• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Sodinokibi Ransomware Spreads via Fake Forums on Hacked Sites
September 3, 2019
Rewterz Threat Alert – Nemty Ransomware Gets Distribution from RIG Exploit Kit
September 3, 2019

Rewterz Threat Alert – Fake BleachBit Website Distributes AZORult Info Stealer

September 3, 2019

Severity

Medium

Analysis Summary

Some cyber criminals have created a web page impersonating the official website of a tool called BleachBit. The cyber criminals spread the AZORult information stealer in the name of this tool. BleachBit is a tool that helps Windows, Linux, and macOS users reclaim disk space by deleting disposable data and has more than one million downloads on Sourceforge.

AZORult is a stealer built to collect various types of sensitive data from an infected computer such as browser history, saved logins, stored credentials in FTP clients, desktop and text files, and more. When designing the malicious site, the domain bleachbitcleaner[.]com was used to appear legitimate. The webpage has only one link available which leads to AZORult, along with the embedded video tutorial for a beta version of the program released in 2009. Data is taken from infected computers to twooo[.]cn.

Once installed, AZORult contacts its command and control (C2) server for instructions. It can collect browser history, login credentials, cookies, and files in specific locations. Fooled users download a ZIP archive from Dropbox which steals a victim’s data on execution and uploads it to the attacker’s command and control servers.

Attack vector for this attack is still unclear. Threat actors may get victims to visit the fake webpage via search engines or manually push the fake website on support forums. They may also target users looking to securely erase sensitive data. They could also use phishing emails and push the link through email attachments.

Impact

  • Credential Theft
  • Disclosure of sensitive Information

Indicators of Compromise

URLs

  • twooo[.]cn
  • bleachbitcleaner[.]com
  • http://5[.]188[.]60[.]32


Malware Hash (MD5/SHA1/SH256)

  • 97c016bab36a85ca830376ec48c7e70ee25edbb55f626aee6219ade7468cee19
  • f291c822ee0c5655b2900f1c8881e415
  • e2abc062bf67676adaaaea235c9b8f1619358447ed6c333b40affb7606571e09
  • a5dbc83ea73adcb51677017f3718f587

Remediation

  • Block the threat indicators at their respective controls.
  • Make sure to download all software from their legitimate sources.
  • Do not execute files without proper scanning.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.