March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
February 25, 2023
Rewterz Threat Advisory – CVE-2022-43923 – IBM Maximo Application Suite Vulnerability
February 27, 2023
Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
February 25, 2023
Rewterz Threat Advisory – CVE-2022-43923 – IBM Maximo Application Suite Vulnerability
February 27, 2023
Severity
Medium
Analysis Summary
Since 2019, Guloader has been in operation as a downloader. GuLoader spreads through spam campaigns with malicious archived attachments. GuLoader downloads the bulk of malware, with the most frequent being AgentTesla, FormBook, and NanoCore. The encrypted payloads of this downloader are usually saved on Google Drive. It also acquired its payloads from Microsoft OneDrive and an attacker-controlled website.
GuLoader can avoid network-based detection by using genuine file-sharing websites, which aren’t often filtered or inspected in corporate contexts. GuLoader malware spawns AgentTesla In its latest campaign in October 2022. AgentTesla is renowned for stealing data from a variety of target workstations’ apps, including browsers, FTP clients, and file downloaders.
Impact
- Malware Installation
- Detection Evasion
- Information Theft
Indicators of Compromise
MD5
- 4ce23c67160357c2102f8c5f6f669adf
- 9fb914c9a670ac3f2d7b43552c65ad10
- 044283cc5bee1d0cdc415a9155061d51
SHA-256
- 5f50b2bbd132ec4fcb465de520ce20c653579588069de9dc8f14579ebe2d062c
- 412f983cf1fb087d9b21bed966aaf91b7468ed1c9f792fb32e5b0a6e9dbbf0c1
- 423efe05f8bcafa36531cb05aadd42fa0ac6a171de0fa5b9749755c7c3a13af7
SHA-1
- f3f8eff2149c3a7fa540113133c61b6065968058
- 29139cf19cdb8a58e23be3d1b55558e323e51a23
- cb4a7579f065201c2a14c36a5dacd9adb1c775fd
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Emails from unknown senders should always be treated with caution.
- Never trust or open links and attachments received from unknown sources/senders.
- Limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
- Enforced Access Management Policies