Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
A recent Total Oil themed campaign being used to distribute the AgentTesla malware. The campaign begins with a phishing email masquerading as an order request from a Liberian oil company employee. Under this guise, the attacker attempts to convince a user to open a Word document and enable macro execution. If successful, an obfuscated VBA macro fulfils its purpose of decoding and executing a PowerShell script. The PowerShell script is responsible for de-obfuscating a C# source code snippet that is subsequently compiled and loaded within that PowerShell process. Once loaded, one of the methods within the C# code is invoked, specifically the one responsible for downloading and executing a malicious payload from a remote URL. This payload was identified to be a .NET loader. Prior to loading the malware, the loader performs a series of anti-sandbox and anti-debugging techniques to exit the program if any related conditions are met. If all checks pass, an executable embedded in the loader is run in a new thread. Analysis revealed that the loaded file is an Agent Tesla keylogger that has significant code overlap with the Hawkeye malware. After establishing persistence via a Registry Run key, the malware performs its ultimate goal of retrieving credentials stored within various applications, such as web browsers, FTP clients, and file downloaders. The malware is capable of using the .NET API to set up a mail client that is used for exfiltrating the harvested credentials to the attacker via SMTP.
URLs
http[:]//www[.]handrush[.]com/wp-content/plugins/akismet/views/DurGhamPop[.]exe
Malware Hash (MD5/SHA1/SH256)