March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Remcos RAT – Active IOCs
October 28, 2021
Rewterz Threat Alert – Trickbot Malware – Active IOCs
October 28, 2021
Rewterz Threat Alert – Remcos RAT – Active IOCs
October 28, 2021
Rewterz Threat Alert – Trickbot Malware – Active IOCs
October 28, 2021
Severity
High
Analysis Summary
The APT group Turla is known by many names including Krypton, MAKERSMARK, Snake, Uroburosk, Venomous Bear, Waterbug, and WhiteBear, and is tracked by researchers. Turla is primarily known for its espionage activities. This time they’re back with the another malicious sample dropping malicious exe file samples to different users. Believed to be sponsored by the Russian FSB security service, Turla has been active since at least 2008 and while constantly evolving its own toolkit, has also been turning its attention towards the infrastructure and resources of other APTs.
Impact
- Information Theft and Espionage
Indicators of Compromise
Filename
- SWCheckState[.]exe
MD5
- 23727a92f8dfa7a5975e744f44089ac9
SHA-256
- a679dbde0f4411396af54ea6ac887bd0488b2339cd8a4b509a01ca5e906f70bd
SHA-1
- 588df4bbe5c0ddb9bb5ed3097989443e633364a5
Remediation
- Block all threat indicators at their respective controls.
- Search for IOCs in your environment.