Rewterz Threat Alert – Banks in West Africa Hit with Off-TheShelf Malware, Free Tools

Monday, January 21, 2019







Attacks hitting financial organizations in West Africa since at least mid-2017 rely on off-the-shelf malware, free hacking tools, and utilities already available on the target systems to steal credentials, install backdoors, and run commands.
Actively four campaigns are observed which are used to lure victims into the trap.



  • NanoCore trojan and PsExec
  • Cobalt Strike, PowerShell scripts, and free tools
  • Mimikatz and Custom RDP



NanoCore trojan and PsExec



In one of the attacks, the threat actor used NanoCore trojan along with PsExec, a legitimate network administration tool, and delivered the malware via phishing emails. To lure the victim into installing the malware, the attacker used documents referring to a West African bank. The targets were in Ivory Coast and Equatorial Guinea.



Cobalt Strike, PowerShell scripts, and free tools


It combined malicious PowerShell scripts with Mimikatz, a hacking tool designed to steal credentials, and UltraVNC opensource software for remote administration. The attackers also used a dynamic DNS service to hide their location by assigning a custom domain name to the IP address of the C2 server.


Mimikatz and custom RDP


Mimikatz can be used to harvest credentials and RDP allows for remote connections to computers, it’s likely the attackers wanted additional remote access capability and were interested in moving laterally across the victim’s network.






  • Remote Access
  • Code Execution
  • System compromise







  • nemesis225[.]ddns[.]net
  • moneygram[.]servehttp[.]com
  • noreply377[.]ddns[.]net



Malware Hash (MD5/SHA1/SH256)



  • 24015acd155ec7305805dbdff1dd074d
  • 4d49e578d359185324acda70a2880dd5
  • 64b88486170e5cb890a7486965a90e84
  • a8372b48280c6ee5b225f8ccd3cf4814
  • 8dd3e20fe9770843bc2c9b2523a7cfb2
  • 470cdc0ea9caed534b14bd5e195d19e8
  • 605e99ea7dc4e73ae2af59cfb03360ec
  • e8828b155567e587fbeca9069289e0d9
  • 80a2576c3148ba5123aa016bf01e72bba53995b172dd263ab2071fad1c9d548d
  • 21c87bcccf7e5c164da7c94772ef71a065a862f9ce32341a38eb39ffb7804305
  • dab1953b9135a9bf0c5ffe86b87ab9a9c6fa34482004aa8bb2bf7ea8d72c8c62
  • 53f8afe36e562c92140f4f8fa1f8ffce9e1f48b1eaff96bd6ab4b03646b97dc3
  • 8fe18a768769342be49ac33d2ba0653ba7f105a503075231719c376b6ded8846
  • 5f456a55f18bf183a7c988617787a041b90e8ecbeed8a01c583597b3fd19b42e
  • ce58546eebd3c8e218b1db19c9c7b5ffe086ee814aab0e891061f8cba954b14d
  • 3b7cc16fa5c5a78f0d1816d09a71b835f589de842b20e8c96c7084b9b0a89ff3
  • 97034d8a97b967b2f18a867b411552f7
  • 332a5371389a8953a96bf09b69edcb6e
  • 8184f24a4f4ff4438dba050b2e3d1af7
  • 6bfc1ec16f3bd497613f57a278188ff7529e94eb48dcabf81587f7c275b3e86d
  • e46ba4bdd4168a399ee5bc2161a8c918095fa30eb20ac88cac6ab1d6dbea2b4a
  • c1993735265f4274b81a6edf789e0245f2f7f5ee78f4172101728a324cdd3d2d
  • 49ae7d13f43bb04ed31d593787d4e17e
  • 75e5594c6882704ea2889e3fd758cbbf
  • 06fe2b7ff6af10cd0ec8395490567f8a0f66d8e083a72f57f18e9ad74dfff727
  • 6eb3281f5a80223a5b58af20d415453a9013a487c89d89cd7658bb7451902548





Consider blocking the IoCs at their respective controls.

Data Sheets

Corporate Brochure

Our Story



Managed Security

Upcoming Rewterz Trainings/Events

Rewterz News

  • 14, June 2019 Rewterz Threat Alert – Advanced Attack Tools Target Non-patched Systems to Distribute Cryptocurrency Miners
  • 14, June 2019 Rewterz Threat Advisory – HP Service Manager Multiple Security Bypass Vulnerabilities
  • 14, June 2019 Rewterz Threat Advisory – CVE-2019-1029 – Microsoft Lync Server 2010 / 2013 Denial of Service Vulnerability
  • 14, June 2019 Rewterz Threat Alert – “Love You” Malspam Phishing Campaign Reemerged

Copyright © Rewterz. All rights reserved.