Rewterz Threat Alert – Heodo Malware – Active IOCs

December 22, 2022

Severity

High

Analysis Summary

Heodo is a malicious program that is a variant of Emotet. Emotet was first identified in 2014. This malware is mostly disseminated through spam emails (malspam). Malicious scripts, document files with built-in macros, or malicious links can all deliver the infection. Emotet has undergone a few alterations.”

Heodo malware can be used to download and execute other malware, steal personal or sensitive information, and so on. Heodo attack victims may incur a monetary loss, data loss, computer infection with additional viruses, identity theft, problems with online privacy, and other concerns. Threat actors use spam campaigns to deceive consumers into installing Heodo on their PCs. They send emails with a malicious Microsoft Word document that, when opened, requests access to information and modification or macros commands.

Impact

Credential Theft
Information Theft
Financial Loss

Indicators of Compromise

MD5

32b9e8bb2b3045f70ae291e83a889442
6900210069871f6a6dc03f3146cf6549

SHA-256

5f52e0f73ac28cd79b8769b747f1f1ce942de17413c30f1888ca4632b62d24bc
c669c2e395b395976d3130efd161441a2b5d7fd5576aacb75773cad6297c9575

SHA-1

109814898774bed993ee09fdae915f633f11e27c
17d17067006d7aefb6245cf0ec99762ca6692b93

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.
Passwords – Ensure that general security policies are employed including: implementing strong passwords, correct configurations, and proper administration security policies.
Admin Access – limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
WAF – Web defacement must be stopped at the web application level. Therefore, set up a Web Application Firewall with rules to block suspicious and malicious requests.
Patch – Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
Secure Coding – Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
2FA – Enable two-factor authentication.
Antivirus – Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using a multi-layered protection is necessary to secure vulnerable assets