Cisco Talospublished Feb 15, 23:03 UTC (Feb 15, 2019)ingested Sep 10, 06:19 UTC

Threat Roundup for Feb. 8 to Feb. 15

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article951 words · extracted from blog.talosintelligence.com · click to collapse

Friday, February 15, 2019 18:03

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 08 and Feb. 15. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

The most prevalent threats highlighted in this roundup are:

Win.Virus.Expiro-6854765-0
Virus
Expiro is a known file infector and information stealer that hinders analysis with anti-debugging and anti-analysis tricks.
Win.Malware.Swisyn-6854761-0
Malware
This family is packed and has anti-analysis tricks to conceal its behavior. The binaries drop other executables that are executed and try to inject malicious code in the address space of other processes.
Win.Dropper.Ribaj-6855378-0
Dropper
This family is written in .NET and is highly malicious. Once executed, these samples drop files in Windows directories, modify other applications and spawn several children. These binaries also change the internet settings and the certificates of the victim's machine as observed in the Windows registry activity.
Doc.Malware.Valyria-6855449-0
Malware
These variants of Valyria are malicious Microsoft Word documents that contain embedded VBA macros used to distribute other malware.
Win.Malware.Cgok-6854725-0
Malware
These binaries are able to detect virtual machines and instrumented environments. They can also complicate the analysis with anti-disassembly and anti-debugging techniques. This family can install additional software and upload information to a remote server.
Win.Malware.Noon-6854584-0
Malware
This family is highly malicious and executes other binaries. These samples contact remote servers, upload information collected on the victim's machine and have persistence.

Threats

Win.Virus.Expiro-6854765-0

Indicators of Compromise
Registry Keys

<HKCU>\Software
<HKCU>\Software\Microsoft\SystemCertificates\MY
<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
<HKU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
<HKU>\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
<HKU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Setup Mutexes
TermService_Perf_Library_Lock_PID_194
kkq-vx_mtx87
\BaseNamedObjects\gazavat-svc
\BaseNamedObjects\kkq-vx_mtx1
\BaseNamedObjects\kkq-vx_mtx29
\BaseNamedObjects\gazavat-svc_29 IP Addresses contacted by malware. Does not indicate maliciousness
N/A Domain Names contacted by malware. Does not indicate maliciousness
N/A Files and or directories created
\ROUTER
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
%ProgramFiles%\Outlook Express\msimn.exe
%ProgramFiles%\Outlook Express\wab.exe
\SfcApi
%ProgramFiles%\Java\jre7\bin\java.exe
%System32%\tlntsvr.exe
\net\NtControlPipe14
%ProgramFiles%\Internet Explorer\iexplore.exe
%ProgramFiles%\Outlook Express\msimn.vir
%ProgramFiles%\Outlook Express\wab.vir
%System32%\narrator.exe
%System32%\utilman.exe File Hashes
0759d83a9d783572b6f1f57399525c8f901ffdb41b536c19e6e70b7764ea8b78
182fe9f51e9347bae5930e28b842f6b0558dae8bf0b2c108704465b971fcf6bc
2d2c5852cbe5414ba1a9775295556499f44850e5b8c5162b6a7d9a5a4a877c99
3de0bb06e54b51c42eebc77788e36675e9ec8bab5b31cba456411e507b80c1eb
56498da2cafc996346f167c1f1abfd0e6c4011870a6981607b4eaa520eac3f37
58571a14a78bfe4d51116c1e2a6127446c98a43e4779a769028b84199b349152
7a72f9e0562311df35d0f40a609aaedaa3027455197180c0c5a931651c1fe600
8adbf00c308922f3c064644c3ade097501cb2be2e79f77b1b32cfee91f140121
93dcbe4d4d2bb9f6b0a454312008914485882521ac9ed7fe109cf5e4dd161427
b3795e744b4ba084946e43e66bb01f05dff180f1302e6219c9f196a220ef7f09
bcc7a15e9397bf7a58ce3b00bc5cba858738c292f501f376795e7f17fa019325
ffee8a3dcc7f1eea25d35586024db359dbe4bcd6e8d6ad5aecb55a8b82ee5487

