Severity
High
Analysis Summary
DangerousPassword is a Chinese APT group that targets cryptocurrency companies. Found in 2018, the threat group uses decoy files with topics like “job description”, “project risk profile”, “monthly business report”, etc. With a hefty number of domain names, Dangerous Password issues decoy files to organizations in Asia and Europe. The group uses phishing emails to deliver Trojan files that impersonate Google, Microsoft, and other servers. Once the files are executed, macros are launched to launch the attack.
Recently discovered sample’s filename includes: Profit Sharing Plan. zip & Password.txt.lnk
Impact
- Information Theft and Espionage
Indicators of Compromise
MD5
- d901c8ccdffa72fdcf53c49f7e4ee1f1
- e43889e785ad02844432fa9645f3418d
SHA-256
- b33541d0eb15a5d0ea37826f34c9725688f2361374e1a31fe101edaf22fb32c9
- 51d53ca36a662b4aad5878987548f0f22f2a53545790577d8043373b6bf7eb75
SHA-1
- 069be7924d6b256f97be3f35fbd75322ecd3c6d3
- a3fb8856ec6ec662e09206e3a9b8a2a93af69bcf
URL
- https[:]//wps[.]wpsonline[.]co/3lL6z8/TE1mdkRZQXJSpIQ5BNhTjADZf9ThNE9QEEUg=
- https[:]//wps[.]wpsonline[.]co/
- https[:]//edit[.]wpsonline[.]co/hdr9VSnBo8SUb0aXd4xXXoG9w+dTjc90QM9hNhcQ4zo=
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.
- Always be suspicious about emails sent by unknown senders.
- Never click on links/ attachments sent by unknown senders.