Rewterz Threat Alert – Riltok Banking Trojan Through Smishing and Social Engineering

Severity

Medium

Analysis Summary

A potential victim receives an SMS text containing a malicious link to a fake website (pretending to be a popular ad service). The advertisements attempt to entice the victim into downloading an update for that app. If the victim falls prey to this scheme (allows installation to proceed), they will actually be downloading the banking Trojan. Once installed, the Trojan reaches out to its command and control server in order to receive commands.

Impact

Credential theft

Indicators of Compromise

IP(s) / Hostname(s)

• 100[.]51[.]100[.]00
• 108[.]62[.]118[.]131
• 172[.]81[.]134[.]165
• 172[.]86[.]120[.]207
• 185[.]212[.]128[.]152
• 185[.]212[.]128[.]192
• 185[.]61[.]000[.]108
• 185[.]61[.]138[.]108
• 185[.]61[.]138[.]37
• 188[.]209[.]52[.]101
• 5[.]206[.]225[.]57

URLs

• alr992[.]date
• avito-app[.]pw
• backfround2[.]pw
• background1[.]xyz
• blacksolider93[.]com
• blass9g087[.]com
• brekelter2[.]com
• broplar3hf[.]xyz
• buy-youla[.]ru
• cd78cg210xy0[.]com
• copsoiteess[.]com
• farmatefc93[.]org
• firstclinsop[.]com
• holebrhuhh3[.]com
• holebrhuhh45[.]com
• karambga3j[.]net
• le22999a[.]pw
• leboncoin-bk[.]top
• leboncoin-buy[.]pw
• leboncoin-cz[.]info
• leboncoin-f[.]pw
• leboncoin-jp[.]info
• leboncoin-kp[.]top
• leboncoin-ny[.]info
• leboncoin-ql[.]top
• leboncoin-tr[.]info
• myyoula[.]ru
• sell-avito[.]ru
• sell-youla[.]ru
• sentel8ju67[.]com
• subito-li[.]pw
• subitop[.]pw
• web-gumtree[.]com
• whitehousejosh[.]com
• whitekalgoy3[.]com
• youlaprotect[.]ru

Malware Hash (MD5/SHA1/SH256)

• 0497b6000a7a23e9e9b97472bc2d3799caf49cbbea1627ad4d87ae6e0b7e2a98
• 417fc112cd0610cc8c402742b0baab0a086b5c4164230009e11d34fdeee7d3fa
• 54594edbe9055517da2836199600f682dee07e6b405c6fe4b476627e8d184bfe
• 6e995d68c724f121d43ec2ff59bc4e536192360afa3beaec5646f01094f0b745
• bbc268ca63eeb27e424fec1b3976bab550da304de18e29faff94d9057b1fa25a
• dc3dd9d75120934333496d0a4100252b419ee8fcdab5d74cf343bcb0306c9811
• e3f77ff093f322e139940b33994c5a57ae010b66668668dc4945142a81bcc049
• ebd0a8043434edac261cb25b94f417188a5c0d62b5dd4033f156b890d150a4c5
• f51a27163cb0ddd08caa29d865b9f238848118ba2589626af711330481b352df

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about text/emails sent by unknown senders.
• Never click on the link/ attachments sent by unknown senders.