Rewterz Threat Alert – Shuckworm APT Group aka Armageddon – Active IOCs
March 6, 2023Rewterz Threat Alert – APT29 aka Nobelium – Active IOCs
March 6, 2023Rewterz Threat Alert – Shuckworm APT Group aka Armageddon – Active IOCs
March 6, 2023Rewterz Threat Alert – APT29 aka Nobelium – Active IOCs
March 6, 2023Severity
Medium
Analysis Summary
Honkbox is a highly advanced and persistent malware that targets macOS systems for cryptocurrency mining. The malware is typically distributed through phishing emails that contain malicious attachments or links, and once installed, it uses a multi-stage infection process to evade detection by security software.
One of the most significant features of Honkbox is its ability to remain hidden on infected systems. It uses a persistence mechanism to execute on startup, which allows it to remain active even after the system is restarted. The malware also uses encryption to hide its communications with the attackers’ command and control server, making it difficult to detect and analyze.
Another notable feature of Honkbox is its resource-intensive cryptocurrency mining process. The malware uses a large amount of CPU and GPU resources, which can lead to system crashes and hardware damage. Additionally, Honkbox can create a backdoor that allows attackers to remotely access and control the infected system, steal sensitive information, and use it for other malicious purposes.
Honkbox is a persistent threat that can be difficult to remove from infected systems. It can use anti-analysis techniques to detect the presence of virtual machines and sandboxes, and it can reinstall itself if it detects that it has been removed. As such, removing Honkbox from an infected system may require professional assistance.
To protect against Honkbox and similar threats, it is essential to practice good cybersecurity hygiene. This includes being cautious when opening emails and attachments from unknown sources, keeping software up-to-date, using strong passwords, and using reputable antivirus software. Additionally, organizations should conduct regular security assessments to identify vulnerabilities and implement appropriate measures to mitigate the risk of attack. By taking proactive steps to protect against malware like Honkbox, organizations can avoid potentially devastating consequences, such as data theft, system damage, and financial loss.
Impact
- Credential Theft
- Information Theft
- Exposure of Sensitive Data
Indicators of Compromise
MD5
- aab1ee1df37329cffd34a557ac7f6496
- dc2f52e350aeab8983102b40e6553741
- 22b3bf21c1b92021ac3fbd91c00633f8
- c68f5c009c6648c1a2700438a4abcd4c
- 9ef08505e2a1f077ea3b06c6309f3275
- 250be26b29bb822a990ce4a885b75a4b
- 60a977b63af69c85ed5de3f1f5c411bb
- 98296a4f10b92cf682a81df745960d90
- bb2537fe9a3b4e7e455f1210826d7c63
- 9b64649be21fd5c678afb96185d48c51
- 5600de63286f12d5ad12879df8f81559
- 69559f246de2a2e16171e84c39a6a700
- b19b356548a47c0f0fedaa6178ca26b7
- a4fb1f938257297b1dbd4c0fdce08cba
- 680c7e0e76e264d052d5a062d758e2f2
SHA-256
- 357c473cb0c1eb3fd228b0a8dc51fe3c29f862c5e1c497727f8274fce5bd822f
- ffc8cc1badc17c408b5e0e7045abbefa05ac2200c057997136880a8695f5656c
- 28d2825b7ee97c8f6a1c6acac6fa6de28f35b10781abee65321ba0f53f9d401f
- a2c6d699834eb992b11778a8d4595e2563b2ffa9d631936baaa0c0e29c504760
- f7106ee5c184bd764b94faba0d926fce48654320456fd7fd30751c56bd9f707b
- ac5b06b7db12c0392d3adc1838e307ab0c9b14c89e596cad1b6d47a9e4aee18f
- fcc902dd3ae5a1413607c3493617f33a4b2dbf03f861c18afc32821b8d47da81
- bfea3de39cf1d872c6616222b567c92d9bc78b4fb3bda94e1274b75693a8398f
- f6c55df67f126d39424c087cd359d7cb30a796b637b8a2fb9f409c9c98fcde7d
- ea28251de6a09d19f8cff7fe366c35d3826c10544a3a45426369aaf9e4b2050d
- 3028436248053280a93c3bedbefa65cacaf6e805e98a9bde09d858db974aab09
- 95756b979d11c7b8f80a952d9b64de1ccce2da256f8ebe639a804a2c2ff66065
- 363f0367ab91805114cfe194b70bf75c983e3d1ec4aacec7dfa9c7aa3e375f05
- d7ec99f0d019f476f82341dba3c2af10f71628f9ab664d05ab007fe420e0cdb1
- a22b48ce098ad4b082c4f4de78c708294e08212ab8dfd818642f7922c8e794c3
SHA-1
- 07bf3061b57605fed11a76d5c0c5503b9ae94bcb
- 0e3a1935dfe58f337dfc0456aeeff9571d6f799b
- 1e63eb81b45f5c472c3e6e7151f146e886491153
- 2ae591a3e14d77a9bc077fe61712c6b77f71fc11
- 33988b411c1064ebdc8bec2d86b7f481fea1c2fe
- 46b14b1818571f730883278a16065e4f6f3978f1
- 59efded10b3d023369d335831244303806c61d8c
- 608d88038296a6f810e492ad7fee3e62629437da
- 6329d04f81851779fc02d45565e1ead38044cde7
- 6751886a9d217b13362fb0533c08abbde949d1ff
- 687ec2b7d79ed6f953c7f519044b7117d12bdafa
- 68f4979c04b4753a9f275f29c00d4b260f4c2ec0
- 6ee76d296abf8da0f98d23f545ba4aa7c69e8211
- 7035ddb5c826fb86294b68e99f0a5675301cec1e
- 7377d8c7cd04fd6117c90a6f5ac5375eba459a78
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
- Do not download document ?les attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.