• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – MINEBRIDGE Targets Finance Sector
February 7, 2020
Rewterz Threat Alert – Espionage Campaign targeting Malaysia Government Officials
February 10, 2020

Rewterz Threat Alert – Emotet/TrickBot Malware Recent Samples – IoCs

February 10, 2020

Severity

High

Analysis Summary

Emotet is a Trojan that is primarily spread through spam emails (malspam). The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails may contain familiar branding designed to look like a legitimate email. Emotet may try to persuade users to click the malicious files by using tempting language and click baits like “Your Invoice,” “Payment Details,” or possibly an upcoming shipment from well-known parcel companies. A fresher campaign is discovered distributing both the Emotet and the Trickbot malware. Indicators of compromise are given below.

Impact

  • Credential theft
  • Exposure of sensitive information
  • Unauthorized Remote Access

Indicators of Compromise

MD5

  • 1044750deccfe551caff847a98eb4b17
  • 9ee1b22b752f25be9182a5d04cf90b3c
  • c17722b468222c45bab8e6cdc83b0748
  • 6b8ba6c385b150bf788faea38b3bf6d8

SHA-256

  • 4ebe60b05162d6264ec0034d02e3ab01e062510a0f4344abbdc17524242d9a73
  • 2a1fd547e8236424e46fa2482d3db48dc7de8e6efe84397ccc9582055e268e69
  • 061dae2be3b5b2bf9c7fc9a16a92d6031e5dbda377b97e9f7371598ac67593f1
  • 72a7981d188c5f8cfc12ea991cb8a4e968993cb63a9fedda6616766e0d2ee6d0

Source IP

  • 51[.]159[.]23[.]217
  • 66[.]85[.]173[.]43
  • 193[.]26[.]217[.]243
  • 71[.]126[.]247[.]90
  • 164[.]68[.]120[.]56
  • 64[.]71[.]35[.]51
  • 187[.]190[.]47[.]173
  • 188[.]227[.]84[.]209
  • 45[.]79[.]223[.]161
  • 91[.]236[.]4[.]234
  • 172[.]221[.]229[.]86
  • 123[.]31[.]31[.]47
  • 203[.]176[.]135[.]102
  • 98[.]239[.]119[.]52
  • 120[.]151[.]194[.]117
  • 195[.]123[.]219[.]69
  • 195[.]123[.]240[.]37
  • 80[.]86[.]91[.]91

URL

  • http[:]//msek[.]lviv[.]ua/wp-includes/report/
  • http[:]//msek[.]lviv[.]ua/
  • http[:]//ingarden[.]lviv[.]ua/

Remediation

  • Block the threat indicators at their respective controls.
  • Do not download email attachments from untrusted emails.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.