

Rewterz Threat Advisory – CVE-2019-11135 – Intel CPUs Vulnerable to Variant 2 of #ZombieLoad Attack
November 14, 2019
Rewterz Threat Advisory – CVE-2019-13939 – ICS: Siemens Mentor Nucleus Networking Module
November 15, 2019
Rewterz Threat Advisory – CVE-2019-11135 – Intel CPUs Vulnerable to Variant 2 of #ZombieLoad Attack
November 14, 2019
Rewterz Threat Advisory – CVE-2019-13939 – ICS: Siemens Mentor Nucleus Networking Module
November 15, 2019Severity
High
Analysis Summary
Newer TrickBot Version “1077” (JMP+2) is found actively targeting victims. TrickBot is a Banking Malware long known for its malicious usage in different campaigns targeting multiple industries. Recently, new variants have been released with additional capabilities. Aside from its information theft capabilities, it also deletes files located in removable and network drives that have particular extensions, after which the files are replaced with a copy of the malware.

Impact
- Information theft
- Exposure of sensitive information
Indicators of Compromise
MD5
- d2b88f123ef635c5344fee05b3f3f7fb
- f52e16efce974ebb303e9f51057e57c5
SH256
- a2188ff2dcca659807db8898153c88520d41033b8f446ecb932957abb6237abb
- 282ffa30ab335c816cdbd3a411b32b777efd675fe8e0c53704ac9d7d09648b88
SHA1
- 408a9e287e48ce2030da93ae236e76c6afd188e5
- 9c1fb6fae217b0b908c42eae42605f470a3015ce
Source IP
- 198.46.190[.]14
- 37[.]44 [.]212[.]148
- 185[.]65[.]202[.]127
- 193[.]37[.]212[.]246
- 193[.]124[.]191[.]243
- 31[.]148[.]99[.]63
- 94[.]103[.]91[.]61
- 203[.]23[.]128[.]179
- 179[.]43[.]147[.]72
- 93[.]123[.]73[.]192
- 51[.]89[.]115[.]120
- 144[.]91[.]76[.]214
- 46[.]21[.]153[.]81
- 194[.]5[.]250[.]98
- 190[.]154[.]203[.]218
- 178[.]183[.]150[.]169
- 200[.]116[.]199[.]10
- 181[.]113[.]20[.]186
- 187[.]58[.]56[.]26
- 85[.]11[.]116[.]194
- 81[.]190[.]160[.]139
- 200[.]21[.]51[.]38
- 181[.]49[.]61[.]237
- 46[.]174[.]235[.]36
- 91[.]232[.]52[.]187
- 36[.]89[.]85[.]103
- 31[.]128[.]13[.]45
- 186[.]42[.]185[.]10
- 170[.]233[.]120[.]53
- 89[.]228[.]243[.]148
- 31[.]214[.]138[.]207
- 186[.]42[.]98[.]254
- 195[.]93[.]223[.]100
- 181[.]112[.]52[.]26
- 190[.]13[.]160[.]19
- 186[.]47[.]122[.]182
- 186[.]71[.]150[.]23
- 190[.]152[.]4[.]98
- 170[.]82[.]156[.]53
- 131[.]161[.]253[.]190
- 181[.]113[.]114[.]50
- 186[.]47[.]121[.]58
- 185[.]70[.]182[.]162
- 200[.]127[.]121[.]99
- 45[.]235[.]213[.]126
Remediation
- Block the threat indicators at their respective controls.
- Do not download random files from the internet.
- Closely monitor port 443 and 449.