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Malware.Swisyn-6854761-0

Indicators of Compromise
Registry Keys

<A>\{32DE27EC-AB30-11E8-A007-00501E3AE7B5}\DEFAULTOBJECTSTORE\IndexTable
<A>\{32DE27EC-AB30-11E8-A007-00501E3AE7B5}\DEFAULTOBJECTSTORE\LruList
<A>\{32DE27EC-AB30-11E8-A007-00501E3AE7B5}\DEFAULTOBJECTSTORE
Value Name: _CurrentObjectId_
<A>\{32DE27EC-AB30-11E8-A007-00501E3AE7B5}\DEFAULTOBJECTSTORE\OBJECTTABLE\AB5
Value Name: _ObjectLru_
<HKLM>\SYSTEM\ControlSet001\Services\RKREVEAL150 Mutexes
RasPbFile
Local\WERReportingForProcess1908
Global\41010221-308a-11e9-a007-00501e3ae7b5 IP Addresses contacted by malware. Does not indicate maliciousness
N/A Domain Names contacted by malware. Does not indicate maliciousness
N/A Files and or directories created
\srvsvc
%WinDir%\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
%LocalAppData%\CrashDumps
\net\NtControlPipe10
%LocalAppData%\Temp\ZGHVFQ.exe
%LocalAppData%\CrashDumps\e94034199ba3413b2180bdd135a7341b52a293c33b0c45640ba12f6578d3a1e0.exe.1908.dmp File Hashes
073fedd91f616c324ba2ed839162c6f6a963afd0a35034e5fc07cbecbbdcb469
19f91a303132a80a4f929f27c415ecd9dd156313ba425942d1c7fc34ad95a863
218ff9378f7808cd0085846dcc2564178c632ffec5f7069e2c9963b4be53aecd
32fbfbf5bb78c2448741bb11a39411b529f025d9069192186556362f530112b9
394dc1c6011efacd4759251c0449b2fb87a8b4eb001c1b7cf6325ea712207d46
3a3aa457427f914f24156be2274b348a52d5551ee340e472d21783f7366086b3
458e2d0b5ef4b6b83c729ff109391a6073c3694765cc9d08e16774f8e82f9de8
56780c038c42e3d7f71e8f790b5a34fb9a680155d979fd58bc6483843ad6489a
5e16bfd4bab0dc29173e9a15d6ef6b98c701eba6dd48241c148605f6fc8fb5a7
6468ae9613dd9fac6ef25cb4afa961c2930c358566019f24a320f7910f29bdb0
822708cc727fc05d090589e46b6f69cec3b806508bd319557f3d26bd1e686b9c
8667a433b1e44b529ee76512bf82b666fdedfa3098ad55e36c8668c883202b38
8ca3fe8ed13101a815d8cca3ee74c7e42da394a822339d419a11d83b18660bb7
9390e81e988e37d9638ca6a1d2f3c7c1259dbea491173c41ad78782cda620313
948db0d6b2a45f4ccd9a7bebe08b20c1613c577bf8d0abd0717f1a5c1c7276ad
b789a641395003148f0d8128e8ae8227e43b6261c50367fb1e55f065d79dd508
bccb8cbfc7987c8814534d8fbdd9ae01acdfc7b6c987450a769de7e702cfdeb4
c822b45d0eb29beaba494f6a61fa616ccd4f71c9d823f6705cadb521b18473e1
e94034199ba3413b2180bdd135a7341b52a293c33b0c45640ba12f6578d3a1e0

