• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Cookie Monster Malware Hijacking WordPress Sessions
October 10, 2019
Rewterz Threat Alert – Another Agenttesla campaign using a compromised Iraq Government site
October 10, 2019

Rewterz Threat Alert – Open Document format creates twist in maldoc landscape

October 10, 2019

Severity

Medium

Analysis Summary

Cisco Talos recently observed attackers changing the file formats they use in an attempt to thwart common antivirus engines. This can happen across other file formats, but today, we are showing a change of approach for an actor who has deemed antivirus engines perhaps “too good” at detecting macro-based infection vectors. We’ve noticed that the OpenDocument (ODT) file format for some Office applications can be used to bypass these detections. ODT is a ZIP archive with XML-based files used by Microsoft Office, as well as the comparable Apache OpenOffice and LibreOffice software.

Impact

Exposure of sensitive information

Indicator of Compromise

Malware Hash SH256

  • 02000ddf92ceb363760acc1d06b7cd1f05be7a1ca6df68586e77cf65f4c6963e
  • 19027327329e2314b506d9f44b6871f2613b8bb72aa831004e6be873bdb1175d
  • 20919e87d52b1609bc35d939695405212b8ca540e50ce8bece01a9fccfa70169
  • 2f4aa28974486152092669c85d75232098d32446adefeeef3a94ad4c58af0fc8
  • 429d270195bed378495349cf066aee649fd1c8c450530d896844b1692ddddc77
  • 80c62c646cce264c08deb02753f619da82b27d9c727e854904b9b7d88e45bf9e
  • 84cb192cc6416b20293dfb8c621267e1584815a188b67757fa0d1af29a7cfdcd
  • b2b51864fa2f80f8edbdaf6721a6780e15a30291a748c2dfc52d574de0d8c3ed
  • d099eac776eabf48f55a75eb863ad539a546202da02720aa83d88308be3ce4ca
  • de8e85328b1911084455e7dc78b18fd1c6f84366a23eaa273be7fbe4488613dd
  • efb81fb8095319f5ee6fd4d6741b80386a824b9df05460d16d22cad1d6bbb35d
  • f24c6a56273163595197c68abeab7f18e4e2bedd6213892d83cdb7a191ff9900
  • f5194cc197d98ed9078cceca223e294c5ec873b86cbeff92eb9eaca17fc90584
  • f9138756639104e2c392b085cc5a98b1db77f0ed6e3b79eacac9899001ed7116

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.