March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Snake Keylogger’s Malware Targeting Ukrainian Citizens – Active IOCs
July 22, 2022
Rewterz Threat Alert – Lazarus APT Group – Active IOCs
July 23, 2022
Rewterz Threat Alert – Snake Keylogger’s Malware Targeting Ukrainian Citizens – Active IOCs
July 22, 2022
Rewterz Threat Alert – Lazarus APT Group – Active IOCs
July 23, 2022
Severity
High
Analysis Summary
DangerousPassword is a Chinese APT group that targets cryptocurrency companies. Found in 2018, the threat group uses decoy files with topics like “job description”, “project risk profile”, “monthly business report”, etc. With a hefty number of domain names, Dangerous Password issues decoy files to organizations in Asia and Europe. The group uses phishing emails to deliver Trojan files that impersonate Google, Microsoft, and other servers. Once the files are executed, macros are launched to launch the attack.
Impact
- Information Theft and Espionage
Indicators of Compromise
MD5
- d13eb9a69a59001de27db3af7589f5c0
- a727ec19eae848a554cbe9cb90dcaf1b
SHA-256
- f7170b70a89f4b5d196e3a09c1d6135d36320548f66cdc2c55bf725b0f8d4ab8
- 899b2da752ad50f525e364f0af930dec91a128effbe8bb601803226604038d5b
SHA-1
- f5ef9c2b87964f495a1a8beb874537433e4a7826
- e5c27492a8bdb5bc2ed68e4326d3208aae9cbd46
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicator of compromise (IOCs) in your environment utilizing your respective security controls.