• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Winnti Group’s skip 2.0: A Microsoft SQL Server backdoor
October 22, 2019
Rewterz Threat Alert – Hackers Leverage Insecure VPN Profile to Breach Avast Antivirus Network
October 22, 2019

Rewterz Threat Alert – Gustuff Banking Trojan Uses New Tactics

October 22, 2019

Severity

High

Analysis Summary

The Gustuff Banking Trojan is now coming with the addition of a “poor man scripting engine” based on JavaScript that provides the operator with the ability to execute scripts while using its own internal commands backed by the power of JavaScript language. The actors have eventually disabled the C2. Campaigns have been detected running via Instagram, Facebook and SMS that aimed to deploy the Gustuff Trojan. The malware is targeting financial institutions in Australia. In addition the malware uses useless targets to send propagation SMS messages. Each target is requested to send SMSs at a rate of 300 per hour. The list of anti-virus/anti-malware software that Gustuff blocks as a self-defense mechanism is now also loaded during the activation cycle, as below.

image4.png

The threat actors are targeting Australian banks and digital currency wallets. This new version seems to target hiring sites’ mobile apps. It comes with dynamic loading of webviews. It can receive a command to create a webview targeting specific domains, while fetching the necessary injections from a remote server. It also appears to be targeting credentials used on the official Australian government’s web portal.

During the activation cycle, the malware now asks the user to update their credit card information without immediately showing a panel for the user to provide the information. Instead, it will wait for the user to do it and — leveraging the Android Accessibility API — will harvest it. 

Impact

  • Credential Theft
  • Theft from digital currency wallets
  • Financial loss

Indicators of Compromise

Domain Name

  • instagram-shared[.]pw
  • instagram-shared[.]net
  • instagram-shared[.]com
  • video-hd33[.]site
  • video-hd30[.]site
  • video-hd29[.]site
  • video-hd24[.]site
  • video-hd20[.]site
  • video-hd18[.]site
  • video-hd17[.]site
  • hd-video4[.]site
  • video-hosting[.]site
  • video-hd1[.]site
  • video-hd[.]site
  • homevideo641a[.]cf
  • homevideo651a[.]cf
  • homevideo54-1a[.]ml
  • videohosting32-e[.]cf
  • videohosting23c[.]cf
  • videohosting62-b[.]tk

Source IP

  • 88.99.174[.]142
  • 88.99.175[.]152
  • 78.46.201[.]36
  • 88.99.174[.]140
  • 88.99.173[.]179

Remediation

  • Block the threat indicators at respective controls.
  • Use token-based two-factor authentication.
  • Only download apps from official app stores.
  • Do not download random files/click on links found on social media platforms.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.