• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – LokiBot – IOCs
April 22, 2020
Rewterz Threat Alert – DopplePaymer Ransomware hits Banka Ekonomike in Kosovo
April 22, 2020

Rewterz Threat Alert – Maze Ransomware – IoCs

April 22, 2020

Severity

High

Analysis Summary

A few weeks ago, Maze Ransomware targeted an Algerian oil company and posted some of their data online as a part of victim shaming. Last week, a large enterprise-class, managed service provider (Cognizant) fell victim to a Maze ransomware attack. This particular campaign includes a signed DLL payload (kepstl32.dll). Upon infection, the trojan will drop a customized desktop image into %temp%, and then traverse the disk, encrypting supported file-types. A copy of the ransom instructions “DECRYPT-FILES.txt” is dropped into each folder containing encrypted files. As with previous variants of Maze, the trojan will attempt to inhibit recovery by deleting shadow copies via WMIC.exe (wmic.exe shadowcopy delete). Given below are the IoCs.

Impact

  • Files Encryption
  • Confidentiality breach

Indicators of Compromise

MD5

  • a0dc59b0f4fdf6d4656946865433bcce
  • fba4cbb7167176990d5a8d24e9505f71
  • c043c153237b334df2f2934f7640e802
  • 910aa49813ee4cc7e4fa0074db5e454a

SHA-256

  • 9d86beb9d4b07dec9db6a692362ac3fce2275065194a3bda739fe1d1f4d9afc7
  • 5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353
  • fb5de69b222d81fea2f4b08fd5af612faf24b9e75698ac331af066fbc360a30a
  • 4218214f32f946a02b7a7bebe3059af3dd87bcd130c0469aeb21b58299e2ef9a

SHA1

  • c10fd0163c42f1149d5dcfb44e31b53a4fe6c6c9
  • aa6cd2698d4f9a7fa99f5807f4b6695a0bfd0124
  • d5ef91b849122109615007329ec6548830f13bfc
  • 45831987fabeb7b32c70f662be8cb24e2efef1dc

Remediation

  • Block the threat indicators at their respective controls.
  • Keep all software and systems updated to latest versions.
  • Do not download any untrusted files from email attachments or the internet.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.