Rewterz Threat Alert – An Emerging Ducktail Infostealer – Active IOCs

Severity

High

Analysis Summary

Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a spear-phishing email that contains a malicious attachment or a link to a malicious website. Once the malware infects a system, it establishes a persistent presence and begins to gather information about the system and the network it is connected to.

The malware is capable of stealing a wide range of sensitive data, including passwords, emails, documents, and other confidential information. It can also execute commands and download additional malware to the compromised system.

In October, 2022, the threat actor behind Ducktail expanded its scope by targeting users with any level of access to Facebook Business accounts using a new version of the malware written in PHP. This highlights the importance of being cautious when downloading software or applications from third-party websites, even if they appear to be legitimate.

The new version of Ducktail appears to be distributed through the use of fake installers for Microsoft Office, games, and other software, which are hosted on legitimate file hosting websites such as MediaFire. Once the user downloads and runs the fake installer, the malware is installed on their system, and the attacker gains access to their Facebook Business account.

Ducktail is a highly sophisticated and stealthy malware, making it difficult to detect and remove. It is important for organizations to implement robust security measures, such as antivirus software and firewalls, to protect against this type of threat. It is also important for users to be vigilant and cautious when opening email attachments or clicking on links from unknown sources.

Impact

• Sensitive Information Theft
• Credential Theft

Indicators of Compromise

MD5

• 1936c71a7736087673d53a05b7044d71
• c437ce6183a5e958255374819faf5807
• 51666431f309d0d52058cd8aace15c96
• 515c327e96ccccf59570f21fa0098596
• 5017e49ecf9229143c5b541d98296d84

SHA-256

• dbc89d5a0aeccd94458d7ade1f40af832829cf6054fb04aef519854432de7fdc
• 2a3e8f903bc68716e5bde38e8862cced2e875e3b6c9ba098bdd6ceb22a12bb66
• c19d6e7af08d0461da00f0ca2b28276eb5a1f2c922c2794abe73f5e5ac37754f
• 3ab2760f3f0bf7442fc3b7c4a1552332ab0cbb33917202d1cb8d1e27ec1828a6
• 8f21130552318acf172b0f9367fcd51257ee9845c07cfd6582ccfcd4b7b383b4

SHA-1

• 6cf6e0208450f31fc5e2e8337fa7a1472ead2b97
• 5b3c87d0e7e3da5db0379fffc9f4914d0a9f2b24
• 4bae5855c598e8726f3a939f2269f12b96b4698b
• 325339586d334d9b4e1d56d92a08dc47e1274917
• 6b07d51fe936dc74e61c44b99f214e6bb1142dce

Remediation

• Block all threat indicators at your respective controls. Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Enable two-factor authentication (2FA) on your accounts adds an extra layer of security and can help prevent unauthorized access even if your login credentials have been stolen.
• Regularly backing up your important data can help ensure that you don’t lose any critical information in the event of a malware infection or other data loss event.
• Be wary of emails, attachments, and links from unknown sources. Also, avoid downloading software from untrusted sources or clicking on suspicious ads or pop-ups.
• Make sure all of your software, including your operating system and applications, are up-to-date with the latest security patches. This can help prevent vulnerabilities that could be exploited by Aurora Stealer and other types of malware.