Cybereason_JP_SOC

Cybereason Japan SOC Team.

[Cybereason_JP_SOC @CybereasonJPSOC]

Cybereason SOCチームは現在活動中のEmotetキャンペーンでの感染のリスクを軽減するツールをGitHubに公開いたしました。
https://t.co/KUE0mGyOr1

GPOやスケジュールタスク等から起動させることで使用可能です。
#emotet #cybersecurity

[Cybereason @cybereason]

Our team in Japan recently developed the tool "Emotet-locker". Check out our GitHub to learn more about this vaccine: https://t.co/2D9HeeDJq4 #cybersecurity #cybereasonjapn #emotet

[サイバーリーズン・ジャパン(A LevelBlue Company) @cybereasonjp]

グローバル通信事業者を標的としたあるAPT攻撃の存在を確認しました。複数回繰り返し行われたこの攻撃は、価値の高い特定のデータに狙いを定めており、標的のネットワークを完全に乗っ取っていました。https://t.co/jNGk8NhxUo
#サイバーセキュリティ #サイバー攻撃

[Cybereason_JP_SOC @CybereasonJPSOC]

@CybereasonJPSOC detects #SundownEK attack via a Japanese real estate website s-housing[.]jp.
@cybereasonjp

[Cybereason_JP_SOC @CybereasonJPSOC]

@CybereasonJPSOC detects #UnderminerEK drops #IcedID -> #Trickbot.
@cybereasonjp

EK IOCs:
Adpop[.]xyz
67.198.185[.]98
67.198.185[.]100
67.198.185[.]101
38.75.136[.]186

Payload IOCs:
4969067b47d71a9fe1b656ec629900d08046015e
42132dfed6174f0dccf06b7e7dc1b05f5cbd6ccd

[Cybereason_JP_SOC @CybereasonJPSOC]

@CybereasonJPSOC
detects what seems to be a #TA505 #maldoc delivers #Formbook.
@cybereasonjp

Doc SHA1: 94f4b3ba8e03a1814b00933d8eb7012575e7343d
Payload SHA1: 62B4591A635A12387CE062801CF041E2
db139[.]com
mengbaibai[.]com
lhtcom-sg[.]tk

[Cybereason_JP_SOC @CybereasonJPSOC]

@CybereasonJPSOC detects the latest #malspam campaign targeting #Japan, spreading #Bebloh / #URLZONE & #Ursnif / #Gozi , which utilizes wmic for execution. Unknown hash.
SHA1:6c41d5953cae2f8c613e3da0a5372a75611db44b

[Cybereason_JP_SOC @CybereasonJPSOC]

Check out the related blog post by our researcher:
EN:
https://t.co/X6Z3MoWMuv
JP:
https://t.co/vN5mR0tfxL

[Cybereason_JP_SOC @CybereasonJPSOC]

@CybereasonJPSOC detects the latest #malspam campaign targeting #Japan, spreading #Bebloh / #URLZONE & #Ursnif / #Gozi , which utilizes #steganography. Unknown hash.
SHA1:7316be0c8696272cd26e33a2360d491ade454935 @cybereasonjp

[Cybereason_JP_SOC @CybereasonJPSOC]

@CybereasonJPSOC detects the #Nanocore #RAT dropped by a #malspam attachment #WinRAR. Low detection rate on VT.
SHA1: e3836b3b0bea91b083f90afe62a238e2510c785f
C&C: 43[.]228[.]157[.]11 @cybereasonjp

[Cybereason_JP_SOC @CybereasonJPSOC]

@CybereasonJPSOC detects the #Remcos #RAT dropped by a #malspam attachment #WinRAR.
SHA1: 10737c19ca28b4334df31e20ec87820e08898dfe @cybereasonjp

[Cybereason_JP_SOC @CybereasonJPSOC]

@CybereasonJPSOC detects the new #WannaMine 4.0 hitting #Japan #Miner #doublepulsar.
Example SHA1: 6039ca6de72452804a7c67748f4df7fdac5ecad3 Malicious domains: iron[.]tenchier[.]com, vi[.]huddle[.]tk @cybereasonjp @cybereason

[Cybereason_JP_SOC @CybereasonJPSOC]

Malicious domains/IPs:
todaymale[.]xyz > 185.56.233.186
mybestdc[.]com > 108.168.193.183
autogenerator[.]info > 91.235.129.167
ad3[.]dogfunnyvideos[.]xyz > 5[.]23[.]49.200
voluptuous[.]googleresearcher[.]xyz > 85.17.197.100

[Cybereason_JP_SOC @CybereasonJPSOC]

@CybereasonJPSOC detects a fresh #HookAds -> #SpelevoEK -> #Shade #Ransomware drive-by, wmic used to launch the payload.@cybereasonjp @cybereason

[Cybereason_JP_SOC @CybereasonJPSOC]

Our agent blocks #gandcrab as it tries to run

[Cybereason_JP_SOC @CybereasonJPSOC]

@cybereason detects and BLOCKS newest #grandcrab #ransomware campaign. Infection chain: Office document -> VBA code -> WMI -> cmd.exe -> cmstp.exe #LOLBIN -> downloads scriptlet from #pastebin. Full analysis will be released soon
https://t.co/29jag2vyIn
https://t.co/NNL0uKiRM5

[Lior Div @liordiv]

New research from Cybereason's Nocturnus research team and important with our growing customer base in Japan. https://t.co/LFANUkXCTw @cybereason @CybereasonJPSOC @Ferguson_Writes

[Cybereason @cybereason]

A new variant of the prolific Ursnif trojan is on the loose. Read about what our research team has been tracking: https://t.co/Dx88usC1xc

[Amit Serper @0xAmit]

Another great report from our awesome Nocturnus team's Assaf Dahan
https://t.co/OCGTcIrqSc

[Cybereason @cybereason]

This new malware is evading commonly security products in Japan. Check out what our Cybereason research team found this month: https://t.co/PikvNvjFTT

[Cybereason_JP_SOC @CybereasonJPSOC]

@joe4security @joe4security - at @cybereason we love using Joe Sandbox!
We just wrote a blog that details one of the campaign mentioned in your great blog post:
https://t.co/X6Z3MoFbCX