March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Snake Keylogger’s Malware – Active IOCs
September 27, 2022
Rewterz Threat Alert – IcedID banking Trojan – Active IOCs
September 27, 2022
Rewterz Threat Alert – Snake Keylogger’s Malware – Active IOCs
September 27, 2022
Rewterz Threat Alert – IcedID banking Trojan – Active IOCs
September 27, 2022
Severity
High
Analysis Summary
APT28 is one of Russia’s longest-running APTs and its operations date back to at least 2007. The group supports Russia in their strategic operations against the U.S, countries of the former Soviet Union, Europe, and now Asia. These attacks mostly involve cyber crimes against the defense and military of targeted countries. To support Russia’s national interests, APT28 compromises the targeted country’s operation, steals their data, and then leaks it to their government. Going by the aliases Fancy Bear, Pawn Storm, Tsar Team, STRONTIUM, and Sofacy Group, APT28 performs their attacks using a spoofed website and phishing emails containing malicious links.
In Feb 2022, APT 28 (allegedly) attacked Eastern European countries using Empire and Invoke-Obfuscation. The MSHTML Remote Code Execution vulnerability, CVE-2021-40444, that was used by their threat actors
Recently, researchers gathered and examined a luring document that was used to install Graphite malware that was uniquely connected to APT28.
‘The luring document is a PowerPoint file that uses a code execution mechanism to be activated when the user enters presentation mode and moves the mouse. The code execution performs a PowerShell script that downloads and executes a OneDrive dropper. The latter downloads a payload that extracts and injects a new PE (Portable Executable) file into itself, which research revealed to be a variation of the Graphite malware family, which utilises the Microsoft Graph API and OneDrive for C&C communications.’
Impact
- Information Theft
- Data Exfiltration
- Exposure of Sensitive Data
Indicators of Compromise
Domain Name
- 9b5uja[.]am[.]files[.]1drv[.]com
- kdmzlw[.]am[.]files[.]1drv[.]com
MD5
- 21bcb8c94f1ffe5aae1cce21a4acdd31
- c0060c0741833af67121390922c44f91
SHA-256
- 1efa9a6e2c80769be8d10b403fc2a05a6c8803b398e547b9b616f66169f33f3a
- d1bceccf5d2b900a6b601c612346fdb3fa5bb0e2faeefcac3f9c29dc1d74838d
SHA-1
- e8dabc359af124d1e6c0e0dac9877c8d34fced1b
- 622eb93e34445c752eeaa623ef9ac6978e58f2fc
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.