• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert -Malware Campaign Hides Ransomware in Super Mario Wrapper
February 11, 2019
Rewterz Threat Alert – Phishing Campaign Targeting Bank Employees in Pakistan, Forging Zimbra
February 12, 2019

Rewterz Threat Alert – Trickbot Banking Trojan hits North American Banks

February 12, 2019

Analysis Summary

Trickbot Banking Trojan has resurfaced and is being distributed through phishing emails, which are largely targeted towards North American recipients, containing a malicious Excel spreadsheet. Unusually, the subject line and content of the body refer to ACH failures due to erroneous hash totals. Macros need to be enabled for the excel spreadsheet to be able to infect the potential victim. If macros are enabled, a PowerShell script is executed to download the payload and begins the infection process which will result in the Trickbot banking Trojan being installed.

Impact

Loss of sensitive information

server-side injections and redirection attacks

Indicators of Compromise

IP(s) / Hostname(s)

  • 198[.]49[.]66[.]162
  • 199[.]21[.]106[.]189
  • 95[.]213[.]236[.]12
  • 193[.]187[.]172[.]100
  • 85[.]17[.]172[.]227
  • 130[.]185[.]250[.]51
  • 85[.]17[.]76[.]90
  • 95[.]211[.]242[.]194
  • URLs
  • api[.]ipify[.]org
  • ruanova[.]mx
  • tdbankmail[.]com
  • http://ruanova[.]mx/5pe[.]rsac
  • http://api[.]ipify[.]org/
  • http://mastersgb[.]com/5pe[.]rsac
  • http://185[.]68[.]93[.]30/radiance[.]png
  • Email Address
  • Sarah[.]Kochan@tdbankmail.com
  • Email Subject
  • Company ACH file failure
  • Malware Hash (MD5/SHA1/SH256)
  • 8ef0b271f1c851ca8e23d843983ae065
  • c7c71979e360cfdd5615624a9079ceeb849e7320
  • 6e9abf58f8aad7ae634a2e13cc7fdd18babe0d62a5fec60ec62e3754851e5873
  • f998c1d9460b52fdab8502057ee1873b10e10cb355a420d524a972514284452d
  • 46706124d4c65111398296ea85b11c57abffbc903714b9f9f8618b80b49bb0f3
  • 479aa1fa9f1a9af29ed010dbe3b080359508be7055488f2af1d4b10850fe4efc
  • 52bc216a6de00151f32be2b87412b6e13efa5ba6039731680440d756515d3cb9
  • 627a9eb14ecc290fe7fb574200517848e0a992896be68ec459dd263b30c8ca48
  • 8d56f6816f24ec95524d6b434fc25f9aad24a27dbb67eab0106bbd7b4160dc75
  • 9a529b2b77c5c8128c4427066c28ca844ff8ebbd8c3b2da27b8ea129960f861b
  • a515f4f847e8d7b2eb46a855224c8f0e9906435546bb15785b6770f2143bc22a
  • af5ee15f47226687816fc4b61956d78b48f62c43480f14df5115d7e751c3d13d
  • b401a0c3a64c2e5a61070c2ae158d3fcf8ebbb51b33593323cd54bbe03d3de00
  • b8b757c2a3e7ae5bb7d6da9a43877c951fb60dcb606cc925ab0f15cdf43d033b
  • bf50566d7631485a0eab73a9d029e87b096916dfbf07df4af2069fc6eb733183
  • c8c789296cc8219d27b32c78e595d3ad6ee1467d2f451f627ce96782a9ff0c5f
  • cbb5ea4210665c6a3743e2b7c5a29d10af21efddfbab310035c9a14336c71de3
  • dff1c7cddd77b1c644c60e6998b3369720c6a54ce015e0044bbbb65d2db556d5
  • f9ebf40d1228fa240c64d86037f2080588ed67867610aa159b80a553bc55edd7
  • fe0f269a1b248c919c4e36db2d7efd3b9624b46f567edd408c2520ec7ba1c9e4

Remediation

  • Block the IOCs at their respective controls.
  • Make sure your anti-virus is up-to-date.
  • Do not open unexpected emails and do not click on any email attachments unless the sender is a legitimate and trusted source.
  • Do not enable the macros or enable edit to see the document.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.