✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Advisory – CVE-2018-10902 – IBM Security Guardium Linux Kernel Privilege Escalation Vulnerability

June 28, 2019
Rewterz

Rewterz Threat Advisory – Industrial control Advantech WebAccess/SCADA Multiple Vulnerabilities

June 28, 2019

Rewterz Threat Alert – Riltok Banking Trojan Through Smishing and Social Engineering

Severity

Medium

Analysis Summary

A potential victim receives an SMS text containing a malicious link to a fake website (pretending to be a popular ad service). The advertisements attempt to entice the victim into downloading an update for that app. If the victim falls prey to this scheme (allows installation to proceed), they will actually be downloading the banking Trojan. Once installed, the Trojan reaches out to its command and control server in order to receive commands.

Impact

Credential theft

Indicators of Compromise

IP(s) / Hostname(s)

  • 100[.]51[.]100[.]00
  • 108[.]62[.]118[.]131
  • 172[.]81[.]134[.]165
  • 172[.]86[.]120[.]207
  • 185[.]212[.]128[.]152
  • 185[.]212[.]128[.]192
  • 185[.]61[.]000[.]108
  • 185[.]61[.]138[.]108
  • 185[.]61[.]138[.]37
  • 188[.]209[.]52[.]101
  • 5[.]206[.]225[.]57

URLs

  • alr992[.]date
  • avito-app[.]pw
  • backfround2[.]pw
  • background1[.]xyz
  • blacksolider93[.]com
  • blass9g087[.]com
  • brekelter2[.]com
  • broplar3hf[.]xyz
  • buy-youla[.]ru
  • cd78cg210xy0[.]com
  • copsoiteess[.]com
  • farmatefc93[.]org
  • firstclinsop[.]com
  • holebrhuhh3[.]com
  • holebrhuhh45[.]com
  • karambga3j[.]net
  • le22999a[.]pw
  • leboncoin-bk[.]top
  • leboncoin-buy[.]pw
  • leboncoin-cz[.]info
  • leboncoin-f[.]pw
  • leboncoin-jp[.]info
  • leboncoin-kp[.]top
  • leboncoin-ny[.]info
  • leboncoin-ql[.]top
  • leboncoin-tr[.]info
  • myyoula[.]ru
  • sell-avito[.]ru
  • sell-youla[.]ru
  • sentel8ju67[.]com
  • subito-li[.]pw
  • subitop[.]pw
  • web-gumtree[.]com
  • whitehousejosh[.]com
  • whitekalgoy3[.]com
  • youlaprotect[.]ru

Malware Hash (MD5/SHA1/SH256)

  • 0497b6000a7a23e9e9b97472bc2d3799caf49cbbea1627ad4d87ae6e0b7e2a98
  • 417fc112cd0610cc8c402742b0baab0a086b5c4164230009e11d34fdeee7d3fa
  • 54594edbe9055517da2836199600f682dee07e6b405c6fe4b476627e8d184bfe
  • 6e995d68c724f121d43ec2ff59bc4e536192360afa3beaec5646f01094f0b745
  • bbc268ca63eeb27e424fec1b3976bab550da304de18e29faff94d9057b1fa25a
  • dc3dd9d75120934333496d0a4100252b419ee8fcdab5d74cf343bcb0306c9811
  • e3f77ff093f322e139940b33994c5a57ae010b66668668dc4945142a81bcc049
  • ebd0a8043434edac261cb25b94f417188a5c0d62b5dd4033f156b890d150a4c5
  • f51a27163cb0ddd08caa29d865b9f238848118ba2589626af711330481b352df

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about text/emails sent by unknown senders.
  • Never click on the link/ attachments sent by unknown senders.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo