• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2022-29402 – TP-Link TL-WR840N EU Vulnerability
May 30, 2022
Rewterz Threat Alert – Ursnif Banking Trojan – Active IOCs
May 30, 2022

Rewterz Threat Alert – Zeppelin Ransomware – Active IOCs

May 30, 2022

Severity

High

Analysis Summary

Zeppelin most commonly is distributed through phishing emails with macro-enabled documents attached, although it has also been known to spread via malvertising and RDP. Once on the system, Zeppelin leverages the same memory allocation techniques to run its payload in memory. In terms of the decryption routine, Zeppelin has evolved to load APIs onto the stack and implements additional obfuscation techniques. Both Buran and Zeppelin perform geolocation checks prior to proceeding with encryption, avoiding encrypting hosts located in Ukraine, Belarus, Kazakhstan, or Russia. For storing configuration data, a Registry key is created. The earliest versions of Zeppelin included the “Buran” keyword in the Registry key name, but have since switched to using “Zeppelin.” Zeppelin is also capable of creating persistence via a Registry Run key. Multiple instances of the executable are run, each with a different purpose. For example, one terminates processes associated with important files while also running Clipbanker to monitor the clipboard, while another is responsible for encryption of files. During encryption, both Buran and Zeppelin use add an infection marker to encrypted files. Finally, both drop a ransom note and open it using notepad.exe.

Impact

  • File Encryption

Indicators of Compromise

MD5

  • 260441ed9d2a0fb7db58c1b904c7c374

SHA-256

  • d67091e8079d0dcf4f3962628e4f7520309a8111750082218c3be89a8fa70e3d

SHA-1

  • b0c88807180389872df34dd98b1e3bdbc1a6f6e9

Remediation

  • Block all threat indicators at your respective controls
  • Search for IOCs in your environment.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.