Coverage

Screenshots of Detection AMP

ThreatGrid

Malware

Win.Dropper.Ribaj-6855378-0

Indicators of Compromise
Registry Keys

<HKCU>\Software\Microsoft\SystemCertificates\My
<HKCU>\Software\Microsoft\SystemCertificates\CA
<HKCU>\Software\Microsoft\SystemCertificates\Disallowed
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\Certificates
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLs
<HKCU>\Software\Microsoft\SystemCertificates\Root
<HKCU>\Software\Microsoft\SystemCertificates\TrustedPeople
<HKLM>\Software\Microsoft\SystemCertificates\CA
<HKLM>\Software\Microsoft\SystemCertificates\Disallowed
<HKLM>\Software\Microsoft\SystemCertificates\TrustedPeople
<HKLM>\Software\Microsoft\SystemCertificates\trust
<HKU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Mutexes
RasPbFile
Local\MSCTF.Asm.MutexDefault1
Global\CLR_CASOFF_MUTEX IP Addresses contacted by malware. Does not indicate maliciousness
91[.]134[.]147[.]134
46[.]4[.]111[.]124
79[.]137[.]116[.]43
151[.]80[.]42[.]103 Domain Names contacted by malware. Does not indicate maliciousness
N/A Files and or directories created
%ProgramFiles%\Hnc\HncUtils\Hmedia\AlbumMaker.exe
%ProgramFiles%\Hnc\HncUtils\Hmedia\PictureStyler.exe
%ProgramFiles%\Hnc\HncUtils\Update\HncCheck.exe
%ProgramFiles%\Hnc\HncUtils\Update\HncUpdate.exe
%SystemDrive%\x997y.exe
%LocalAppData%\Microsoft\Windows\WER\ReportQueue\AppCrash_p606h.exe_4863d852a7d73cfde1714dd63e191d3b678536_650ba745
%SystemDrive%\TEMP\x810y.exe
%LocalAppData%\Temp\suqv362h.cmdline
%LocalAppData%\Temp\suqv362h.err
%LocalAppData%\Temp\suqv362h.out
%LocalAppData%\Temp\suqv362h.tmp
%LocalAppData%\Temp\suqv362h.cmdline
%LocalAppData%\Temp\suqv362h.out
%SystemDrive%\TEMP\x915y.exe
%SystemDrive%\p155h.exe
%SystemDrive%\x458y.exe
%SystemDrive%\x578y.exe File Hashes
06a416703a26e095bc95fec44dc4751c5791ab9e1c99018c95e9d09282e3d4b0
0b29c1eecbeada06924782aec009d8acf4a76893bd773a269b64a45fb3100ace
1470b0737d00fde7f9fed30d1a8b314715309fb71363e6eb06fa36a88c20061e
18c7f1d80af84c6b22941d0a0faf3ceb1b345254917573e217342041b3eabba3
1e33909178e6080fd417f24631710b3878814dfcaf447a71037c4a5e7461f3d4
1f993367b585974f87a7ab1d47979c64631e586ffcfc45a4abb641249ef3c2b6
2dc55ee6064851769cd403581967517abd947cc5895ae986e4ed0c4f88468cc6
2ea96a2c655d5f315b8dc22929924e7760ac083b92952f7c46d8b885060bede5
2ecaeaa9bc1fdd5f1f8ab0d9d775d6f606280f8a86f3c9944925a3ed39e5e26a
308b3c1dc4b2d19860c4dbe0ecb3bff55e2665c0121ebecf66cd5ae10d643cdb
4158285e5c3569543876349c0db59e5a8f341eed5e2795ce864d3943f04a0f6c
492e76881ff64ed066405ba7550bfe1f1d38a1e464af5e07bd3cb5f44277f2f5
50ee79ea155621b2bc0952e66aa451348ac393030ba11b521f55eefa5de85dd6
54396b08903dccb3cea7039b505912cadbf0ef36ddf025f7c3cbf3618b3fd1ca
5488a6601bac36620c48be50c3ee1c41831cac6f64aac8f7fbbfaeebe2e290e1
5687568d18019b9a391437e0d2fcb2a1e36eecb0ea8cc0d143d15389d0d63fd6
57e539645e32c6fe261abaa56e8dd56a9ca2ae147a2035a933bed10e1e97439a
58c46b39d71971b1ce3643264918d3292607841800656cfda6f6b0b89a682a85
5dab3d191197694361d12090ac15228ca26f5658412e7fa51f6afe8b2a28ff81
6047bc6f35d9bda3eedd9615cdd78f873a7318a0fca92733d4ade714ee264928
68edeb326a914ea915a293ada3dc5341923698889080a8a1be321f2229ba88ae
6a752d266112e05196a77043058317a5a0e53151613cf067521ff93f4b904818
788132452a60297f0b2736e4dd1ed7f10f69599eaba6ae93914b87eb858bb470
7a9a1476d383517377cbb03e480ea1880efb51eef39e70fb5dcd29b1ab859a8c
7c3f98328eebdafc2a245deb4eacdc79fc69f671da80168fce96a755a31b882b

Coverage

Screenshots of Detection AMP

ThreatGrid

Doc.Malware.Valyria-6855449-0

Indicators of Compromise
Registry Keys

<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLs
<HKLM>\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\CA\Certificates
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certificates Mutexes
Global\552FFA80-3393-423d-8671-7BA046BB5906
Local\10MU_ACB10_S-1-5-5-0-57527 IP Addresses contacted by malware. Does not indicate maliciousness
112[.]78[.]117[.]186
185[.]165[.]123[.]206
203[.]143[.]82[.]157
136[.]243[.]80[.]123
201[.]148[.]107[.]187 Domain Names contacted by malware. Does not indicate maliciousness
syonenjump-fun[.]com
tehranautomat[.]ir
www[.]tfmakeup[.]com
soportek[.]cl
mebelove[.]ru
tfmakeup[.]com
tilda[.]cc Files and or directories created
\ROUTER
%UserProfile%\971.exe
%SystemDrive%\~$8325604.doc
%LocalAppData%\Temp\CVR9952.tmp
\TEMP\~$8b14c4fe8c25557a0a8a9061cc9eda7c97bb0f89f8f4ae4f645d6c1d996d4e.doc File Hashes
048e2a3852452f990da142fd74095f16dc2e419346567a988c69b3d8ee62014a
0ddd6eca67f679e7767d6b834afd489009bdfed0aa0fcde6cd3293f8ffe1a0bc
13f7dfeb4ca314f5a738c4667968551b31a3f11efa864c97cb36dc68932d636a
168308817df0b5f51a942117a0a736ecbbb5642648b480803d0fe70c5473983d
2e53f63e8ae62b54fa5cb3378ed0252f202c144dcab869e642b96605765c2651
59fb51c98a77c782fed98fd718b5292ae7c980b60069a733175a39513237cdfb
6c552b50dd293986580d928225c05220c4fdfc246a40efbe514cdd118ea19fe5
6f59607f97d7242934de29fedd6cd1ac0efd74c99e7ca212b68c042ffb8bf9c6
8dedf65f3f2d21cf53781e7837e779a15753bda1f0ace6cb3f23523c2bb97225
9638653f353c805aad3d99d7f76e91733ddc7982a517ef1260f401de16d970fc
a8ecd3c1fcc6e41d4a24c4d8c39f1d7696a83ba28d148511e92c2fd13bfddbf6
b8bf2e3308ef42d8649aa1b2a7f05e16ba8c04d42e495bb1223f5fc6d3d7b2a0
c1982d4406ae41e126221026a549358fe967761e868e358a1b1e9e2c6a9f0113
c6c1e7aa4fe9ae0b12caa5143b3d9c7b541d6d94bc9341c6a349de1a973c2713
d358c4836374c3c6869b731c42249fad48aeaef089f7959cebb989be9a78b056
de883059dc699081ae98bd4b295be8972f4a3bf5e699265a97a422a91d8acfbb
e33244791d5d6972de721c5dbf114f8b2921cd5fc407a1f1b7e23119c0d07504
e496c2b0549e81380e1be0df042c849989474071d1f3b3ec7513b40fa0e7e546
e88b14c4fe8c25557a0a8a9061cc9eda7c97bb0f89f8f4ae4f645d6c1d996d4e
f299cb65e5c336cb1a31b5cd73948d07dd68780e7329248bfc5d080d75b43070
fa24a0c05815300726dd268426b28397471f067cdedcdb2f3258df75af169c28
ff7898391c17d84e6acf87e8106c8947bb0924815e90809cd645aa1fb35d0b6a

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Malware

Win.Malware.Cgok-6854725-0

Indicators of Compromise
Registry Keys

<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value Name: ProxyBypass
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY
Value Name: AddToFavoritesInitialSelection
<HKU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Mutexes
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
Local\MSCTF.Asm.MutexDefault1
\BaseNamedObjects\Global\AmInst__Runing_1
Global\AmInst__Runing_1 IP Addresses contacted by malware. Does not indicate maliciousness
N/A Domain Names contacted by malware. Does not indicate maliciousness
www[.]millesimalnonremuneration[.]site Files and or directories created
\srvsvc
%WinDir%\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
%LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.dat
\lsass
\ROUTER File Hashes
00dab31016dd49471a3cb73d13eefcc8811ac389d26f06f383b905e6850c6abe
013689006fd96ed4ec46592ce46e9c5a6e0af74040519991d8d550127c11e353
0253ad922dcd84936c68d68d7524979ba468fc654344a772dbbe17c528037ec0
02bb34fc8bf07578357ad6d771cf91a0131e7e99dbe8298b64555e38e7e9a2cc
02d28b601b87806ed74a5bcb9fa04d6634f3b7f9949b4393aa4379649997dc88
02dd9c6fb756466cbd12e13d0a962b64670b49d1fc596e18fdbaded971b0b667
0372d2b10999c791b93b17c484ce4611f31fd833ca235276748d7ffe512601d5
0492856e08c5f50c72cda713d77ade79eefd4cd89f611de92c47b4fff249db17
04b6c948af264febc278760d73efafcb3fa814b659a7c811f8b2053e4e957966
0509780a1a8a14666ddd7592f4a787f2b5d4bfb599b838fa4e73676fdd234e70
05f245d3ef7f2e527949285fa93acd2d9e0ab7a6fb95e565798eb751d3358712
06ab46bc303dd3716be11e5066687c9500b7ca4bfeefc261a3bb168000835fd6
0732d16625b8f1b1a4b489cd123d1d8e1ce89cb61a71c8ef00bb1b37bd294f6e
078332f7ce5dd623750c9f7b7a148e04a3f499a2abd45e9c756c63ec4906ebaa
07cb4ed6fb479abb07137e49c090d623a3b21762496c98fb0885176d9702553a
07dfb8670514998cda1a27e5076d9b80febc39c201d9a85652e96ca39572b8c7
09be7b1275949afd71f1c26965bd079a61c7cefba97086fe3d423c7c669ca1df
0aeb055d03bbc6f637944e8a82de7a36e959e3ae1ef3c9b04217ea91a9966fd7
0b2eb1d35ee7076f18cfab589df2432afb4ad1af19590b15b09eb18e8e68abf2
0b38bc30f470e19ff3e973f5d8b0ca196e58c7cdb49ee1ccc1769ad8422cd356
0c45267be8dd1bee444bedce0f29f9c6f6537f9cc14f14eb3d189c6ab7df053a
0c72e02a1a7ad5f3140c57b9e6f3650afe09692d452fff294a4658a4e33573b0
0cd3b49efa9072f463402e1d5d887cf38a5d6ac1a26dacb508739c3b2e15c4d2
0ce65debee6f89d18a75d99d5ee271d8cf1fe948833c657d6dc64c85666aae0f
0d73b17699c07d1b2f04c8b3ec883138e1133ff9ff2f0b13dddfe04ae6e52e0b

