Rewterz Threat Alert – GandCrab Malware Delivered via Malspam Campaign
January 17, 2020Rewterz Threat Alert – Cloud based python RAT targeting Middle Eastern countries
January 17, 2020Rewterz Threat Alert – GandCrab Malware Delivered via Malspam Campaign
January 17, 2020Rewterz Threat Alert – Cloud based python RAT targeting Middle Eastern countries
January 17, 2020Severity
High
Analysis Summary
A new APT organization that has been active since at least 2017 , mainly targeting cyber espionage activities in countries in South Asia . The attack method of this organization is similar to the SideWinder and Bitter organizations of Indian background , but there are essential differences in the details of the attack and the Trojans used. The organization is suspected to have an Indian background, and it mainly targets cyber espionage in government, military, diplomacy, intelligence, atomic energy and universities in South Asia, including Pakistan, Sri Lanka, Maldives and Bangladesh. In spear-phishing attacks, the organization made good use of information related to current political and military targets to produce phishing emails and bait documents, using SFX files disguised as PDF documents , and LNK files disguised as Trojan horse delivery vectors. CVE also used CVE in the early days -2017-11882 Vulnerability spread Trojan.
Impact
Exposure of sensitive information
Indicators of Compromise
From Email
dgpr[.]paknavy[.]gov[.]pk@email[.]com
Hostname
- mail[.]navy[.]mil[.]bd[.]mailupdatenavybdzimbra[.]gov-pk[.]org
- mfamail[.]foreign[.]gov[.]mv[.]mfamailzimbraupdation[.]gov-pk[.]org
- mail[.]paec[.]gov-pk[.]org
- pakcert[.]gov-pk[.]org
MD5
- 791253aded5df197d9db441a6fe2eb4e
- 6a271282fe97322d49e9692891332ad7
- ab88bef8a85aae29dbd6efc3137f227f
- 02e81e2ba998919f1716b881505f2a89
- 6a19e8a202dfdb11bf3aaf9e53f8776a
- 9c9ff19affff6d62e72e618f2b7284da
- 98cc17985510ee4c259447b7c4a2a684
- 3d6aab4e4e055b9c50837c6adc97e060
SHA-256
- 83bac454581249fb89706b61b1b115f0505f76f026870a7ea5507f2e7f9f738c
- 75592b43b8ebf15d880530318dcdecc4901a697015d06ed99e0fff3ce5a90b99
- cfc7070be01d037575248199cc013c0e360aa4fbb33be4e751d6cbf654a062bc
- f8983bc0ed39fc9dd4675eac5a02c7c24b0a9e57c34865bbe9f7117d4ad8321c
- 8fb17be82e6998740e2c17d49012fbd475fcaf8b2ecf8990d996a30b1061cddf
- aefe7ce3ec9328664b375dfb9910b863e086560f990c6d35bf467e2e5b0a992f
- 0e6fadc64284167473bfc8eb22987852a8a8e8cb323548d2e2efdfb26354adb3
- f5026999207600eb4c63c03c2679d46e1a3ec8e25696810d9c7f74721f4d59eb
SHA1
- 178f07d1e8afc9b0fb3150fad234b74b5e53778d
- a9cc72e785cbd46abcdf7cf90f57beca46c29fab
- bf789d83854ca7b149fa9de516024a0d1b1b0aaf
URL
- http[:]//pakcert[.]gov-pk[.]org[:]443/news[.]php
- http[:]//pakcert[.]gov-pk[.]org/CNS_Guidelines_2019[.]zip
- http[:]//pakcert[.]gov-pk[.]org[:]443/login/process[.]php
- http[:]//110[.]10[.]176[.]193[:]4443
- http[:]//pakcert[.]gov-pk[.]org[:]4443/news[.]php
- http[:]//pakcert[.]gov-pk[.]org/shipment[.]rar
- http[:]//pakcert[.]gov-pk[.]org/zaqxswcde[.]hta[.]
- http[:]//pakcert[.]gov-pk[.]org/zaqxswcderfv[.]hta[:]
- http[:]//pakcert[.]gov-pk[.]org/poilkjmnb
- http[:]//pakcert[.]gov-pk[.]org/zaqxswcderfv[.]hta
- http[:]//pakcert[.]gov-pk[.]org[:]443/admin/get[.]php
- http[:]//pakcert[.]gov-pk[.]org/zxcvqwerasdf
- http[:]//pakcert[.]gov-pk[.]org/zaqxswcde[.]hta
- http[:]//pakcert[.]gov-pk[.]org/mnbvcxz
- http[:]//pakcert[.]gov-pk[.]org[:]443
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.