September 2, 2024
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Recent Wave of Muddy Water Attacks
November 22, 2019
Rewterz Threat Alert – Login to Unblock Microsoft Excel
November 25, 2019
Rewterz Threat Alert – Recent Wave of Muddy Water Attacks
November 22, 2019
Rewterz Threat Alert – Login to Unblock Microsoft Excel
November 25, 2019
Severity
High
Analysis Summary
The Trickbot banking trojan keeps evolving according to researchers who spotted this week an updated password grabber module that could be used to steal OpenSSH private keys and OpenVPN passwords and configuration files.
TrickBot (also known as Trickster, TrickLoader, and TheTrick) is a modular and constantly updated malware continuously upgraded with new capabilities and modules since October 2016 when it was initially spotted in the wild.
Trickbot just-updated password grabbing module that now targets the OpenSSH and OpenVPN applications was discovered by researchers on a compromised 64-bit Windows 7 device.
The pwgrab64 password grabber module they found is not a new addition, as it was spotted by researchers back in November 2018 while analyzing a variant capable of looting passwords from several web browsers and apps like Google Chrome, Mozilla Firefox, Internet Explorer, Microsoft Edge, Microsoft Outlook, Filezilla, and WinSCP.
In February, this password stealer module got upgraded to grab credentials utilized to authenticate to remote servers using VNC, PuTTY, and Remote Desktop Protocol (RDP).
TrickBot also got updated with Windows Defender circumventing capabilities, was upgraded with a new IcedID proxy module for stealing banking info, and its creators introduced a new module for stealing browser cookies during July.
Impact
Credential theft
Indicators of Compromise
URL
- https[:]//185[.]222[.]202[.]183[:]447/
- https[:]//51[.]89[.]115[.]113[:]447/
- https[:]//81[.]177[.]180[.]252[:]447/
- https[:]//5[.]182[.]211[.]61[:]447/
- https[:]//185[.]99[.]2[.]245[:]447/
- https[:]//5[.]2[.]76[.]193[:]447/
- https[:]//91[.]92[.]136[.]82[:]447/
- https[:]//185[.]203[.]243[.]138[:]447/
- https[:]//146[.]185[.]253[.]170[:]447/
- https[:]//212[.]73[.]150[.]233[:]443/
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.