✕
Request a Demo
Rewterz
Rewterz Threat Advisory – CVE-2019-11135 – Intel CPUs Vulnerable to Variant 2 of #ZombieLoad Attack
November 14, 2019
Rewterz
Rewterz Threat Advisory – CVE-2019-13939 – ICS: Siemens Mentor Nucleus Networking Module
November 15, 2019

Rewterz Threat Alert – Trickbot Malware Resurfaces with New Version

Severity

High

Analysis Summary

Newer TrickBot Version “1077” (JMP+2) is found actively targeting victims. TrickBot is a Banking Malware long known for its malicious usage in different campaigns targeting multiple industries. Recently, new variants have been released with additional capabilities. Aside from its information theft capabilities, it also deletes files located in removable and network drives that have particular extensions, after which the files are replaced with a copy of the malware.

EJRFVOFX0AAhLh4.jpg:large

Impact

  • Information theft
  • Exposure of sensitive information

Indicators of Compromise

MD5

  • d2b88f123ef635c5344fee05b3f3f7fb
  • f52e16efce974ebb303e9f51057e57c5

SH256

  • a2188ff2dcca659807db8898153c88520d41033b8f446ecb932957abb6237abb
  • 282ffa30ab335c816cdbd3a411b32b777efd675fe8e0c53704ac9d7d09648b88

SHA1

  • 408a9e287e48ce2030da93ae236e76c6afd188e5
  • 9c1fb6fae217b0b908c42eae42605f470a3015ce

Source IP

  • 198.46.190[.]14
  • 37[.]44 [.]212[.]148
  • 185[.]65[.]202[.]127
  • 193[.]37[.]212[.]246
  • 193[.]124[.]191[.]243
  • 31[.]148[.]99[.]63
  • 94[.]103[.]91[.]61
  • 203[.]23[.]128[.]179
  • 179[.]43[.]147[.]72
  • 93[.]123[.]73[.]192
  • 51[.]89[.]115[.]120
  • 144[.]91[.]76[.]214
  • 46[.]21[.]153[.]81
  • 194[.]5[.]250[.]98
  • 190[.]154[.]203[.]218
  • 178[.]183[.]150[.]169
  • 200[.]116[.]199[.]10
  • 181[.]113[.]20[.]186
  • 187[.]58[.]56[.]26
  • 85[.]11[.]116[.]194
  • 81[.]190[.]160[.]139
  • 200[.]21[.]51[.]38
  • 181[.]49[.]61[.]237
  • 46[.]174[.]235[.]36
  • 91[.]232[.]52[.]187
  • 36[.]89[.]85[.]103
  • 31[.]128[.]13[.]45
  • 186[.]42[.]185[.]10
  • 170[.]233[.]120[.]53
  • 89[.]228[.]243[.]148
  • 31[.]214[.]138[.]207
  • 186[.]42[.]98[.]254
  • 195[.]93[.]223[.]100
  • 181[.]112[.]52[.]26
  • 190[.]13[.]160[.]19
  • 186[.]47[.]122[.]182
  • 186[.]71[.]150[.]23
  • 190[.]152[.]4[.]98
  • 170[.]82[.]156[.]53
  • 131[.]161[.]253[.]190
  • 181[.]113[.]114[.]50
  • 186[.]47[.]121[.]58
  • 185[.]70[.]182[.]162
  • 200[.]127[.]121[.]99
  • 45[.]235[.]213[.]126

Remediation

  • Block the threat indicators at their respective controls.
  • Do not download random files from the internet.
  • Closely monitor port 443 and 449.