April 24, 2024
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Amadey Botnet – Active IOCs
November 29, 2021Rewterz Threat Alert – Lazarus APT Group – Active IOCs
November 29, 2021Rewterz Threat Alert – Amadey Botnet – Active IOCs
November 29, 2021Rewterz Threat Alert – Lazarus APT Group – Active IOCs
November 29, 2021
Severity
Medium
Analysis Summary
A new AgentTesla campaign is seen targeting victims with malspam. AgentTesla is known for stealing data from different applications on victim machines, such as browsers, FTP clients, and file downloaders. Agent Tesla collects personal information from the victim’s machine, steals data from the victim’s clipboard, can log keystrokes, capture screenshots, and access the victim’s webcam. It can kill running analysis processes and AVsoftware. The spyware also performs basic actions to check whether it is running on a virtual machine or in debug mode, in an attempt to hide its capabilities and actions from researchers. All the data it obtains is sent in encrypted form via SMTP protocol.
Impact
- Information Theft
- Exposure of Sensitive Data
Indicators of Compromise
Email Subject
- RE[:] Payment Update // Bank Detail Confirmation – TOP URGENT!!!
Filename
- Payment Advice[.]ace
MD5
- 879788dfdbe88f588c0fa05a8b9464c1
- 3849c55bcfd1f8fe8ee318def3a9c8d0
SHA-256
- 803a59e264c89c85a62c2d20efb815efdaf3906ed151ec590b9d114f0a375166
- 5b778a8d903af27b143edac83b20186af6c5f2d8dc120ade47546daad4d99a5b
SHA-1
- 1d12cd8f2ef519b5737e38bfc3437d897bcaa819
- 72cec43a9cc014ee2e0f096c32e9b002bebc9177
Remediation
- Block the threat indicators at their respective controls.
- Search for IOCs in your environment.
- Do not download such files from the internet without confirming their legitimacy.