Rewterz Threat Alert – Banks in West Africa Hit with Off-TheShelf Malware, Free Tools

Monday, January 21, 2019

SEVERITY: Medium

 

 

ANALYSIS SUMMARY

 

 

Attacks hitting financial organizations in West Africa since at least mid-2017 rely on off-the-shelf malware, free hacking tools, and utilities already available on the target systems to steal credentials, install backdoors, and run commands.
Actively four campaigns are observed which are used to lure victims into the trap.

 

 

  • NanoCore trojan and PsExec
  • Cobalt Strike, PowerShell scripts, and free tools
  • Mimikatz and Custom RDP

 

 

NanoCore trojan and PsExec

 

 

In one of the attacks, the threat actor used NanoCore trojan along with PsExec, a legitimate network administration tool, and delivered the malware via phishing emails. To lure the victim into installing the malware, the attacker used documents referring to a West African bank. The targets were in Ivory Coast and Equatorial Guinea.

 

 

Cobalt Strike, PowerShell scripts, and free tools

 

It combined malicious PowerShell scripts with Mimikatz, a hacking tool designed to steal credentials, and UltraVNC opensource software for remote administration. The attackers also used a dynamic DNS service to hide their location by assigning a custom domain name to the IP address of the C2 server.

 

Mimikatz and custom RDP

 

Mimikatz can be used to harvest credentials and RDP allows for remote connections to computers, it’s likely the attackers wanted additional remote access capability and were interested in moving laterally across the victim’s network.

 

 

IMPACT

 

 

  • Remote Access
  • Code Execution
  • System compromise

 

 

INDICATORS OF COMPROMISE

 

URLs

 

  • nemesis225[.]ddns[.]net
  • moneygram[.]servehttp[.]com
  • noreply377[.]ddns[.]net

 

 

Malware Hash (MD5/SHA1/SH256)

 

 

  • 24015acd155ec7305805dbdff1dd074d
  • 4d49e578d359185324acda70a2880dd5
  • 64b88486170e5cb890a7486965a90e84
  • a8372b48280c6ee5b225f8ccd3cf4814
  • 8dd3e20fe9770843bc2c9b2523a7cfb2
  • 470cdc0ea9caed534b14bd5e195d19e8
  • 605e99ea7dc4e73ae2af59cfb03360ec
  • e8828b155567e587fbeca9069289e0d9
  • 80a2576c3148ba5123aa016bf01e72bba53995b172dd263ab2071fad1c9d548d
  • 21c87bcccf7e5c164da7c94772ef71a065a862f9ce32341a38eb39ffb7804305
  • dab1953b9135a9bf0c5ffe86b87ab9a9c6fa34482004aa8bb2bf7ea8d72c8c62
  • 53f8afe36e562c92140f4f8fa1f8ffce9e1f48b1eaff96bd6ab4b03646b97dc3
  • 8fe18a768769342be49ac33d2ba0653ba7f105a503075231719c376b6ded8846
  • 5f456a55f18bf183a7c988617787a041b90e8ecbeed8a01c583597b3fd19b42e
  • ce58546eebd3c8e218b1db19c9c7b5ffe086ee814aab0e891061f8cba954b14d
  • 3b7cc16fa5c5a78f0d1816d09a71b835f589de842b20e8c96c7084b9b0a89ff3
  • 97034d8a97b967b2f18a867b411552f7
  • 332a5371389a8953a96bf09b69edcb6e
  • 8184f24a4f4ff4438dba050b2e3d1af7
  • 6bfc1ec16f3bd497613f57a278188ff7529e94eb48dcabf81587f7c275b3e86d
  • e46ba4bdd4168a399ee5bc2161a8c918095fa30eb20ac88cac6ab1d6dbea2b4a
  • c1993735265f4274b81a6edf789e0245f2f7f5ee78f4172101728a324cdd3d2d
  • 49ae7d13f43bb04ed31d593787d4e17e
  • 75e5594c6882704ea2889e3fd758cbbf
  • 06fe2b7ff6af10cd0ec8395490567f8a0f66d8e083a72f57f18e9ad74dfff727
  • 6eb3281f5a80223a5b58af20d415453a9013a487c89d89cd7658bb7451902548

 

REMEDIATION

 

 

Consider blocking the IoCs at their respective controls.

Data Sheets

Corporate Brochure


Our Story


Services


Solutions


Managed Security


Upcoming Rewterz Trainings/Events

Rewterz News

  • 14, June 2019 Rewterz Threat Alert – Advanced Attack Tools Target Non-patched Systems to Distribute Cryptocurrency Miners
  • 14, June 2019 Rewterz Threat Advisory – HP Service Manager Multiple Security Bypass Vulnerabilities
  • 14, June 2019 Rewterz Threat Advisory – CVE-2019-1029 – Microsoft Lync Server 2010 / 2013 Denial of Service Vulnerability
  • 14, June 2019 Rewterz Threat Alert – “Love You” Malspam Phishing Campaign Reemerged

Copyright © Rewterz. All rights reserved.