

Rewterz Threat Alert – Mahalo FIN7 – IOC’s
October 11, 2019
Rewterz Threat Advisory – CVE-2019-8790 – Swift for Ubuntu Information disclosure vulnerability
October 14, 2019
Rewterz Threat Alert – Mahalo FIN7 – IOC’s
October 11, 2019
Rewterz Threat Advisory – CVE-2019-8790 – Swift for Ubuntu Information disclosure vulnerability
October 14, 2019Severity
High
Analysis Summary
New samples of the Adwind RAT have been found that use multi-layer obfuscation. The campaign they are used in has the US petroleum industry as its target, a Netskope research article indicates. Once a system is infected, Adwind gains persistence through the registry. To remain hidden, it injects itself into other processes on the system. Computer security services, such as firewalls and anti-virus applications, are terminated. Sensitive data found on the system is gathered and sent back home. The payload was found on an Australian ISP called Westnet in some of the users’ home directories. Netskope was not certain if the Westnet users’ accounts had been compromised or if the attacker was a Westnet user. Multiple JAR extractions take place when the victim executes the payload. Since the malware is Java-based, it is also cross-platform, i.e., it can function on Windows, Linux, and Mac platforms.
Impact
Exposure of sensitive information
Indicators of Compromise
IP
185[.]205[.]210[.]48
Hashes : MD5
- 0b7b52302c8c5df59d960dd97e3abdaf
- 3bdfd33017806b85949b6faa7d4b98e4
- 781fb531354d6f291f1ccab48da6d39f
- a32c109297ed1ca155598cd295c26611
- a9175094b275a0aaed30604f7dceeb14
URL
- http[:]//members[.]westnet[.]com[.]au/~howrahnursery_nbn/
- http[:]//members[.]westnet[.]com[.]au/~jbush/
- http[:]//members[.]westnet[.]com[.]au/~joeven/
- http[:]//members[.]westnet[.]com[.]au/~lionsnortham/
- http[:]//members[.]westnet[.]com[.]au/~mcleodart/
- http[:]//members[.]westnet[.]com[.]au/~philchief/
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.