Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
A Remcos RAT being delivered by a recently identified phishing campaign. This remote access tool was initially observed back in 2016 and was sold on various hacking sites and hacking forums. It still remains active and in use by threat actors to this day. In this case study, it was observed being distributed via email in a phishing campaign. The adversary attempts to entice a potential victim into believing that the email contains an invoice which needs to be reviewed. The infection process begins once a user opens the malicious attachment (order201900512.ace). Once the malware has been successfully installed on a victim’s system, the adversary will have full remote control of that system. The email comes from a legitimate domain and the subject was seen as “RE: NEW ORDER 573923”. The malware itself makes use of an obfuscated AutoIt wrapper that possesses anti-debugging capabilities used to make being detected difficult.
System access
Filename
order201900512.ace
Email Address
rud-division@alkuhaimi.com
Email Subject
RE: NEW ORDER 573923
Malware Hash (MD5/SHA1/SH256)
Remediation