Spoofing in the reeds with Rietspoof

guest · Feb 16, 2019

Spoofing in the reeds with Rietspoof
We’re tracking a new cyberthreat that combines file formats to create a more versatile malware
February 16, 2019
https://blog.avast.com/rietspoof-malware-increases-activity

Since August 2018, we have been monitoring a new malware family we’re calling Rietspoof. Rietspoof is a new multi-stage malware that exhibits some very striking features and capabilities.

Rietspoof utilizes several stages, combining various file formats, to deliver a potentially more versatile malware. Our data suggests that the first stage was delivered through instant messaging clients, such as Skype or Messenger. It delivers a highly obfuscated Visual Basic Script with a hard-coded and encrypted second stage — a CAB file [...] is digitally signed with a valid signature, mostly using Comodo CA.

What’s interesting to note, is that the third stage uses a simple TCP protocol to communicate with its C&C [...] In version two, the protocol not only supports its own protocol running over TCP, but it also tries to leverage HTTP/HTTPS requests.
Conclusion
[...] has had a significant increase in its activity during January 2019. During this time, the developer has used several valid certificates to sign related files.
And, to date, the malware-infected files are rarely being detected by most antivirus software.
Click to expand...

Log in or Sign up

Spoofing in the reeds with Rietspoof

guest Guest

Log in or Sign up

Spoofing in the reeds with Rietspoof

guest Guest

Useful Searches