Rewterz Threat Alert – Honkbox Malware – Active IOCs

Severity

Medium

Analysis Summary

Honkbox is a highly advanced and persistent malware that targets macOS systems for cryptocurrency mining. The malware is typically distributed through phishing emails that contain malicious attachments or links, and once installed, it uses a multi-stage infection process to evade detection by security software.

One of the most significant features of Honkbox is its ability to remain hidden on infected systems. It uses a persistence mechanism to execute on startup, which allows it to remain active even after the system is restarted. The malware also uses encryption to hide its communications with the attackers’ command and control server, making it difficult to detect and analyze.

Another notable feature of Honkbox is its resource-intensive cryptocurrency mining process. The malware uses a large amount of CPU and GPU resources, which can lead to system crashes and hardware damage. Additionally, Honkbox can create a backdoor that allows attackers to remotely access and control the infected system, steal sensitive information, and use it for other malicious purposes.

Honkbox is a persistent threat that can be difficult to remove from infected systems. It can use anti-analysis techniques to detect the presence of virtual machines and sandboxes, and it can reinstall itself if it detects that it has been removed. As such, removing Honkbox from an infected system may require professional assistance.

To protect against Honkbox and similar threats, it is essential to practice good cybersecurity hygiene. This includes being cautious when opening emails and attachments from unknown sources, keeping software up-to-date, using strong passwords, and using reputable antivirus software. Additionally, organizations should conduct regular security assessments to identify vulnerabilities and implement appropriate measures to mitigate the risk of attack. By taking proactive steps to protect against malware like Honkbox, organizations can avoid potentially devastating consequences, such as data theft, system damage, and financial loss.

Impact

• Credential Theft 
• Information Theft
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• aab1ee1df37329cffd34a557ac7f6496
• dc2f52e350aeab8983102b40e6553741
• 22b3bf21c1b92021ac3fbd91c00633f8
• c68f5c009c6648c1a2700438a4abcd4c
• 9ef08505e2a1f077ea3b06c6309f3275
• 250be26b29bb822a990ce4a885b75a4b
• 60a977b63af69c85ed5de3f1f5c411bb
• 98296a4f10b92cf682a81df745960d90
• bb2537fe9a3b4e7e455f1210826d7c63
• 9b64649be21fd5c678afb96185d48c51
• 5600de63286f12d5ad12879df8f81559
• 69559f246de2a2e16171e84c39a6a700
• b19b356548a47c0f0fedaa6178ca26b7
• a4fb1f938257297b1dbd4c0fdce08cba
• 680c7e0e76e264d052d5a062d758e2f2

SHA-256

• 357c473cb0c1eb3fd228b0a8dc51fe3c29f862c5e1c497727f8274fce5bd822f
• ffc8cc1badc17c408b5e0e7045abbefa05ac2200c057997136880a8695f5656c
• 28d2825b7ee97c8f6a1c6acac6fa6de28f35b10781abee65321ba0f53f9d401f
• a2c6d699834eb992b11778a8d4595e2563b2ffa9d631936baaa0c0e29c504760
• f7106ee5c184bd764b94faba0d926fce48654320456fd7fd30751c56bd9f707b
• ac5b06b7db12c0392d3adc1838e307ab0c9b14c89e596cad1b6d47a9e4aee18f
• fcc902dd3ae5a1413607c3493617f33a4b2dbf03f861c18afc32821b8d47da81
• bfea3de39cf1d872c6616222b567c92d9bc78b4fb3bda94e1274b75693a8398f
• f6c55df67f126d39424c087cd359d7cb30a796b637b8a2fb9f409c9c98fcde7d
• ea28251de6a09d19f8cff7fe366c35d3826c10544a3a45426369aaf9e4b2050d
• 3028436248053280a93c3bedbefa65cacaf6e805e98a9bde09d858db974aab09
• 95756b979d11c7b8f80a952d9b64de1ccce2da256f8ebe639a804a2c2ff66065
• 363f0367ab91805114cfe194b70bf75c983e3d1ec4aacec7dfa9c7aa3e375f05
• d7ec99f0d019f476f82341dba3c2af10f71628f9ab664d05ab007fe420e0cdb1
• a22b48ce098ad4b082c4f4de78c708294e08212ab8dfd818642f7922c8e794c3

SHA-1

• 07bf3061b57605fed11a76d5c0c5503b9ae94bcb
• 0e3a1935dfe58f337dfc0456aeeff9571d6f799b
• 1e63eb81b45f5c472c3e6e7151f146e886491153
• 2ae591a3e14d77a9bc077fe61712c6b77f71fc11
• 33988b411c1064ebdc8bec2d86b7f481fea1c2fe
• 46b14b1818571f730883278a16065e4f6f3978f1
• 59efded10b3d023369d335831244303806c61d8c
• 608d88038296a6f810e492ad7fee3e62629437da
• 6329d04f81851779fc02d45565e1ead38044cde7
• 6751886a9d217b13362fb0533c08abbde949d1ff
• 687ec2b7d79ed6f953c7f519044b7117d12bdafa
• 68f4979c04b4753a9f275f29c00d4b260f4c2ec0
• 6ee76d296abf8da0f98d23f545ba4aa7c69e8211
• 7035ddb5c826fb86294b68e99f0a5675301cec1e
• 7377d8c7cd04fd6117c90a6f5ac5375eba459a78

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Do not download document ?les attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.