• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – MegaCortex Ransomware V.2
September 25, 2019
Rewterz Threat Alert – Formbook Harvests Financial Data using Phishing
September 25, 2019

Rewterz Threat Alert – Zebrocy Infects Targets with Backdoor hosted on Dropbox

September 25, 2019

Severity

Medium

Analysis Summary

Zebrocy APT operators recently launched campaign using a backdoor to maintain access to victim hosts and extract profiling information. The operators used a Golang-based version instead of the variant written in Delphi. Zebrocy is a toolkit of downloaders, droppers, and backdoors, that is associated with the Russian-speaking advanced threat group Sednit. The hackers are also known by the names APT28, Fancy Bear, Sofacy, Group 74, and STRONTIUM. The group targets governments, embassies and Ministries of Foreign Affairs in Eastern European and Central Asian countries. The document attached to the spear-phishing message is blank but includes a reference to a remote payload. Dropbox is used to host the malicious template – wordData.dotm – containing malicious macros that are executed upon opening the empty document.

Depending on the Microsoft Word version, the VBA macros are disabled by default and user action is required to enable them. It also contains an embedded ZIP archive that the macros dropped and extracted.

Impact

Theft of Sensitive Information

Indicators of Compromise

IP(s) / Hostname(s)

185[.]221[.]202[.]35

URLs

  • hxxp[:]//185[.]221[.]202[.]35/software-protection/app[.]php
  • hxxps[:]//www[.]dropbox[.]com/s/foughx315flj51u/wordData[.]dotm?dl=1

Filename

  • lmss.exe
  • ospsvc.dll

Malware Hash (MD5/SHA1/SH256)

  • 5C366EF31C5036D3A4AA0BAECFFCEC5EC89106CC5B94989C192877721676105A
  • 1d09f491777cc9b80d5e07880314c7b3
  • 3652C16479540AFE3E4DA18E32E93F91A9357E81F170296AF99BDABBF527AFB2
  • 4c9d9d17702e4ef4898b85e2d41ce8ab
  • 2B657E2926D52A9550ECE4590075DCF3CC2BCDCB331BEC9B66F6EE85D2A1214E
  • d7f174cd44686c3afc4a9a5ac646f0db
  • cd7660ddb2a022a89312965bf29d81c8dd3d5585d8858e626ccac945942c4b4c
  • c28d031b3131d62f2a03b037a4ce5199
  • 82120b08d8a6342f14243b84ffb0cbe8298fa7ef118897206b3fe3e07cf7005c
  • e26fe7f009adb74033be0a18b2847fcc

Remediation

  • Block the threat indicators at their respective controls.
  • Do not download email attachments coming from untrusted sources.
  • Do not enable macros for files unless extremely necessary.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.