March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – CVE-2023-29338 – Microsoft Visual Studio Code Vulnerability
May 11, 2023
Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs
May 11, 2023
Rewterz Threat Advisory – CVE-2023-29338 – Microsoft Visual Studio Code Vulnerability
May 11, 2023
Rewterz Threat Alert – GuLoader Malspam Campaign – Active IOCs
May 11, 2023
Severity
Medium
Analysis Summary
Nivdort is a type of Trojan horse malware that first appeared in 2013 and primarily targets Windows-based computers. It typically spreads through email attachments or downloads from malicious websites and can perform a range of malicious activities, including stealing sensitive information, downloading additional malware, and participating in botnets.
Nivdort is a complex and sophisticated piece of malware that uses various techniques to evade detection and resist removal, such as encrypting its own code and using rootkit techniques to hide its presence. It can also modify system settings and files to maintain persistence on a system.
One of the most concerning aspects of Nivdort is its ability to steal sensitive information, including login credentials, financial data, and personal information. It can also download additional malware onto infected systems for further attacks.
To protect against Nivdort and other types of malware, individuals and organizations should use reputable antivirus software, avoid suspicious email attachments and downloads, and keep their systems up-to-date with the latest security patches and updates.
Impact
- Unauthorized Access
- Information Theft
Indicators of Compromise
Domain Name
eveningladder.net
MD5
- 603d91534195cdd4ded3844217744759
SHA-256
- b310f2a41360cf9f5ec82fee3686560259c9619fbc1b82d91ab2c3c72fb65340
SHA-1
- 63284f5484e98e50f7da671cea85f4383a677d6f
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
- Patch and upgrade any platforms and software timely and make it into a standard security policy.
- Enforced Access Management Policies.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.