• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Hybrid Composer plugin for WordPress security bypass
July 26, 2019
Rewterz Threat Alert – Java ATM Malware: The Insider Threat Phantom
July 30, 2019

Rewterz Threat Alert – Formbook Malware Phishing Campaign

July 30, 2019

Severity

Medium

Analysis Summary

A new campaign that uses the Formbook malware, masquerading as an order inquiry through phishing emails.

Initial point of infections sources from a phishing email:

image-1564471385.png

Inside this email is a malicious word document that contains a highly obfuscated macro that once executed launches PowerShell. It then downloads and executes the “cripted.exe” file which is the final stage Formbook malware. PowerShell is also utilized to execute the Microsoft .Net C compiler, to create future code for the malware. Formbook is a notorious information stealer that is available for purchase on underground markets. Many of its capability include:

  • Key logging
  • Clipboard monitoring
  • Grabbing HTTP/HTTPS/SPDY/HTTP2 forms and network requests
  • Grabbing passwords from browsers and email clients
  • Screenshots

The malware also includes anti-detection and anti-virus evasion techniques that make it difficult to detect and triage on the infected machine. IBM X-Force IRIS will continue to monitor the campaign and will update this collection if new information becomes available.

Impact

Exposure of sensitive information

Indicators of Compromise

Malware Hash (MD5/SHA1/SH256)

  • C60270131A806EBC96998A610FB99194
  • 5e343cf889994324a4232666cab81a49a41aa99cb48e2efb1593a5c79e18010e
  • 8d644d27a9332b773dce7307b348c09e

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the link/attachments sent by unknown senders.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.