Rewterz Threat Alert – Campaign Deploying Malware via MalSpam Targeting Web Application Servers

Severity

Medium

Analysis Summary

A new email campaign has been discovered that drops malicious files via spam emails. During analysis of these malicious files, a variant of c99madshell was found with a full suite of attack capabilities on web application servers running older versions of PHP.

Impact

Malware Infection

Indicators of Compromise

URLs

gulfup[.]com

Filename

10_lot_photo.jpg

Email Address

xkemox[@]gmail[.]com

Malware Hash (MD5/SHA1/SH256)

• 8e50e5e71ff22abeaf878a1d2dbb274ef84e0d4f9ccc120bf0c3b016fce0fe13
• 5179a36d40e1148eb54af2eeeb932a16cf397326a19f5ca2678be4f5ff28914f

Remediation

• Maintain up-to-date antivirus signatures and engines.
• Update PHP to the latest version available.
• Keep operating system patches up-to-date.
• Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Restrict users’ ability (permissions) to install and run unwanted software applications.
• Keep administrative privileges strictly limited to relevant users only.
• Enforce a strong password policy and implement regular password changes.
• Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
• Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its “true file type” (i.e., the extension matches the file header).
• Monitor users’ web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumbdrives, external drives, CDs, etc.).
• Scan all software downloaded from the Internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate ACLs.