September 9, 2024
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Sodinokibi Ransomware Spreads via Fake Forums on Hacked Sites
September 3, 2019
Rewterz Threat Alert – Nemty Ransomware Gets Distribution from RIG Exploit Kit
September 3, 2019
Rewterz Threat Alert – Sodinokibi Ransomware Spreads via Fake Forums on Hacked Sites
September 3, 2019
Rewterz Threat Alert – Nemty Ransomware Gets Distribution from RIG Exploit Kit
September 3, 2019
Severity
Medium
Analysis Summary
Some cyber criminals have created a web page impersonating the official website of a tool called BleachBit. The cyber criminals spread the AZORult information stealer in the name of this tool. BleachBit is a tool that helps Windows, Linux, and macOS users reclaim disk space by deleting disposable data and has more than one million downloads on Sourceforge.
AZORult is a stealer built to collect various types of sensitive data from an infected computer such as browser history, saved logins, stored credentials in FTP clients, desktop and text files, and more. When designing the malicious site, the domain bleachbitcleaner[.]com was used to appear legitimate. The webpage has only one link available which leads to AZORult, along with the embedded video tutorial for a beta version of the program released in 2009. Data is taken from infected computers to twooo[.]cn.
Once installed, AZORult contacts its command and control (C2) server for instructions. It can collect browser history, login credentials, cookies, and files in specific locations. Fooled users download a ZIP archive from Dropbox which steals a victim’s data on execution and uploads it to the attacker’s command and control servers.
Attack vector for this attack is still unclear. Threat actors may get victims to visit the fake webpage via search engines or manually push the fake website on support forums. They may also target users looking to securely erase sensitive data. They could also use phishing emails and push the link through email attachments.
Impact
- Credential Theft
- Disclosure of sensitive Information
Indicators of Compromise
URLs
- twooo[.]cn
- bleachbitcleaner[.]com
- http://5[.]188[.]60[.]32
Malware Hash (MD5/SHA1/SH256)
- 97c016bab36a85ca830376ec48c7e70ee25edbb55f626aee6219ade7468cee19
- f291c822ee0c5655b2900f1c8881e415
- e2abc062bf67676adaaaea235c9b8f1619358447ed6c333b40affb7606571e09
- a5dbc83ea73adcb51677017f3718f587
Remediation
- Block the threat indicators at their respective controls.
- Make sure to download all software from their legitimate sources.
- Do not execute files without proper scanning.