Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
September 22, 2023
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]September 22, 2023Severity Medium Analysis Summary First discovered in 2016, Revenge RAT is a remote access trojan (RAT) designed to give an attacker complete control over an infected […]September 22, 2023Severity High Analysis Summary The Konni APT (Advanced Persistent Threat) group is a cyber espionage group that has been active since at least 2014. It is […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
September 22, 2023Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]September 22, 2023Severity Medium Analysis Summary First discovered in 2016, Revenge RAT is a remote access trojan (RAT) designed to give an attacker complete control over an infected […]September 22, 2023Severity High Analysis Summary The Konni APT (Advanced Persistent Threat) group is a cyber espionage group that has been active since at least 2014. It is […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Rewterz Threat Alert – “Stealc” – An Information Stealer Malware – Active IOCs
August 22, 2023Rewterz Threat Advisory – CVE-2023-40068 – WordPress Advanced Custom Fields and Fields Pro Plugin Vulnerability
August 22, 2023
Severity
High
Analysis Summary
Lumma is an information stealer that is sold as a Malware-as-a-Service (MaaS) on Russian-speaking underground forums and Telegram. Lumma is an information stealer, which means its primary purpose is to steal sensitive data from infected systems. Lumma is written in the C programming language, which allows for efficient and low-level access to system resources. It is distributed as a service by LummaC, the seller, on Russian-speaking underground forums and Telegram channels. Lumma places a particular emphasis on stealing cryptocurrency wallets. This indicates that the malware is designed to target and extract sensitive information related to cryptocurrency, such as private keys or wallet.dat files. In addition to its focus on cryptocurrency wallets, Lumma also possesses file grabber capabilities.
To protect against Lumma Stealer and similar threats, it is essential to follow security best practices. This includes regularly updating software and operating systems, using strong and unique passwords, implementing multi-factor authentication, exercising caution when opening email attachments or clicking on suspicious links, and using reputable antivirus/anti-malware solutions. Security awareness training can also help users recognize and avoid phishing attempts.
Impact
- Data Exfiltration
- Credential Theft
- Information Theft
- Financial Loss
Indicators of Compromise
MD5
- 0b02742b5d489839e5e112bfd2e0e653
- ebac06e859dd555bbb5012fcdb9c6528
- 35b823296152d234d2a6a9999df3a462
- e6b8cfb15c6fce9abcea7a716345d537
SHA-256
- 130208c4a8f02c294315c49274f1e5266d9e1e38290c03ef5d1fc192cb8748f7
- 93015b567e5ba8266205fb1183a6a26a3b950b67fd1366639ae232206d972f77
- c28bc925e3bad21b524eca44b846ae271a0435e9735c9624ba6404d8125401a5
- 6d0fee7a64435cda0b8ac5652c5a19e9e284514bec8110ae7c02341dcc3e1277
SHA-1
- f1d5afeac227fa81e76a57374d6614fa078e4865
- 282dd3d008f4b4272111c31d0089b595d3e5b7bb
- c07c47772f2f2422bf223c85099d560f9b06bbd0
- c56b60c650439c124b403e31aced45c584ecdd7b
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Emails from unknown senders should always be treated with caution. Never trust or open links and attachments received from unknown sources/senders.
- Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
- Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets