Upload File

threat intelligence report - infoblox

3
TLP: WHITE https://www.us-cert.gov/tlp Hermes Ransomware Cyber Report Overview Hermes is a ransomware family that was first detected in February 2017. While the initial version of Hermes was quickly reverse engineered, subsequent versions, including the latest (version 2.1) from February 2018, are still being observed in the wild and continue to pose a threat. In the week of 23-27 July, Infoblox observed an influx of spam emails delivering malicious Microsoft Word documents that downloaded Hermes 2.1 via the AZORult trojan. Customer Impact As with other variants of ransomware, Hermes encrypts a user’s files so that they cannot be recovered without contacting the attacker for a decryption key. The ransom note that we reviewed did not request a specific payment amount; however, other reports on Hermes claim a typical ransom is between $500 and $1500. 1 Whereas earlier Hermes encryption was relatively easy to decrypt, files encrypted by version 2.1 cannot be decrypted with third-party tools. According to a report from Cybersecurity Ventures, the total costs to business from ransomware exceeded $5 billion in 2017. 2 The impacts range from direct losses to workday disruptions and damage to reputations. A breach of the Taiwanese Far Eastern International Bank last year included Hermes as a tool to destroy evidence following earlier data theft and fraudulent transfers. 3 Campaign Analysis In this campaign, email messages claim to come from job applicants searching for employment. Each message contains the subject “Job Application” and is sent from an email address on the domain anjanabro[.]com. The email contains instructions for the recipient to open the attached file (purportedly a resume), and enter the password included in the body of the message. Once the user opens the malicious file, it displays a warning that its content cannot be viewed until the recipient enables macros for the document. After macros are enabled, the document downloads additional files that will infect the recipient’s device. The initial payload that we observed in this campaign is the AZORult trojan. Once it has been dropped, the infected machine reaches out to a command and control (C2) server and downloads Hermes, the secondary payload. Hermes begins surreptitiously encrypting all the files on the machine. Upon completion, it displays a ransom note with instructions to contact the attacker and pay them a ransom in Bitcoin to recover the files.

Upload: others

Post on 13-Apr-2022

4 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Threat Intelligence Report - Infoblox

TLP: WHITE https://www.us-cert.gov/tlp

Hermes Ransomware Cyber Report

OverviewHermes is a ransomware family that was first detected in February 2017. While the initial version of Hermes was quickly reverse engineered, subsequent versions, including the latest (version 2.1) from February 2018, are still being observed in the wild and continue to pose a threat. In the week of 23-27 July, Infoblox observed an influx of spam emails delivering malicious Microsoft Word documents that downloaded Hermes 2.1 via the AZORult trojan.

Customer ImpactAs with other variants of ransomware, Hermes encrypts a user’s files so that they cannot be recovered without contacting the attacker for a decryption key. The ransom note that we reviewed did not request a specific payment amount; however, other reports on Hermes claim a typical ransom is between $500 and $1500.1 Whereas earlier Hermes encryption was relatively easy to decrypt, files encrypted by version 2.1 cannot be decrypted with third-party tools.

According to a report from Cybersecurity Ventures, the total costs to business from ransomware exceeded $5 billion in 2017.2 The impacts range from direct losses to workday disruptions and damage to reputations. A breach of the Taiwanese Far Eastern International Bank last year included Hermes as a tool to destroy evidence following earlier data theft and fraudulent transfers.3

Campaign AnalysisIn this campaign, email messages claim to come from job applicants searching for employment. Each message contains the subject “Job Application” and is sent from an email address on the domain anjanabro[.]com. The email contains instructions for the recipient to open the attached file (purportedly a resume), and enter the password included in the body of the message.

Once the user opens the malicious file, it displays a warning that its content cannot be viewed until the recipient enables macros for the document. After macros are enabled, the document downloads additional files that will infect the recipient’s device.

