Rewterz Threat Alert – Vendetta Group’s COVID-19 Phishing Emails

Severity

Medium

Analysis Summary

Vendetta group is a prolific group focused on email campaigns mainly based on the Covid-19. Their targets are distributed all over the world and their attacks have been detected in countries such as Australia, Mexico, Egypt, Romania, Austria or China. Vendetta chooses targets from the technological, business and government sectors that handle sensitive information. They have showed remarkable skills during this phase. The use of COVID-19 themes as a lure has been a consistent tactic in their campaigns since their appearance. The most recent campaign indicates a clear intent to victimize users in Taiwan based on the content and language. The email claims that the attachment contains information regarding making an appointment for testing at the Taiwan CDC. The researchers note the email was high quality and indicated sophisticated targeting, unlike most phishing emails which contain grammatical mistakes or appear to be fake. Attached in the email is an ISO containing a packed .NET executable identified as RoboSki. RoboSki, upon execution, runs a DLL file in memory that extracts shell code from an embedded PNG image. The shell code, in turn, drops the next payload in memory, the ReZer0 malware. This kicks off a chain of payload executions in memory leading to the final payload, which in this campaign is the Remcos RAT. Attribution to the Vendetta group is based on the infection chain, PDB path indicators, shared infrastructure, and other similarities. Other campaigns by the group distribute other RATs and information stealers different like Nanocore, Arkei etc.

Impact

• Information Theft
• Unauthorized Remote access
• System takeover

Indicators of Compromise

MD5

• f3823acd3e8a4dcf21da8c206e13f257
• 62d2c5f606e9f2e19dea14690bdf3929
• c1500911b0595cda6cfda1f5d2da5d41
• 4980ec330062a006d8cf4c70a036514a
• 3f5d99abf7520b9a9f2a2d0428e86cce
• e720d68bfb21ef9e1d1f1a351b27a23f
• c42ee85b50ff14e27eec730278d34b89
• a0eaf52016fd686336b02772befc9bd3
• ac7b352486eeeba78146b3643d0f29e8
• a703eddc151334c7cb9d76411e7867f8
• 0f3feea28e99381970d9f50a49d58a74
• 0362f695e45afe0c5887851ea87d46c7

SHA-256

• b2bccd13743ac9153a8b731af82d6b19fa7395dd16596a3b5f783f1092419c3a
• dcaf6aed333996a431610306d24a90e7bb27035cdeb93901c1e1b00626877e78
• f4f76522a5a1a8f056d53bfea97293f503b6bc703cf37ff60dd8b47f47ecaaaa
• 0f525a06128b217d0081ee6d81a2d2fe04e9ecd20cf0e0fa7c99aaa9ed83154d
• bbf20efcdbae1950b49b4f121f17baee19a5d638983e96a954bd6e602fb35b16
• 713c780c42db40b3456b797e578c889f19a915441a428277aaa8235dfecd0142
• c315112980543e9046f7b3167586d3a5ba25734aac85679542adaca7867f3ef7
• b26960e8083466e40ebbfcc6dfe93c4080a516d6260e1a2900ce7649fc44442e
• 147e92a20eaa350aef112cd3110af132aa9667af4e8eb90d345d4b7da8cea95c
• bcaf5698e3d5291c284e0ea40deec27e69c4942049f1c90a4e334e066485dfa9
• 9fbb3df3c9b58626be3f9e66e8b4abd811a8069839374ade15cc405eb3b4d816
• 080ff06496d8b6b5e6307059e378ed7052e381a6f130d89385c778edf32ae996
• 19b5353bf8a69a64536c865a4890b69ee1dcd59445968e1cfd94c62e1a97b11e
• d5d3cf535b3313077956d5708225cf8029b039ed0652ee670ce25ea80d2b00c0
• 51b0165fba9cf8e0b7bfebdc33e083ecc44d37cdbb15b5159b88b71e52b0255b
• 0aa87ed22e193e1c6aa9944cf1b9e88ec4ae6a5b3f975e3fb72c0f5b06b864f2

SHA1

• 2b2f21f38913e6480f12b8c338cb0f50c04da986
• 8b6fb59040065545350eb2ed4c183ddb7e5647d8
• a8f6edbaa89c0b9b576b1b2a013f501b75af2ce8
• 1c0cf119996580e67608a27ca354662ddd33ceb6
• 7c611407c1d499e3d050eba3f6881aced62436b4
• 4194f65b0166ff63b250141949e5540c269ef51f
• 98f1a9eff1ad1e2f274ac4100e6670f2e95431c6
• 8becce5944bd5568f860dd37f7a371e16e4b9f4c
• 6816640db9fe701732b02280f09ee2baa8ef2eeb
• 337b8837f71dd5cadf791ebf05e46e0918b488af
• fcd655242f18ec6adc00d57424e62acee797d38d
• 3aea3327ee6f8ce0d28f19cba9a09d16c3f694d2

Source IP

• 172[.]111[.]188[.]199

Remediation

• Block the threat indicators at their respective controls.
• Ensure employee awareness against phishing campaigns. 
• Do not download files attached in untrusted emails even if they look legitimate.