Rewterz Threat Alert – Buhtrap backdoor and ransomware distributed via major advertising platform

Severity

Medium

Analysis Summary

Recently, some threat actors distributed their malware by abusing Yandex.Direct and hosted it on GitHub. The group used two well-known backdoors — Buhtrap and RTM — as well as ransomware and cryptocurrency stealers. Malicious ads were posted through Yandex.Direct, aimed at redirecting a potential target to a website offering malicious downloads disguised as document templates.

The user must run the executable in order for it to work. Moreover, the cryptocurrency addresses associated with the ransom payment of this campaign are encrypted using RC4.

Impact

• File encryption
• Cryptocurrency mining

Indicators of Compromise

IP(s) / Hostname(s)

• stat-counter-7-1[.]bit
• stat-counter-7-2[.]bit

URLs

• blanki-shabloni24[.]ru
• clipbanker[.]hm
• ktosdelaetskrintotpidor[.]com
• medialeaks[.]icu
• sositehuypidarasi[.]com
• icq[.]chatovod[.]info
• spy[.]banker[.]kw
• spy[.]buhtrap[.]ae
• spy[.]buhtrap[.]ag
• womens-history[.]me

Filename

• nike.exe
• sbornik_dokumentov.exe
• master_blankov_300.exe
• mir_vseh_blankov_24.exe
• blanki.exe
• master-blankov24.exe
• vseblanki24.exe
• masterblankov24.exe
• btctradebot.exe
• hashfish.exe
• hashfish.apk

Malware Hash (MD5/SHA1/SH256)

• d53d1452f383725f3386868839d1b7b2
• 4112520ab7344076b2fe93a43fcde5ad
• 9554fc65845324f783ffa2911c8b2cd9
• c87afebec0fd296ccbaf60b5a8403719
• 33cc2f1943e834dff6650e0e1ab70e87
• d06d957763ccc49a7fb1a65d6430ead0
• 3e521df314e3295cd8b8ff7ca19153a3
• 1269e8bdb4fc853e8670b710415658cb
• 55233473ba6fa3fdfdac096d5c0e0bbf
• 37960e9e34832c5ff314c30ab64c6d7a
• cd16693695c59427b08e6597019b85f3
• c01f3f066eae4b255f29739707f27175
• 09647962c6335e2f81ae97fe2e28c15c
• 23a73657fe1e95a2c08e1b30a8cf6c48
• 77487c27f5476f7bcb092106f4845b4f
• d336e579505f40c72902a7df9aa04138
• 3a1230a7d7a0d7dafafb443d0cb751d4

Remediation

• Block the threat indicators at their respective controls.
• Do not download files from untrusted sources.
• Do not click on URLs attached in unexpected/untrusted emails.