GootKit Malware

Gootkit is an advanced banking Trojan first discovered in mid-2014. Known for using various techniques to evade detection, the malware also has its own unique methods: it’s partially written in JavaScript and it incorporates the node.js runtime environment.

GootKit is also known as talalpek, Trojan. GootKit or Xswkit. Like many other trojans, GootKit steals various personal, confidential information. Once installed, it also acts as a ‘backdoor’ allowing cybercriminals to access and control a computer remotely (e.g. to download additional files to an infected computer). GootKit is often distributed using another trojan-type program called Emotet.

Table of Contents

The three main modules

Gootkit uses three main modules,

  • The Loader

  • The Main Module

  • The Web Injection Module

The loader module is the first stage of the Trojan which sets up the persistent environment. The main module creates a proxy server which works in conjunction with the new browser injection module.

How did GootKit infiltrate my computer?

Typically, cybercriminals proliferate GootKit trojan using spam email campaigns such as Emergency Exit Map. Most spam campaigns infect computers through presented web links or attachments. Opening these links or attachments leads to download and installation of a malicious program such as GootKit, or other high-risk computer infection. The presented attachments are often Microsoft Office documents (Word, Excel, and so on), PDF or archive files (such as ZIP, RAR), executable files (.exe), and so on. For example, if a downloaded and opened attachment is an MS Office document, it will ask to enable macro commands. Allowing this gives permission for malware to be downloaded and installed. Similar rules apply to other malicious attachments – they must first be opened to do any harm.

Recommendations

  • Use a firewall to block all incoming connections from the Internet to services that should not be publicly available. By default, you should deny all incoming connections and only allow services you explicitly want to offer to the outside world.

  • Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.

  • Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task. When prompted for a root or UAC password, ensure that the program asking for administration-level access is a legitimate application.

  • Disable AutoPlay to prevent the automatic launching of executable files on network and removable drives, and disconnect the drives when not required. If write access is not required, enable read-only mode if the option is available.

  • Turn off file sharing if not needed. If file sharing is required, use ACLs and password protection to limit access. Disable anonymous access to shared folders. Grant access only to user accounts with strong passwords to folders that must be shared.

  • Turn off and remove unnecessary services. By default, many operating systems install auxiliary services that are not critical. These services are avenues of attack. If they are removed, threats have less avenues of attack.

  • If a threat exploits one or more network services, disable, or block access to, those services until a patch is applied.

  • Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.

  • Configure your email server to block or remove email that contains file attachments that are commonly used to spread threats, such as .vbs, .bat, .exe, .pif and .scr files.

  • Isolate compromised computers quickly to prevent threats from spreading further. Perform a forensic analysis and restore the computers using trusted media.

  • Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

  • If Bluetooth is not required for mobile devices, it should be turned off. If you require its use, ensure that the device’s visibility is set to “Hidden” so that it cannot be scanned by other Bluetooth devices. If device pairing must be used, ensure that all devices are set to “Unauthorized”, requiring authorization for each connection request. Do not accept applications that are unsigned or sent from unknown sources

For more cybersecurity information contact us at help@theweborion.com

Joker Spyware

The malware “Joker” is spyware that gives malicious agents access to the victims’ SMS and contact list and other device information. Apps linked to it on the Google Play Store have been downloaded over 470,000 times, possibly affecting hundreds of thousands of Android devices with malware.

The Joker was capable of stealing SMS messages, contact information and other sensitive data from infected devices. The spyware also signed victims up to premium subscriptions without their knowledge. The researcher who found the malware said it “stands out as a small and a silent one. It is using as little Java code as possible and thus generates as little footprint as possible.”

According to Kuprins, malware only attacks targeted countries. Unfortunately, India finds a place in the list of 37 countries that have been attacked by this spyware. Majority of the infected apps contain a list of Mobile Country Codes (MCC) and the victim is one who is using SIM card from one of these countries in order to receive the second-stage payload. “The majority of the discovered apps target the EU and Asian countries, however, some apps allow for any country to join. Furthermore, most of the discovered apps have an additional check, which will make sure that the payload won’t execute when running within the US or Canada,” Kuprins said, in a blog post.