Coverage

Screenshots of Detection AMP

ThreatGrid

Malware

Win.Malware.Noon-6854584-0

Indicators of Compromise
Registry Keys

<HKCU>\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\
<HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
<HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\
<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion
<HKCU>\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2
<HKU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Mutexes
8-3503835SZBFHHZ
30NAO081CA46913z IP Addresses contacted by malware. Does not indicate maliciousness
198[.]187[.]30[.]49
69[.]172[.]201[.]218
81[.]19[.]145[.]88
94[.]46[.]164[.]14
98[.]124[.]199[.]103 Domain Names contacted by malware. Does not indicate maliciousness
www[.]klomaxbv[.]com
www[.]chamberoffortune[.]com
www[.]holdf[.]com
www[.]giantbuffalo[.]win
www[.]quantiz[.]tech
www[.]ciercglabslush[.]win
www[.]wcqr[.]info
www[.]asfloorsolutions[.]com
www[.]i-executive[.]com
www[.]saintjohnmarketplace[.]com
www[.]saintjohnonline[.]com Files and or directories created
%WinDir%\win.ini
%SystemDrive%\Documents and Settings\All Users\Struggleres.exe
%AllUsersProfile%\Struggleres.exe
%AppData%\30NAO081
%ProgramFiles% (x86)\Pkz7dkzi
%ProgramFiles% (x86)\Pkz7dkzi\Cookiesnrqhbx0.exe
%LocalAppData%\Temp\Pkz7dkzi\Cookiesnrqhbx0.exe File Hashes
0943a587d42f975d917bc60f8f005b792bd48eabe54536c61eaef36ee584dcc0
162872c960b6e48b45ea369bfa3d258eee4f479b4b498e5255fbb4c9c269a267
371a044bdd6f70866e13bf6390da862b5e50a763237d9f2fbb24819a3d861ac5
40094d7e1dad49a198122dcbaa478f6ad209195afa1376ad5977e374c798fbb2
4a412b49a26f49678d097725e5ce59da94264662241ed0b7945cce02f366c033
734e94e32e2c0418e3216ec25e2065433caf355674867a5d55919079a6ec5938
760a0c53b23f3d82ff54acb3c49b1fbe2d33d486ad7a8056be3cb7a495391758
8acfe115a997dc4cb24fcab62c80eef8fd3580c0aa1bb2308e6326069311d0ff
94969ce153aa5109f92842d9cfd6ff038623bb64b657a60ae0f8499fca60f7b5
94f746c852afb96875a8099e62d57ab1f8eaddfa440a77f2f76c2123c887ea2a
a688df4d7ef86c28c5789a1572e7b9cf9f7175fc1432fdf87f168ba7dc9f11fb
b91b055bacdcaa77c6865ad46679fe9735a6eac0e052419705cd3c9323bf7dac
c2f2c6ed54f470b887836f0a9cc42faed42503618747b5d843f4b9db448cbcfb
dbb6046d50ea2889e178e37ec7fb49c247fd2ba48c699562eac6be8acf7ac4d2
dd2df86722edddf0d95c827fa56a737913cacde56c0d417cd706ee58b99ddb37
ff4d8ff268c02c8c48808a51aad0cc528fbc23aec709823347cbd03cd74cf80a

