Rewterz Threat Advisory – CVE-2018-17937 – gpsd, microjson Stack-Based Buffer Overflow Vulnerability
February 15, 2019Rewterz Threat Alert – ‘Transaction Refund’ Phishing campaign dropping malicious links
February 19, 2019Severity: Medium
Analysis Summary
MalSpam Phishing campaigns have been observed targeting financial organizations to drop malware. The campaigns include:
Emotet Phishing: This campaign drops the emotet malware which is capable of network-wide infection and has advanced features to evade detection.
AMEX themed Phishing This campaign has been going on for a while and resurfaces with new variants every now and then. This phishing email contains an HTML attachment which loads a script from a remote site. Decoding this JavaScript, a phishing form appears requesting the recipients to enter sensitive information like their online account credentials, card number, security code, expiration date, mother’s maiden name, mother’s birth date, birth year, first elementary school name, their security pin, etc.
Impact
- Network-wide Infection
- Account compromise
Indicators of Compromise
URLs
https[:]//emiuk[.]org/
Filename
myvtfile.exe
Email Subject
New invoice from Himanshu Khurana
Invoice Attached for Payment
Malware Hash (MD5/SHA1/SH256)
- f149fcb5b0f7ef28a235cb81d7ee4dbc
- 3acb33d68f5b39c3f8c083ae81bcba9ab3cfe73d
- cacca9f46b8a5fc85187b7adee630979
- 1d437f1bca057040515ca5aeecb2539c15a99c01
- 7c344293212b1de4798beb0cf70c9bec493460d5befba2eef1ce26a83c04ad2f
Remediation
- Block threat indicators at their respective controls.
- Spread phishing awareness among end users.
- Do not download email attachments coming from unknown sources.
- Never enter sensitive information on any site unless intended, and always type the legitimate URL instead of following links