Rewterz Threat Alert – TA505 Active IoCs

Severity

High

Analysis Summary

TA505 is a prolific cybercriminal group known for its attacks against multiple financial institutions and retail companies using malicious spam campaigns and different malware. In the group’s latest campaign, they deploy the Get2 Downloader via Office Template Macros which leads to the malware. This also allow threat actors to gain access to the compromised network, providing opportunities to steal financial data or install ransomware. This is an active campaign expected to target financial institutions around the world. This threat actor has been highly active in the wild since the second quarter of 2020. TA505 aka EvilCorp is found consistently targeting financial institutions around the world. Every week, fresher IoCs are discovered related to this threat group.

Impact

• Credential Theft
• Unauthorized Access
• Information Theft
• Financial Loss

Indicators of Compromise

Domain Name

• news-37876-mshome[.]com
• pssd-ltdgroup[.]com
• news-389767-mshome[.]com
• near-back[.]com
• dropbox-cdnt[.]com
• shortcut-links[.]com
• nels-ltd[.]com
• onedrives-live[.]com

MD5

• 52d14e42c014d44d61f293ab0d7ed49e
• 14970ce0a3d03c46a4180db69866d0d1
• b2fbe9a356d1598b271a9631a922ef7a
• ac43b411b9bd455a8cde89face9ea9b9
• 9cab3a1e56303949b7b54897d84c77fe
• 0dddf693f6a707ce26853edfb256e447
• 861f423251bfa7c707cd76b2cd4225a0

SHA-256

• 9dda44a9924d81e3074d59adff40803c622ccd6fc058c5d8080557d0edafbd17
• 0e3a83e441951860929c99e24bf19e76fe281c3e1b1f7f3aea49b0a38673f873
• e2b03931b8adf597caceb14e8b3016586fc91e296d34b2395ed2da140a9b6343
• 498f5dac2641da10c56d45667fb8f23c1477f8772d32044a34f3938018c9f442
• 83ad319279941b4fb21ba7ba1a0558e0770ddc21521665757810ecb0222b8f5a
• 1139371898eb49ced0244b3743b7bf55e6ec41e56c07539fa901ad2422e117e6
• b33b3beb75ffe4fda66b9b38e3121f1abb4b7896f99ba4f35b511c7ed63c305c

SHA1

• e08831b5818270fbab2df306de03dbc56df46e24
• 79cd170e2249a880689b1b05c939ee2bc6defa7d
• fc9c3ee5aa81de37171302b62e7854b45b733546
• 9e64c75bcab11797392059e2ed39c19463e9f3cb
• 87ec7095c180be2fa1082bcba9cc16b05b49a580
• 96c4e0c4788e28faf1150bdff2e76d1324aa6806
• d9dc1f8a66fb37aae209721177a1746155f389f1

Remediation

• Block the threat indicators at their respective controls.
• Do not download attachments from untrusted emails.