March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – CVE-2019-15083 – Zoho ManageEngine ServiceDesk Plus Vulnerability
May 19, 2020
Rewterz Threat Alert – EasyJet Airlines 9 million travel records taken in data breach
May 19, 2020
Rewterz Threat Advisory – CVE-2019-15083 – Zoho ManageEngine ServiceDesk Plus Vulnerability
May 19, 2020
Rewterz Threat Alert – EasyJet Airlines 9 million travel records taken in data breach
May 19, 2020
Severity
Medium
Analysis Summary
Researchers observed a COVID-19 themed spear-phishing email targeted towards co-operative banks in India. Appearing to come from a large Indian bank and aimed towards smaller co-operative banks, the body of the email claims that the attached file contains information regarding measures related to COVID-19. The attachment is a ZIP archive masquerading as a spreadsheet or PDF. Inside the archive is a JAR file that similarly attempts to hide as a spreadsheet or PDF. This JAR file acts as a first-stage, dropping and executing the second-stage JAR. It also establishes persistence via a Registry Run key. The second-stage payload is the Adwind jRAT and provides the main malicious functionality. It communicates with its C2 server on a non-standard port. Once connected to its C2, it can receive a variety of commands that provide extensive remote access capabilities. Specifically, it can download and execute additional payloads, capture screenshots, provide remote desktop access, perform file operations, and more.
Impact
- Information theft
- Financial loss
Indicators of Compromise
MD5
- D7409C0389E68B76396F9C33E48AB72B
- 09477F63366CF4B4A4599772012C9121
- 8C5FFB7584370811AF61F81538816613
- 01AB7192109411D0DEDFE265005CCDD9
- 0CEACC58852ED15A5F55C435DB585B7D
SHA-256
- 0ad602eeba1970ed5230bb59ad1e197c3bd3d28bb57a62dd418dd2c7ddeddb9f
- c50b9aaadf69c7ce1112d8d9b00ed9dacb15a2873ab17161e42a9f5d96658e54
SHA1
- e0d2f14f4c2b19d7fd994279ba329cadd20f6d0f
- cb347f131b133b187808ff72cab80a5be420f552
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.
- Search for IOCs in the existing environment.