Severity
High
Analysis Summary
The OceanLotus Group aka APT32 is using a suite of remote access trojans dubbed “Ratsnif” to leverage new network attack capabilities. Researchers have analyzed the Ratsnif trojans, which offer a veritable swiss-army knife of network attack techniques. The trojans, under active development since 2016, combine capabilities like packet sniffing, gateway/device ARP poisoning, DNS poisoning, HTTP injection, and MAC spoofing.
Impact
- DNS poisoning
- HTTP injection
- MAC spoofing
Indicators of Compromise
URLs
http[:]//search[.]webstie[.]net/
Filename
- javaw.exe
- Client.exe
Malware Hash (MD5/SHA1/SH256)
- 7fd526e1a190c10c060bac21de17d2c90eb2985633c9ab74020a2b78acd8a4c8
- b20327c03703ebad191c0ba025a3f26494ff12c5908749e33e71589ae1e1f6b3
- b214c7a127cb669a523791806353da5c5c04832f123a0a6df118642eee1632a3
- b4e3b2a1f1e343d14af8d812d4a29440940b99aaf145b5699dfe277b5bfb8405
Remediation
Block all threat indicators at your respective controls.