Rewterz Threat Alert – Nivdort Malware – Active IOCs

Severity

Medium

Analysis Summary

Nivdort is a type of Trojan horse malware that first appeared in 2013 and primarily targets Windows-based computers. It typically spreads through email attachments or downloads from malicious websites and can perform a range of malicious activities, including stealing sensitive information, downloading additional malware, and participating in botnets.

Nivdort is a complex and sophisticated piece of malware that uses various techniques to evade detection and resist removal, such as encrypting its own code and using rootkit techniques to hide its presence. It can also modify system settings and files to maintain persistence on a system.

One of the most concerning aspects of Nivdort is its ability to steal sensitive information, including login credentials, financial data, and personal information. It can also download additional malware onto infected systems for further attacks.

To protect against Nivdort and other types of malware, individuals and organizations should use reputable antivirus software, avoid suspicious email attachments and downloads, and keep their systems up-to-date with the latest security patches and updates.

Impact

• Unauthorized Access
• Information Theft

Indicators of Compromise

Domain Name

eveningladder.net

MD5

• 603d91534195cdd4ded3844217744759

SHA-256

• b310f2a41360cf9f5ec82fee3686560259c9619fbc1b82d91ab2c3c72fb65340

SHA-1

• 63284f5484e98e50f7da671cea85f4383a677d6f

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Enforced Access Management Policies.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.