Rewterz Threat Alert – TA505 Impersonates Airlines

Severity

Medium

Analysis Summary

Threat actor TA505 is impersonating Airlines disguising as domestic e-ticket (e-ticket) certificates from the morning of July 25, ahead of the summer vacation season.

The attacker is the ‘** Airline e-Ticket Certificate.’ , And using the sophisticated Korean language in the body of the e-mail content, the e-mail recipient is encouraged to open the attached file.

Attached file is’ e-ticket (random number) .iso ‘file name is attached to the compressed file, the icon and extension when decompressed as a PDF document disguised as a screen saver file’ e-ticket certificate _66016630.pdf. scr ‘or’ L207123.lnk ‘will be downloaded.

The ‘e-ticket voucher _66016630.pdf.scr’ file is malicious code based on .Net. The C2 server acts as an additional payload download.

Impact

• System Access
• Exposure of sensitive information

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

• 0571bb4ecf3dbf5d5185eabd7d03d455
• 1d87a127b31c8a67f6902bdc6366374b
• 22e41b97813c028fd7c4ae6d32572534
• 279215fc358060825372c2de68dd5c4f
• 3f45a8fbec15305de1d4a296006c5b01
• 44215ae4681773954b404ddfae416248
• 4d0511050aa5e48d3cac0e697e168fb3
• 57484338303a48dffadf466f74db4bab
• 5f6c61cccf8cb547a3979e1d49a7ef81
• 62b1ad72a7cb1699cebe7b71518f65be
• 7928e36c8a45f98d5adf2016740b77eb
• 91bce06fe0ee40afb9ba7ea12ae00a77
• ad78c04d0e7990d32d09becb82426d37
• c3e961ad583d9c4bd3892456eb6516d5
• c43496f70be5263a4bab6c853e610951
• c9ce180f2fa6097798224c7cc3abdfaf
• cf07da2872c29a4682380a66080fcd61
• d6438345c12dd000ff2d55a7a3b8ccb6
• deb3a3d09a656ac14eb83574d2fcd2b3
• f834018fee0597d8be54b7174bc5048d

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the link/attachments sent by unknown senders.