Google also recently removed the popular CamScanner app from its app store. The app was harboring a malicious module called Trojan-Dropper.AndroidOS.Necro.n and bombarding users with ads. Although there were no data leaks, users were still incredibly annoyed by the module.

For more Cyber Security Information contact us at help@theweborion.com.

 

TFlower Ransomware

TFlower is software categorized as ransomware. Unlike most ransomware-type programs, it does not change extensions of encrypted files. It does, however, create a ransom message (within a text file named “!_Notice_!.txt“) that contains instructions about how to purchase a decryption tool. Typically, programs such as TFlower encrypt (lock) files, which then cannot be accessed unless they are decoded with a decryption tool (that cyber criminals encourage victims to purchase).

The ransom message (“!_Notice_!.txt”) states that files can only be decrypted with the key that was used to encrypt them. To obtain a decryption tool, victims are encouraged to pay TFlower developers a ransom of 15 BTC (Bitcoin).

“TFlower” is targeting corporate environments via exposed Remote Desktop Services (RDS). TFlower is a very malicious program that belongs to the infamous Ransomware cryptovirus category. This infection is among the hardest to detect and because of that it is very effective in its malicious attack. As a typical cryptovirus, TFlower is pretty straightforward in its activities and follows a specific agenda. The goal of the infection is to sneak in the system without being noticed and to place a complex encryption to a number of files that it considers as important to you. Once it locks them up, the malware will immediately place a ransom-demanding notification with the help of which it will blackmail you to pay a certain amount of money in exchange for the unique access key which can reverse the applied encryption.

First discovered in August, the ransomware makes its way onto a corporate network after attackers hack into a machine’s exposed Remote Desktop Services. This attack vector enables bad actors to infect the local machine with TFlower. At that point, malefactors can attempt to move throughout the network and generate even more infections using PowerShell Empire and other tools. When executed, the ransomware will display a console that shows the activity being performed by the ransomware while it is encrypting a computer.

TFlower Ransomware

TFlower is software categorized as ransomware. Unlike most ransomware-type programs, it does not change extensions of encrypted files. It does, however, create a ransom message (within a text file named “!_Notice_!.txt“) that contains instructions about how to purchase a decryption tool. Typically, programs such as TFlower encrypt (lock) files, which then cannot be accessed unless they are decoded with a decryption tool (that cyber criminals encourage victims to purchase).

The ransom message (“!_Notice_!.txt”) states that files can only be decrypted with the key that was used to encrypt them. To obtain a decryption tool, victims are encouraged to pay TFlower developers a ransom of 15 BTC (Bitcoin).

“TFlower” is targeting corporate environments via exposed Remote Desktop Services (RDS). TFlower is a very malicious program that belongs to the infamous Ransomware cryptovirus category. This infection is among the hardest to detect and because of that it is very effective in its malicious attack. As a typical cryptovirus, TFlower is pretty straightforward in its activities and follows a specific agenda. The goal of the infection is to sneak in the system without being noticed and to place a complex encryption to a number of files that it considers as important to you. Once it locks them up, the malware will immediately place a ransom-demanding notification with the help of which it will blackmail you to pay a certain amount of money in exchange for the unique access key which can reverse the applied encryption.

First discovered in August, the ransomware makes its way onto a corporate network after attackers hack into a machine’s exposed Remote Desktop Services. This attack vector enables bad actors to infect the local machine with TFlower. At that point, malefactors can attempt to move throughout the network and generate even more infections using PowerShell Empire and other tools. When executed, the ransomware will display a console that shows the activity being performed by the ransomware while it is encrypting a computer.



