Rewterz Threat Alert – Indicators of Compromise by Rat Malware

Severity

Medium

Analysis Summary

Rat malware is actively being spread through phishing campaign and is being sent to different users. Threat indicators are provided.

Indicators of Compromise

IP(s) / Hostname(s)

• 154.0.26[.]27
• l264.l264849.96[.]lt

URLs

hxxps://drive.google[.]com/uc?export=download&id=1kaflsznpssrxg_5xs6jlmtyzaz41p1y5

www.diverbooster[.]com

hxxp://www.diverbooster[.]com/transfert/putty.exe

winsec.ddns[.]net

winsec.gotdns[.]ch

hxxps://we[.]tl/t-mizglhghtn

hxxps://wetransfer[.]com/downloads/e5c234ac484973041af77a211ebe2afe20190408032

603/1e5aa2

hxxp://l264.l264849.96[.]lt/adbsro37qtl3cbw9vo0lk2bx8vv7jmx2mlesim9ddw11fem3sjp3iju

oufk/adb1.php?feedback=

hxxp://l264.l264849.96[.]lt/adbsro37qtl3cbw9vo0lk2bx8vv7jmx2mlesim9ddw11fem3sjp3iju

oufk/adoo.php

hxxp://l264.l264849.96[.]lt/adbsro37qtl3cbw9vo0lk2bx8vv7jmx2mlesim9ddw11fem3sjp3iju

oufk/dsp.php

Email Address

• adodo.kokou[@]gim-uemoa[.]org
• elisabet[@]capeunionmart.co[.]za

Malware Hash (MD5/SHA1/SH256)

• 4248ffd7101b479329ed96ebfc381798
• ffd340524000ad59b239595a1b46a420b7483048
• 592cf5d578dd6d377760500c5953677da5850d1a033538d5734b55209117ef58
• 50b86696af7110b504293e0ff3de2df1
• 978293fc8ba5ad99a0644ff4d5396f3bca5f80aa
• 10d36b54486d045b310379517cc521930dcb3d6bc80081ed06e6880d6c972298
• f94ddd13bb6f98a9e51f0140daa8c2a88e70cbfb
• abb79990c4971bedc5f8cf77f028d22eb97ff40d193638a0bb256c0a706e935c
• ef676b5e1bc08a45610697fc84d895dc

Remediation

• Block threat indicators at your respective controls 
  
• Never click on links/ attachments sent by unknown senders 
  
• Always be suspicious about the emails sent by unknown senders