Rewterz Threat Alert – Clever Microsoft Phishing Scam Creates a Local Login Form
December 9, 2019Rewterz Threat Alert – Trick Bot – Fake Payroll Emails to Conduct Phishing Attacks
December 10, 2019Severity
Medium
Analysis Summary
While investigating a recent malspam campaign that targeted the United States and distributed the IcedID Trojan, researchers from Malwarebytes Labs noticed some changes, one of which was the payload being delivered using steganography. The payload data is encrypted and encoded within a PNG image file. The email in the malspam campaign had the subject line of “USPS Delivery Unsuccessful Attempt Notification” and had attached to them a Word document that contained malicious macros. If the email recipient opened the document and enabled macros, the end result would be the installation of the IcedID Trojan. Persistence is achieved using a scheduled task. IcedID will inject implants into web browsers in order to steal financial information. It also steals other information such as credentials from various applications and cookies. IcedID can also, on instructions from its C&C server, install additional malware.
Impact
- Credential theft
- Financial loss
Indicators of Compromise
MD5
- 29E709CEB0FA00ED56CD9E3CED4FDC70
- 407CDE16473474C15F66651307E42D9B
SHA-256
- 58c8518a85d32448881050757f6a8b0468636d3ebb74315023d9963b32355501
- 7aa3ef953f07267af9389d26ce7214cfcef453436c7dee78f39b924d21312464
SHA1
- 8afbecd6f857f4e512193449864326518648d3b0
- c66bede3d34261c2b86fb9f1d75ac5059c4233b9
URL
- http://104.168.198.230/wordupd.tmp
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.