Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity
Medium
Analysis Summary
The noticeable aspects of this specific campaign are the use of existing e-mail threads within compromised e-mail account to spread their malware, use of encrypted ZIP compressed archive to protect a malicious Word Document, and a polymorphic Ursnif payload- the hash of downloaded Ursnif payload changes regularly.
When the document is opened, the On-Open (AutoOpen) VBA/Macros triggers an encoded PowerShell command which downloads a binary – Decoded-PS-1.png in attachments.
Impact
Malware infection
Indicators of Compromise
URLs
Filename
Challenger.zip
Email Address
Malware Hash (MD5/SHA1/SH256)
Remediation