March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Advisory – CVE-2019-10974 – NREL EnergyPlus Denial of Service and Code Execution Vulnerability
July 24, 2019
Rewterz Threat Advisory – CVE-2018-0105 – Cisco Enterprise License Manager Information Disclosure Vulnerability
July 24, 2019
Rewterz Threat Advisory – CVE-2019-10974 – NREL EnergyPlus Denial of Service and Code Execution Vulnerability
July 24, 2019
Rewterz Threat Advisory – CVE-2018-0105 – Cisco Enterprise License Manager Information Disclosure Vulnerability
July 24, 2019
Severity
Medium
Analysis Summary
A white paper was published by Yoroi exploring the risks that users can encounter when downloading materials from P2P sharing network, such as the Torrent one. They discussed how crooks easily lure their victims to download malware along with the desired content.
Technical Analysis
As anticipated, the file downloaded from the BitTorrent network is an executable. A quick recon revealed it actually is an SFX archive containing several other files.
The archive contains more than a dozen of files. In detail it embeds:
- 16 temporary files used during execution;
- a Visual Basic Script;
- a batch script;
- and a setup file
It is possible to see the SFX configuration file. After the auto-extraction, the first file run is “run.vbs”. Its content is minimal and quickly redirect the execution to a small batch file, “installer.bat” contained in the same folder. Then it runs installer.bat (the filename) with the parameter “0? (WindowStyle hidden, to avoid hidden windows because it may trigger AntiViruses heuristics) and “true” (WaitOnReturn).
The content of “installer.bat” file is also minimal and points to a more complex text file “007.tmp”, later renamed as “007.bat”.
Impact
Exposure of sensitive information
Indicators of Compromise
Malware Hash (MD5/SHA1/SH256)
- 552a4cbd2628d16d1fc910c9fc24bc426cafdf0f755f7b4013484adbc0393ca7
- 73bc41504045e4e6de1b63ec40433afabf316141b1289c69905ee946e1b1a263
- 746d17e8d0b961f0c7733f155152fa54d2610fc6d117217d24f32d3ad370075e
- 7bd25bd3c0f003ffea67c846b4fefd8fb8b4f72d836544d0ef786c5c6c63b422
- a3574e73234e18be8d233c9e3fa3819600fc40341d8be8fc4449e4e73632ad6d
- b6080b2786d2e4ac30207fb2f177046cfd40fa6578c56f3dfd13abab7d62e2ea
- f9b2e61200addf760d7bd157c73201e97257b12d5177837a1bffb98f4064e76a
Remediation
- Always research before downloading any software from internet.
- Always scan your files.
- Always download from the publisher’s site.