Beware of scam during COVID-19 Pandemic:

We are all in the mid of pandemic on the Corona infection widespread and facing nationwide lockdown (many countries are facing the lockdown for more than 15 days. Many people including celebrities like actors, sportspersons started contributing to generously on PM care fund, so these funds can contribute to people who are suffering from COVID-19 infection. But, scammers are using this time to lure the contributor and collecting funds to fake BHIM account which deceives like PMcare fund. Refer to the below snapshot:

The legit account has the beneficiary name (Registered name) as Pm Cares and the fake ID as pmcare@sbi. Contributors need to be more careful about the beneficiary BHIM UPI ID is correct. Ev 

Post by

newWorld

Analysis of latest Trickbot malware sample - served in excel attachment

Twitter link:

https://twitter.com/James_inthe_box/status/1233086420857708544

The malware sample of trickbot was already submitted in the anyrun online sandbox for malware analysis.

https://app.any.run/tasks/e6c13b94-9234-4709-ac42-2461b94725e9/

We collected this malware sample and performed a manual analysis. The file details are:

Searched this hash in the VirusTotal for detection hits:

File name: Unpaid_invoice_1462.xls

File size: 109.5 KB

SHA256: 9e777e1e2e80909b5054c1eca935edc7046feb7d4546f40d392549e2f481d08e

MD5: 1f38f17810621dbff93a4e8cbd2ea1bf

This excel embedded with a macro that connects to a suspicious URL. We executed the malware in our VM, it prompts to enable the macro. After enabling, it to try to connect the following Link:

URL: pnxkntdl(.)xyz/KJSDBViad7

Currently, it didn’t download any other payloads.

Post made by

newWorld