Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
On discovery of a suspicious binary, MeltX0R researchers were able to identify malware and infrastructure being used by the Emissary Panda APT group in a recent campaign against unknown targets. Emissary Panda is also known as APT27, BRONZE UNION, Iron Tiger, LuckyMouse, TG-3390, and Threat Group-3390. The initially discovered binary was an executable file masquerading as a legitimate Microsoft utility but signed with a Chinese certificate. Execution of the binary results in privilege escalation followed by the dropping of a DLL in the System32 folder and a batch file in the victim’s temp directory. The DLL is then loaded using rundll32, at which point persistence is established via a new service. The aforementioned batch file is responsible for clearing the attacker’s tracks by deleting both the initial binary and itself. Next, the DLL is loaded a second time, this time by svchost. Running under svchost, the DLL file drops autocheck.sys, reads the hosts file, and initiates communication with its C2 over HTTP, HTTPS, and DNS. At the time of analysis, the researchers were unable to generate a response from the C2 server so the secondary payload was unable to be identified. Based on known TTPs used by Emissary Panda and similar samples to the one obtained for this researcher, MeltX0R identified that the initial payload was the ZxShell RAT installer.
Malware Hash (MD5/SHA1/SH256)