Coverage

Screenshots of Detection AMP

ThreatGrid

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0208-0215/

Type	Indicator	Context
domain	syonenjump-fun.com	Names contacted by malware. Does not indicate maliciousness syonenjump-fun[.]com tehranautomat[.]ir www[.]tfmakeup[.]com soportek[.]cl meb
sha256	00dab31016dd49471a3cb73d13eefcc8811ac389d26f06f383b905e6850c6abe	Windows\WebCache\WebCacheV01.dat \lsass \ROUTER File Hashes 00dab31016dd49471a3cb73d13eefcc8811ac389d26f06f383b905e6850c6abe 013689006fd96ed4ec46592ce46e9c5a6e0af74040519991d8d550127c1
sha256	013689006fd96ed4ec46592ce46e9c5a6e0af74040519991d8d550127c11e353	31016dd49471a3cb73d13eefcc8811ac389d26f06f383b905e6850c6abe 013689006fd96ed4ec46592ce46e9c5a6e0af74040519991d8d550127c11e353 0253ad922dcd84936c68d68d7524979ba468fc654344a772dbbe17c5280
sha256	0253ad922dcd84936c68d68d7524979ba468fc654344a772dbbe17c528037ec0	9006fd96ed4ec46592ce46e9c5a6e0af74040519991d8d550127c11e353 0253ad922dcd84936c68d68d7524979ba468fc654344a772dbbe17c528037ec0 02bb34fc8bf07578357ad6d771cf91a0131e7e99dbe8298b64555e38e7e
sha256	02bb34fc8bf07578357ad6d771cf91a0131e7e99dbe8298b64555e38e7e9a2cc	d922dcd84936c68d68d7524979ba468fc654344a772dbbe17c528037ec0 02bb34fc8bf07578357ad6d771cf91a0131e7e99dbe8298b64555e38e7e9a2cc 02d28b601b87806ed74a5bcb9fa04d6634f3b7f9949b4393aa437964999
sha256	02d28b601b87806ed74a5bcb9fa04d6634f3b7f9949b4393aa4379649997dc88	4fc8bf07578357ad6d771cf91a0131e7e99dbe8298b64555e38e7e9a2cc 02d28b601b87806ed74a5bcb9fa04d6634f3b7f9949b4393aa4379649997dc88 02dd9c6fb756466cbd12e13d0a962b64670b49d1fc596e18fdbaded971b
sha256	02dd9c6fb756466cbd12e13d0a962b64670b49d1fc596e18fdbaded971b0b667	b601b87806ed74a5bcb9fa04d6634f3b7f9949b4393aa4379649997dc88 02dd9c6fb756466cbd12e13d0a962b64670b49d1fc596e18fdbaded971b0b667 0372d2b10999c791b93b17c484ce4611f31fd833ca235276748d7ffe512
sha256	0372d2b10999c791b93b17c484ce4611f31fd833ca235276748d7ffe512601d5	c6fb756466cbd12e13d0a962b64670b49d1fc596e18fdbaded971b0b667 0372d2b10999c791b93b17c484ce4611f31fd833ca235276748d7ffe512601d5 0492856e08c5f50c72cda713d77ade79eefd4cd89f611de92c47b4fff24
sha256	048e2a3852452f990da142fd74095f16dc2e419346567a988c69b3d8ee62014a	a9061cc9eda7c97bb0f89f8f4ae4f645d6c1d996d4e.doc File Hashes 048e2a3852452f990da142fd74095f16dc2e419346567a988c69b3d8ee62014a 0ddd6eca67f679e7767d6b834afd489009bdfed0aa0fcde6cd3293f8ffe
sha256	0492856e08c5f50c72cda713d77ade79eefd4cd89f611de92c47b4fff249db17	2b10999c791b93b17c484ce4611f31fd833ca235276748d7ffe512601d5 0492856e08c5f50c72cda713d77ade79eefd4cd89f611de92c47b4fff249db17 04b6c948af264febc278760d73efafcb3fa814b659a7c811f8b2053e4e9
sha256	04b6c948af264febc278760d73efafcb3fa814b659a7c811f8b2053e4e957966	56e08c5f50c72cda713d77ade79eefd4cd89f611de92c47b4fff249db17 04b6c948af264febc278760d73efafcb3fa814b659a7c811f8b2053e4e957966 0509780a1a8a14666ddd7592f4a787f2b5d4bfb599b838fa4e73676fdd2
sha256	0509780a1a8a14666ddd7592f4a787f2b5d4bfb599b838fa4e73676fdd234e70	948af264febc278760d73efafcb3fa814b659a7c811f8b2053e4e957966 0509780a1a8a14666ddd7592f4a787f2b5d4bfb599b838fa4e73676fdd234e70 05f245d3ef7f2e527949285fa93acd2d9e0ab7a6fb95e565798eb751d33
sha256	05f245d3ef7f2e527949285fa93acd2d9e0ab7a6fb95e565798eb751d3358712	80a1a8a14666ddd7592f4a787f2b5d4bfb599b838fa4e73676fdd234e70 05f245d3ef7f2e527949285fa93acd2d9e0ab7a6fb95e565798eb751d3358712 06ab46bc303dd3716be11e5066687c9500b7ca4bfeefc261a3bb1680008
sha256	06a416703a26e095bc95fec44dc4751c5791ab9e1c99018c95e9d09282e3d4b0	%SystemDrive%\x458y.exe %SystemDrive%\x578y.exe File Hashes 06a416703a26e095bc95fec44dc4751c5791ab9e1c99018c95e9d09282e3d4b0 0b29c1eecbeada06924782aec009d8acf4a76893bd773a269b64a45fb31
