March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert –Raccoon Infostealer – Active IOCs
September 14, 2021
Rewterz Threat Alert – Nanocore Rat – Active IOCs
September 14, 2021
Rewterz Threat Alert –Raccoon Infostealer – Active IOCs
September 14, 2021
Rewterz Threat Alert – Nanocore Rat – Active IOCs
September 14, 2021
Severity
High
Analysis Summary
Konni’s APT Group continues to attack malicious documents written in Russian. Konni’s APT Group conducts attacks with Russian-North Korean trade and economic investment documents. The vector used for the attack is probably the Spear Phishing method and has been reported in Korea. The malicious file suspected of being used as an attachment has the name Russia-North Korea-South Korea-Trade and Economic Relations-Investment.doc
These malicious documents used by Konni APT
The malicious DOC document file contains the following VBA code. If the [Use Content] button is clicked, the VBA malware included inside is activated. And the contents of the document are printed as follows, which makes the user dazzle like a normal document file. VBA code makes connections with malicious C2 servers contained in the ObjectPool zone. The attacker would communicate with the attacker’s server through a combination of instructions contained in the ObjectPool TextBox1 to TextBox3 data and content.
Impact
- Information Theft and Espionage
Indicators of Compromise
Filename
- Russia-North Korea-South Korea-Trade and Economic Relations-Investment[.]doc
MD5
- b3f76f60fe8737a2bd098120c7495ff1
- 598217191b9283f95a025fc454b7a4f9
- 6f287b6e63915d95be6bc6988713d83c
- a51912c138ae264b61c6edb492c355a6
- 32a60c3697e5d59e0cb83b9d829f256d
- 27fd4e8b72e11357f0a00b5beb964920
- 0c81b761f75047ccc4f41371fd8106d4
SHA-256
- a7d5f7a14e36920413e743932f26e624573bbb0f431c594fb71d87a252c8d90d
- 4876a41ca8919c4ff58ffb4b4df54202d82804fd85d0010669c7cb4f369c12c3
- 491ed46847e30b9765a7ec5ff08d9acb8601698019002be0b38becce477e12f6
- 062aa6a968090cf6fd98e1ac8612dd4985bf9b29e13d60eba8f24e5a706f8311
- 10109e69d1fb2fe8f801c3588f829e020f1f29c4638fad5394c1033bc298fd3f
- 8e7fb6e2f5cab40baf71083b4406f993d482e945117f146efc9b2aeeb7772625
- ed63e84985e1af9c4764e6b6ca513ec1c16840fb2534b86f95e31801468be67a
SHA1
- 4cd59826e2718d4e8728fc4b46f3b35fd8ee7958
- 65c5bafccea1a60eb5efb1fbc976333b6dddbd1f
- 13aa8bbf1a843b7cf81d6f052e83a9c3d113041a
- dcbc54031bcae59d583269d5f0a0d1145c8378ef
- ea02453f526ff78604f422c02523f1d8c901fd8a
- 50dafeaa2b75e183661be525fde060782a794ef6
- e431fb275b8fe9c09d53ac4ac35a0c9503acf03e
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.
- Always be suspicious about emails sent by unknown senders.
- Never click on the link/attachments sent by unknown senders.