March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – Multiple Vulnerabilities in Firefox Exploited in the Wild
April 6, 2020
Rewterz Threat Alert – Trickbot Banking Trojan Delivered via Malspam – IoCs
April 6, 2020
Rewterz Threat Advisory – Multiple Vulnerabilities in Firefox Exploited in the Wild
April 6, 2020
Rewterz Threat Alert – Trickbot Banking Trojan Delivered via Malspam – IoCs
April 6, 2020
Severity
Medium
Analysis Summary
NetWire RAT is a is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012. In this scenario the NetWire RAT is distributed via through GuLoader.using Microsoft Word documents. The chain starts with fake email which contains a web link for a Microsoft Word document. The word document has macro code that retrieves a Windows executable for GuLoader. The executable retrieves an encrypted data file used for NetWire.
In previous campaigns of Netwire RAT the same procedure has been used to kickoff the infection chain and similar fake emails were followed up with the web links for the users to click on the malicious attachments and lures for malspam pushing NetWIre RAT.
Impact
- Information theft
- Exposure of sensitive data
Indicators of Compromise
MD5
- ae1a12d04352572a7c426a0653bd0996
- 343c3b31aa339ce68e8f7a9454e27e07
- 5599333a0dc6a4f1d5dcafaab6840216
SHA-256
- cc554633c0b734778211a6289e1d6d383d734a3e1a8edeb13d6d0fafc8a2f162
- 661d9c0c23e9c17412eee8d72cc1bb66c1b4e5f73908c8cce48f89420f38b205
- aadc6031fed895de570214afb8b6cdc66f17d01f1df0407f4d57f1d04313ae2b
- 4d373131b0d3254d72f1a06ea168267376b8cc8f805daa53963db5f051631967
- c87e798118a539a136baa0bb9d2539a6e074b0ee640cf0a4ed1ef17936f69ebf
SHA1
- 203d5a5fe71d2d733d9cf9204aeb7e9661410a5a
- 4df8eadb7f64f6582cc6a684586c8b474f077032
- dccc69b8025bfecb73da72853747d1eb5fbf5a73
URL
- http[:]//wwwrossogatocom/ROSSO_encrypted_54E9BA0bin
- http[:]//wwwartizaacom/Andys_18US_Taxdoc
- http[:]//matpincscrcom/tec_encrypted_340BD0bin
- http[:]//saidialxocom/lpexe
- http[:]//murthydigitalscom/PM_2019_Screen_18_Tax_Filedoc
- http[:]//ptgteftcom/Exten/TY1920/TY30exe
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.