Rewterz Threat Alert – AZORult Active-IOCs
August 10, 2021Rewterz Threat Alert – Oski Data Stealer Malware – Fresh IOCs
August 10, 2021Rewterz Threat Alert – AZORult Active-IOCs
August 10, 2021Rewterz Threat Alert – Oski Data Stealer Malware – Fresh IOCs
August 10, 2021Severity
High
Analysis Summary
The North Korean advanced persistent threat (APT) group Kimsuky has been found to be distributing a fake Korean Internet and Security Agency (KISA) app via malicious emails. A mobile malware researcher has shared information about a fake KISA vaccine or security android app disguised as the KISA security program. When the target downloads the APK implanted file from the email and installs the application on his device, the malicious code does its job. It executes in the background without the target’s knowledge and collects sensitive information from his device.
Impact
- Watering hole attacks
- Keyloggers
- Remote Access Connections
Indicators of Compromise
MD5
- de2a8a728f81d44562bfd3e91c95f002
- 70294ac8b61bfb936334bcb6e6e8cc50
- a0c7e9dc69e439cb431e6dea9f0d5930
SHA-256
- 7900ca98a6fbed74aa5a393758c43ad7abc9d8c73c3fbab7af93bae681065f4e
- 512ad244c58064dfe102f27c9ec8814f3e3720593fe1e3ed48a8cb385d52ff84
- 359ab5e0b57da0307ca9472e5b225dcd0f9dc9bf2efd2f15b1ca45b78791b6bc
SHA-1
- 85fd33ccbc35b4503c13b4f1e87d69efec292780
- f7b59f735ae76c76646617a9cc639ee591322ab2
- cebaf2bfcf1f2297d18e4d35efb2597adc334513
URL
- http[:]//dkekftks[.]atwebpages[.]com/ccom1/download[.]php?filename=ccom1
- http[:]//dkekftks[.]atwebpages[.]com/ccom1/post[.]php
- http[:]//dktkglrkshqhfn[.]atwebpages[.]com/ccom2/download[.]php?filename=ccom2
- http[:]//tksRpdl[.]atwebpages[.]com/ccom2/download[.]php?filename=ccom2
- http[:]//tktlal2[.]atwebpages[.]com/ccom2/download[.]php?filename=ccom2
- http[:]//tktlal3[.]atwebpages[.]com/ccom3/download[.]php?filename=ccom3
Remediation
- Search for IOCs in your environment.
- Block all threat indicators at their respective controls.
- Always be suspicious about emails sent by unknown senders.