Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
A phishing campaign using Google Docs links to evade email gateway detection and distribute TrickBot. The emails are sent via the legitimate Google Docs services, which means the content is a legitimate shared file notification from Google and contains only Google links. The message from the sender claims to be regarding a previously sent document that needs to be viewed. If a user falls for the lure, they are directed to a Google Docs file hosted on the genuine Google service. The content of the document is a fake 404 error and a link to an executable hosted on Google Drive. The file masquerades as a PDF in order to trick a user into opening it. If it is opened, it first creates a copy of itself in the ProgramData folder and an additional copy in a subfolder of the User AppData directory, which also contains the TrickBot configuration. Persistence is established via a scheduled task that executes the payload every 11 minutes. Finally, it hollows out svchost.exe to inject the malicious code. Additional svchost processes are continually spawned to run various TrickBot modules.
Security Bypass
IP(s) / Hostname(s)
URLs
Malware Hash (MD5/SHA1/SH256)