sha256	06ab46bc303dd3716be11e5066687c9500b7ca4bfeefc261a3bb168000835fd6	5d3ef7f2e527949285fa93acd2d9e0ab7a6fb95e565798eb751d3358712 06ab46bc303dd3716be11e5066687c9500b7ca4bfeefc261a3bb168000835fd6 0732d16625b8f1b1a4b489cd123d1d8e1ce89cb61a71c8ef00bb1b37bd2
sha256	0732d16625b8f1b1a4b489cd123d1d8e1ce89cb61a71c8ef00bb1b37bd294f6e	6bc303dd3716be11e5066687c9500b7ca4bfeefc261a3bb168000835fd6 0732d16625b8f1b1a4b489cd123d1d8e1ce89cb61a71c8ef00bb1b37bd294f6e 078332f7ce5dd623750c9f7b7a148e04a3f499a2abd45e9c756c63ec490
sha256	073fedd91f616c324ba2ed839162c6f6a963afd0a35034e5fc07cbecbbdcb469	1b52a293c33b0c45640ba12f6578d3a1e0.exe.1908.dmp File Hashes 073fedd91f616c324ba2ed839162c6f6a963afd0a35034e5fc07cbecbbdcb469 19f91a303132a80a4f929f27c415ecd9dd156313ba425942d1c7fc34ad9
sha256	0759d83a9d783572b6f1f57399525c8f901ffdb41b536c19e6e70b7764ea8b78	%System32%\narrator.exe %System32%\utilman.exe File Hashes 0759d83a9d783572b6f1f57399525c8f901ffdb41b536c19e6e70b7764ea8b78 182fe9f51e9347bae5930e28b842f6b0558dae8bf0b2c108704465b971f
sha256	078332f7ce5dd623750c9f7b7a148e04a3f499a2abd45e9c756c63ec4906ebaa	16625b8f1b1a4b489cd123d1d8e1ce89cb61a71c8ef00bb1b37bd294f6e 078332f7ce5dd623750c9f7b7a148e04a3f499a2abd45e9c756c63ec4906ebaa 07cb4ed6fb479abb07137e49c090d623a3b21762496c98fb0885176d970
sha256	07cb4ed6fb479abb07137e49c090d623a3b21762496c98fb0885176d9702553a	2f7ce5dd623750c9f7b7a148e04a3f499a2abd45e9c756c63ec4906ebaa 07cb4ed6fb479abb07137e49c090d623a3b21762496c98fb0885176d9702553a 07dfb8670514998cda1a27e5076d9b80febc39c201d9a85652e96ca3957
sha256	07dfb8670514998cda1a27e5076d9b80febc39c201d9a85652e96ca39572b8c7	ed6fb479abb07137e49c090d623a3b21762496c98fb0885176d9702553a 07dfb8670514998cda1a27e5076d9b80febc39c201d9a85652e96ca39572b8c7 09be7b1275949afd71f1c26965bd079a61c7cefba97086fe3d423c7c669
sha256	0943a587d42f975d917bc60f8f005b792bd48eabe54536c61eaef36ee584dcc0	%LocalAppData%\Temp\Pkz7dkzi\Cookiesnrqhbx0.exe File Hashes 0943a587d42f975d917bc60f8f005b792bd48eabe54536c61eaef36ee584dcc0 162872c960b6e48b45ea369bfa3d258eee4f479b4b498e5255fbb4c9c26
sha256	09be7b1275949afd71f1c26965bd079a61c7cefba97086fe3d423c7c669ca1df	8670514998cda1a27e5076d9b80febc39c201d9a85652e96ca39572b8c7 09be7b1275949afd71f1c26965bd079a61c7cefba97086fe3d423c7c669ca1df 0aeb055d03bbc6f637944e8a82de7a36e959e3ae1ef3c9b04217ea91a99
sha256	0aeb055d03bbc6f637944e8a82de7a36e959e3ae1ef3c9b04217ea91a9966fd7	b1275949afd71f1c26965bd079a61c7cefba97086fe3d423c7c669ca1df 0aeb055d03bbc6f637944e8a82de7a36e959e3ae1ef3c9b04217ea91a9966fd7 0b2eb1d35ee7076f18cfab589df2432afb4ad1af19590b15b09eb18e8e6
sha256	0b29c1eecbeada06924782aec009d8acf4a76893bd773a269b64a45fb3100ace	6703a26e095bc95fec44dc4751c5791ab9e1c99018c95e9d09282e3d4b0 0b29c1eecbeada06924782aec009d8acf4a76893bd773a269b64a45fb3100ace 1470b0737d00fde7f9fed30d1a8b314715309fb71363e6eb06fa36a88c2
sha256	0b2eb1d35ee7076f18cfab589df2432afb4ad1af19590b15b09eb18e8e68abf2	55d03bbc6f637944e8a82de7a36e959e3ae1ef3c9b04217ea91a9966fd7 0b2eb1d35ee7076f18cfab589df2432afb4ad1af19590b15b09eb18e8e68abf2 0b38bc30f470e19ff3e973f5d8b0ca196e58c7cdb49ee1ccc1769ad8422
sha256	0b38bc30f470e19ff3e973f5d8b0ca196e58c7cdb49ee1ccc1769ad8422cd356	1d35ee7076f18cfab589df2432afb4ad1af19590b15b09eb18e8e68abf2 0b38bc30f470e19ff3e973f5d8b0ca196e58c7cdb49ee1ccc1769ad8422cd356 0c45267be8dd1bee444bedce0f29f9c6f6537f9cc14f14eb3d189c6ab7d
sha256	0c45267be8dd1bee444bedce0f29f9c6f6537f9cc14f14eb3d189c6ab7df053a	c30f470e19ff3e973f5d8b0ca196e58c7cdb49ee1ccc1769ad8422cd356 0c45267be8dd1bee444bedce0f29f9c6f6537f9cc14f14eb3d189c6ab7df053a 0c72e02a1a7ad5f3140c57b9e6f3650afe09692d452fff294a4658a4e33
