Rewterz Threat Alert – Nivdort Malware – Active IOCs

Severity

High

Analysis Summary

Nivdort is a notorious and sophisticated strain of malware that has been active in the cyber threat landscape for several years. It typically spreads through various means, including malicious email attachments, drive-by downloads, compromised websites, and social engineering tactics. It often disguises itself as legitimate files or software to deceive users into executing it. Nivdort is a complex and sophisticated piece of malware that uses various techniques to evade detection and resist removal, such as encrypting its own code and using rootkit techniques to hide its presence. It can also modify system settings and files to maintain persistence on a system.

One of the most concerning aspects of Nivdort is its ability to steal sensitive information, including login credentials, financial data, and personal information. It can also download additional malware onto infected systems for further attacks.

To protect against Nivdort and other types of malware, individuals and organizations should use reputable antivirus software, avoid suspicious email attachments and downloads, and keep their systems up-to-date with the latest security patches and updates.

Impact

• Unauthorized Access
• Information Theft

Indicators of Compromise

Domain Name

winterfortieth.net

MD5

• e27d5d4a623da4d0305378516c33d9a0

SHA-256

• 00a52b729d6dfa0bf7b94756a2ac07f90b42d7bbeb23dc4d0867dadcebc5fd9b

SHA-1

• 89fb3a0c8a960f2d2c9dd451262be5a9148e5bc0

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Enforced Access Management Policies.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.