March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – CVE-2020-16202 – Advantech WebAccess Node privilege escalation
September 21, 2020
Rewterz Threat Alert – Dridex Banking Trojan – IoCs
September 22, 2020
Rewterz Threat Advisory – CVE-2020-16202 – Advantech WebAccess Node privilege escalation
September 21, 2020
Rewterz Threat Alert – Dridex Banking Trojan – IoCs
September 22, 2020
Severity
High
Analysis Summary
Emotet is a banking trojan usually distributed via email spam. The malicious word documents are now increasingly delivered within a password-protected zip-file. This is done in order to prevent researchers to automatically detect and extract Emotet’s IoCs. Until recently, Emotet was rarely distributed with a password protected archive. Most spams featured a link to an office document or had it attached directly to the email. There have been just a few zip-file occurrences at the beginning of September. Recently, significant volume of emails containing zips with Emotet have been reported. Emotet is currently using random first names to create authentic reply chains, with an empty “Original Message” footer. The first lines of the email will now reference an encrypted zip file archive and provide the password, instead of just mentioning the document as before. Emails have been spotted in several different languages just like before.
Impact
- Theft of sensitive information
- Financial loss
Indicators of Compromise
MD5
- 4473e1406415a70312e54713b3ee5461
- 8ab198ee39b8dceebf833581222d4a2e
- db928ce2ca31b422d4e5785932fc8f22
SHA-256
- 003f19a4d9c1af6c87b437385d5274bb39fc4499264dbde7dcf76f5db1f351fa
- 2f345073e3bb0169d18ee8fe2dc052679777afa5f862fe6dc895688a8c4958d0
- 67824f7d30de00f42e6113fd77722452ace44733dddd60a0fba1c54567aefa1f
SHA1
- 187d38f6674c38a4c968fc3ea25ccce89f111f59
- a9f495d3b70870b023fc723cfb0afbd56cd7b75d
- 688b349c1f623c7d10a6a3f9141bffedbd6d519e
Source IP
- 71[.]72[.]196[.]159
- 190[.]192[.]39[.]136
URL
- http[:]//personalizzabili[.]com/images/lvyX7QK/
- http[:]//sasystemsuk[.]com/index_files/j9b/
- http[:]//bigtreestudios[.]org/temporary/cpmNZIXomC/
Remediation
- Block the threat indicators at their respective controls.
- Do not download unexpected password-protected zip-files coming from unknown sources.