Severity
Medium
Analysis Summary
Recently, some threat actors distributed their malware by abusing Yandex.Direct and hosted it on GitHub. The group used two well-known backdoors — Buhtrap and RTM — as well as ransomware and cryptocurrency stealers. Malicious ads were posted through Yandex.Direct, aimed at redirecting a potential target to a website offering malicious downloads disguised as document templates.
The user must run the executable in order for it to work. Moreover, the cryptocurrency addresses associated with the ransom payment of this campaign are encrypted using RC4.
Impact
- File encryption
- Cryptocurrency mining
Indicators of Compromise
IP(s) / Hostname(s)
- stat-counter-7-1[.]bit
- stat-counter-7-2[.]bit
URLs
- blanki-shabloni24[.]ru
- clipbanker[.]hm
- ktosdelaetskrintotpidor[.]com
- medialeaks[.]icu
- sositehuypidarasi[.]com
- icq[.]chatovod[.]info
- spy[.]banker[.]kw
- spy[.]buhtrap[.]ae
- spy[.]buhtrap[.]ag
- womens-history[.]me
Filename
- nike.exe
- sbornik_dokumentov.exe
- master_blankov_300.exe
- mir_vseh_blankov_24.exe
- blanki.exe
- master-blankov24.exe
- vseblanki24.exe
- masterblankov24.exe
- btctradebot.exe
- hashfish.exe
- hashfish.apk
Malware Hash (MD5/SHA1/SH256)
- d53d1452f383725f3386868839d1b7b2
- 4112520ab7344076b2fe93a43fcde5ad
- 9554fc65845324f783ffa2911c8b2cd9
- c87afebec0fd296ccbaf60b5a8403719
- 33cc2f1943e834dff6650e0e1ab70e87
- d06d957763ccc49a7fb1a65d6430ead0
- 3e521df314e3295cd8b8ff7ca19153a3
- 1269e8bdb4fc853e8670b710415658cb
- 55233473ba6fa3fdfdac096d5c0e0bbf
- 37960e9e34832c5ff314c30ab64c6d7a
- cd16693695c59427b08e6597019b85f3
- c01f3f066eae4b255f29739707f27175
- 09647962c6335e2f81ae97fe2e28c15c
- 23a73657fe1e95a2c08e1b30a8cf6c48
- 77487c27f5476f7bcb092106f4845b4f
- d336e579505f40c72902a7df9aa04138
- 3a1230a7d7a0d7dafafb443d0cb751d4
Remediation
- Block the threat indicators at their respective controls.
- Do not download files from untrusted sources.
- Do not click on URLs attached in unexpected/untrusted emails.