Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
IBM X-Force IRIS responded to an incident in a financial services customer in southeast Asia that we assess with high confidence was perpetrated by ITG03. During this engagement, IRIS was able to observe several unreported malware and tools used by ITG03 to conduct specific actions which indicate the adversary was interested in accessing the SWIFT environment of the institution. One tool, a listener backdoor, included a set of command capabilities that is virtually identical to other command sets we have analyzed in their custom-coded malware employed against different targets. Specifically, the commands for downloading and time-stomping files, secure file/directory deletion and the proxy capabilities in addition to the other commands are a strong signature of ITG03 custom trojans. The sample svchost.exe is a backdoor that listens to port 443 (SSL port). The port can be overridden by specifying a port number in the command line arguments using the -F parameter. The backdoor listens for and accepts commands from a C2 and contains the capabilities to remotely access files, processes, execute commands, and download and upload data. The binary can also connect to a remote server by specifying an address with the -C parameter.
Financial loss
Malware Hashes : MD5