Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
March 15, 2023Severity High Analysis Summary According to researchers, a Golang-based botnet named GoBruteforcer has been discovered, which is specifically targeting web servers running FTP, MySQL, phpMyAdmin, and […]March 15, 2023Severity High Analysis Summary DarkComet RAT (Remote Administration Tool) is a type of malware that is designed to allow attackers to gain remote access to a […]March 15, 2023Severity High Analysis Summary CVE-2023-23410 CVSS:7.8 Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
March 15, 2023Severity High Analysis Summary According to researchers, a Golang-based botnet named GoBruteforcer has been discovered, which is specifically targeting web servers running FTP, MySQL, phpMyAdmin, and […]March 15, 2023Severity High Analysis Summary DarkComet RAT (Remote Administration Tool) is a type of malware that is designed to allow attackers to gain remote access to a […]March 15, 2023Severity High Analysis Summary CVE-2023-23410 CVSS:7.8 Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Rewterz Threat Advisory – GhostEmperor: Chinese-speaking APT Targets Southeast Asia
August 2, 2021Rewterz Threat Alert – Nanocore Rat – Fresh IOCs
August 2, 2021
Severity
Medium
Analysis Summary
Spyware.Vidar is a product that offers threat actors the option to set their preferences for the stolen information. Besides credit card numbers and passwords, Vidar can also scrape an impressive selection of digital wallets. This spyware can be spread using various campaigns. Vidar, which originally became active in late 2018, is a family of malware that operates primarily as an information stealer and is often observed as a precursor to ransomware deployment. It enables the capture and exfiltration of data from a system, including system information, browser data, and credentials.
Impact
- Data exfiltration
- Information theft
- Exposure of sensitive data
Indicators of Compromise
MD5
777acfd08570d14671ed2c930e5dab23
e6ed552b84d437e90031f9fc3d41b62a
0cdbf556d7a79cad46bb1764340f3059
a6585d142ccdd83b02e71251666f8da5
SHA-256
1c33eed32ee64e2abbc1b66486b46f93b5ca61d42e384d3dd49810c73f48147f
fd866b4e18b49ef0232eda27280a0d56a9e408792bba4cddded1961fe64e7bf3
c0a92a6da42fcee96230ff476e66ff5f7c89c2bd958497e3effe44d2278d2a54
6752628c342d3c82cb29c6e3457b70d192893d3a4cafb9bd4d8f46d182ef00e1
SHA-1
1e469fe07643d874cc33f4dc743424616b1c7751
a3ef9269bc3a1c10ab532a4e45e674b90802d435
5b2b6a16656b4555b9c56bde65bd1db7449a6b64
d6439a898b492bd9da93b7a4d988e4a1f8fb9ba4
URL
https[:]//onedrive[.]live[.]com/download?cid=A77E36DF7E14E234&resid=A77E36DF7E14E234%21315&authkey=AP6b
KqoKOJpV7pw
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.