Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
FortiGuard Labs came across an interesting tweet from the security researcher @h4ckak about a suspicious file that looks to be a decoy file in an APT campaign. Upon digging deeper and found that this file might be part of a new BadPatch campaign. BadPatch is a tag used for a set of malware that was used in a campaign with a possible link to the Gaza hackers group which was first reported in 2017. This group has been involved in an espionage campaign targeting the Middle East since 2012 based on the compilation timestamp of the first malware discovered. Since then, BadPatch has gone off our radar for almost two years.
This malware is a multi-component python-compiled malware that has the capability to steal and exfiltrate data from targeted victims. We will also be discussing some patterns as proof of this malware’s possible link to BadPatch.
The attack sample uploaded to VirusTotal is an executable file named ???? ??????? ???? ????? .scr (Prime Minister Mohammad Ishtayeh .scr). Although we didn’t find the initial vector from which this file came, we believe that it was distributed as an attachment to spam emails, similar to previous BadPatch attacks.
This executable file is an SFX executable containing two files:
When executed, this file opens the decoy .doc file, which contains text that looks like it was drawn from a news article from Sama News.
It also executes the file d.exe, which only works on 64-bit Windows machine. We believe, though, that a 32-bit version may also exist as other component files. The d.exe file is responsible for downloading three files.
SHA256