Threat actormedium
A new RevengeHotels campaign targets Latin America
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files | 7.8 | 99% | KEVRansomwarePoC ×6 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1077ea936033ee9e9bf444dafb55867c | b713cc SGDoHBZQWpLKXCAoTHXdBGlnQJLZCGBOVGLH_{TIMESTAMP}.ps1 1077ea936033ee9e9bf444dafb55867c cargajecerrr.txt b1a5dc66f40a38d807ec8350ae89d1e4 cargajece |
| md5 | 3ac65326f598ee9930031c17ce158d3d | 4a88c0dc) that ensures the second file, a VenomRAT implant (3ac65326f598ee9930031c17ce158d3d), is correctly executed in memory. The malicious code also |
| md5 | 607f64b56bb3b94ee0009471f1fe9a3c | ase64-encoded and have descriptive names: venumentrada.txt (607f64b56bb3b94ee0009471f1fe9a3c), which can be interpreted as “VenomRAT entry point”, and r |
| md5 | 91454a68ca3a6ce7cb30c9264a88c0dc | , is a heavily obfuscated loader (MD5 of the decoded file: 91454a68ca3a6ce7cb30c9264a88c0dc) that ensures the second file, a VenomRAT implant (3ac65326 |
| md5 | b1a5dc66f40a38d807ec8350ae89d1e4 | e64-encoded code. This code retrieves the cargajecerrr.txt (b1a5dc66f40a38d807ec8350ae89d1e4) file from a remote malicious server and invokes it as Powe |
| md5 | d5f241dee73cffe51897c15f36b713cc | named SGDoHBZQWpLKXCAoTHXdBGlnQJLZCGBOVGLH_{TIMESTAMP}.ps1 (d5f241dee73cffe51897c15f36b713cc), where “\{TIMESTAMP\}” is a generated number based on the |
| md5 | dbf5afa377e3e761622e5f21af1f09e6 | an be interpreted as “VenomRAT entry point”, and runpe.txt (dbf5afa377e3e761622e5f21af1f09e6), which is named after a malicious tool for in-memory execu |
| md5 | fbadfff7b61d820e3632a2f464079e8c | ery request. In the case at hand, we analyzed Fat146571.js (fbadfff7b61d820e3632a2f464079e8c), which follows the format Fat\{NUMBER\}.js , where “Fat” i |
From the original article
9 min read at securelist.com
RevengeHotels, also known as TA558, is a threat group that has been active since 2015, stealing credit card data from hotel guests and travelers. RevengeHotels’ modus operandi involves sending emails with phishing links which redirect victims to websites mimicking document storage. These sites, in turn, download script files to ultimately infect the targeted machines.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.