

Rewterz Threat Alert – Android Banking Trojan
December 7, 2020
Rewterz Threat Alert – Threat Actors targeting organizations associated with COVID-19 Vaccine
December 7, 2020
Rewterz Threat Alert – Android Banking Trojan
December 7, 2020
Rewterz Threat Alert – Threat Actors targeting organizations associated with COVID-19 Vaccine
December 7, 2020Severity
High
Analysis Summary
DeathStalker has leveraged several malware strains and delivery chains across the years, from the Python and VisualBasic-based Janicab, to the PowerShell-based Powersing, passing by the JavaScript-based Evilnum. DeathStalker also consistently leveraged anti-detection and antivirus evasion techniques, as well as intricate delivery chains, that would drop lots of files on target’s file systems. This particular malware has found stealthier evasion tactics. On the obfuscation front, the malware uses DNS over HTTPS as a communication channel, in order to hide communications with command-and-control (C2) behind legitimate-looking traffic. PowerPepper regularly polls the C2 server for commands to execute. The implant sends TXT-type DNS requests (with DoH or plain DNS requests if the later fails) to the name servers (NS) that are associated with a malicious C2 domain name. The server replies with a DNS response, embedding an encrypted command.

PowerPepper also adds steganography to the list of evasion techniques, which is the practice of hiding data inside images. In this case, the malicious code is embedded in what appears to be regular pictures of ferns or peppers (hence the name), and it is then extracted by a loader script. The loader is disguised as a verification tool from identity services provider GlobalSign.
It uses custom obfuscation, with parts of its malicious delivery scripts hidden in Word-embedded objects. Communications with the implant and servers are encrypted and the usage of trusted, signed scripts makes it difficult for the antivirus software to recognize the implant as malicious at startup. The first variant of PowerPepper emerged in the wild in mid-July 2020, as dropped from a Word Document that had been submitted on a public multiscanner service. PowerPepper was cultivated to execute remote shell commands sent by DeathStalker operators, which are aimed at stealing sensitive business information.
Impact
- Detection Evasion
- Unauthorized Code Execution
- Theft of Sensitive Business Information
- Data Exfiltration
Indicators of Compromise
Domain Name
- allmedicalpro[.]com
- mediqhealthcare[.]com
- gofinancesolutions[.]com
From Email
- a[.]christy_inbox@outlook[.]com
Hostname
- mailsigning[.]pythonanywhere[.]com
- mailsignature[.]pythonanywhere[.]com
- mailservices[.]pythonanywhere[.]com
- mailservice[.]pythonanywhere[.]com
- globalsignature[.]pythonanywhere[.]com
- footersig[.]pythonanywhere[.]com
MD5
- 3a6099214f474c1501c110ce66033f3c
- 871d64d8330d956593545dfff069194e
- 5d04d246f3e5da6a9347ec72494d5610
SHA-256
- fbb033af9efb9ab5b83978fc35e518e2f4018406589656ff6616e42b76526f18
- 46afa83e0b43fdb9062dd3e5fb7805997c432dd96f09ddf81f2162781daaf834
- 4b59fa6daeaaedace0c7eb5201dd21041de5c09f4d5d38e0f8e9eb2bbda9444a
SHA1
- 0ce862f8b50deda047e78789e8d74c610c61ad15
- 158ffa8f372674159c1a4338807032e8de1d2ff8
- ace1a579e77615abb9740b4ea234376b8a4d39af
URL
- https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYejBpdekg1WUCM9M?e=UkhU10
- https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYe1ulhtazjNVvCqY?e=WptVTC
- https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYeePNerfsAWK0qVY?e=e4SsYM
- https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYdifkocKujNavvjY?e=hhuBV8
- https[:]//www[.]gsn-nettoyage[.]com/wp-snapshots/etoken[.]php
- https[:]//www[.]gsn-nettoyage[.]com/wp-snapshots/btoken[.]php
- https[:]//www[.]gsn-nettoyage[.]com/wp-snapshots/1[.]docx
- https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYdcbz1YwTJRkOxP4?e=u5wtbX
- https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYd1921tVEMKWaCUs?e=MyoVNF
Remediation
- Block the threat indicators at their respective controls.
- Do not download files attached in untrusted emails.
- Do not download and execute untrusted files from random sources on the internet.