• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2019-7590 – Johnson Controls exacqVision Server Vulnerability
July 19, 2019
Rewterz Threat Advisory – CVE-2019-13345 – Squid Multiple Cross Site Scripting Vulnerabilities
July 19, 2019

Rewterz Threat Alert – Hard Pass: Declining APT34’s Invite to Join Their Professional Network

July 19, 2019

Severity

High

Analysis Summar

A phishing campaign conducted by APT34, an Iranian-nexus threat actor. Three key attributes caught with this particular campaign:

  • Masquerading as a member of Cambridge University to gain victims’ trust to open malicious documents,
  • The usage of LinkedIn to deliver malicious documents,
  • The addition of three new malware families to APT34’s arsenal.

A backdoor that communicates with a single command and control (C2) server using HTTP GET and POST requests, TONEDEAF supports collecting system information, uploading and downloading of files, and arbitrary shell command execution. When executed, this variant of TONEDEAF wrote encrypted data to two temporary files – temp.txt and temp2.txt – within the same directory of its execution.

Retracing the steps preceding exploit detection, it was identified that System.doc was dropped by a file named ERFT-Details.xls. Combining endpoint- and network-visibility, to correlate that ERFT-Details.xls originated from the URL http://www.cam-research-ac[.]com/Documents/ERFT-Details.xls. Network evidence also showed the access of a LinkedIn message directly preceding the spreadsheet download.

Impact

  • Arbitrary shell command execution
  • Exposure of sensitive information

Indicators of Compromise

IP(s) / Hostname(s)

185[.]15[.]247[.]154

URLs

  • http[:]//185[.]15[.]247[.]154/free/second[.]php
  • http[:]//185[.]15[.]247[.]154/free/uploadFiles/
  • http[:]//offlineearthquake[.]com/
  • http[:]//offlineearthquake[.]com/download?id=bom&n=000
  • http[:]//offlineearthquake[.]com/download?id=bov&n=000
  • http[:]//offlineearthquake[.]com/download?id=LXq&n=000
  • http[:]//offlineearthquake[.]com/file/6H3/P86[.]dll?id=Zwh&n=000
  • http[:]//offlineearthquake[.]com/upload?id=bwd&n=
  • http[:]//www[.]cam-research-ac[.]com/Documents/Cambridge_employment_form[.]zip
  • offlineearthquake[.]com
  • www[.]cam-research-ac[.]com
  • c[.]cdn-edge-akamai[.]com
  • cam-research-ac[.]com

Malware Hash (MD5/SHA1/SH256)

  • 021a0f57fe09116a43c27e5133a57a0a
  • 2175299818a00a5dbcc1d96c3ef4cdca4e94052a22f08fcf8e982d0548a7bff0
  • 50fb09d53c856dcd0782e1470eaeae35
  • 6eca9c2b7cf12c247032aae28419319e
  • 9fff498b78d9498b33e08b892148135f
  • b338baa673ac007d7af54075ea69660b
  • caf418cbf6a9c4e93e79d4714d5d3b87
  • d8abe843db508048b4d4db748f92a103

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.