

Cyber Resilience: Fortifying Defenses In The Face Of Persistent Threats
September 10, 2024
Bitter APT – Active IOCs
September 11, 2024
Cyber Resilience: Fortifying Defenses In The Face Of Persistent Threats
September 10, 2024
Bitter APT – Active IOCs
September 11, 2024Severity
High
Analysis Summary
Heodo is a malicious program that is a variant of Emotet. Emotet was first identified in 2014. This malware is mostly disseminated through spam emails (malspam). Malicious scripts, document files with built-in macros, or malicious links can all deliver the infection. Emotet has undergone a few alterations.
Heodo malware can download and execute other malware, steal personal or sensitive information, etc. Heodo attack victims may incur a monetary loss, data loss, computer infection with additional viruses, identity theft, problems with online privacy, and other concerns. Threat actors use spam campaigns to deceive consumers into installing Heodo on their PCs. They send emails with a malicious Microsoft Word document that, when opened, requests access to information and modification or macros commands.
Impact
- Credential Theft
- Information Theft
- Financial Loss
Indicators of Compromise
MD5
- 5c975df3d5a557e85a06676463ad0654
- 6097fc2f6ff8ad43e8e0be3d797d4ec9
- 1e7fbaebf26c173bd25e09c110cc46fc
- 667ead6e36314bd21b1fa1fb9f1960b6
- 459061967c92b83083c24ed4963e7a18
- 4fb20070ef46f4896c7aca0262e18ce6
- 31313c859e23c86b348948df8bf8ed45
- 6086601a8560a2037f5091d8632d0509
SHA-256
- 65f25ac4a4a913ba247966013b44cb92b0fab945d9d91cd561d3aa6d15577270
- 12cc979c1b38dd0da15645b463c2ad03fe2b5ad73b76cddd94b9fea746d5547c
- ea330d901669c5b2bbd27c6252c3ed6a6c3694f5ee4b2c55371de2ed872e1a56
- c13c6923bd8eab75c07640ad362833787d78a005577f8d5e32927139df8e2cd0
- 9e9c2fb86b9215aabb51108105b5c5a553f9c2d4904f8f03c4a8b7ff3602c989
- c433439befa9874ea6532f43760bfaf3ff5f76716229996c111b21e5b1641a7d
- 7863a1d2d90b2b739663843f977876640a10760896e74f15655fbbefa444ccc2
- ac34e44a897a626c34db1c18efcf707fc1d5473a46117586649f31f53c28496a
SHA-1
- 3b1ad66b6e7e2384d1aed2288d8ed5d17e2f4fef
- 02c725105332ef46824d1fc7039fff8d4a264b18
- 5873ef0771da9e0dff1f1fa93d01b77efb8a9eb8
- b14ecebb5df15c8ab0f11663d419c2ccb1944760
- f9ba0b5b57d56314264a088a2f0830635da2a206
- c3b5d217932b4f2c3ce765691103b14f1a4520e8
- 9af2067bd1cd21607b65d137fb1f0645c4c3b9b6
- 2a7203ea36b649e95f42a2cf0fcf38347d0a7640
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.
- Passwords - Ensure that general security policies include implementing strong passwords, correct configurations, and proper administration of security policies.
- Admin Access - limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
- WAF - Web defacement must be stopped at the web application level. Therefore, set up a Web Application Firewall with rules to block suspicious and malicious requests.
- Patch - Patch and upgrade any platforms and software on time and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
- Secure Coding - Along with network and system hardening, code hardening should be implemented within the organization to secure their websites and software. Use testing tools to detect any vulnerabilities in the deployed codes.
- 2FA - Enable two-factor authentication.
- Antivirus - Enable antivirus and anti-malware software and update signature definitions promptly. Using a multi-layered protection is necessary to secure vulnerable assets.