CookieMiner

CookieMiner is high-risk malware that objectives the Mac running system. Following successful infiltration, CookieMiner statistics personal information. Its main reason is to steal credentials of diverse accounts (primarily those regarding cryptocurrencies). This malware additionally opens a ‘backdoor‘ called EmPyre and injects a crypto mining device into the system. The malware, which researchers have dubbed CookieMiner, has quite a few guns in its armory that might make it mainly worrisome for cryptocurrency investors.

According to security analysts Yue Chen, Cong Zheng, Wenjun Hu, and Zhi Xu, the macOS-based totally malware can scouse borrow browser cookies from users’ Google Chrome and Apple Safari browsers. Specifically, cookies related to the subsequent cryptocurrency exchanges are targeted:

Binance

Bitstamp

Bittrex

Coinbase

MyEtherWallet

Poloniex

Table of Contents

Any internet site with “blockchain” in its domain name (for instance, blockchain.Com)

The cookies are grabbed from the infected consumer’s browser, zipped up and then uploaded to a remote server underneath the control of the criminals. CookieMiner downloads a Python script (known as “harmlesslittlecode.Py”) that can extract stored login credentials and credit card statistics from Google Chrome’s local statistics storage. It does so through adopting decryption and extraction techniques from the code of Google Chromium, an open-source model of the Google Chrome browser, researchers said. In addition to stealing cookies, CookieMiner had no qualms approximately raiding the Chrome browser to extract stored passwords and credit score card details.

The malware’s ability includes:

Steals Google Chrome and Apple Safari browser cookies from the victim’s device,

Steals stored usernames and passwords in Chrome,

Steals saved credit score card credentials in Chrome,

Steals iPhone’s textual content messages if subsidized as much as Mac,

Steals cryptocurrency wallet facts and keys,

Mines cryptocurrency at the victim’s system, and

Maintains manipulation of the inflamed system the use of the EmPyre backdoor.

Its ability to scouse borrow SMS records from iTunes backups creates the ability to pass multi-issue authentication and impersonate the consumer from their very own system.

For greater cybersecurity statistics contact us at help@theweborion.Com

BRATA Android RAT

Another vindictive Android remote get admission to the instrument (RAT) named BRATA was situated with the guide of Kaspersky specialists while spreading through WhatsApp and SMS messages to taint and mystery operator on Brazilian clients.

The new RAT changed into named based on its “Brazilian RAT Android” description with the aid of the Kaspersky Global Research & Analysis Team (GReAT) researchers who spotted it in the wild in January.

Until now, the researchers have discovered more than 20 particular BRATA variations in Android apps delivered via the Google Play Store, with some also having been found on unofficial Android app stores.

RAT becomes added through the reputable Google Play Store and also via unofficial Android app stores. The experts have already located greater than 20 specific BRATA versions in Android apps at the Play Store.

Most of the contaminated apps pose as an update to the famous instantaneous messaging utility WhatsApp that would address the CVE-2019-3568 flaw in the instantaneous messaging application. Once the malware has inflamed the victim’s device, it will start a keylogging feature, enhancing it with real-time streaming functionality. The malware leverages the Android Accessibility Service function to have interaction with different applications set up at the victim’s device.

BRATA helps many commands, along with unlocking the victims’ devices, collecting device statistics, turning off the device’s display to surreptitiously run tasks in the background, executing any specific utility and uninstall itself and eliminates any contamination traces.

“It is worth bringing up that the infamous fake WhatsApp update registered over 10,000 downloads in the authentic Google Play Store, achieving as much as 500 victims in step with day,” concludes Kaspersky.

Indicators of Compromise

MD5

  • 1d8cf2c9c12bf82bf3618becfec34ff7

  • 4203e31024d009c55cb8b1d7a4e28064

  • 4b99fb9de0e31004525f99c8a8ea6e46

For greater cybersecurity statistics contact us at help@theweborion.Com

What Is Cyber Security, And Why Does It Matter ?

What Is Cyber Security?

Cybersecurity or records generation security is the technique of protecting computers, networks, applications, and facts from unauthorized access or assaults which could be aimed for exploitation.

Why Cyber Security Matters?

