• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Fresh Emotet IoCs
December 29, 2020
Rewterz Threat Advisory – CVE-2020-17533 – Apache Accumulo privilege escalation
December 30, 2020

Rewterz Threat Alert – Credential Stealer Targeting Banks in US, Canada and India

December 29, 2020

Severity

Medium

Analysis Summary

Threat actors have been discovered distributing a new credential stealer written in AutoHotkey (AHK) scripting language as part of an ongoing campaign that started early 2020. Customers of financial institutions in the US and Canada are among the primary targets for credential exfiltration, with a specific focus on banks such as Scotiabank, Royal Bank of Canada, HSBC, Alterna Bank, Capital One, Manulife, and EQ Bank, as well as an Indian banking firm ICICI Bank. The multi-stage infection chain commences with a malware-laced Excel file that’s embedded with a Visual Basic for Applications (VBA) AutoOpen macro, which is subsequently used to drop and execute the downloader client script (“adb.ahk”) via a legitimate portable AHK script compiler executable (“adb.exe”). 

password stealer

The downloader client script is also responsible for achieving persistence, profiling victims, and downloading and running additional AHK scripts from command-and-control (C&C) servers located in the US, the Netherlands, and Sweden. What makes this malware different is that instead of receiving commands directly from the C&C server, it downloads and executes AHK scripts to accomplish different tasks. Chief among them is a credential stealer that targets various browsers such as Google Chrome, Opera, Microsoft Edge, and more. Once installed, the stealer also attempts to download an SQLite module (“sqlite3.dll”) on the infected machine, using it to perform SQL queries against the SQLite databases within browsers’ app folders. In the final step, the stealer collects and decrypts credentials from browsers and exfiltrates the information to the C&C server in plaintext via an HTTP POST request.

Impact

  • Credential Theft
  • Data Exfiltration
  • Unauthorized Access

Indicators of Compromise

MD5

  • 41190583bbbb2fd7f355c2e42b2d70a3
  • 33e9cc02c07a2bf4af4123779f405126

SHA-256

  • bed925d7c0af493c9ccd2828d6fdefe6f4255bada51f645a8fffdd67e24b87fd
  • 27d9eb869eea6c713c6f109eca867844e2feceb0783bda2b78f7a92dffc833f6

SHA1

  • 9c9ebef0dc57e363dd3ce03bf2f29d2e6146a2d5
  • ebb94b5b3cd8378d15a3c14c8d401d927cc81464

Source IP

  • 93[.]115[.]23[.]48
  • 94[.]103[.]94[.]186
  • 2[.]56[.]215[.]97
  • 199[.]192[.]29[.]202
  • 5[.]39[.]223[.]162

Remediation

  • Block the threat indicators at their respective controls.
  • Do not download files attached in untrusted emails.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.