• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – McDonalds-Themed Facebook Malvertising Deploys Mispadu Banking Trojan
November 20, 2019
Rewterz Threat Alert – Trickbot Info-Stealer Active Infection Campaigns – IoCs
November 20, 2019

Rewterz Threat Alert – Malspam Campaigns Spreading Dridex Banking Trojan

November 20, 2019

Severity

High

Analysis Summary

Dridex also known as Bugat and Cridex is a form of malware that specializes in stealing bank credentials via a system that utilizes macros from Microsoft Word. Recent malspam campaigns have been observed delivering the Dridex banking malware on windows systems. The phishing emails contain a word or excel attachment with embedded macros. Once the target downloads the file and enables macros, Dridex is downloaded on the victim machine which may lead to financial theft.
The primary objective of this software is to steal banking information from users of infected machines to immediately launch fraudulent transactions. Bank information for the software installs a keyboard listener and performs injection attacks.

Impact

  • Theft of banking information
  • Fraudulent transactions
  • Financial loss

Indicators of Compromise

From Email

  • jclugo[@]nanodepot[.]mx
  • comprobantes[@]aviso[.]com[.]gt
  • trafficmxp[@]archive[.]airindia[.]it
  • rh[.]esod[@]atlanticahotels[.]com[.]br
  • atendimento[@]turboautocenter[.]com[.]br
  • info[@]centrotimarzignano[.]it
  • jcarrere[@]bld[.]com[.]ar
  • syful[@]comillaonline[.]com
  • ricardo[@]4rtransportes[.]com[.]br
  • gerentecompras[@]mayoreoferrefama[.]com
  • citas[@]portadacartagena[.]com
  • k-inagaki[@]link-vision[.]com
  • faturamentopm[@]coopmetro[.]com[.]br
  • dvalera[@]abastosbicentenario[.]gob[.]ve
  • ventas3[@]distribuidoradeaceros[.]mx
  • m[.]biec[@]gotec-group[.]com
  • informacion[@]actgrupo[.]com
  • contabilidad[@]insalus[.]es

MD5

  • ba87bd0a355d24ddc39c8cb2c7186abf
  • 05ffb09ff7900cb970c245f94506dd7f
  • 28bdba10872356b1887dcf0b70990ffc
  • a2eb8748c37efcb2ecba817b754d7871
  • 923384cd1063c03f8e0bb44965187be7
  • 9d68dec7048ab46ee26f2cf8ddfec07f
  • 1daef4e6d1e3263d364ca28b599fdd21
  • f506a9e9b77f160026f46947c18a2b8a

SHA-256

  • 6ddf5c04bca8882d1fdb7e4885c86b07876c907bd1fef61cf5545eedfc6b03e7
  • 21de494751a16dca9bce6ace38e1d7be7a7846fb1d9a4a3c4e82b0f9db6e1e0a
  • 690052ad639bf1c44de6fc385247b19f3b4254585208082bb7231cf28c3ff95e
  • d166416b665534fca9dec4b205a0c1f28fdd5dd2cb45b92be8a908c4d35f652a
  • 87011e99a114ccff3994c196876d90e0f8627b2e040884cfbbb44033bbc22ac7
  • 017d4751de322d3cfebbe452f28ea4b16f3412307c6567d9cb7790eac7dc4175
  • 5203f290148afad7aec1493d56c43d0df5710e6a7c23ea2c1326f73ed7861d90
  • 6b1b3cd62ba169a9be6e71d013a52575111b3a15d0cb3bace971031b82057411

Source IP

  • 65[.]99[.]252[.]241
  • 93[.]38[.]63[.]46
  • 103[.]229[.]85[.]12
  • 62[.]112[.]65[.]20
  • 124[.]108[.]39[.]115
  • 190[.]202[.]150[.]26
  • 198[.]1[.]68[.]89
  • 200[.]69[.]233[.]197
  • 162[.]241[.]182[.]168
  • 174[.]142[.]9[.]228
  • 72[.]47[.]249[.]132
  • 91[.]142[.]215[.]72

Remediation

  • Block the threat indicators at their respective controls.
  • Do not download files attached in emails coming from untrusted sources.
  • Do not enable macros for untrusted files.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.