Rewterz Threat Advisory – Confucius APT Group Actively Targeting Pakistani Officials Deploying Warzone RAT
June 8, 2021Rewterz Threat Alert – MuddyWater – Active IOCs
June 8, 2021Severity
High
Analysis Summary
Gootkit is complex multi-stage banking malware has been arround since 2014. Initially it was distributed via spam and exploits kits such as Spelevo and RIG. In conjunction with spam campaigns, the adversaries later switched to compromised websites where the visitors are tricked into downloading the malware. Gootkit is capable of stealing data from the browser, performing man-in-the-browser attacks, keylogging, taking screenshots and lots of other malicious actions. Its loader performs various virtual machine and sandbox checks and uses sophisticated persistence algorithms. In 2019, Gootkit stopped operating after it experienced a data leak, but has been active again since November 2020. Gootkit’s victims are mainly located in EU countries such as Germany and Italy.
Impact
- Unauthorized Access
Indicators of Compromise
Domain Name
- kvaladrigrosdrom[.]top
- scellapreambulus[.]top
- lbegardingstorque[.]com
- kerymarynicegross[.]top
- pillygreamstronh[.]com
MD5
- 97713132e4ea03422d3915bab1c42074
SHA-256
- 3966cb4e8d6f111dd98fb07158547d0080a9b9cba698c73b42c2499cdbb70416
SHA1
- a90c6e7c5650e73ceb0b329fa8c78045632100ee
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.
- Do not download files from untrusted sources or emails.