The initial payload that we observed in this campaign is the AZORult trojan. Once it has been dropped, the infected machine reaches out to a command and control (C2) server and downloads Hermes, the secondary payload.

Hermes begins surreptitiously encrypting all the files on the machine. Upon completion, it displays a ransom note with instructions to contact the attacker and pay them a ransom in Bitcoin to recover the files.

Page 2: Threat Intelligence Report - Infoblox

TLP: WHITE https://www.us-cert.gov/tlp

Attack Chain

Victim Receives Malicious Spam Email Subject: Job Application

From address: *@anjanabro.com Attachment filename: [First name]’s Resume.doc

File Macro Downloads AZORult Trojan URL: hXXp://205.185.121[.]209/azo.exe

AZORult Trojan Calls Back to C2 Node URL: briancobert[.]com/index.php

AZORult Trojan Downloads Hermes Ransomware URL: hXXp://205.185.121[.]209/5.exe

Victim Opens Attachment, Enters Password, Enables Macros

Hermes Encrypts Files and Displays Ransom Note

Vulnerabilities & MitigationHermes employs social engineering to spread malspam related to fake job applications. Educating users on the dangers posed by malspam and ransomware is crucial to limiting its success and impact. Also, regularly backing up data and systems will minimize the potential impact of ransomware in general. To avoid these infections, users should:

• Always be suspicious of unexpected emails and unknown senders.

• Always be suspicious of vague emails, especially when there is a prompt to open an attachment.

• Do not open unexpected attached files and do not enable macros, particularly those in Microsoft Office products. Macros are a very common infection vector used by many families of malware.

• Always stay up-to-date with the latest security patches.

Appendix

Representative Indicators of Compromise Description

Subject: Job Application From address: *@anjanabro.com

Attachment filename: [First name]’s Resume.doc (password protected)

Email characteristics

hXXp://205.185.121[.]209/azo.exe AZORult trojan download URL

briancobert[.]com/index.php AZORult C2 server

hXXp://205.185.121[.]209/5.exe Hermes ransomware download URL

[email protected] [email protected]

Ransom contact information

Page 3: Threat Intelligence Report - Infoblox

Infoblox is leading the way to next-level DDI with its Secure Cloud-Managed Network Services. Infoblox brings next-level security, reliability and automation to on-premises, cloud and hybrid networks, setting customers on a path to a single pane of glass for network management. Infoblox is a recognized leader with 50 percent market share comprised of 8,000 customers, including 350 of the Fortune 500.

Corporate Headquarters | 3111 Coronado Dr. | Santa Clara, CA | 95054 +1.408.986.4000 | 1.866.463.6256 (toll-free, U.S. and Canada) | [email protected] | www.infoblox.com

© 2019 Infoblox, Inc. All rights reserved. Infoblox logo, and other marks appearing herein are property of Infoblox, Inc. All other marks are the property of their respective owner(s).

Endnotes

1. https://www.pcrisk.com/removal-guides/13175-hermes-21-ransomware

2. https://cybersecurityventures.com/ransomware-damage-report-2017-5-billion/

3. ttps://www.bleepingcomputer.com/news/security/north-korean-hackers-used-hermes-ransomware-to- hide-recent-bank-heist/


Threat Intelligence: Collecting, Analysing, EvaluatingThreat Intelligence: Collecting, Analysing, Evaluating mwrinfosecurity.com CPNI.gov.uk cert.gov.uk 4/36 Threat intelligence is

Kaspersky Threat Intelligence Portal...Threat Intelligence Resource Subscribers to Kaspersky’s Threat Intelligence Portal enjoy a single point of entry to: Kaspersky Threat Data

Building Successful Threat Intelligence Programs · Building Successful Threat Intelligence Programs Allan Thomson, LookingGlass CTO June 2017 ... “Threat Intelligence” –evidence-based

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

INFOBLOX DNS THREAT NDE I X...QUARTERLY REPORT 2015 INFOBLOX DNS THREAT NDE I X. EXECUTIVE SUMMARY ... After dipping in Q3 2015, the threat index rebounded in Q4 2015 to 128—near

