Rewterz Threat Alert – TA505 Packed Samples – IoCs

Severity

High

Analysis Summary

TA505 malware samples are being detected after a short break, as this threat group had been highly active since late June until late September. Threat Actors make use of packers when distributing their malware as they remain an effective way to evade detection and to make them more difficult to analyze. Packed samples are found being distributed. TA505 is a prolific cybercriminal group known for its attacks against multiple financial institutions and retail companies using malicious spam campaigns and different malware. In this latest campaign, samples of AZORult information Stealer have been detected. Malware is usually deployed by this threat actor via Office Template Macros leading to the malware. This also allows threat actors to gain access to the compromised network, providing opportunities to steal financial data or install ransomware. TA505 aka EvilCorp is found consistently targeting financial institutions around the world.

Impact

• Credential Theft
• Unauthorized Access
• Information Theft
• Financial Loss
• Detection Evasion

Indicators of Compromise

MD5

• ccdc3f83d847daf09e6c10be46b63b2e
• ca8d09ed7231b32c14128127c55e571e
• b65646fd89d5860c470112417a54fb2f
• 4b2eb480398c2e40628ad79d5086b2dd
• ae8a3d4c59c7cc5093965d8bd1f075b7
• b891d06dd4d1d0bb1ae4fe6c8fead8e4
• 692c4e4db4aaec596dc570b1f12b8c2a
• 8a72e59ec862f246e95e5076a981b608

SHA-256

• e4eb1a831a8cc7402c8e0a898effd3fb966a9ee1a22bce9ddc3e44e574fe8c5e
• bb5054f0ec4e6980f65fb9329a0b5acec1ed936053c3ef0938b5fa02a9daf7ee
• ad320839e01df160c5feb0e89131521719a65ab11c952f33e03d802ecee3f51f
• 74c5ae5e64d0a850eb0ebe3cbca4c6b92918a8365f2f78306643be9cffc32def
• 6d15cd4cadac81ee44013d1ad32c18a27ccd38671dee051fb58b5786bc0fa7d3
• 6831fc67ca09d9027fef8b3031a11e9595fc1df1cb547c6f587947d13dad151a
• 4b0eafcb1ec03ff3faccd2c0f465f5ac5824145d00e08035f57067a40cd179d2
• 103084a964d0b150e1268c8a1a9d8c2545f7f0721e78a1b98b74304320aeb547

SHA1

• 6bb4c9540ee6ef244d2a830ca939094ae7e412a9
• 998cb01b909746a9360ed9366d51e57e9f0b82d5
• 57d589642b57f034cd1439fee637f0325cf5b4da
• 5eaf713adb790326849f286bac996a6881a194d8
• f8f4ae7cc639e7986e0728e48ae718d2f901fe42
• ffea934bd037c8e7213241d5bd78d758bfd3ca69
• ebe279adc0735a091ebe880b2c33f60f02ce23a8
• 8a8bef662216f212186b3e6020bc62b7c52f5643

Remediation

• Block the threat indicators at their respective controls.
• Do not download attachments from untrusted emails.