Rewterz Threat Advisory – ICS: Siemens SIMATIC CP 442-1 and CP 443-1 RNA Vulnerability
May 11, 2022Rewterz Threat Advisory – CVE-2022-29885 – Apache Tomcat Vulnerability
May 12, 2022Rewterz Threat Advisory – ICS: Siemens SIMATIC CP 442-1 and CP 443-1 RNA Vulnerability
May 11, 2022Rewterz Threat Advisory – CVE-2022-29885 – Apache Tomcat Vulnerability
May 12, 2022Severity
High
Analysis Summary
The Emergency Response Team of Ukraine has warned about phishing attacks that use the information-stealing malware Jester Stealer on compromised computers. The subject line of the bulk email campaign appears to be a “chemical attack”. These emails contain a link to a macro-laced Microsoft Excel file which leads to computers getting infected with Jester Stealer after opening. In this campaign, the attack operates by downloading and running an .EXE file obtained from compromised web resources, which needs prospective victims to allow macros after viewing the document.
Jester Stealer is an information stealer first analyzed by researchers when it surfaced on hacker forums back in July 2021. This malicious program is designed to steal a wide range of sensitive data from infected machines. Browsing data, account passwords, and financial and banking information theft are all the primary targets of this malware. It also collects information stored in browsers, such as account passwords, email messages, IM app chats, and cryptocurrency wallet information. This stolen information is then transferred to a remote server, where threat actors gather it to use in future attacks or sell it on dark web markets. The info-stealer has anti-analysis capabilities (anti-VM/debug/sandbox), but doesn’t implement any persistence method. Threat actors exfiltrate data through Telegram using statically configured proxy addresses.
Impact
- Data Exfiltration
- Credential Theft
- Information Theft
- Cryptocurrency Wallet Theft
Indicators of Compromise
Domain Name
- igshop[.]net
- dcshost[.]net
- marmaris[.]com[.]ua
- autodoka[.]com[.]ua
- lightnogu5owjjllyo4tj2sfos6fchnmcidlgo6c7e6fz2hgryhfhoyd[.]onion
- wasabiwallet[.]online
- ip-api[.]com
MD5
- d5c9fd40738ac33f59467811c1ceb30b
- d80f1d64e07909d29d7a2a1888931af9
- 4742c9d0a6b5b3b10ae7eb8f6b3e2fe6
- 70ef45cb31af0b6f37be051de4170839
SHA-256
- 5df051b418cd3d51cfcfe17685275e03b0efdf9a80ce237d2deccb3749576092
- f963ed8559ade984e81a95238c4875d4c0a6ff14a7695630429bf98d4235d596
- ef7ddd544267a8781c99f08146d455aa08beab867e0453b07f1131edcbef92b2
- a2234ee40097fa832eb3a533840e86de3933cf216fbf8445d2946cb7b61c887b
SHA-1
- ebe1ca8671686c6867ec7b443b9c5a8a749c45de
- e4559f4fe4db9c01fbc8d4432a3471c1390d1623
- f4708af7d5aaaeb949e22f0e8d5d9dbaaf819cf0
- 1539d0c2657b60a8f75d130faf4ae1468263d103
SHA-256
- https[:]//igshop[.]net/uploads/Map026[.]xlsb
- https[:]//igshop[.]net/uploads/Map023[.]xlsb
- https[:]//igshop[.]net/uploads/Map021[.]xlsb
- https[:]//igshop[.]net/uploads/Updater-Microsoft[.]exe
- https[:]//dcshost[.]net/mail/OfficeUpdaterNew[.]exe
- https[:]//marmaris[.]com[.]ua/misc/Updater-Microsoft[.]exe
- https[:]//autodoka[.]com[.]ua/extra/Updater-Microsoft[.]exe
- http[:]//lightnogu5owjjllyo4tj2sfos6fchnmcidlgo6c7e6fz2hgryhfhoyd[.]onion/stealer/1026977440
Remediation
- Block the threat indicators at their respective controls.
- Search for IOCs in your environment