fc99b1407655674573ee4167f1e3dcbd


  • 07a4e04ee8b4c8dc0f7507f56dc24db00537d4637afee43dbb9357d4d54f6ff4
  • 97200b2b005e60a1c6077eea56fc4bb3e08196f14ed692b9422c96686fbfc3ad
  • af77d91269c731b4624594826b18f8c9b3df08ac80aeae5968db55b33bd3d9f4
  • 26a0ca13e857b8f6260ceea4373cbfde1526f8d7df9cf27926959df1f63dadf5
  • 3addeebf734e6f11e755bf31b559081d9a6020358952136c330c7004e10725b6
  • a033fb94947caf6c22523af2d660b89d0c0fe6ee0ee200853312f192d29ed964
  • 46106474c1e05747a77866e6e6166b31d37e1524e3f3e7d2abca5f3c07454505

Source IP

  • 185.49.69[.]210
  • 89.34.111[.]113


  • http[:]//185.162.131[.]96/i/kr http[:]//185.162.131[.]96/i/pm
  • http[:]//185.162.131[.]96/i/195/195
  • http[:]//185.162.131[.]96/i/IconServicesAgent
  • http[:]//185.162.131[.]96/i/thk http[:]//185.162.131[.]96/i/kri
  • http[:]//185.162.131[.]96 http[:]//185.162.131[.]96/i/pmi


  • Block the threat indicators at their respective controls.
  • Immediately update Firefox to a fixed version that patches the zero-day.

Data Sheets

Corporate Brochure

Our Story



Managed Security

Upcoming Rewterz Trainings/Events

Rewterz News

  • 6, December 2019 Rewterz Threat Advisory – CVE-2019-14899 – New Linux Vulnerability Inferring and hijacking VPN-tunneled TCP connections
  • 6, December 2019 Rewterz Threat Advisory – CVE-2019-18232 – ICS: Thales DIS SafeNet Sentinel LDK License Manager Runtime Privilege Escalation Vulnerability
  • 5, December 2019 Rewterz Threat Alert – “ZeroCleare” Targets Energy Sector in the Middle East
  • 5, December 2019 Rewterz Threat Alert – CStealer Trojan Targeting Chrome Passwords

Copyright © Rewterz. All rights reserved.