Rewterz Threat Alert – Hackers Abuse Windows Error Service in Fileless Malware Attack
October 7, 2020Rewterz Threat Alert – ‘Bahamut’ Threat Group Attacks Targets in the Middle East and South Asia
October 8, 2020Rewterz Threat Alert – Hackers Abuse Windows Error Service in Fileless Malware Attack
October 7, 2020Rewterz Threat Alert – ‘Bahamut’ Threat Group Attacks Targets in the Middle East and South Asia
October 8, 2020Severity
Medium
Analysis Summary
Active IoCs have been retrieved linked to the Azorult malware, that target and infect victims with the Azorult stealer. AZORult is a Trojan stealer that collects various data on infected computers and sends it to the C&C server, including browser history, login credentials, cookies, files from folders as specified by the C&C server (for example, all TXT files from the Desktop folder), cryptowallet files, etc.
Impact
- Credential Theft
- Exposure of sensitive information
Indicators of Compromise
URL
- http[:]//cantecme[.]xyz/aliandsimbi/index[.]php
- http[:]//books[.]myscriptcase[.]com/index[.]php
- http[:]//192[.]236[.]178[.]80/7z/0617773[.]jpg
- http[:]//pt[.]wildsdesigns[.]com/PL341/index[.]php
- http[:]//jinbdre[.]xyz/PL333/index[.]php
- http[:]//ddnsmachiavelli[.]ddns[.]net/PL341/index[.]php
- http[:]//185[.]239[.]242[.]174/oue/index[.]php
Remediation
- Block the threat indicators at their respective controls.
- Do not download email attachments from unknown senders.