Rewterz Threat Alert -Malware Campaign Hides Ransomware in Super Mario Wrapper
February 11, 2019Rewterz Threat Alert – Phishing Campaign Targeting Bank Employees in Pakistan, Forging Zimbra
February 12, 2019Analysis Summary
Trickbot Banking Trojan has resurfaced and is being distributed through phishing emails, which are largely targeted towards North American recipients, containing a malicious Excel spreadsheet. Unusually, the subject line and content of the body refer to ACH failures due to erroneous hash totals. Macros need to be enabled for the excel spreadsheet to be able to infect the potential victim. If macros are enabled, a PowerShell script is executed to download the payload and begins the infection process which will result in the Trickbot banking Trojan being installed.
Impact
Loss of sensitive information
server-side injections and redirection attacks
Indicators of Compromise
IP(s) / Hostname(s)
- 198[.]49[.]66[.]162
- 199[.]21[.]106[.]189
- 95[.]213[.]236[.]12
- 193[.]187[.]172[.]100
- 85[.]17[.]172[.]227
- 130[.]185[.]250[.]51
- 85[.]17[.]76[.]90
- 95[.]211[.]242[.]194
- URLs
- api[.]ipify[.]org
- ruanova[.]mx
- tdbankmail[.]com
- http://ruanova[.]mx/5pe[.]rsac
- http://api[.]ipify[.]org/
- http://mastersgb[.]com/5pe[.]rsac
- http://185[.]68[.]93[.]30/radiance[.]png
- Email Address
- Sarah[.]Kochan@tdbankmail.com
- Email Subject
- Company ACH file failure
- Malware Hash (MD5/SHA1/SH256)
- 8ef0b271f1c851ca8e23d843983ae065
- c7c71979e360cfdd5615624a9079ceeb849e7320
- 6e9abf58f8aad7ae634a2e13cc7fdd18babe0d62a5fec60ec62e3754851e5873
- f998c1d9460b52fdab8502057ee1873b10e10cb355a420d524a972514284452d
- 46706124d4c65111398296ea85b11c57abffbc903714b9f9f8618b80b49bb0f3
- 479aa1fa9f1a9af29ed010dbe3b080359508be7055488f2af1d4b10850fe4efc
- 52bc216a6de00151f32be2b87412b6e13efa5ba6039731680440d756515d3cb9
- 627a9eb14ecc290fe7fb574200517848e0a992896be68ec459dd263b30c8ca48
- 8d56f6816f24ec95524d6b434fc25f9aad24a27dbb67eab0106bbd7b4160dc75
- 9a529b2b77c5c8128c4427066c28ca844ff8ebbd8c3b2da27b8ea129960f861b
- a515f4f847e8d7b2eb46a855224c8f0e9906435546bb15785b6770f2143bc22a
- af5ee15f47226687816fc4b61956d78b48f62c43480f14df5115d7e751c3d13d
- b401a0c3a64c2e5a61070c2ae158d3fcf8ebbb51b33593323cd54bbe03d3de00
- b8b757c2a3e7ae5bb7d6da9a43877c951fb60dcb606cc925ab0f15cdf43d033b
- bf50566d7631485a0eab73a9d029e87b096916dfbf07df4af2069fc6eb733183
- c8c789296cc8219d27b32c78e595d3ad6ee1467d2f451f627ce96782a9ff0c5f
- cbb5ea4210665c6a3743e2b7c5a29d10af21efddfbab310035c9a14336c71de3
- dff1c7cddd77b1c644c60e6998b3369720c6a54ce015e0044bbbb65d2db556d5
- f9ebf40d1228fa240c64d86037f2080588ed67867610aa159b80a553bc55edd7
- fe0f269a1b248c919c4e36db2d7efd3b9624b46f567edd408c2520ec7ba1c9e4
Remediation
- Block the IOCs at their respective controls.
- Make sure your anti-virus is up-to-date.
- Do not open unexpected emails and do not click on any email attachments unless the sender is a legitimate and trusted source.
- Do not enable the macros or enable edit to see the document.