Rewterz Threat Advisory – CVE-2018-15439 – Cisco Small Business Switches Privileged Access Vulnerability
January 21, 2019Rewterz Threat Alert: DarkHydrus APT Uses Google Drive to Send Commands to RogueRobin Trojan
January 21, 2019Rewterz Threat Advisory – CVE-2018-15439 – Cisco Small Business Switches Privileged Access Vulnerability
January 21, 2019Rewterz Threat Alert: DarkHydrus APT Uses Google Drive to Send Commands to RogueRobin Trojan
January 21, 2019SEVERITY: Medium
ANALYSIS SUMMARY
Attacks hitting financial organizations in West Africa since at least mid-2017 rely on off-the-shelf malware, free hacking tools, and utilities already available on the target systems to steal credentials, install backdoors, and run commands.
Actively four campaigns are observed which are used to lure victims into the trap.
- NanoCore trojan and PsExec
- Cobalt Strike, PowerShell scripts, and free tools
- Mimikatz and Custom RDP
NanoCore trojan and PsExec
In one of the attacks, the threat actor used NanoCore trojan along with PsExec, a legitimate network administration tool, and delivered the malware via phishing emails. To lure the victim into installing the malware, the attacker used documents referring to a West African bank. The targets were in Ivory Coast and Equatorial Guinea.
Cobalt Strike, PowerShell scripts, and free tools
It combined malicious PowerShell scripts with Mimikatz, a hacking tool designed to steal credentials, and UltraVNC opensource software for remote administration. The attackers also used a dynamic DNS service to hide their location by assigning a custom domain name to the IP address of the C2 server.
Mimikatz and custom RDP
Mimikatz can be used to harvest credentials and RDP allows for remote connections to computers, it’s likely the attackers wanted additional remote access capability and were interested in moving laterally across the victim’s network.
IMPACT
- Remote Access
- Code Execution
- System compromise
INDICATORS OF COMPROMISE
URLs
- nemesis225[.]ddns[.]net
- moneygram[.]servehttp[.]com
- noreply377[.]ddns[.]net
Malware Hash (MD5/SHA1/SH256)
- 24015acd155ec7305805dbdff1dd074d
- 4d49e578d359185324acda70a2880dd5
- 64b88486170e5cb890a7486965a90e84
- a8372b48280c6ee5b225f8ccd3cf4814
- 8dd3e20fe9770843bc2c9b2523a7cfb2
- 470cdc0ea9caed534b14bd5e195d19e8
- 605e99ea7dc4e73ae2af59cfb03360ec
- e8828b155567e587fbeca9069289e0d9
- 80a2576c3148ba5123aa016bf01e72bba53995b172dd263ab2071fad1c9d548d
- 21c87bcccf7e5c164da7c94772ef71a065a862f9ce32341a38eb39ffb7804305
- dab1953b9135a9bf0c5ffe86b87ab9a9c6fa34482004aa8bb2bf7ea8d72c8c62
- 53f8afe36e562c92140f4f8fa1f8ffce9e1f48b1eaff96bd6ab4b03646b97dc3
- 8fe18a768769342be49ac33d2ba0653ba7f105a503075231719c376b6ded8846
- 5f456a55f18bf183a7c988617787a041b90e8ecbeed8a01c583597b3fd19b42e
- ce58546eebd3c8e218b1db19c9c7b5ffe086ee814aab0e891061f8cba954b14d
- 3b7cc16fa5c5a78f0d1816d09a71b835f589de842b20e8c96c7084b9b0a89ff3
- 97034d8a97b967b2f18a867b411552f7
- 332a5371389a8953a96bf09b69edcb6e
- 8184f24a4f4ff4438dba050b2e3d1af7
- 6bfc1ec16f3bd497613f57a278188ff7529e94eb48dcabf81587f7c275b3e86d
- e46ba4bdd4168a399ee5bc2161a8c918095fa30eb20ac88cac6ab1d6dbea2b4a
- c1993735265f4274b81a6edf789e0245f2f7f5ee78f4172101728a324cdd3d2d
- 49ae7d13f43bb04ed31d593787d4e17e
- 75e5594c6882704ea2889e3fd758cbbf
- 06fe2b7ff6af10cd0ec8395490567f8a0f66d8e083a72f57f18e9ad74dfff727
- 6eb3281f5a80223a5b58af20d415453a9013a487c89d89cd7658bb7451902548
REMEDIATION
Consider blocking the IoCs at their respective controls.