Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
May 30, 2023
Severity High Analysis Summary Recently, researchers discovered an advanced phishing method called “file archiver in the browser” that exploits .ZIP domains to deceive unsuspecting individuals. This […]May 28, 2023Severity High Analysis Summary An email protection and network security services provider has issued a warning regarding a zero-day vulnerability that has been exploited to compromise […]May 26, 2023Severity High Analysis Summary CVE-2023-32165 CVSS:9.8 D-Link D-View could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in TftpReceiveFileHandler […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
May 30, 2023Severity High Analysis Summary Recently, researchers discovered an advanced phishing method called “file archiver in the browser” that exploits .ZIP domains to deceive unsuspecting individuals. This […]May 28, 2023Severity High Analysis Summary An email protection and network security services provider has issued a warning regarding a zero-day vulnerability that has been exploited to compromise […]May 26, 2023Severity High Analysis Summary CVE-2023-32165 CVSS:9.8 D-Link D-View could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in TftpReceiveFileHandler […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Rewterz Threat Alert – Sodinokibi Ransomware Spreads via Fake Forums on Hacked Sites
September 3, 2019Rewterz Threat Alert – Nemty Ransomware Gets Distribution from RIG Exploit Kit
September 3, 2019
Severity
Medium
Analysis Summary
Some cyber criminals have created a web page impersonating the official website of a tool called BleachBit. The cyber criminals spread the AZORult information stealer in the name of this tool. BleachBit is a tool that helps Windows, Linux, and macOS users reclaim disk space by deleting disposable data and has more than one million downloads on Sourceforge.
AZORult is a stealer built to collect various types of sensitive data from an infected computer such as browser history, saved logins, stored credentials in FTP clients, desktop and text files, and more. When designing the malicious site, the domain bleachbitcleaner[.]com was used to appear legitimate. The webpage has only one link available which leads to AZORult, along with the embedded video tutorial for a beta version of the program released in 2009. Data is taken from infected computers to twooo[.]cn.
Once installed, AZORult contacts its command and control (C2) server for instructions. It can collect browser history, login credentials, cookies, and files in specific locations. Fooled users download a ZIP archive from Dropbox which steals a victim’s data on execution and uploads it to the attacker’s command and control servers.
Attack vector for this attack is still unclear. Threat actors may get victims to visit the fake webpage via search engines or manually push the fake website on support forums. They may also target users looking to securely erase sensitive data. They could also use phishing emails and push the link through email attachments.
Impact
- Credential Theft
- Disclosure of sensitive Information
Indicators of Compromise
URLs
- twooo[.]cn
- bleachbitcleaner[.]com
- http://5[.]188[.]60[.]32
Malware Hash (MD5/SHA1/SH256)
- 97c016bab36a85ca830376ec48c7e70ee25edbb55f626aee6219ade7468cee19
- f291c822ee0c5655b2900f1c8881e415
- e2abc062bf67676adaaaea235c9b8f1619358447ed6c333b40affb7606571e09
- a5dbc83ea73adcb51677017f3718f587
Remediation
- Block the threat indicators at their respective controls.
- Make sure to download all software from their legitimate sources.
- Do not execute files without proper scanning.