March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset
January 31, 2020
Rewterz Threat Alert – Revival of Crimson RAT – IoCs
February 3, 2020
Rewterz Threat Alert – New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset
January 31, 2020
Rewterz Threat Alert – Revival of Crimson RAT – IoCs
February 3, 2020
Severity
High
Analysis Summary
Evil Corp phishing campaign is using attachments featuring HTML redirectors for delivering malicious Excel documents. The final payload is being dropped using an Excel document that bundles a malicious macro. Evil Corp (also tracked as TA505 and SectorJ04) is a financially motivated cybercrime group known for focusing on attacks against retail companies and financial institutions via large-sized malicious spam campaigns driven by the Necurs botnet.This threat actor distributed remote access Trojans (RATs) and malware downloaders that delivered the Dridex and Trick banking Trojans as secondary payloads, as well as Locky, BitPaymer, Philadelphia, GlobeImposter, Jaff ransomware strains on their targets’ computer.
The new campaign uses HTML redirectors attached to emails. When opened, the HTML leads to the download Dudear, a malicious macro-laden Excel file that drops the payload.
The phishing messages come with HTML attachments which will automatically start downloading the Excel file used to drop the payload.The victims are instructed to open the Excel document on their computer as online previewing is not available and to enable editing to get access to its contents.Once executed on the victim’s computer, the malware will also attempt to drop an info-stealing Trojan tracked by Microsoft as GraceWire. Like most other info stealers, this will also start collecting sensitive information from the victim’s device and send it to its masters via a command-and-control server.
Impact
- Information Theft
- Additional malware infection
Indicators of Compromise
Domain Name
aka[.]ms
MD5
- e4f3f79678ddb3e304a256fa20154fbe
- 674f833c4c33f5cc9d156533c1b63e12
- 8b2bd6352e0ffe8b0e2bad20b49c8682
- 2ba8747d8ace2e2fb879bb272b8c650f
- e832505580d44c7ad1bee8a67c3ee280
- c4aaab31a70a34709e28baaebd209629
SHA-256
- d75c0e88f203dce04e7c90a32a17cee25e5d3acbb5add7c33d257b8600281f2b
- 6dee4408f563522f7fe5efb9891c409827643039bf7c8cd17c0d80bcc2997ece
- b81302bc5cbfeddf3b608a60b25f86944eddcef617e733cddf0fc93ee4ccc7ab
- bf86ccaf5e7f20124a259212a3a78dae12ec2594f48d5256a01323c772abc606
- 63c137ed882560ba03b7333a49b0714990c581f4e8a1b7579b339c74f465aa03
- 44ffbe69f8f189de7fa4f794686241ee4c814de90681bfff0a37e344ed12954e
URL
http[:]//aka[.]ms/MsftSecIntel
Remediation
- Block the threat indicators at their respective controls.
- Do not respond to untrusted emails.