• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – APT Using Steganography to Spread CobaltStrike
December 29, 2020
Rewterz Threat Alert – Credential Stealer Targeting Banks in US, Canada and India
December 29, 2020

Rewterz Threat Alert – Fresh Emotet IoCs

December 29, 2020

Severity

High

Analysis Summary

Emotet has recently found in increased cyber activities after a short period of dormancy. Fresher IoCs are being retrieved everyday. Emotet is a banking trojan turned to a malware loader that drops other payloads after initial infection, often Qbot. Emotet Malware is constantly being detected in the wild, targeting organizations from multiple sectors and countries, primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate email. Emotet operators usually try to get users to click the malicious files by using lures like “YourInvoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. Emotet has gone through a few iterations. Early versions arrived as a malicious JavaScript file. Later versions evolved to use macro-enabled documents to retrieve the virus payload from command and control (C&C) servers run by the attackers. Lately, Emotet infections have been used to distribute other malware like Qakbot. So these can be multi-stage attacks that bundle other malware with emotet.

Impact

  • Credential Theft
  • Information Theft
  • Financial Loss

Indicators of Compromise

MD5

  • f5a730468ed8daa28578acee71b0c685
  • f2e53067a34e38ad2dd24f9d3b308326
  • 66009e80847d04f67ddb1eb0cda0ce35
  • 1feaadfd9cb65a2f9f39dba2aae508fe
  • a29cd4c21017efc5487f9d1f90a60bed
  • 0cf9a1c5c7282acf17c60a8d823a7921
  • 9ca5d12a4ba8b98881670af77da9db2e
  • d725786fd717b03741473f4c7cdd7041

SHA-256

  • cd47947804cd66ca26d9c8df758faddba8ac6575fe2863e810a15237ff114fca
  • 8c49b2f291f88331c53493459f4a2c3f5d83c384366eab6fc92d4853b0d91102
  • d0f3f7ff91592d588b5a5409142c52e9df303622e19ef9d95156e9a99da6684f
  • f14043530d1da9ab12ecb95532ce13964852ac52328e4c754c71117f1206adf1
  • 827102ec1f787e529f384e4daa25348f5c5fd2643d68141756744c1637794830
  • b2dab8fab758e4669061b7dec41605bb07d75e7d1268e5c48bf26c866f920d18
  • b34953cd8e1e329f1bb6cbfafe7c962281911a179c5dd54e94e058b0bfaf30eb
  • adb4320936098b1adbfcbf7c081d3b6a143d521ea3cc6eb2b5728d12097c0b95

SHA1

  • 0eab749475654892ef5efeccd8fb021d28dd6150
  • 87bc0e78e620ff1e3a7d0bd470b77cb0760bcf04
  • 913281750653bcaf0689ce214cbb834b21a28194
  • b356b87b98b528b76163bfbf026ef43583e68c65
  • 6a60f1c4651d635a9d4a80edd82d12c0f4108391
  • ceb5488565fe92f124f3891fb98b7adcf9a2a185
  • 9468748b741160c5af943b57077e038ff59296d0
  • d634cef3b51a7895ff9d4a249c140bfcb26afe38

Remediation

  • Block the threat indicators at their respective controls.
  • Do not download files attached in untrusted emails.
  • Do not download untrusted files from random sources on the internet.
  • Only download software from legitimate and official sources.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.