• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert “Beyond The Grave” Virus – Threat Indicators
March 5, 2019
Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls
March 6, 2019

Rewterz Threat Alert – Threat Actors Targeting Banks Using Tools to Bypass Cyber Security Controls

March 6, 2019

Severity

Medium

Analysis Summary

Advanced techniques, tools and procedures (TTPs) have been observed being used by a new threat actor in order to bypass cyber controls used by many corporations. This threat actor is targeting financial organizations like banks with more sophisticated tools, complex obfuscation and customization. The attack begins with a phishing email containing a malicious link that downloads a word document. Examples of URLs created by the threat actor include hxxps://socgen-cert[.]com/documents/REQ-193.doc and hxxps://ing[]cert[.]com/documents/PO-2815.doc. The documents were also seen on amf-fr[.]org, alerts-swift[.]com, and socgencompliance[.]com.

Initial Access: Spear Phishing Link

Execution: Scripting, PowerShell, User Execution, Regsvr32

Persistence: Registry Run Keys / Startup Folder (in older versions)

Defense Evasion: Masquerading, Regsvr32, Download New Code at Runtime

Command and Control: Remote Access Tools, Uncommonly Used Port

Impact

Security Bypass

Complex Cyber-attack

Indicators of Compromise


IP(s) / Hostname(s)

  • 51.38.150[.]171
  • 80.82.64[.]126
  • 82.221.128[.]183
  • 185.10.68[.]29
  • 185.10.68[.]189
  • 185.10.68[.]20
  • 185.117.73[.]234
  • 191.101.172[.]26
  • 198.50.239[.]63

URLs

  • nlscdn[.]com
  • ing-cert[.]com
  • riscomponents[.]pw
  • socgen-cert[.]com
  • amf-fr[.]org
  • alerts-swift[.]com
  • finanstilsy[.]net4

Malware Hash (MD5/SHA1/SH256)

  • 9111e08fd904e25defd6ba0a98142410
  • 39cbce484f3769eb23ea8dab0077d38c
  • 1d9aa66eebb174742433d88347c88243
  • e04c69af05c40d5e8a8ab4941d4aad24
  • efbcffc10763a287bdedfb6e892ae20c
  • 0d42a54f427c044c59b0777b9ddf3eb3
  • 8ec83dba30c4f4d014899fbcc9a78171
  • 487982bc6f4a82556f0ab3c219f55ae0
  • a7e5ee61098748ffb9c42e65cdad6505
  • f65811df2f65507099c7147da07c05d0
  • 981f0fbaed1b125cc3fb9fa5a4418969
  • db1b9ebe9d782874e6aa4bc7509626b4
  • 073ede09792ec2995d403b8076516e06
  • 2a7d037d059f348f5fd0545396cb728f
  • 3d91a135ebb28a25dc525fd6a407693a
  • 65efb4aabcb3ad60b44d50a54841ea4b
  • 9a39f0099f884c96130f4f5a402a82af
  • 6abb9951a1daa868116becc72812ea8b
  • 87f36cfeb984559d10232d6160b9eb30
  • 09e2a5b102f82c3cd0e1b7cc23152432
  • 835e69a43117eab940f8d9505642bd7c
  • cf3a6d21b2b8e728f63ec3f822575c28
  • b43d81328845e8aeba2ca40eb6979ece
  • 66c8986971d3e8662e2351fe937c2191
  • 9e6810fcf7bba8f51ee7010b4d4751a3
  • efbcffc10763a287bdedfb6e892ae20c
  • 50dc84e07a7923f0e415d0cfe26bfaad
  • a7e5ee61098748ffb9c42e65cdad6505
  • 8cf07b203063067472743c1b8cca6631
  • 413aa1e29e3f0564feb48ea482dc717adb75a40f2abbf2471566a05935f45b01
  • bee422ce01607b48c6d2c322caadf9fe050b9a916d751fc9facd9fa3edf46d14
  • d57f128afb4843b6f0072fadda8dd14046b31703098e365bc5a226e117090d44
  • 2f5a668c0c8366dfbf337c8390b0cd2a976ecbe1b47bdfb221c22703432d45db
  • a1093d68e9f9f511ecf1cc38c457dda00318bb97633b36b8383d45b66f41eeec
  • 511db1ca13761147e26229795cab3ddd1f0a0c00a677da93628183ff5d2e2639
  • 9a72b7af8c9a00542c83959cfee61e7be9a831717dc1ff27227bea63e36da004
  • e2bec3d92896f0007a1811310c96eb7333a66142558057c482b5fb2196ff22e1
  • 59a24d9ac0ed2f2bea3883d7b943ab1229acfe3f9f350f2dee6deb14c559920b
  • 08a1a6ecdccc13695968545b2888a91eb0f05ef60e1bde9e86c4a9b386395af7
  • 515449cdae6f9b997a3a73c1e0244808d4dc5aef77e74bfc3006f099a27cfe1d
  • c32856605c7bc754b5649e90863f58e25f094dceeac5546bc27220e9313ae1c5
  • 822f38009000278b26c916f52bfbeec93a894464cb8645353faf1f3aad2b5327
  • eb4eea0dfb1a0b1bd7e2d3e6e932f2f86877d046b330bde6efc6169f5b3a0981
  • a87d22f102a186710dce923c729f960e3f8b5147161965716ef95ce0d857bfc9
  • 728bbbea8797c5e00a8737ebf6bebfffb3d84f9c86f144963a2940025329c28b
  • f4d208c6df8571f7992a500d3787b4685907914e6445159e57921e77f8285208
  • 471545026007c352f60c75355221cd13784ed3499dbd9eeb221fe7824ade0842
  • 546aea2f9b7351c4efdec0dc197f057144af12f7e3617aa0d79353b1160508d1
  • 87eac683f348971d3afc6daa13669d4830e7497d6a6edb61a34ab1b2b93ae0f7
  • 25ae00c80a4ec85cb548c891598cf76d131b168a70116a84cb62b4defa3f698c
  • 7065f6be16923215d3e7cbd5d769a7ca3721279c16085339a449959b6fb18ab3
  • ad18110f61e18af03902b0b14a0dddcd312e627bcd278e12a245e2f4831db829
  • df9447faeb4c1f8b463d81515448767848a1c1d05d32fd745b7b8cd2ce3766c8
  • b9f987ef7a0c57a851c20832dbf58883e64ec6e513718b506e20ca2f71c241c8
  • e2566eb542898662f5a8a5717d7990e988ebaedb2445fe4f3bf0dab166e13e5c
  • db526cb59caa89c533032cee02b738be48699517a673e8870efa44ef2b8c1eb3
  • b991288ecd158e84076f7cc38d4ecbcd18cccc580f1971b0dfdd7c88b78e0794


Remediation

Block the threat indicators at their respective controls.

Ensure strict measures against phishing emails.

  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.