• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Nanocore RAT- IOC’s
September 3, 2020
Rewterz Threat Advisory – CVE-2020-3495 – Critical Code Execution Flaw in Cisco Jabber for Windows
September 4, 2020

Rewterz Threat Alert – Epic Manchago Maldocs Used for Infostealer Delivery

September 3, 2020

Severity

Medium

Analysis Summary

Researchers detected malicious Excel documents in July 2020 that are able to deliver malware through VBA-activated spreadsheets. Unlike most malicious excel documents, these particular samples were created using EPPlus software. It is believed the campaign is being carried out by a single threat actor based on the number of samples provided to services such as VirusTotal. Additionally, delivery of payloads supports this theory. The lack of Office metadata led researchers to conclude the files were created in EPPlus as well as the uncompiled code contained within the spreadsheets. All of the sample maldocs contain a password protected VBA project. Efforts to recover the passwords were unsuccessful. A handful of samples were obtained and it was determined the VBA code will use either PowerShell or ActiveX to download the payload. These payloads are hosted on various websites. There is a common pattern to the second stage downloader. The stage 2 EXE loads a DLL. This DLL extracts and decodes steganography encoded images from the EXE. Finally, the DLL loads the stage 3 EXE. This is the final payload. These final stages included such malware as AgentTesla, Azorult, Formbook, Matiex, and njRAT. There does not appear to be a pattern in the targeting of victims. 

final_stage_delivery.png?w=1040

Impact

  • Information theft
  • Exposure  of sensitive data 

Indicators of Compromise

MD5

  • 9fb432d12e031b75367206b1b81d9353
  • 7f0983e521913f83b0df18f872c4f63e
  • 0273712f0bcaf6da2ac681e77852f15c
  • 351e3d2752f956dbdeb693bcd032bf10
  • 147599dd9ac8c5e1917b02efd5563f6b
  • 214fd8a8a00c702e41e573858906f6ac
  • 0c3f8edc8224fb687951bd5436c5532f
  • ba45206a338b1b2118a6b948ee91a593
  • d7a834e225fe3710530ef79cb336774d
  • 69a8680d7dc152696a45b1600bea55c1

SHA1

  • fa48fa38e591459ec837ac519813cf137fc09ebd
  • daa83e58b189ebd6b21f7b5d35b15f80b2162129
  • c3a2abd1c6e1ce7c4b654642163c472626756a00
  • 307a339de200cf747edac58056d520ad53d8840c
  • 34255da63836bda9b49dd1c2142050fcade99423
  • d5e17b3dcdd96d7d9694c78a3e792af823a5d9ae
  • 92f12ee9d5d0ef2df122a10ba9921ddf0314ba1b
  • 0cc7e92fda18909f8c1e2d9caf457a4072d98105

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.