Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
The use of Microsoft SQL queries to retrieve next-stage payloads has been relatively rare as a form of malware distribution. Using this tactic, new Microsoft Office macros are found acting as a staged downloader called “WhiteShadow.” WhiteShadow has been resurfacing in multiple campaigns with evolving evasion techniques.
Below is an example of one such campaign:
When recipients open malicious attached documents and activate macros, WhiteShadow operates by executing SQL queries against attacker-controlled Microsoft SQL Server databases.
Once retrieved, the macro decodes the string and writes it to disk as a PKZip archive of a Windows executable. Once extracted by the macro, the executable is run on the system to start installing malware, which is determined by the actor based on the script configuration stored in the malicious Microsoft Office attachments.
Series of malicious email campaigns distributing Microsoft Word and Microsoft Excel attachments containing the WhiteShadow downloader Visual Basic macro have been retrieved. Below is a visual infection chain of WhiteShadow.
IP(s) / Hostname(s)
URLs
Malware Hash (MD5/SHA1/SH256)