Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity
Medium
Analysis Summary
An email campaign spreading XpertRAT via ISO images with advanced anti-analysis techniques. The phishing email in this campaign mimics a well-known Italian manufacturing company. Attached is an ISO file packed with a Delphi packer, which the researchers note will mount natively to the file system if it is running Windows 8 or above. The malicious payload is stored in the resource section of the ISO as encrypted data. Before the final payload is executed on the system, the malware performs a series of checks for anti-analysis purposes. First, it checks for whether a debugger is attached to the malicious process. Then it checks for cursor movements, indicating real user activity. Next, it checks information about the CPU in order to identify whether the system is running on a hypervisor. The list of running processes is then checked for analysis tools or anti-malware products. Finally, the file path of the EXE is checked for keywords, such as “sandbox”, “sample”, and more. If all the checks are successful, the final payload is injected into a new “iexplore.exe” process. This payload was identified to be XpertRAT. Once it has been installed and has established persistence, it attempts to communicate with its C2.
Impact
Indicators of Compromise
IP(s) / Hostname(s)
216[.]38[.]2[.]211
URLs
thisurl[.]doesntexist[.]com
Filename
po-ima0948436.exe
Malware Hash (MD5/SHA1/SH256)
Remediation