Rewterz Threat Alert – Anchor Malware Targets Point-of-Sale Infrastructure

Severity

High

Analysis Summary

A new wave of targeted campaigns is detected against financial, manufacturing and retail businesses that began in early October. This campaign started with a TrickBot infection and progressed into a hacking operation targeting sensitive financial systems. This new operation is focused on targeting point of sale (PoS) systems. The campaign leverages a newly discovered malware family called Anchor exclusively for high-profile targets. The campaign shows resemblance to past attacks that were linked to the financially-motivated FIN6 threat actor, a group that is known to target POS systems and has been linked to TrickBot infections in the past. The attacks target POS systems to steal sensitive information by taking over critical assets in the victims’ network. Anchor_DNS is a backdoor that uses the DNS protocol to stealthily communicate with C2 servers. The majority of the initial interactive hacking operation uses the known tools Meterpreter, PowerShell Empire, and Cobalt Strike for reconnaissance and lateral movement.

Impact

• System Takeover
• Information Theft
• Financial loss

Indicators of Compromise

Domain name

• excelestimation[.]com
• nuthetazeta[.]org
• deckmastershousesavers[.]com

Hostname

• www[.]deckmastershousesavers[.]com
• www[.]nuthetazeta[.]org

MD5

• 2d23de0fbb0b0c9d92c9c49d33084cbd
• bae56bd11370d4f8c703c5e6fb0a88d1
• 6ef57f45690c9153c8c7020ef132324b

SHA-256

• 1a2f54a9b467e0aa55a5928f2417b3718f531be4373c30bf6c77019f409312c1
• 80bbe2b16f8f6574b897ae406571ef679acbe35c71bffa8571e338afefab0633
• 8a84715e07e93c6f678a96a4e3b0526bb9fd06e9269be3272169036065fbd97f

Source IP

• 162[.]241[.]218[.]28
• 66[.]147[.]244[.]153
• 50[.]87[.]253[.]47
• 66[.]147[.]242[.]193
• 95[.]216[.]124[.]146

URL

• hxxp://deckmastershousesavers[.]com/
• hxxp://www[.]deckmastershousesavers[.]com/YA7FFJUG[.]exe
• hxxp://nuthetazeta[.]org
• hxxp://nuthetazeta[.]org/
• hxxp://nuthetazeta[.]org/Print_Preview[.]exe
• hxxp://nuthetazeta[.]org/datareceiver[.]php
• hxxp://nuthetazeta[.]org/datareceiver[.]php?hostname=USER%2DPC&osversion=760117601&time=4%3A35%3A39 PM
• hxxp://nuthetazeta[.]org/kjsdfhnv
• hxxp://nuthetazeta[.]org/print_preview[.]exe
• hxxp://excelestimation[.]com/

Remediation

• Block the threat indicators at their respective controls.
• Do not download files/click on links attached in untrusted emails.
• PoS systems can also benefit from whitelisting or locked down systems.