March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
November 18, 2022
Rewterz Threat Alert – Qakbot (Qbot) Malware – Active IOCs
November 18, 2022
Rewterz Threat Alert – SmokeLoader Malware – Active IOCs
November 18, 2022
Rewterz Threat Alert – Qakbot (Qbot) Malware – Active IOCs
November 18, 2022
Severity
High
Analysis Summary
DangerousPassword is a Chinese APT group that targets cryptocurrency companies. Found in 2018, the threat group uses decoy files with topics like “job description”, “project risk profile”, “monthly business report”, etc. With a hefty number of domain names, Dangerous Password issues decoy files to organizations in Asia and Europe. The group uses phishing emails to deliver Trojan files that impersonate Google, Microsoft, and other servers. Once the files are executed, macros are launched to launch the attack.
Impact
- Information Theft and Espionage
Indicators of Compromise
MD5
- b3a413ca95799de4a37403edc18afe34
- 21e9ddd5753363c9a1f36240f989d3a9
SHA-256
- 0937cbb980cb898eacd8458366fc4de3510266b8fbcd68010aa04e58bf72df28
- a3f087c83453cde2bc845122c05ebeb60e8891e395b45823c192869ec1b72ea6
SHA-1
- 5a0e591b79f6ae46418e5f615b0a7771750371fb
- 71627bf5d3fa0c09e0631b2172ee0c6499168ed9
URL
- https://www.capmarketreport.com/packageupd.msi?ccop=RoPbnVqYd
Remediation
- Block all the threat indicators at your respective controls.
- Search for IOCs in your environment.