April 19, 2024
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls
March 6, 2019Rewterz Threat Alert – Threat Indicators – Ursnif/Gozi Malspam
March 6, 2019Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls
March 6, 2019Rewterz Threat Alert – Threat Indicators – Ursnif/Gozi Malspam
March 6, 2019
Severity
Medium
Analysis Summary
Advanced techniques, tools and procedures (TTPs) have been observed being used by a new threat actor in order to bypass cyber controls used by many corporations. This threat actor is targeting financial organizations like banks with more sophisticated tools, complex obfuscation and customization. The attack begins with a phishing email containing a malicious link that downloads a word document. Examples of URLs created by the threat actor include hxxps://socgen-cert[.]com/documents/REQ-193.doc and hxxps://ing[]cert[.]com/documents/PO-2815.doc. The documents were also seen on amf-fr[.]org, alerts-swift[.]com, and socgencompliance[.]com.
Initial Access: Spear Phishing Link
Execution: Scripting, PowerShell, User Execution, Regsvr32
Persistence: Registry Run Keys / Startup Folder (in older versions)
Defense Evasion: Masquerading, Regsvr32, Download New Code at Runtime
Command and Control: Remote Access Tools, Uncommonly Used Port
Impact
Security Bypass
Complex Cyber-attack
Indicators of Compromise
IP(s) / Hostname(s)
- 51.38.150[.]171
- 80.82.64[.]126
- 82.221.128[.]183
- 185.10.68[.]29
- 185.10.68[.]189
- 185.10.68[.]20
- 185.117.73[.]234
- 191.101.172[.]26
- 198.50.239[.]63
URLs
- nlscdn[.]com
- ing-cert[.]com
- riscomponents[.]pw
- socgen-cert[.]com
- amf-fr[.]org
- alerts-swift[.]com
- finanstilsy[.]net4
Malware Hash (MD5/SHA1/SH256)
- 9111e08fd904e25defd6ba0a98142410
- 39cbce484f3769eb23ea8dab0077d38c
- 1d9aa66eebb174742433d88347c88243
- e04c69af05c40d5e8a8ab4941d4aad24
- efbcffc10763a287bdedfb6e892ae20c
- 0d42a54f427c044c59b0777b9ddf3eb3
- 8ec83dba30c4f4d014899fbcc9a78171
- 487982bc6f4a82556f0ab3c219f55ae0
- a7e5ee61098748ffb9c42e65cdad6505
- f65811df2f65507099c7147da07c05d0
- 981f0fbaed1b125cc3fb9fa5a4418969
- db1b9ebe9d782874e6aa4bc7509626b4
- 073ede09792ec2995d403b8076516e06
- 2a7d037d059f348f5fd0545396cb728f
- 3d91a135ebb28a25dc525fd6a407693a
- 65efb4aabcb3ad60b44d50a54841ea4b
- 9a39f0099f884c96130f4f5a402a82af
- 6abb9951a1daa868116becc72812ea8b
- 87f36cfeb984559d10232d6160b9eb30
- 09e2a5b102f82c3cd0e1b7cc23152432
- 835e69a43117eab940f8d9505642bd7c
- cf3a6d21b2b8e728f63ec3f822575c28
- b43d81328845e8aeba2ca40eb6979ece
- 66c8986971d3e8662e2351fe937c2191
- 9e6810fcf7bba8f51ee7010b4d4751a3
- efbcffc10763a287bdedfb6e892ae20c
- 50dc84e07a7923f0e415d0cfe26bfaad
- a7e5ee61098748ffb9c42e65cdad6505
- 8cf07b203063067472743c1b8cca6631
- 413aa1e29e3f0564feb48ea482dc717adb75a40f2abbf2471566a05935f45b01
- bee422ce01607b48c6d2c322caadf9fe050b9a916d751fc9facd9fa3edf46d14
- d57f128afb4843b6f0072fadda8dd14046b31703098e365bc5a226e117090d44
- 2f5a668c0c8366dfbf337c8390b0cd2a976ecbe1b47bdfb221c22703432d45db
- a1093d68e9f9f511ecf1cc38c457dda00318bb97633b36b8383d45b66f41eeec
- 511db1ca13761147e26229795cab3ddd1f0a0c00a677da93628183ff5d2e2639
- 9a72b7af8c9a00542c83959cfee61e7be9a831717dc1ff27227bea63e36da004
- e2bec3d92896f0007a1811310c96eb7333a66142558057c482b5fb2196ff22e1
- 59a24d9ac0ed2f2bea3883d7b943ab1229acfe3f9f350f2dee6deb14c559920b
- 08a1a6ecdccc13695968545b2888a91eb0f05ef60e1bde9e86c4a9b386395af7
- 515449cdae6f9b997a3a73c1e0244808d4dc5aef77e74bfc3006f099a27cfe1d
- c32856605c7bc754b5649e90863f58e25f094dceeac5546bc27220e9313ae1c5
- 822f38009000278b26c916f52bfbeec93a894464cb8645353faf1f3aad2b5327
- eb4eea0dfb1a0b1bd7e2d3e6e932f2f86877d046b330bde6efc6169f5b3a0981
- a87d22f102a186710dce923c729f960e3f8b5147161965716ef95ce0d857bfc9
- 728bbbea8797c5e00a8737ebf6bebfffb3d84f9c86f144963a2940025329c28b
- f4d208c6df8571f7992a500d3787b4685907914e6445159e57921e77f8285208
- 471545026007c352f60c75355221cd13784ed3499dbd9eeb221fe7824ade0842
- 546aea2f9b7351c4efdec0dc197f057144af12f7e3617aa0d79353b1160508d1
- 87eac683f348971d3afc6daa13669d4830e7497d6a6edb61a34ab1b2b93ae0f7
- 25ae00c80a4ec85cb548c891598cf76d131b168a70116a84cb62b4defa3f698c
- 7065f6be16923215d3e7cbd5d769a7ca3721279c16085339a449959b6fb18ab3
- ad18110f61e18af03902b0b14a0dddcd312e627bcd278e12a245e2f4831db829
- df9447faeb4c1f8b463d81515448767848a1c1d05d32fd745b7b8cd2ce3766c8
- b9f987ef7a0c57a851c20832dbf58883e64ec6e513718b506e20ca2f71c241c8
- e2566eb542898662f5a8a5717d7990e988ebaedb2445fe4f3bf0dab166e13e5c
- db526cb59caa89c533032cee02b738be48699517a673e8870efa44ef2b8c1eb3
- b991288ecd158e84076f7cc38d4ecbcd18cccc580f1971b0dfdd7c88b78e0794
Remediation
- Block the threat indicators at their respective controls.
- Ensure strict measures against phishing emails.