• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2018-17937 – gpsd, microjson Stack-Based Buffer Overflow Vulnerability
February 15, 2019
Rewterz Threat Alert – ‘Transaction Refund’ Phishing campaign dropping malicious links
February 19, 2019

Rewterz Threat Alert – Multiple Phishing Campaigns Dropping Emotet Malware and Stealing Information

February 15, 2019

Severity: Medium

Analysis Summary

MalSpam Phishing campaigns have been observed targeting financial organizations to drop malware. The campaigns include:

Emotet Phishing: This campaign drops the emotet malware which is capable of network-wide infection and has advanced features to evade detection.

AMEX themed Phishing This campaign has been going on for a while and resurfaces with new variants every now and then. This phishing email contains an HTML attachment which loads a script from a remote site. Decoding this JavaScript, a phishing form appears requesting the recipients to enter sensitive information like their online account credentials, card number, security code, expiration date, mother’s maiden name, mother’s birth date, birth year, first elementary school name, their security pin, etc.

Impact

  • Network-wide Infection
  • Account compromise

Indicators of Compromise


URLs

https[:]//emiuk[.]org/

Filename

myvtfile.exe

Email Subject

New invoice from Himanshu Khurana

Invoice Attached for Payment

Malware Hash (MD5/SHA1/SH256)

  • f149fcb5b0f7ef28a235cb81d7ee4dbc
  • 3acb33d68f5b39c3f8c083ae81bcba9ab3cfe73d
  • cacca9f46b8a5fc85187b7adee630979
  • 1d437f1bca057040515ca5aeecb2539c15a99c01
  • 7c344293212b1de4798beb0cf70c9bec493460d5befba2eef1ce26a83c04ad2f

Remediation

  • Block threat indicators at their respective controls.
  • Spread phishing awareness among end users.
  • Do not download email attachments coming from unknown sources.
  • Never enter sensitive information on any site unless intended, and always type the legitimate URL instead of following links
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.