• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Clever Microsoft Phishing Scam Creates a Local Login Form
December 9, 2019
Rewterz Threat Alert – Trick Bot – Fake Payroll Emails to Conduct Phishing Attacks
December 10, 2019

Rewterz Threat Alert – IcedID Used Steganography to Hide Payload

December 10, 2019

Severity

Medium

Analysis Summary

While investigating a recent malspam campaign that targeted the United States and distributed the IcedID Trojan, researchers from Malwarebytes Labs noticed some changes, one of which was the payload being delivered using steganography. The payload data is encrypted and encoded within a PNG image file. The email in the malspam campaign had the subject line of “USPS Delivery Unsuccessful Attempt Notification” and had attached to them a Word document that contained malicious macros. If the email recipient opened the document and enabled macros, the end result would be the installation of the IcedID Trojan. Persistence is achieved using a scheduled task. IcedID will inject implants into web browsers in order to steal financial information. It also steals other information such as credentials from various applications and cookies. IcedID can also, on instructions from its C&C server, install additional malware.

Impact

  • Credential theft
  • Financial loss

Indicators of Compromise

MD5

  • 29E709CEB0FA00ED56CD9E3CED4FDC70
  • 407CDE16473474C15F66651307E42D9B

SHA-256

  • 58c8518a85d32448881050757f6a8b0468636d3ebb74315023d9963b32355501
  • 7aa3ef953f07267af9389d26ce7214cfcef453436c7dee78f39b924d21312464

SHA1

  • 8afbecd6f857f4e512193449864326518648d3b0
  • c66bede3d34261c2b86fb9f1d75ac5059c4233b9

URL

  • http://104.168.198.230/wordupd.tmp

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.