March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – ICS: Multiple Siemens Products Security Vulnerabilities
June 10, 2020
Rewterz Threat Alert – Metamorfo Campaign Targeting Banking Customers
June 10, 2020
Rewterz Threat Advisory – ICS: Multiple Siemens Products Security Vulnerabilities
June 10, 2020
Rewterz Threat Alert – Metamorfo Campaign Targeting Banking Customers
June 10, 2020
Severity
High
Analysis Summary
A Netwire campaign targeting Italian industry. As the Netwire variant was common to known samples, the main focus of their reporting on the subject was the unique attack chain used to distribute the RAT. The campaign begins with an Italian language email and XLS attachment. This XLS attachment contains a macro that kicks off the infection chain if a user opts to enable macros. This macro simply downloads what appears to be an image file but instead is an XSL stylesheet containing JavaScript. The contained JavaScript downloads and executes a VBS file hosted on the same server as the fake image file. In turn, the VBS code fetches yet another payload from the remote server. This payload is downloaded as a .jpg and read by the VBS code as raw bytes that will eventually become executable PowerShell code. The PowerShell code provides two functions. First, it loads a DLL that can perform an AMSI bypass. Then, it loads a second DLL that can inject the Netwire payload into another process. Persistence is established via a Registry Run key. As mentioned, the final payload is the Netwire RAT, which provides attackers with the ability to steal information from victim machines, such as credentials, browser history, and keystrokes. The researchers note that similarities exist between the naming conventions of variables in the payloads from this campaign with those in Aggah campaigns targeting the Italian manufacturing industry.
Impact
- Information theft
- Exposure of sensitive data
Indicators of Compromise
MD5
- ce7b8394cdc66149f91ed39ce6c047ee
- 4e4001c6c47d09009eb24ce636bf5906
- 4b8e4d05092389216f947e980ac8a7b9
- ad066878659d1f2d0aee06546d3e500b
- ebe4a3f4ceb6d8f1a0485e3ce4333a7c
SHA-256
- b7e95d0dcedd77ab717a33163af23ab2fd2dc6d07cdf81c5e4cfe080b0946b79
- 818fa737f4041136cde620c3fa3bac5124f60506ef1a64bbc2f8472218039db5
- 48d9c8293d94c851dec10832b2ef6800dc91669e8fef96d8763d17d6b225e42c
SHA1
- 2e0003aeda533f10ef3a69cb6217dbc1da980b9e
- 42b1a3e7891c78f026a9773fad96931ebf8e08cf
- fb7f0880acc174e0c89728783c348cba69315b08
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.