• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Cerberus – A Banking Trojan Targeting Banking Apps – IoCs
September 4, 2019
Rewterz Threat Alert – Network Routers Hit with Glupteba Campaign
September 5, 2019

Rewterz Threat ALert – Trickbot Using Google Docs to Bypass Email Gateways

September 5, 2019

Severity

Medium

Analysis Summary

A phishing campaign using Google Docs links to evade email gateway detection and distribute TrickBot. The emails are sent via the legitimate Google Docs services, which means the content is a legitimate shared file notification from Google and contains only Google links. The message from the sender claims to be regarding a previously sent document that needs to be viewed. If a user falls for the lure, they are directed to a Google Docs file hosted on the genuine Google service. The content of the document is a fake 404 error and a link to an executable hosted on Google Drive. The file masquerades as a PDF in order to trick a user into opening it. If it is opened, it first creates a copy of itself in the ProgramData folder and an additional copy in a subfolder of the User AppData directory, which also contains the TrickBot configuration. Persistence is established via a scheduled task that executes the payload every 11 minutes. Finally, it hollows out svchost.exe to inject the malicious code. Additional svchost processes are continually spawned to run various TrickBot modules.

Impact

Security Bypass

Indicators of Compromise

IP(s) / Hostname(s)

  • 107[.]181[.]175[.]122
  • 181[.]129[.]93[.]226
  • 186[.]47[.]40[.]234
  • 190[.]152[.]4[.]210
  • 198[.]27[.]74[.]146
  • 200[.]119[.]45[.]140
  • 79[.]143[.]31[.]94


URLs

  • https[:]//docs[.]google[.]com/uc?id=112QLCdDtd4y-mAzr8hobCs0TP5mQmKfL
  • https[:]//jaquetas01[.]cordenadorltda[.]org
  • https[:]//services[.]halapar[.]org
  • https[:]//docs[.]google[.]com/document/d/1fgSfd4DwReVKbcLI3ISO2jhX1Yn8WOqbXnmU_bg00_A/edit?usp=sharing_eip&ts=5d5accb1

Malware Hash (MD5/SHA1/SH256)

  • ab2a8fc10e8c1a39ae816734db9480de
  • 20328b1f169b1edeef38853dafbbacfdac53c66f7f1dd62f387091bedebfd497

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the link/attachments sent by unknown senders.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.