✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Advisory – Trend Micro OfficeScan XG Data Manipulation Vulnerability

April 3, 2019
Rewterz

Rewterz Threat Alert – Phishing Related to Etihad Group Of Companies

April 4, 2019

Rewterz Threat Alert – Lazarus Group – Indicators of Compromise

Analysis Summary

APT group Lazarus continues to target the financial world with their enhanced techniques and tools and are currently active supplying malware. The group uses customized PowerShell scripts on Windows systems. These scripts connect to the command and control infrastructure and await commands. The scripts disguise themselves with names that appear to be WordPress files or other open-source-based file names.

Impact

Malware infection

Indicators of Compromise

IP(s)/ Hostname(s)

  • http[.]//115[.]28[.]160[.]20[.]443
  • http[.]//bluecreekrobotics[.]com/wp-includes/common[.]php
  • http[.]//dev[.]microcravate[.]com/wp-includes/common[.]php
  • http[.]//dev[.]whatsyourcrunch[.]com/wp-includes/common[.]php
  • http[.]//enterpriseheroes[.]com[.]ng/wp-includes/common[.]php
  • http[.]//hrgp[.]asselsolutions[.]com/wp-includes/common[.]php
  • http[.]//nzssdm[.]com/assets/mt[.]dat
  • http[.]//nzssdm[.]com/assets/wwtm[.]dat
  • https[.]//baseballcharlemagnelegardeur[.]com/wp-content/languages/common[.]php
  • https[.]//bogorcenter[.]com/wp-content/themes/index2[.]php
  • https[.]//eventum[.]cwsdev3[.]bi[.]com/wp-includes/common[.]php
  • https[.]//streamf[.]ru/wp-content/index2[.]php
  • https[.]//towingoperations[.]com/chat/chat[.]php
  • https[.]//vinhsake[.]com//wp-content/uploads/index2[.]php
  • https[.]//www[.]tangowithcolette[.]com/pages/common[.]php
  • nzssdm[.]com

Malware Hash (MD5/SHA1/SH256)

  • 0316f6067bc02c23c1975d83c659da21
  • 171b9135540f89bf727b690b9e587a4e
  • 29a37c6d9fae5664946c6607f351a8dc
  • 35e38d023b253c0cd9bd3e16afc362a7
  • 4345798b2a09fc782901e176bd0c69b6
  • 4cbd45fe6d65f513447beb4509a9ae3d
  • 5182e7a2037717f2f9bbf6ba298c48fb
  • 668d5b5761755c9d061da74cb21a8b75
  • 6a0f3abd05bc75edbfb862739865a4cc
  • 72fe869aa394ef0a62bb8324857770dd
  • 86d3c1b354ce696e454c42d8dc6df1b7
  • Da4981df65cc8b5263594bb71a0720a1
  • F392492ef5ea1b399b4c0af38810b0d6
  • a18bc8bc82bca8245838274907e64631
  • ad3f966d48f18b5e7b23a579a926c7e8
  • cb713385655e9af0a2fc10da5c0256f5
  • e6d5363091e63e35490ad2d76b72e851
  • e9a6a945803722be1556fd120ee81199

Remediation

  • Block threat indicators at respective controls 
  • Always be aware of the suspicious emails sent by unknown senders 
  • Never click on the link/attachments sent by unknown senders

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo