Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
A recent Ursnif malspam campaign is seen as spoofing replies to emails and that includes Dridex as its follow-up malware. The campaign follows the typical pattern of Ursnif infection in which victims are asked to open a zip attachment containing Word documents with malicious macros. The document is password-protected and the password for the zip attachment is usually ‘777.’ It’s designed to infect a vulnerable windows host. Both Ursnif and Dridex stay persistent through the Windows registry. Ursnif copies itself and deletes the original version and Dridex remains persistent through DLL files. Enabling macros on the Word document dropped a script file in the C:\Windows\Temp directory, and the script file retrieved the initial Windows executable (EXE) file for Ursnif.
Traffic generated by Ursnif infections follows relatively consistent patterns. During these type of Ursnif infections, we often find follow-up malware retrieved by the Ursnif-infected host. In this case, it was Dridex. Dridex, a banking trojan, also known as Bugat and Cridex is a form of malware that specializes in stealing bank credentials via a system that utilizes macros from Microsoft Word.Ursnif Trojan (aka Dreambot, Gozi, and ISFB) is an information stealing trojan.
Domain Name
MD5
SHA-256
Source IP
URL