SORVEPOTEL has been observed to spread across Windows systems through convincing phishing messages with malicious ZIP file attachments. Interestingly, the phishing message that contains the malicious file attachment requires users to open it on a desktop, suggesting that threat actors might be more interested in targeting enterprises rather than consumers. Once opened, the malware automatically propagates via WhatsApp Web, causing infected accounts to be banned due to excessive spam activity. Author: AlienVault
Related Tags:
turn
brazilian
bradesco
water saci
whatsapp web
SORVEPOTEL
format
LNK file
c server
Associated Indicators:
2150F38C436EABEBD3A93B3ACE1064315153C882CE763991B6D0FB798766E0DB
DCDDE53C50AEF9531C9F59F341A4E2D59796CDD94A973F2C2A464B2CAFED41F5
BD62148637152396B757C8B106D5A62982BCE9DF12F0A6030DDA9138E44E7328
3B68826E4A1D95B1DD58B3BF1095750F31A72D8BDDD1DBB35E6547AC0CF4769B
1A0AF26749F5BC21732C53FC12F3A148215C8221CBEFFE920411656F1FFE7500
C50B6FF360E5614D91F80A5E2D616A9D0D1A9984751BF251F065426A63DAC0B5
2D83C4D620866F4AE647ED6A70113686BB7B80B1A7BBDCF544FD0FFEC105C4A6
C18AF1AD244A775142E8D79E516734DEC446EED4
E1B03152340789ECC4E2D9FB4720B0D44D0513E1