Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
A malware family they have named Amavaldo, and focus on two campaigns they observed which targeted Mexico and Brazil. ESET have identified a number of characteristics typical of Latin American banking Trojans which includes, that they are written in Delphi, contain backdoor functionality, use long distribution chains, functionality may involve multiple components, abuse legitimate tools and software, make persistent connections to C&C servers, use little-known cryptographic algorithms, and target Spanish or Portuguese speaking countries. Latin American banking Trojans tend to use social engineering techniques rather than web-injection to steal money from victims. Infected systems are monitored for certain activity which presents an opportunity for the attackers to launch their social engineering attacks. In the past, Amavaldo had been used to target Brazilian users, but in April 2019, began to be used in attacks against Mexican users. The Amavaldo family is modular malware and the final payload ZIP file consists of three components, an executable file which is a copy of a legitimate application, an injector DLL and an encrypted banking Trojan. Amavaldo collects certain information from the victim system, newer versions communicate with the C&C server using the Delphi SecureBridge library. The beginning of the infection chain is an MSI installer, in the case of the campaign targeting Mexico, ESET believe spam emails may have been the distribution vector.
Malware Hash (MD5/SHA1/SH256)