Highly publicized breaches of supposedly stable systems, even those maintained via elite organizations, cast worry into the overall populace that their non-public statistics could be uncovered. This makes cyber safety an increasingly regular topic, as leaders inside the field need to continuously collaborate to generate new techniques that can correctly triumph over the contemporary cyber threats. The relevance and commonality of identity theft are increasing, and banks, authorities entities, credit score providers, and insurance companies are scrambling to locate approaches to stem the tide of this malicious and costly shape of virtual robbery. The huge issues listed below, among others, provide propulsion for the sphere of cyber safety.

Privacy: 

Organizations should recognize that each of their information and their customers’ facts is at risk.The Electronic Frontier Foundation revealed a number of the different approaches hackers could maliciously use private digital facts of many sorts — starting from sensitive facts concerning an enterprise or company to the private details, web history, and different private records of person consumers. In acknowledgment of this threat, any organization that stores information ought to well secure their records network, or else they may be setting their pastimes and their customers’ pursuits at risk.

Data-centric economy: Now extra than ever before, statistics are being stored in big quantities.

Computing conglomerate Intel estimates that by 2020, our world will depend on a “net of things” that consists of 200 billion interconnected “smart” devices. As every one of these gadgets will be capable of storing/communicating information, the total amount of valuable information being hosted on-line will almost truly rise. This will create an even greater demand for cyber protection specialists who understand a way to adapt to new forms of cyber assaults.

Individual risk: 

Cyber protection threats affect countless individuals each year.Breaches can damage people via giving criminals an outlet to steal property or get the right of entry to private information. More concerningly, online data isn’t the overall volume of the things that would be compromised through a digital assault. In fact, Forbes offers a plethora of examples of objects that have been significantly hacked within the latest past — along with cars, domestic alarm systems, and banking apps as well as infrastructural necessities, consisting of site visitors systems, dams, strength grids, and extra.

Global risk: 

Cybersafety threats ought to affect an entire us of an economy or worldwide infrastructure.In December 2015, unidentified hackers waged a large assault against Turkish top-level domains, effectively shutting down access to any websites using them. Tr us of a code suffix. This uncovered the arena to a brand new reality, wherein a successful attack on an entire u. S. A .’s net infrastructure is actually possible This proves that cyber safety isn’t always best a necessity to defend the privacy of consumers, but it’s also important to assure the safety and impenetrability of government networks and infrastructural elements.

How To Stay Cyber-Secure While Working From Home ?

  • Embrace quick and inexpensive wins

 

“Enable multi-thing authentication wherever possible, adding another layer of safety to any apps you use,” says Jeremy Hendy, head of Studio. “Additionally, a password manager can help avoid unstable behavior such as saving or sharing credentials. Both kinds of products provide cost-effective answers for organizations.”

 

  • Go private

 

Roy Reynolds, technical director at Vodat International, says: “Having a VPN solution, which sits at the PC, laptop, or mobile device and creates an encrypted network connection, should be encouraged. A VPN makes it secure for the employee to get entry to IT resources within the company and some other place on the internet.”

 

  • Update cybersecurity for home-working 

 

“Does your cutting-edge cybersecurity coverage consist of remote running?” asks Zeki Turedi, generation strategist at CrowdStrike. “Ensure the coverage is adequate as your company transitions to having more humans out of doors in the office. They need to consist of remote-working rights of entry to management, the usage of personal devices, and updated information privacy concerns for employees to get entry to files and other statistics.”

 

  • Only use work devices

 

“Communicate with colleagues the usage of IT equipment furnished by using employers,” warns Luke Vile of PA Consulting. “There is often a variety of software installed in the history of enterprise IT that keeps humans secure. If a security incident passed off on a worker’s personal tool, the organization – and the worker – might not be absolutely protected.”

 

 

Daniel Milnes, a statistics lawyer at Forbes Solicitors, says: “Without the right safety, personal devices used to get entry to paintings networks can leave groups prone to hacking. If records are leaked or breached through a personal device, the organization can be deemed liable.”