Rewterz Threat Alert – APT C-23 aka AridViper Active in the Region – Active IOCs

Severity

High

Analysis Summary

APT C-23 also known as AridViper and Desert Falcon is active in the region targeting different sectors with their malicious documents. The group’s discovery came around March 2017 with their main targets emerged as the Middle East. The group has previously faked an android app to deploy Android/SpyC23.A mainly for spying, including reading notifications from messaging apps, call recording and screen recording, and with new stealth features, such as dismissing notifications from built-in Android security apps.

New sample seems used by APT-C-23. Once it gets executed, a document relating to information about EgyptAir is shown to confuse the victim and meanwhile RAT is executed to perform remote control. 
 

Impact

• Unauthorized access of victim’s machine
• Information theft and espionage
• Exposure of sensitive data

Indicators of Compromise

Filename

• AuditPolicy[.]exe

MD5

• e38c06f83a5c1b0a4f82c965a4c78654

SHA-256

• 823bf27b1e559d6607f5224ab99de1c83bb5d36e2ed0e6644d551e94ec45d248

SHA-1

• 78c945e7277f6b7549929442705aeb6ec4eb444a

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.
• Always be suspicious about emails sent by unknown senders.
• Never click on links/attachments sent by unknown senders.