Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity: HIGH
Analysis Summary
Security analysts have found a bait document being circulated in the Middle East, designed specifically for Arabic users. It is an Office Word document with malicious macros embedded to drop and execute a backdoor packed by Enigma Virtual Box. It looks like this:
The backdoor program has a built-in keyword list containing names of people or opera movies to communicate with C2, which distributes control commands to further control the victim’s computer device. Investigations suggested that the attack is being carried out by Molerats.
The IP address (198[.]54[.]117[.]244) that took over the C2 domain name is bound with a large number of malicious domain names, and is not controlled by the threat actors currently.
Impact
System Compromise
Malware Infection
Indicators of Compromise
IP(s) / Hostname(s)
198[.]54[.]117[.]244
URLs
smartweb9[.]com
Filename
Malware Hash (MD5/SHA1/SH256)
Remediation