Rewterz Threat Alert – Trickbot Malware

Rewterz Threat Alert –APT SideWinder Group – Active IOCs

August 17, 2021

Rewterz Threat Alert – Quasar RAT – Active IOCs

August 17, 2021

Rewterz Threat Alert – Trickbot Malware – Fresh IOCs

Severity

High

Analysis Summary

TrickBot is a banking Trojan that targets sensitive information and acts as a dropper for other malware. Trickbot is usually spread via malicious malspam campaigns. These campaigns send unsolicited emails that direct users to download malware from malicious websites or trick the user into opening malware through an attachment. TrickBot is also dropped as a secondary payload by other malware. The malspam campaigns that use Trickbot use branding familiar to the recipient, such as invoices from accounting and financial firms. The emails typically include an attachment, such as a Microsoft Word or Excel document. The opened attachment will prompt the user to enable macros, which executes a VBScript to run a PowerShell script to download the malware.

Impact

Credential theft
Financial loss
Exposure of sensitive data

Indicators of Compromise

Domain Name

securityupdateav[.]com
windowsupdatesc[.]com

IP

23[.]19[.]227[.]147
108[.]62[.]118[.]247
212[.]114[.]52[.]180
196[.]43[.]106[.]38
186[.]97[.]172[.]178
37[.]228[.]70[.]134
144[.]48[.]139[.]206
190[.]110[.]179[.]139
172[.]105[.]15[.]152
177[.]67[.]137[.]111
27[.]72[.]107[.]215
186[.]66[.]15[.]10
189[.]206[.]78[.]155
202[.]131[.]227[.]229
185[.]9[.]187[.]10
196[.]41[.]57[.]46
212[.]200[.]25[.]118
197[.]254[.]14[.]238
45[.]229[.]71[.]211
181[.]167[.]217[.]53
181[.]129[.]116[.]58
185[.]189[.]55[.]207
172[.]104[.]241[.]29
14[.]241[.]244[.]60
144[.]48[.]138[.]213
202[.]138[.]242[.]7
202[.]166[.]196[.]111
36[.]94[.]100[.]202
187[.]19[.]167[.]233
181[.]129[.]242[.]202
36[.]94[.]27[.]124
43[.]245[.]216[.]116
186[.]225[.]63[.]18
41[.]77[.]134[.]250

MD5

951068d313ac0c41d1743f0798b051c1
17492f7b9906b807cffd30e8a0edd993
1a5f3ca6597fcccd3295ead4d22ce70b
4fd94383d9c745ecc270bdd67889f1d8
ae276a8143c07b4fc14c4eff07ffcadf
1a5f3ca6597fcccd3295ead4d22ce70b
4fd94383d9c745ecc270bdd67889f1d8
ae276a8143c07b4fc14c4eff07ffcadf
1a5f3ca6597fcccd3295ead4d22ce70b
4fd94383d9c745ecc270bdd67889f1d8
ae276a8143c07b4fc14c4eff07ffcadf

SHA-256

a1d4bdaf5365ae346d7519afb44f06effd8a2861f4fc82e1067eb86723dbf96d
7e8c547fcc86e26b973e4c974da8ee2c4cfe84846e2cdfcd7f265929d27602f9
7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7
92db40988d314cea103ecc343b61188d8b472dc524c5b66a3776dad6fc7938f0
8358c51b34f351da30450956f25bef9d5377a993a156c452b872b3e2f10004a8
7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7
92db40988d314cea103ecc343b61188d8b472dc524c5b66a3776dad6fc7938f0
8358c51b34f351da30450956f25bef9d5377a993a156c452b872b3e2f10004a8
7501da197ff9bcd49198dce9cf668442b3a04122d1034effb29d74e0a09529d7
92db40988d314cea103ecc343b61188d8b472dc524c5b66a3776dad6fc7938f0
8358c51b34f351da30450956f25bef9d5377a993a156c452b872b3e2f10004a8

SHA1

e786d3e20624a16a60264810c4823951ff3d14a3
ac0724c724f8d6e2a54b41b86d99aa189e40dc81
31a359bfee00337bc9c6d23c2cb88737ac9b61c8
7da18493faa8226e26b6b6e2f2842eace1d7c152
8ae6dde50fd3a5697076fed6d6b61acdc8b75e1d
31a359bfee00337bc9c6d23c2cb88737ac9b61c8
7da18493faa8226e26b6b6e2f2842eace1d7c152
8ae6dde50fd3a5697076fed6d6b61acdc8b75e1d
31a359bfee00337bc9c6d23c2cb88737ac9b61c8
7da18493faa8226e26b6b6e2f2842eace1d7c152
8ae6dde50fd3a5697076fed6d6b61acdc8b75e1d

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.