Rewterz Threat Alert – Netwire RAT Malware

Severity

High

Analysis Summary

A Netwire campaign targeting Italian industry. As the Netwire variant was common to known samples, the main focus of their reporting on the subject was the unique attack chain used to distribute the RAT. The campaign begins with an Italian language email and XLS attachment. This XLS attachment contains a macro that kicks off the infection chain if a user opts to enable macros. This macro simply downloads what appears to be an image file but instead is an XSL stylesheet containing JavaScript. The contained JavaScript downloads and executes a VBS file hosted on the same server as the fake image file. In turn, the VBS code fetches yet another payload from the remote server. This payload is downloaded as a .jpg and read by the VBS code as raw bytes that will eventually become executable PowerShell code. The PowerShell code provides two functions. First, it loads a DLL that can perform an AMSI bypass. Then, it loads a second DLL that can inject the Netwire payload into another process. Persistence is established via a Registry Run key. As mentioned, the final payload is the Netwire RAT, which provides attackers with the ability to steal information from victim machines, such as credentials, browser history, and keystrokes. The researchers note that similarities exist between the naming conventions of variables in the payloads from this campaign with those in Aggah campaigns targeting the Italian manufacturing industry. 

Impact

• Information theft
• Exposure of sensitive data

Indicators of Compromise

MD5

• ce7b8394cdc66149f91ed39ce6c047ee
• 4e4001c6c47d09009eb24ce636bf5906
• 4b8e4d05092389216f947e980ac8a7b9
• ad066878659d1f2d0aee06546d3e500b
• ebe4a3f4ceb6d8f1a0485e3ce4333a7c

SHA-256

• b7e95d0dcedd77ab717a33163af23ab2fd2dc6d07cdf81c5e4cfe080b0946b79
• 818fa737f4041136cde620c3fa3bac5124f60506ef1a64bbc2f8472218039db5
• 48d9c8293d94c851dec10832b2ef6800dc91669e8fef96d8763d17d6b225e42c

SHA1

• 2e0003aeda533f10ef3a69cb6217dbc1da980b9e
• 42b1a3e7891c78f026a9773fad96931ebf8e08cf
• fb7f0880acc174e0c89728783c348cba69315b08

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.