Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls

Wednesday, March 6, 2019

Severity

Medium

Analysis Summary


Advanced techniques, tools and procedures (TTPs) have been observed being used by a new threat actor in order to bypass cyber controls used by many corporations. This threat actor is targeting financial organizations like banks with more sophisticated tools, complex obfuscation and customization. The attack begins with a phishing email containing a malicious link that downloads a word document. Examples of URLs created by the threat actor include hxxps://socgen-cert[.]com/documents/REQ-193.doc and hxxps://ing[]cert[.]com/documents/PO-2815.doc. The documents were also seen on amf-fr[.]org, alerts-swift[.]com, and socgencompliance[.]com.

Initial Access: Spear Phishing Link

Execution: Scripting, PowerShell, User Execution, Regsvr32

Persistence: Registry Run Keys / Startup Folder (in older versions)

Defense Evasion: Masquerading, Regsvr32, Download New Code at Runtime

Command and Control: Remote Access Tools, Uncommonly Used Port

Impact


Security Bypass

Complex Cyber-attack


Indicators of Compromise


IP(s) / Hostname(s)

  • 51.38.150[.]171
  • 80.82.64[.]126
  • 82.221.128[.]183
  • 185.10.68[.]29
  • 185.10.68[.]189
  • 185.10.68[.]20
  • 185.117.73[.]234
  • 191.101.172[.]26
  • 198.50.239[.]63

URLs

  • nlscdn[.]com
  • ing-cert[.]com
  • riscomponents[.]pw
  • socgen-cert[.]com
  • amf-fr[.]org
  • alerts-swift[.]com
  • finanstilsy[.]net4


Malware Hash (MD5/SHA1/SH256)

  • 9111e08fd904e25defd6ba0a98142410
  • 39cbce484f3769eb23ea8dab0077d38c
  • 1d9aa66eebb174742433d88347c88243
  • e04c69af05c40d5e8a8ab4941d4aad24
  • efbcffc10763a287bdedfb6e892ae20c
  • 0d42a54f427c044c59b0777b9ddf3eb3
  • 8ec83dba30c4f4d014899fbcc9a78171
  • 487982bc6f4a82556f0ab3c219f55ae0
  • a7e5ee61098748ffb9c42e65cdad6505
  • f65811df2f65507099c7147da07c05d0
  • 981f0fbaed1b125cc3fb9fa5a4418969
  • db1b9ebe9d782874e6aa4bc7509626b4
  • 073ede09792ec2995d403b8076516e06
  • 2a7d037d059f348f5fd0545396cb728f
  • 3d91a135ebb28a25dc525fd6a407693a
  • 65efb4aabcb3ad60b44d50a54841ea4b
  • 9a39f0099f884c96130f4f5a402a82af
  • 6abb9951a1daa868116becc72812ea8b
  • 87f36cfeb984559d10232d6160b9eb30
  • 09e2a5b102f82c3cd0e1b7cc23152432
  • 835e69a43117eab940f8d9505642bd7c
  • cf3a6d21b2b8e728f63ec3f822575c28
  • b43d81328845e8aeba2ca40eb6979ece
  • 66c8986971d3e8662e2351fe937c2191
  • 9e6810fcf7bba8f51ee7010b4d4751a3
  • efbcffc10763a287bdedfb6e892ae20c
  • 50dc84e07a7923f0e415d0cfe26bfaad
  • a7e5ee61098748ffb9c42e65cdad6505
  • 8cf07b203063067472743c1b8cca6631
  • 413aa1e29e3f0564feb48ea482dc717adb75a40f2abbf2471566a05935f45b01
  • bee422ce01607b48c6d2c322caadf9fe050b9a916d751fc9facd9fa3edf46d14
  • d57f128afb4843b6f0072fadda8dd14046b31703098e365bc5a226e117090d44
  • 2f5a668c0c8366dfbf337c8390b0cd2a976ecbe1b47bdfb221c22703432d45db
  • a1093d68e9f9f511ecf1cc38c457dda00318bb97633b36b8383d45b66f41eeec
  • 511db1ca13761147e26229795cab3ddd1f0a0c00a677da93628183ff5d2e2639
  • 9a72b7af8c9a00542c83959cfee61e7be9a831717dc1ff27227bea63e36da004
  • e2bec3d92896f0007a1811310c96eb7333a66142558057c482b5fb2196ff22e1
  • 59a24d9ac0ed2f2bea3883d7b943ab1229acfe3f9f350f2dee6deb14c559920b
  • 08a1a6ecdccc13695968545b2888a91eb0f05ef60e1bde9e86c4a9b386395af7
  • 515449cdae6f9b997a3a73c1e0244808d4dc5aef77e74bfc3006f099a27cfe1d
  • c32856605c7bc754b5649e90863f58e25f094dceeac5546bc27220e9313ae1c5
  • 822f38009000278b26c916f52bfbeec93a894464cb8645353faf1f3aad2b5327
  • eb4eea0dfb1a0b1bd7e2d3e6e932f2f86877d046b330bde6efc6169f5b3a0981
  • a87d22f102a186710dce923c729f960e3f8b5147161965716ef95ce0d857bfc9
  • 728bbbea8797c5e00a8737ebf6bebfffb3d84f9c86f144963a2940025329c28b
  • f4d208c6df8571f7992a500d3787b4685907914e6445159e57921e77f8285208
  • 471545026007c352f60c75355221cd13784ed3499dbd9eeb221fe7824ade0842
  • 546aea2f9b7351c4efdec0dc197f057144af12f7e3617aa0d79353b1160508d1
  • 87eac683f348971d3afc6daa13669d4830e7497d6a6edb61a34ab1b2b93ae0f7
  • 25ae00c80a4ec85cb548c891598cf76d131b168a70116a84cb62b4defa3f698c
  • 7065f6be16923215d3e7cbd5d769a7ca3721279c16085339a449959b6fb18ab3
  • ad18110f61e18af03902b0b14a0dddcd312e627bcd278e12a245e2f4831db829
  • df9447faeb4c1f8b463d81515448767848a1c1d05d32fd745b7b8cd2ce3766c8
  • b9f987ef7a0c57a851c20832dbf58883e64ec6e513718b506e20ca2f71c241c8
  • e2566eb542898662f5a8a5717d7990e988ebaedb2445fe4f3bf0dab166e13e5c
  • db526cb59caa89c533032cee02b738be48699517a673e8870efa44ef2b8c1eb3
  • b991288ecd158e84076f7cc38d4ecbcd18cccc580f1971b0dfdd7c88b78e0794


Remediation

  • Block the threat indicators at their respective controls.
  • Ensure strict measures against phishing emails.

Data Sheets

Corporate Brochure


Our Story


Services


Solutions


Managed Security


Upcoming Rewterz Trainings/Events

Rewterz News

  • 2, May 2019 Rewterz Threat Advisory – CVE-2019-2725 – WebLogic Server Vulnerability
  • 11, April 2019 Rewterz threat Advisory – Microsoft Internet Explorer Multiple Vulnerabilities
  • 11, April 2019 Rewterz Threat Advisory – Microsoft SharePoint Multiple Products Multiple Script Insertion Vulnerabilities
  • 11, April 2019 Rewterz Threat Advisory – Microsoft Exchange Server OWA Multiple Spoofing Vulnerabilities

Copyright © Rewterz. All rights reserved.