• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2019-1378 – Windows 10 Update Assistant Elevation of Privilege Vulnerability
October 14, 2019
Rewterz Threat Advisory – CVE-2019-14287 – Sudo Flaw Lets Linux Users Run Commands As Root
October 15, 2019

Rewterz Threat Alert – OpenCarrot Malware Identified in Financial Sector

October 15, 2019

Severity

High

Analysis Summary

IBM X-Force IRIS responded to an incident in a financial services customer in southeast Asia that we assess with high confidence was perpetrated by ITG03. During this engagement, IRIS was able to observe several unreported malware and tools used by ITG03 to conduct specific actions which indicate the adversary was interested in accessing the SWIFT environment of the institution. One tool, a listener backdoor, included a set of command capabilities that is virtually identical to other command sets we have analyzed in their custom-coded malware employed against different targets. Specifically, the commands for downloading and time-stomping files, secure file/directory deletion and the proxy capabilities in addition to the other commands are a strong signature of ITG03 custom trojans. The sample svchost.exe is a backdoor that listens to port 443 (SSL port). The port can be overridden by specifying a port number in the command line arguments using the -F parameter. The backdoor listens for and accepts commands from a C2 and contains the capabilities to remotely access files, processes, execute commands, and download and upload data. The binary can also connect to a remote server by specifying an address with the -C parameter.

Impact

Financial loss

Indicators of Compromise

Malware Hashes : MD5

  • 02361636b6510a3c56611085c72
  • ef79fef7cb50c58204fe9f20e60c1e2543102
  • 559fab985ccc9e66f8c9b283915c59bf
  • 5b4b30bb05355ae497e1b0bf3d8f153f
  • dc7af3f4f4e567ea6af8fb72692738e1

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.