Rewterz Threat Alert – Remcos RAT – Active IOCs
July 15, 2021Rewterz Threat Advisory – CVE-2021-1422 – Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Vulnerability
July 16, 2021Rewterz Threat Alert – Remcos RAT – Active IOCs
July 15, 2021Rewterz Threat Advisory – CVE-2021-1422 – Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Vulnerability
July 16, 2021Severity
High
Analysis Summary
The North Korean advanced persistent threat (APT) group Kimsuky has been found to be distributing a fake Korean Internet and Security Agency (KISA) app via malicious emails. A mobile malware researcher has shared information about a fake KISA vaccine or security android app disguised as the KISA security program. When the target downloads the APK implanted file from the email and installs the application on his device, the malicious code does its job. It executes in the background without the target’s knowledge and collects sensitive information from his device.
Impact
- Watering hole attacks
- Keyloggers
- Remote Access Connections
Indicators of Compromise
MD5
- 8a7686430d9ad2832e8a4c3992186b36
- 3a0d0f6141bedffca45843ef81c73d10
- e98252b09d1eeee99ed087a3ea8668cd
SHA-256
- 567d0baa21036ee79b9380e4aa53917f1f816676ebcd060bfdd4959e2b40300a
- 991d4f92e3ceb5c34154cde4f417ab17ff43719769a5485570f9090d0600bcdd
- 41186d953408b7df43226258359f517d5cb7b00c026804a2222bc481fd36113c
SHA-1
- e930fe7c15aaa7c1f1a9fa0898b1d9549eacb217
- 7b8a2bcd2c987b92719c89ed45964a12ccb69531
- 53936f10f4ca6e9450f0ac72d5dc9ca4db414a87
URL
- http[:]//tbear[.]mypressonline[.]com/officeDocument/2006/relationships/BIO[.]dotm
- http[:]//btige[.]myartsonline[.]com/officeDocument/2006/relationships/BIO[.]dotm
- http[:]//tbear[.]mypressonline[.]com/officeDocument/2006/relationships/BIO[.]dotm
- http[:]//stair[.]myartsonline[.]com/officeDocument/2006/relationships/BIO[.]dotm
- http[:]//ccav[.]myartsonline[.]com/officeDocument/2006/relationships/BIO[.]dotm
- http[:]//visul[.]myartsonline[.]com/officeDocument/2006/relationships/BIO[.]dotm
- http[:]//modri[.]myartsonline[.]com/officeDocument/2006/relationships/BIO[.]dotm
- http[:]//ranso[.]myartsonline[.]com/Package/2006/relationships/InterKoreanSummit[.]dotm
- http[:]//lieon[.]mypressonline[.]com/Package/2006/relationships/InterKoreanSummit[.]dotm
- http[:]//chels[.]mypressonline[.]com/Package/2006/relationships/InterKoreanSummit[.]dotm
- http[:]//warcr[.]onlinewebshop[.]net/Package/2006/relationships/InterKoreanSummit[.]dotm
- http[:]//jupit[.]getenjoyment[.]net/Package/2006/relationships/InterKoreanSummit[.]dotm
- http[:]//ripzi[.]getenjoyment[.]net/Package/2006/relationships/InterKoreanSummit[.]dotm
- http[:]//lovels[.]myartsonline[.]com/ys/ha[.]txt
- http[:]//lovel[.]myartsonline[.]com/le/ej[.]txt
- http[:]//visul[.]myartsonline[.]com/yk/yo[.]txt
- http[:]//vbqwer[.]mypressonline[.]com/test[.]log
- http[:]//tbear[.]mypressonline[.]com/test[.]txt
- http[:]//obser[.]mygamesonline[.]org/nw[.]txt
- http[:]//modri[.]myartsonline[.]com/gu/nw[.]txt
- http[:]//warcr[.]onlinewebshop[.]net/le/eh[.]txt
- http[:]//stair[.]atwebpages[.]com/ne/la[.]txt
- http[:]//giruz[.]atwebpages[.]com/sw/cu[.]txt
- http[:]//benze[.]atwebpages[.]com/ki/mc[.]txt
- http[:]//rster[.]atwebpages[.]com/an/ce[.]txt
- http[:]//mantc[.]getenjoyment[.]net/ya/ng[.]txt
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.