Rietspoof

Rietspoof

Multiple stage malware that starts in messenger or skype, delivers a script that infects and continues on through 4-5 stages depending on the target.

Community Names:

• Trojan.YDJX-4
• Generic.Trojan.Agent.TPE1UM
• VBA:Rietspoof-A [Trj]

Attack Vector:

• Links in Skype & Messenger

References:

• https://www.technadu.com/rietspoof-malware-distribution-skype-messenger/58503/ 
• https://blog.avast.com/rietspoof-malware-increases-activity
• https://twitter.com/malwrhunterteam/status/1097568650507284483
• https://www.hybrid-analysis.com/sample/90813ad836effce0e21843c7db025d56bf1d204af25746578800f09a049ac008?environmentId=100
• https://twitter.com/James_inthe_box/status/1097569129123311624
• https://malware.sekoia.fr/results/90813ad836effce0e21843c7db025d56bf1d204af25746578800f09a049ac008
• https://www.virustotal.com/#/file/90813ad836effce0e21843c7db025d56bf1d204af25746578800f09a049ac008/detection
• https://www.vmray.com/analyses/90813ad836ef/report/overview.html