• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Cryptomining Worms Steals AWS Credentials
August 19, 2020
Rewterz Threat Alert – IcedID Trojan Rebooted with New Evasive Tactics
August 19, 2020

Rewterz Threat Alert – New ‘Duri’ Campaign Uses HTML Smuggling to Deliver Malware

August 19, 2020

Severity

High

Analysis Summary

Researchers have been closely monitoring an attack we are naming “Duri.” Duri leverages HTML smuggling to deliver malicious files to users’ endpoints by evading network security solutions such as sandboxes and legacy proxies. Isolation prevents this attack from infecting the endpoint. The malware that Duri downloads is not new. It has previously been delivered via Dropbox, but the attackers have now displaced Dropbox with other cloud hosting providers and have blended in the HTML smuggling technique to infect endpoints. Once the user clicks on the link, there are multiple levels of redirection before the user lands on an HTML page hosted on duckdns[.]org. The landing page invokes a JavaScript onload that initializes data for a blob object from a base64 encoded variable.

DURI_fig1

A ZIP file is dynamically constructed from the blob object with MIME type as octet/stream and is downloaded to the endpoint. The user still needs to open the ZIP file and execute it.

Impact

  • Security bypass
  • Data breach
  • Exposure of data 

Indicators of Compromise

URL

  • hxxp[:]//huzirh[.]com/hidrol/
  • hxxp[:]//isocamprh[.]com[.]br/
  • hxxp[:]//hxxp[.]plasticospr[.]com/webmailgrupo?nzn11t6c68b5k40ry31c903ez3xaq/formulario_correios_37[.]pdf
  • hxxp[:]//gmpbusdoor[.]com/
  • hxxp[:]//hxxp[.]isocamprh[.]com[.]br/incolajes
  • hxxp[:]//iboxrh[.]com/consultoriarh?1e0wq712tctv0232v000lnjsn4c7a/boleto[.]3673[.]pdf
  • hxxp[:]//www[.]isocamprh[.]com[.]br/incolajes
  • hxxp[:]//hxxp[.]isocamprh[.]com[.]br/incolajes/
  • hxxp[:]//isocamprh[.]com[.]br/incolajes?page=boletos&idBoleto=8868
  • hxxp[:]//hxxp[.]westermarh[.]com/waycompany?WhatsApp_Historico_de_Conversas?whatsapphistorico/index[.]html?visualizar=c06e8cf10aeaf00c33360d2b2bfb6792
  • hxxp[:]//hxxp[.]grentrepostorh[.]com/
  • hxxp[:]//update-completo[.]com/
  • hxxp[:]//plasticospr[.]com/webmailgrupo?fotoswhatsapps/Imagem[.]htmldigitaloceanspaces[.]com/Fotos[.]html
  • hxxp[:]//ultrafarmarh[.]com/transglobal?WhatsApp_Historico_de_Conversas?whatsapphistorico/index[.]html?visualizar=c06e8cf10aeaf00c33360d2b2bfb6792
  • hxxp[:]//hidrolrh[.]com/
  • hxxp[:]//hxxp[.]casadaembalagemriopreto[.]com/officeclean?NZN11T6C68B5K40RY31C903EZ3XAQ/Formulario_Correios_37[.]pdf
  • hxxp[:]//www[.]fjpconstrucoes[.]com/predilecta

Remediation

  • Block all threat indicators at your respective controls.
  • Search for IOCs in your environment. 
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.