Rewterz Threat Alert -Malware Campaign Hides Ransomware in Super Mario Wrapper

Rewterz Threat Alert – Phishing Campaign Targeting Bank Employees in Pakistan, Forging Zimbra

February 12, 2019

Rewterz Threat Alert – Trickbot Banking Trojan hits North American Banks

Analysis Summary

Trickbot Banking Trojan has resurfaced and is being distributed through phishing emails, which are largely targeted towards North American recipients, containing a malicious Excel spreadsheet. Unusually, the subject line and content of the body refer to ACH failures due to erroneous hash totals. Macros need to be enabled for the excel spreadsheet to be able to infect the potential victim. If macros are enabled, a PowerShell script is executed to download the payload and begins the infection process which will result in the Trickbot banking Trojan being installed.

Impact

Loss of sensitive information

server-side injections and redirection attacks

Indicators of Compromise

IP(s) / Hostname(s)

198[.]49[.]66[.]162
199[.]21[.]106[.]189
95[.]213[.]236[.]12
193[.]187[.]172[.]100
85[.]17[.]172[.]227
130[.]185[.]250[.]51
85[.]17[.]76[.]90
95[.]211[.]242[.]194
URLs
api[.]ipify[.]org
ruanova[.]mx
tdbankmail[.]com
http://ruanova[.]mx/5pe[.]rsac
http://api[.]ipify[.]org/
http://mastersgb[.]com/5pe[.]rsac
http://185[.]68[.]93[.]30/radiance[.]png
Email Address
Sarah[.]Kochan@tdbankmail.com
Email Subject
Company ACH ﬁle failure
Malware Hash (MD5/SHA1/SH256)
8ef0b271f1c851ca8e23d843983ae065
c7c71979e360cfdd5615624a9079ceeb849e7320
6e9abf58f8aad7ae634a2e13cc7fdd18babe0d62a5fec60ec62e3754851e5873
f998c1d9460b52fdab8502057ee1873b10e10cb355a420d524a972514284452d
46706124d4c65111398296ea85b11c57abﬀbc903714b9f9f8618b80b49bb0f3
479aa1fa9f1a9af29ed010dbe3b080359508be7055488f2af1d4b10850fe4efc
52bc216a6de00151f32be2b87412b6e13efa5ba6039731680440d756515d3cb9
627a9eb14ecc290fe7fb574200517848e0a992896be68ec459dd263b30c8ca48
8d56f6816f24ec95524d6b434fc25f9aad24a27dbb67eab0106bbd7b4160dc75
9a529b2b77c5c8128c4427066c28ca844ﬀ8ebbd8c3b2da27b8ea129960f861b
a515f4f847e8d7b2eb46a855224c8f0e9906435546bb15785b6770f2143bc22a
af5ee15f47226687816fc4b61956d78b48f62c43480f14df5115d7e751c3d13d
b401a0c3a64c2e5a61070c2ae158d3fcf8ebbb51b33593323cd54bbe03d3de00
b8b757c2a3e7ae5bb7d6da9a43877c951fb60dcb606cc925ab0f15cdf43d033b
bf50566d7631485a0eab73a9d029e87b096916dfbf07df4af2069fc6eb733183
c8c789296cc8219d27b32c78e595d3ad6ee1467d2f451f627ce96782a9ﬀ0c5f
cbb5ea4210665c6a3743e2b7c5a29d10af21efddfbab310035c9a14336c71de3
dﬀ1c7cddd77b1c644c60e6998b3369720c6a54ce015e0044bbbb65d2db556d5
f9ebf40d1228fa240c64d86037f2080588ed67867610aa159b80a553bc55edd7
fe0f269a1b248c919c4e36db2d7efd3b9624b46f567edd408c2520ec7ba1c9e4

Remediation

Block the IOCs at their respective controls.
Make sure your anti-virus is up-to-date.
Do not open unexpected emails and do not click on any email attachments unless the sender is a legitimate and trusted source.
Do not enable the macros or enable edit to see the document.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo

Full Name *

Email Address *

Contact Number

Company Name

Country