Severity
High
Analysis Summary
An attack is detected utilizing a recent Firefox zero-day and malware payloads in order to gain access to victim’s computers, networks, and sensitive information. Mozilla released an emergency Firefox update to fix a critical remote execution vulnerability that was actively used in targeted attacks in the wild. This bug was given a CVE ID of CVE-2019-11707 while the vulnerability could be exploited for remote code execution, it would need to be chained with a sandbox escape vulnerability CVE-2019-11708 in order to affect the host operating system.
Cryptocurrency firms were the target of attacks utilizing this exploit. Their goal was most likely to gain access to corporate information, stored cryptocurrency funds, or their networks. The phishing email that allegedly initiated these attacks claimed to be an “Adam Prize Organizer” named Neil Morris who was requesting assistance from the target. This email contained a now defunct url of http://people.ds.cam.ac.uk/nm603/awards/Adams_Prize. When a user visited this URL with Firefox, the exploit would drop a malicious payload on the computer. This trojan is a Remote Access Trojan, or RAT, that would allow an attacker to gain full access to the infected computer. In addition to RAT capabilities, Netwire is designed to steal information from browsers and other applications.
Impact
- Unauthorized Access
- Information Theft
- Remote Code Execution
- System Takeover
- Financial loss
Indicators of Compromise
Domain Name
- athlon4free2updates1[.]com
- analyticsfit[.]com
MD5
- de3a8b1e149312dac5b8584a33c3f3c6
- af10aad603fe227ca27077b83b26543b
- 5030422b3428c0f938e3ad03720ca9e8
- 8b2b7537c792ecf24d8ee7b9fbb942f8
- 70286abc22eca9a9cbea24e551c891cd
- b6f92b20816f23c147445bd5eec86a06
- fc99b1407655674573ee4167f1e3dcbd
SHA-256
- 07a4e04ee8b4c8dc0f7507f56dc24db00537d4637afee43dbb9357d4d54f6ff4
- 97200b2b005e60a1c6077eea56fc4bb3e08196f14ed692b9422c96686fbfc3ad
- af77d91269c731b4624594826b18f8c9b3df08ac80aeae5968db55b33bd3d9f4
- 26a0ca13e857b8f6260ceea4373cbfde1526f8d7df9cf27926959df1f63dadf5
- 3addeebf734e6f11e755bf31b559081d9a6020358952136c330c7004e10725b6
- a033fb94947caf6c22523af2d660b89d0c0fe6ee0ee200853312f192d29ed964
- 46106474c1e05747a77866e6e6166b31d37e1524e3f3e7d2abca5f3c07454505
Source IP
- 185.49.69[.]210
- 89.34.111[.]113
URL
- http[:]//185.162.131[.]96/i/kr http[:]//185.162.131[.]96/i/pm
- http[:]//185.162.131[.]96/i/195/195
- http[:]//185.162.131[.]96/i/IconServicesAgent
- http[:]//185.162.131[.]96/i/thk http[:]//185.162.131[.]96/i/kri
- http[:]//185.162.131[.]96 http[:]//185.162.131[.]96/i/pmi
Remediation
- Block the threat indicators at their respective controls.
- Immediately update Firefox to a fixed version that patches the zero-day.
- http://rewterz.com/rewterz-news/rewterz-threat-advisory-cve-2019-11707-mozilla-firefox-vulnerability-exploited-in-the-wild