March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – “Lost Files” Data Wiper Ransomware Getting Paid Without Recovering Files
October 10, 2019
Rewterz Threat Alert – Cookie Monster Malware Hijacking WordPress Sessions
October 10, 2019
Rewterz Threat Alert – “Lost Files” Data Wiper Ransomware Getting Paid Without Recovering Files
October 10, 2019
Rewterz Threat Alert – Cookie Monster Malware Hijacking WordPress Sessions
October 10, 2019
Severity
Medium
Analysis Summary
An attack campaign using the Drupalgeddon2 unauthenticated remote code execution vulnerability to execute malicious code and deface websites. In the case analyzed for their blog, Akamai researchers identified a compromised bodysurfing website logging website requests containing code execution attempts. After cleaning up old infections and reducing a web server’s security posture, the code is used to download two files, a GIF image and a TXT file. The GIF image has the appropriate GIF header but is actually used to execute embedded PHP code. The PHP code first performs website defacement and displays a notification of the infection to visitors to the site. Hidden behind this defacement page are functions that allow the attacker to execute various commands via GET or POST requests, such as scanning for local credentials, getting system configurations, and opening a web shell. The TXT file downloaded in the initial infection contains a malicious Perl script. It provides the attacker with denial of service (DoS) and RAT capabilities. For command and control, it leverages an IRC server that has since been taken down. The researchers note that the attack seems to be more opportunistic than targeted.
Impact
- Denial of service
- Credential theft
- Exposure of sensitive information
Indicator of Compromise
IP
91[.]121[.]160[.]194
SH256
e18bf4ddee0b0db77541f3a3ea52d3bbe8fa943dd0ca3f573572fea22533afbe
SHA1
0ef7f63d746c34819d21057bd58b02781777bb29
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.