Rewterz Threat Alert – An Emerging Fsysna Trojan – Active IOCs

Severity

Medium

Analysis Summary

Fsysna Trojan is a type of malware that can infect Windows-based computers. It is typically propagates through the use of the Mimikatz tool, which is an open-source utility that is commonly used by attackers to harvest credentials and other sensitive information from a compromised system. The use of Mimikatz allows the malware to escalate its privileges and spread to other machines on the network, even if the initial infected machine does not have administrator privileges.

In addition, the Fsysna Trojan uses the Windows temp folder for its operations, which allows it to evade detection by antivirus software and other security measures that are designed to monitor specific directories or processes. It also uses the Netsh tool to open ports and establish a connection to the command and control server, which is used to receive instructions for its Monero mining operations.

To protect against the Fsysna Trojan and other forms of malware, it is important to use up-to-date antivirus software and to be cautious when downloading and installing software or clicking on links from unknown sources. Employing network segmentation and monitoring can also help to limit the spread of the malware and detect any suspicious activity on the network. Additionally, educating users about safe browsing practices and the dangers of phishing attacks can help to prevent initial infection.

Impact

• Unauthorized Access 
• Information Theft

Indicators of Compromise

Domain Name

ziaurus111.duckdns.org

MD5

• 5cda5cfc81215cf52ea8de1013519b36

SHA-256

• 3d7e427d40e910fd255e0527941e56bfc08fcfbd9bb0cd98e45932fe04332430

SHA-1

• 107329f4b67d99df689fa5c54922ba31cced098b

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Enforced Access Management Policies.