Rewterz Threat Alert – GAMAREDON APT Introduces New Variants

Severity

Medium

Analysis Summary

Gamaredon, the Russia-backed advanced persistent threat (APT) threat actor that has been active since at least 2013 has reinforced its cyber warfare activities a new surge of Gamaredon APT attacks targeting the Ukrainian national security force with spear-phishing emails, introducing new variants of malware. The attached exploit document delivers additional payload and the spear-phishing email is marked as ‘clean’ by Kaspersky Secure Mail Gateway. The email header information further affirms that the threat actor is originating from Russia. The exploit document employs the template injection technique to install additional malware on the victim’s machine. Upon opening the document, it connects back to the hacker’s server to download the payload file.

Impact

• Code Execution
• Data Manipulation
• Information Theft

Indicators of Compromise

Hostname

• srv159232[.]hoster-test[.]ru

MD5

• 1bfaec25ad02e0c25323ef0427fef804
• 00193e6e5daddd26d2417ad49038b2ae
• 8e575b76cbd9d7b7b41080991aafd663

SHA-256

• 03bb1ab8eded2f124056cf1ea66570a24c80d15e58925fa462a55140fda75dc0
• 91501d0a71ce70aac3d9009fde9cea8bb414e8a4ae1427c39c2b826e36c19565
• 6fa02e965c84eeabc1601263c203e1b524fd9500584e4ca08907d3b97cb963a0

SHA1

• 1c4016e2cd2311e4cf95d03474362e383dd268f0
• 5a1b5cd7d14aa36e7975befee2cebbd801533f2b
• 007a2ee57e55d1d504829ab3ab4676508c0f031c

Source IP

• 31[.]28[.]24[.]131

URL

• http[:]//srv159232[.]hoster-test[.]ru/json[.]php
• http[:]//Moris[.]hopto[.]org/post/win/SBuTcj[.]dot
• http[:]//Sakidus[.]myftp[.]org/KyVJhg[.]dot

Remediation

• Block the threat indicators at their respective controls.
• Do not download files attached in untrusted emails.