Rewterz Threat Alert – Active Exploitation of Firefox 0-Day Targets Cryptocurrency

Severity

High

Analysis Summary

An attack is detected utilizing a recent Firefox zero-day and malware payloads in order to gain access to victim’s computers, networks, and sensitive information. Mozilla released an emergency Firefox update to fix a critical remote execution vulnerability that was actively used in targeted attacks in the wild. This bug was given a CVE ID of CVE-2019-11707 while the vulnerability could be exploited for remote code execution, it would need to be chained with a sandbox escape vulnerability CVE-2019-11708 in order to affect the host operating system.

Cryptocurrency firms were the target of attacks utilizing this exploit. Their goal was most likely to gain access to corporate information, stored cryptocurrency funds, or their networks. The phishing email that allegedly initiated these attacks claimed to be an “Adam Prize Organizer” named Neil Morris who was requesting assistance from the target. This email contained a now defunct url of http://people.ds.cam.ac.uk/nm603/awards/Adams_Prize. When a user visited this URL with Firefox, the exploit would drop a malicious payload on the computer. This trojan is a Remote Access Trojan, or RAT, that would allow an attacker to gain full access to the infected computer. In addition to RAT capabilities, Netwire is designed to steal information from browsers and other applications.

Impact

• Unauthorized Access
• Information Theft
• Remote Code Execution
• System Takeover
• Financial loss

Indicators of Compromise

Domain Name

• athlon4free2updates1[.]com
• analyticsfit[.]com

MD5

• de3a8b1e149312dac5b8584a33c3f3c6
• af10aad603fe227ca27077b83b26543b
• 5030422b3428c0f938e3ad03720ca9e8
• 8b2b7537c792ecf24d8ee7b9fbb942f8
• 70286abc22eca9a9cbea24e551c891cd
• b6f92b20816f23c147445bd5eec86a06
• fc99b1407655674573ee4167f1e3dcbd

SHA-256

• 07a4e04ee8b4c8dc0f7507f56dc24db00537d4637afee43dbb9357d4d54f6ff4
• 97200b2b005e60a1c6077eea56fc4bb3e08196f14ed692b9422c96686fbfc3ad
• af77d91269c731b4624594826b18f8c9b3df08ac80aeae5968db55b33bd3d9f4
• 26a0ca13e857b8f6260ceea4373cbfde1526f8d7df9cf27926959df1f63dadf5
• 3addeebf734e6f11e755bf31b559081d9a6020358952136c330c7004e10725b6
• a033fb94947caf6c22523af2d660b89d0c0fe6ee0ee200853312f192d29ed964
• 46106474c1e05747a77866e6e6166b31d37e1524e3f3e7d2abca5f3c07454505

Source IP

• 185.49.69[.]210
• 89.34.111[.]113

URL

• http[:]//185.162.131[.]96/i/kr http[:]//185.162.131[.]96/i/pm
• http[:]//185.162.131[.]96/i/195/195
• http[:]//185.162.131[.]96/i/IconServicesAgent
• http[:]//185.162.131[.]96/i/thk http[:]//185.162.131[.]96/i/kri
• http[:]//185.162.131[.]96 http[:]//185.162.131[.]96/i/pmi

Remediation

• Block the threat indicators at their respective controls.
• Immediately update Firefox to a fixed version that patches the zero-day.
• http://www.rewterz.com/rewterz-news/rewterz-threat-advisory-cve-2019-11707-mozilla-firefox-vulnerability-exploited-in-the-wild