Certified Threat Intelligence Analyst...04 Certified Threat Intelligence Analyst Why Organizations Need A Threat Intelligence Team Traditional approaches to malicious attacks are slowly

Threat Intelligence

NETSCOUT THREAT INTELLIGENCE REPORT · NETSCOUT Threat Intelligence LETTER FROM NETSCOUT THREAT INTELLIGENCE Today, attackers can release enormous terabit-per second-scale DDoS attacks

Threat intelligence platforms

Cyber Threat Intelligence

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

State of Threat Intelligence Studyf6ce14d4647f05e937f4-4d6abce208e5e17c2085b466b98c2083.r3.cf1.rackcdn.c…Operationalizing Threat Intelligence .....11 2016 Threat Intelligence Agenda

Using Threat Intelligence

BloxOneTM Threat Defense Architecture Guide...Infoblox BloxOne Threat Defense Architecture Guide 4 TIDE is backed by the Infoblox Cyber intelligence Unit (CIU) that normalizes and

Cyber Threat Intelligence Modeling Based on Heterogeneous ... · 2.1Cyber Threat Intelligence Cyber Threat Intelligence (CTI) extracted from security-related data is structured information

CYBER THREAT INTELLIGENCE - Microsoft...Cyber threat intelligence supports the following cyber security ... Optiv’s Cyber Threat Intelligence Workshop was developed to advise and

Introduction to Threat Containment, Malware & DNS · 11 || © 2013 Infoblox Inc. All Rights Reserved. © 2017 Infoblox Inc. All Rights Reserved. Introduction to Threat Containment,

Infoblox Threat Protection Rules - Oracle · Threat Protection Rules This document contains information about threat protection rules for the Infoblox Advanced DNS Protection solution

SMARTER Threat Intelligence · Our threat intelligence is derived from the Webroot® Threat Intelligence Platform, our proprietary cloud-based security analysis architecture designed

Threat monitor Threat Intelligence Report Q1 2020

MACHINE READABLE THREAT INTELLIGENCE - CRNi.crn.com/custom/LookingGlass_MRTI Feeds_Final_Nov_2016.pdf · machine readable threat intelligence collecting internet intelligence for

THREAT INTELLIGENCE - CrowdStrike

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Global Threat Intelligence Center (GTIC) 2017 … Security Q2 2017... · Global Threat Intelligence Center (GTIC) Quarterly Threat Intelligence Report Q2 2017. ... In previous editions

Certified Threat Intelligence Analyst - EC-Council · Certified Threat Intelligence Analyst 1 Certified IA Threat Intelligence Analyst C T CERTIFIED THREAT ... It describes building

Infoblox Deployment Guide - Threat Insight...Troubleshooting & FAQ Threat Insight..... 55 Unable to download Threat Analytics Module and Whitelist Set.....55 Threat Analytics service

Threat Intelligence Briefing

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Counter Threat Unit™ Threat Intelligence

group-ib.com Threat Detection System Group−IB THREAT ... · group-ib.com How Threat Intelligence Works • Your security systems continuously detect threats. • Threat Intelligence

Infoblox Infographic - Threat Containment and Operations · availability DNS, DHCP, and IPAM services throughout your distributed network. Infoblox DDI makes it easier for you to

Threat Intelligence - Amazon Web Services · Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence ... Goal of Intelligence Analysis. Cyber Kill Chain™ Model

INFOBLOX DNS THREAT NDE I X · EXECUTIVE SUMMARY • The Infoblox DNS Threat Index for the first quarter of 2016 rose 12 percent compared to the first quarter of 2015, and increased

Infoblox Deployment Guide - BloxOne Threat Defense DNS ... · BloxOne Threat Defense DNS Forwarding Proxy QSG 3 Overview Infoblox BloxOneTM Threat Defense Cloud (B1TD Cloud) is a