sha256	0c72e02a1a7ad5f3140c57b9e6f3650afe09692d452fff294a4658a4e33573b0	67be8dd1bee444bedce0f29f9c6f6537f9cc14f14eb3d189c6ab7df053a 0c72e02a1a7ad5f3140c57b9e6f3650afe09692d452fff294a4658a4e33573b0 0cd3b49efa9072f463402e1d5d887cf38a5d6ac1a26dacb508739c3b2e1
sha256	0cd3b49efa9072f463402e1d5d887cf38a5d6ac1a26dacb508739c3b2e15c4d2	02a1a7ad5f3140c57b9e6f3650afe09692d452fff294a4658a4e33573b0 0cd3b49efa9072f463402e1d5d887cf38a5d6ac1a26dacb508739c3b2e15c4d2 0ce65debee6f89d18a75d99d5ee271d8cf1fe948833c657d6dc64c85666
sha256	0ce65debee6f89d18a75d99d5ee271d8cf1fe948833c657d6dc64c85666aae0f	49efa9072f463402e1d5d887cf38a5d6ac1a26dacb508739c3b2e15c4d2 0ce65debee6f89d18a75d99d5ee271d8cf1fe948833c657d6dc64c85666aae0f 0d73b17699c07d1b2f04c8b3ec883138e1133ff9ff2f0b13dddfe04ae6e
sha256	0d73b17699c07d1b2f04c8b3ec883138e1133ff9ff2f0b13dddfe04ae6e52e0b	debee6f89d18a75d99d5ee271d8cf1fe948833c657d6dc64c85666aae0f 0d73b17699c07d1b2f04c8b3ec883138e1133ff9ff2f0b13dddfe04ae6e52e0b Coverage Screenshots of Detection AMP ThreatGrid Malware Wi
sha256	0ddd6eca67f679e7767d6b834afd489009bdfed0aa0fcde6cd3293f8ffe1a0bc	a3852452f990da142fd74095f16dc2e419346567a988c69b3d8ee62014a 0ddd6eca67f679e7767d6b834afd489009bdfed0aa0fcde6cd3293f8ffe1a0bc 13f7dfeb4ca314f5a738c4667968551b31a3f11efa864c97cb36dc68932
sha256	13f7dfeb4ca314f5a738c4667968551b31a3f11efa864c97cb36dc68932d636a	eca67f679e7767d6b834afd489009bdfed0aa0fcde6cd3293f8ffe1a0bc 13f7dfeb4ca314f5a738c4667968551b31a3f11efa864c97cb36dc68932d636a 168308817df0b5f51a942117a0a736ecbbb5642648b480803d0fe70c547
sha256	1470b0737d00fde7f9fed30d1a8b314715309fb71363e6eb06fa36a88c20061e	1eecbeada06924782aec009d8acf4a76893bd773a269b64a45fb3100ace 1470b0737d00fde7f9fed30d1a8b314715309fb71363e6eb06fa36a88c20061e 18c7f1d80af84c6b22941d0a0faf3ceb1b345254917573e217342041b3e
sha256	162872c960b6e48b45ea369bfa3d258eee4f479b4b498e5255fbb4c9c269a267	587d42f975d917bc60f8f005b792bd48eabe54536c61eaef36ee584dcc0 162872c960b6e48b45ea369bfa3d258eee4f479b4b498e5255fbb4c9c269a267 371a044bdd6f70866e13bf6390da862b5e50a763237d9f2fbb24819a3d8
sha256	168308817df0b5f51a942117a0a736ecbbb5642648b480803d0fe70c5473983d	feb4ca314f5a738c4667968551b31a3f11efa864c97cb36dc68932d636a 168308817df0b5f51a942117a0a736ecbbb5642648b480803d0fe70c5473983d 2e53f63e8ae62b54fa5cb3378ed0252f202c144dcab869e642b96605765
sha256	182fe9f51e9347bae5930e28b842f6b0558dae8bf0b2c108704465b971fcf6bc	83a9d783572b6f1f57399525c8f901ffdb41b536c19e6e70b7764ea8b78 182fe9f51e9347bae5930e28b842f6b0558dae8bf0b2c108704465b971fcf6bc 2d2c5852cbe5414ba1a9775295556499f44850e5b8c5162b6a7d9a5a4a8
sha256	18c7f1d80af84c6b22941d0a0faf3ceb1b345254917573e217342041b3eabba3	0737d00fde7f9fed30d1a8b314715309fb71363e6eb06fa36a88c20061e 18c7f1d80af84c6b22941d0a0faf3ceb1b345254917573e217342041b3eabba3 1e33909178e6080fd417f24631710b3878814dfcaf447a71037c4a5e746
sha256	19f91a303132a80a4f929f27c415ecd9dd156313ba425942d1c7fc34ad95a863	dd91f616c324ba2ed839162c6f6a963afd0a35034e5fc07cbecbbdcb469 19f91a303132a80a4f929f27c415ecd9dd156313ba425942d1c7fc34ad95a863 218ff9378f7808cd0085846dcc2564178c632ffec5f7069e2c9963b4be5

Threat Roundup for Feb. 8 to Feb. 15

Indicators of compromiseauto-extracted · verify before use · export allAll →

Threats

Win.Virus.Expiro-6854765-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Swisyn-6854761-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Dropper.Ribaj-6855378-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Doc.Malware.Valyria-6855449-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Cgok-6854725-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Noon-6854584-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys