ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Cisco Talospublished ()ingested

Threat Roundup for July 6

highRansomwareimportance 57
Read the original
Tagsransomware

Indicators of compromiseAll →

TypeIndicatorContext
domainaa0533.3322.orgRE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Mutexes aa0533.3322.org IP Addresses 157.122.62.205 Domain Names aa0533.3322.org Fi
domainbbs.18wos.org6dCs1QGzbKslin0UfIk= IP Addresses 98.126.20.12 Domain Names bbs.18wos.org Files and or directories created %LocalAppData%\Temp\8ECHPO
domainpool.hashrefinery.coms N/A IP Addresses 104.25.206.114 104.27.144.1 Domain Names pool.hashrefinery.com www.ahashpool.com zpool.ca Files and or directories created
ipv4104.25.206.114rs of Compromise Registry Keys N/A Mutexes N/A IP Addresses 104.25.206.114 104.27.144.1 Domain Names pool.hashrefinery.com www.ahashpo
ipv4104.27.144.1e Registry Keys N/A Mutexes N/A IP Addresses 104.25.206.114 104.27.144.1 Domain Names pool.hashrefinery.com www.ahashpool.com zpool.
ipv41.234.83.146/A IP Addresses 218.54.31.226 218.54.31.165 133.242.129.155 1.234.83.146 Domain Names N/A Files and or directories created \TEMP\287
ipv4133.242.129.155e: Run Mutexes N/A IP Addresses 218.54.31.226 218.54.31.165 133.242.129.155 1.234.83.146 Domain Names N/A Files and or directories crea
ipv413.32.81.92rs of Compromise Registry Keys N/A Mutexes N/A IP Addresses 13.32.81.92 Domain Names all.fingersleep.bid Files and or directories c
ipv4157.122.62.205ows\CurrentVersion\Run Mutexes aa0533.3322.org IP Addresses 157.122.62.205 Domain Names aa0533.3322.org Files and or directories creat
ipv4218.54.31.165DOWS Value Name: Run Mutexes N/A IP Addresses 218.54.31.226 218.54.31.165 133.242.129.155 1.234.83.146 Domain Names N/A Files and or
ipv4218.54.31.226ENTVERSION\WINDOWS Value Name: Run Mutexes N/A IP Addresses 218.54.31.226 218.54.31.165 133.242.129.155 1.234.83.146 Domain Names N/A
ipv498.126.20.12Groove:PathMutex:tzanqCjN6dCs1QGzbKslin0UfIk= IP Addresses 98.126.20.12 Domain Names bbs.18wos.org Files and or directories created
sha2560304c1aabe233566025b24140d43f882e002cbe74abea4c243d78bf8a04c1068crosoft-Windows-Diagnosis-DPS%4Operational.evtx File Hashes 0304c1aabe233566025b24140d43f882e002cbe74abea4c243d78bf8a04c1068 139bd7f69953d5dccc274e6a6f2e958d11a43abb2281b8576f387b79dc1
sha256091caa24acc44bd5898784480f2c3260982ded40ce62f48d4dbe38c45a4c0d4brsleep.bid Files and or directories created N/A File Hashes 091caa24acc44bd5898784480f2c3260982ded40ce62f48d4dbe38c45a4c0d4b 09b987244a583826dc9bc222e26f8f3e65726eff2db388b55c04ae66b46
sha25609b987244a583826dc9bc222e26f8f3e65726eff2db388b55c04ae66b46c8eb9a24acc44bd5898784480f2c3260982ded40ce62f48d4dbe38c45a4c0d4b 09b987244a583826dc9bc222e26f8f3e65726eff2db388b55c04ae66b46c8eb9 0a1bfce878c1bdd816537faaac7cc2353b2a936a77207a2a977367f2584
sha2560a1bfce878c1bdd816537faaac7cc2353b2a936a77207a2a977367f2584750497244a583826dc9bc222e26f8f3e65726eff2db388b55c04ae66b46c8eb9 0a1bfce878c1bdd816537faaac7cc2353b2a936a77207a2a977367f258475049 0dd1f6ee91132936f0dbf28de674daf0faf0f24fabacabb9b9dc774c370
sha2560a843d45cf437e0298edb7e1014528b3381eb65d054cf8904d23b8142f19dae6\svchest000.exe %WinDir%\BJ.exe %WinDir%\BJ.exe File Hashes 0a843d45cf437e0298edb7e1014528b3381eb65d054cf8904d23b8142f19dae6 2ad4073ae1de153fa8a5b337c2ecbdb76a9ac21ea8ac242a05421cf354e
sha2560bf91ab95e85012f58d4b9a67e09841f04ec21666bdceadc5f16a93e4c4a96e3\Sean_Paul_-_Ya_Not_Ready_(;yanotready;)[1].mp3 File Hashes 0bf91ab95e85012f58d4b9a67e09841f04ec21666bdceadc5f16a93e4c4a96e3 1c3953149711add3b2335959c8c6579f29956ec02150b8a241af83c302c
sha2560d57c750f39cbb9e4ee8504658348835b45dc4241d7c099ec58ed7bfe5a628a2Temp\juexb.exe %LocalAppData%\Temp\golfinfo.ini File Hashes 0d57c750f39cbb9e4ee8504658348835b45dc4241d7c099ec58ed7bfe5a628a2 260dcb0f2fffeb4ae9c3c7a200396f8264333d8cb63ba4c3f368dde36cd
sha2560dd1f6ee91132936f0dbf28de674daf0faf0f24fabacabb9b9dc774c37056f06ce878c1bdd816537faaac7cc2353b2a936a77207a2a977367f258475049 0dd1f6ee91132936f0dbf28de674daf0faf0f24fabacabb9b9dc774c37056f06 0e44e2374c17aa24491a983697492b6959aa1fe8a88115941221e8bab7b
sha2560e44e2374c17aa24491a983697492b6959aa1fe8a88115941221e8bab7b1df356ee91132936f0dbf28de674daf0faf0f24fabacabb9b9dc774c37056f06 0e44e2374c17aa24491a983697492b6959aa1fe8a88115941221e8bab7b1df35 0fcd13d88db16457f9433406d4980c09618cca2f603814c93b8f0668d47
sha2560fcd13d88db16457f9433406d4980c09618cca2f603814c93b8f0668d47500522374c17aa24491a983697492b6959aa1fe8a88115941221e8bab7b1df35 0fcd13d88db16457f9433406d4980c09618cca2f603814c93b8f0668d4750052 0ff7deba9749c4052e44b2126ff0bc4b247aa705b0a08131e2796fcb0a8
sha2560ff7deba9749c4052e44b2126ff0bc4b247aa705b0a08131e2796fcb0a8147e13d88db16457f9433406d4980c09618cca2f603814c93b8f0668d4750052 0ff7deba9749c4052e44b2126ff0bc4b247aa705b0a08131e2796fcb0a8147e1 1020c323397bb9bec65e2b407ac08ad60967a3b2274117d2ae8e0fd86ce
sha2561020c323397bb9bec65e2b407ac08ad60967a3b2274117d2ae8e0fd86ce3dc00eba9749c4052e44b2126ff0bc4b247aa705b0a08131e2796fcb0a8147e1 1020c323397bb9bec65e2b407ac08ad60967a3b2274117d2ae8e0fd86ce3dc00 11e5487b2871708ab06220dc24e11952bef82744ceb620895932b8a444f
sha25611e5487b2871708ab06220dc24e11952bef82744ceb620895932b8a444f9fd17323397bb9bec65e2b407ac08ad60967a3b2274117d2ae8e0fd86ce3dc00 11e5487b2871708ab06220dc24e11952bef82744ceb620895932b8a444f9fd17 156e39ec36273b4ee35fd949ea73b22d4eaf8e30b3d6a5b769a17c7ff33
sha256139bd7f69953d5dccc274e6a6f2e958d11a43abb2281b8576f387b79dc19c1971aabe233566025b24140d43f882e002cbe74abea4c243d78bf8a04c1068 139bd7f69953d5dccc274e6a6f2e958d11a43abb2281b8576f387b79dc19c197 13a84666419bdcb611b1f1d361578d7abd9d0397325564b4ccb7b4a52d5
sha25613a84666419bdcb611b1f1d361578d7abd9d0397325564b4ccb7b4a52d5239357f69953d5dccc274e6a6f2e958d11a43abb2281b8576f387b79dc19c197 13a84666419bdcb611b1f1d361578d7abd9d0397325564b4ccb7b4a52d523935 1d41d24f744d82aebb31db5757fb8b7b0c50e8b1de75e97717769968fa0
sha256156e39ec36273b4ee35fd949ea73b22d4eaf8e30b3d6a5b769a17c7ff3328dbe87b2871708ab06220dc24e11952bef82744ceb620895932b8a444f9fd17 156e39ec36273b4ee35fd949ea73b22d4eaf8e30b3d6a5b769a17c7ff3328dbe 1f5552f125424c23601987d9a7d08a7e408e2545e30c7fd678ccefbcb19
sha2561c3953149711add3b2335959c8c6579f29956ec02150b8a241af83c302c5ca59ab95e85012f58d4b9a67e09841f04ec21666bdceadc5f16a93e4c4a96e3 1c3953149711add3b2335959c8c6579f29956ec02150b8a241af83c302c5ca59 312418dededf7fa07ee39314ac977b06b9a7c22550b4f269852cd801cd0
sha2561d41d24f744d82aebb31db5757fb8b7b0c50e8b1de75e97717769968fa0d1d10666419bdcb611b1f1d361578d7abd9d0397325564b4ccb7b4a52d523935 1d41d24f744d82aebb31db5757fb8b7b0c50e8b1de75e97717769968fa0d1d10 1ee26bc768fbb572b9e690b6e3f41db4265e812800794197c8208c66676
sha2561ee26bc768fbb572b9e690b6e3f41db4265e812800794197c8208c666767e59b24f744d82aebb31db5757fb8b7b0c50e8b1de75e97717769968fa0d1d10 1ee26bc768fbb572b9e690b6e3f41db4265e812800794197c8208c666767e59b 2df1bd9cc78c2e9603c41b650ca606f99ef4ba52aebee9b39dbd2d110ad
sha2561f5552f125424c23601987d9a7d08a7e408e2545e30c7fd678ccefbcb19d35cb9ec36273b4ee35fd949ea73b22d4eaf8e30b3d6a5b769a17c7ff3328dbe 1f5552f125424c23601987d9a7d08a7e408e2545e30c7fd678ccefbcb19d35cb 20607e1efba4dd19618384a3cd81cf83ed9199cf98e95072695f3335b9f
sha25620607e1efba4dd19618384a3cd81cf83ed9199cf98e95072695f3335b9f1edca2f125424c23601987d9a7d08a7e408e2545e30c7fd678ccefbcb19d35cb 20607e1efba4dd19618384a3cd81cf83ed9199cf98e95072695f3335b9f1edca 230de1d3cbaec2530bdfa3baaaab3de627036e36de6d41ad8d722a178ee
sha256230de1d3cbaec2530bdfa3baaaab3de627036e36de6d41ad8d722a178ee76e40e1efba4dd19618384a3cd81cf83ed9199cf98e95072695f3335b9f1edca 230de1d3cbaec2530bdfa3baaaab3de627036e36de6d41ad8d722a178ee76e40 2a5b2558b069a188168013d13fdae0140db5591042f0600aae96f791aeb
sha256260dcb0f2fffeb4ae9c3c7a200396f8264333d8cb63ba4c3f368dde36cdb98a4750f39cbb9e4ee8504658348835b45dc4241d7c099ec58ed7bfe5a628a2 260dcb0f2fffeb4ae9c3c7a200396f8264333d8cb63ba4c3f368dde36cdb98a4 3149e9891bf310b3f4f8de7484f105ee407b58615af36baf67d62ad1921
sha2562a5b2558b069a188168013d13fdae0140db5591042f0600aae96f791aeb10cc21d3cbaec2530bdfa3baaaab3de627036e36de6d41ad8d722a178ee76e40 2a5b2558b069a188168013d13fdae0140db5591042f0600aae96f791aeb10cc2 2f1a27c79aac8a2832bbed6ab2eba63bd3af4e3cdae608fcfa2df473b43
sha2562ad4073ae1de153fa8a5b337c2ecbdb76a9ac21ea8ac242a05421cf354e7ab3cd45cf437e0298edb7e1014528b3381eb65d054cf8904d23b8142f19dae6 2ad4073ae1de153fa8a5b337c2ecbdb76a9ac21ea8ac242a05421cf354e7ab3c 38589756ca7eec53222f1c5bc2a2e46dcaaa3628a52b779fcc7a61bcf6c
sha2562df1bd9cc78c2e9603c41b650ca606f99ef4ba52aebee9b39dbd2d110ad4c45abc768fbb572b9e690b6e3f41db4265e812800794197c8208c666767e59b 2df1bd9cc78c2e9603c41b650ca606f99ef4ba52aebee9b39dbd2d110ad4c45a 332870f1b71e77fd1521ceac1db6f72454d44bab3d8253f94359889a1a0
sha2562f1a27c79aac8a2832bbed6ab2eba63bd3af4e3cdae608fcfa2df473b43b3bc1558b069a188168013d13fdae0140db5591042f0600aae96f791aeb10cc2 2f1a27c79aac8a2832bbed6ab2eba63bd3af4e3cdae608fcfa2df473b43b3bc1 33f13e96394048f90ba1171becc45b503352dd2f7c93ddfe6d4c1692f50
sha256312418dededf7fa07ee39314ac977b06b9a7c22550b4f269852cd801cd062d493149711add3b2335959c8c6579f29956ec02150b8a241af83c302c5ca59 312418dededf7fa07ee39314ac977b06b9a7c22550b4f269852cd801cd062d49 3b8a6b0dcbed99f23cdc57de2822fcbfabdabd82af3dfa664294f9e12ce
sha2563149e9891bf310b3f4f8de7484f105ee407b58615af36baf67d62ad19218bdf4b0f2fffeb4ae9c3c7a200396f8264333d8cb63ba4c3f368dde36cdb98a4 3149e9891bf310b3f4f8de7484f105ee407b58615af36baf67d62ad19218bdf4 387ea2cd50f3a5e563f37af14a525ef675ca98b7f38c49c5809d1d42b51
sha256332870f1b71e77fd1521ceac1db6f72454d44bab3d8253f94359889a1a0f8322d9cc78c2e9603c41b650ca606f99ef4ba52aebee9b39dbd2d110ad4c45a 332870f1b71e77fd1521ceac1db6f72454d44bab3d8253f94359889a1a0f8322 33c5bdcb00c39040bc42db0ddbb1d43540e446111dd344358cb166635a7
sha25633c5bdcb00c39040bc42db0ddbb1d43540e446111dd344358cb166635a7b78750f1b71e77fd1521ceac1db6f72454d44bab3d8253f94359889a1a0f8322 33c5bdcb00c39040bc42db0ddbb1d43540e446111dd344358cb166635a7b7875 432d7c14056525b1de7bec20a9ed80f1744eccf9928d763d2948c0d5ae5
sha25633f13e96394048f90ba1171becc45b503352dd2f7c93ddfe6d4c1692f50ade0c7c79aac8a2832bbed6ab2eba63bd3af4e3cdae608fcfa2df473b43b3bc1 33f13e96394048f90ba1171becc45b503352dd2f7c93ddfe6d4c1692f50ade0c 340cb86784d60dcd8f181b52b70ed8840db818fd07f71b2e08123853db9
sha256340cb86784d60dcd8f181b52b70ed8840db818fd07f71b2e08123853db9110fbe96394048f90ba1171becc45b503352dd2f7c93ddfe6d4c1692f50ade0c 340cb86784d60dcd8f181b52b70ed8840db818fd07f71b2e08123853db9110fb 3e19a6dafc60c42bf2519e7f608b36b2bcc1fe49be79a7b90c2057334e1
sha25638589756ca7eec53222f1c5bc2a2e46dcaaa3628a52b779fcc7a61bcf6ccb59673ae1de153fa8a5b337c2ecbdb76a9ac21ea8ac242a05421cf354e7ab3c 38589756ca7eec53222f1c5bc2a2e46dcaaa3628a52b779fcc7a61bcf6ccb596 47ff4094684b1e2b01f5b76b8b97d7e5d30a62c286d461af985f2bc2ee4
sha256387ea2cd50f3a5e563f37af14a525ef675ca98b7f38c49c5809d1d42b51e95199891bf310b3f4f8de7484f105ee407b58615af36baf67d62ad19218bdf4 387ea2cd50f3a5e563f37af14a525ef675ca98b7f38c49c5809d1d42b51e9519 704d7bbc772efcaa18b585c1ab782da7a643e0c45bc19bb18ef7cf258ab
sha2563b8a6b0dcbed99f23cdc57de2822fcbfabdabd82af3dfa664294f9e12cee8c978dededf7fa07ee39314ac977b06b9a7c22550b4f269852cd801cd062d49 3b8a6b0dcbed99f23cdc57de2822fcbfabdabd82af3dfa664294f9e12cee8c97 49d27a252212601cee8b63ee5b9a2ce06a33d20964debe19bd656495ee7
sha2563e19a6dafc60c42bf2519e7f608b36b2bcc1fe49be79a7b90c2057334e1c718986784d60dcd8f181b52b70ed8840db818fd07f71b2e08123853db9110fb 3e19a6dafc60c42bf2519e7f608b36b2bcc1fe49be79a7b90c2057334e1c7189 3ef67512f826f552e8ed94a71ffec10605fafee6133bb456c9eb8cfebcc
sha2563ef67512f826f552e8ed94a71ffec10605fafee6133bb456c9eb8cfebcc8ccd36dafc60c42bf2519e7f608b36b2bcc1fe49be79a7b90c2057334e1c7189 3ef67512f826f552e8ed94a71ffec10605fafee6133bb456c9eb8cfebcc8ccd3 41db8921036c29be08be7f894bd8596df6d9848f6754f82fad27c635f17
sha25641db8921036c29be08be7f894bd8596df6d9848f6754f82fad27c635f177abb1512f826f552e8ed94a71ffec10605fafee6133bb456c9eb8cfebcc8ccd3 41db8921036c29be08be7f894bd8596df6d9848f6754f82fad27c635f177abb1 422f80129d4c71fcf4db6780cfc81b58f5c4e29b412046f0a17285d9828
sha256422f80129d4c71fcf4db6780cfc81b58f5c4e29b412046f0a17285d98284f5a8921036c29be08be7f894bd8596df6d9848f6754f82fad27c635f177abb1 422f80129d4c71fcf4db6780cfc81b58f5c4e29b412046f0a17285d98284f5a8 45547b35cadfea536f117f375f6a8c8dd7926a41f4be9be23fa4be98377
sha256432d7c14056525b1de7bec20a9ed80f1744eccf9928d763d2948c0d5ae55b3f3dcb00c39040bc42db0ddbb1d43540e446111dd344358cb166635a7b7875 432d7c14056525b1de7bec20a9ed80f1744eccf9928d763d2948c0d5ae55b3f3 4ea449f4ef2a4bdcd96d8cab961168a541ec7bbc51144503f47e2ed3e6b
sha25645547b35cadfea536f117f375f6a8c8dd7926a41f4be9be23fa4be983777c9f20129d4c71fcf4db6780cfc81b58f5c4e29b412046f0a17285d98284f5a8 45547b35cadfea536f117f375f6a8c8dd7926a41f4be9be23fa4be983777c9f2 4926f1a5e295d0498c6ece78dfc82443589aa541e57fb0d0cbb59ddc61b
sha25647ff4094684b1e2b01f5b76b8b97d7e5d30a62c286d461af985f2bc2ee4fad73756ca7eec53222f1c5bc2a2e46dcaaa3628a52b779fcc7a61bcf6ccb596 47ff4094684b1e2b01f5b76b8b97d7e5d30a62c286d461af985f2bc2ee4fad73 5e18aabbaf18265f6e70031308979b3eed61d28da49dfd3bfe7789b52d6
sha2564926f1a5e295d0498c6ece78dfc82443589aa541e57fb0d0cbb59ddc61bad57fb35cadfea536f117f375f6a8c8dd7926a41f4be9be23fa4be983777c9f2 4926f1a5e295d0498c6ece78dfc82443589aa541e57fb0d0cbb59ddc61bad57f 4d4603ca66e76b8f5cafe5b1bf5368124836b6879734e3212f5fa94a2e6
sha25649d27a252212601cee8b63ee5b9a2ce06a33d20964debe19bd656495ee7598eeb0dcbed99f23cdc57de2822fcbfabdabd82af3dfa664294f9e12cee8c97 49d27a252212601cee8b63ee5b9a2ce06a33d20964debe19bd656495ee7598ee 786dba298d82bb0b39404f5885bf5d9ae00db54ea34d337a628eca0aa6e
sha2564b40436146cee215c59870e36f4f968345f877a3da99f25848d44afa3f1b31c7\53D5.bat %LocalAppData%\Temp\53C4.tmp\53D5.bat File Hashes 4b40436146cee215c59870e36f4f968345f877a3da99f25848d44afa3f1b31c7 59ca65691aac6fb4fb6b5455a8aaf519a9ccfe58a0711ebd80f2fda578d
sha2564d4603ca66e76b8f5cafe5b1bf5368124836b6879734e3212f5fa94a2e632fbf1a5e295d0498c6ece78dfc82443589aa541e57fb0d0cbb59ddc61bad57f 4d4603ca66e76b8f5cafe5b1bf5368124836b6879734e3212f5fa94a2e632fbf Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha2564ea449f4ef2a4bdcd96d8cab961168a541ec7bbc51144503f47e2ed3e6bfad20c14056525b1de7bec20a9ed80f1744eccf9928d763d2948c0d5ae55b3f3 4ea449f4ef2a4bdcd96d8cab961168a541ec7bbc51144503f47e2ed3e6bfad20 50687a27477a80574af7b836e90083330d486815804e9b7a5eccf3547d6
sha25650687a27477a80574af7b836e90083330d486815804e9b7a5eccf3547d62e8f89f4ef2a4bdcd96d8cab961168a541ec7bbc51144503f47e2ed3e6bfad20 50687a27477a80574af7b836e90083330d486815804e9b7a5eccf3547d62e8f8 5b9aa3c388e1ac3dc9d4dd0e427590ce4a1f977787b7a2c5bd846b9d984
sha25659ca65691aac6fb4fb6b5455a8aaf519a9ccfe58a0711ebd80f2fda578d7a69536146cee215c59870e36f4f968345f877a3da99f25848d44afa3f1b31c7 59ca65691aac6fb4fb6b5455a8aaf519a9ccfe58a0711ebd80f2fda578d7a695 5f23072d7826fa01e40f03cf61f414766a47ec1f356b6ccfdb38e2d070e
sha2565b9aa3c388e1ac3dc9d4dd0e427590ce4a1f977787b7a2c5bd846b9d984008f0a27477a80574af7b836e90083330d486815804e9b7a5eccf3547d62e8f8 5b9aa3c388e1ac3dc9d4dd0e427590ce4a1f977787b7a2c5bd846b9d984008f0 62852003a07eaac1dab52df33a58cc979dd8fff6cc240b5feb330b3f7ff
sha2565e18aabbaf18265f6e70031308979b3eed61d28da49dfd3bfe7789b52d63d593094684b1e2b01f5b76b8b97d7e5d30a62c286d461af985f2bc2ee4fad73 5e18aabbaf18265f6e70031308979b3eed61d28da49dfd3bfe7789b52d63d593 7aaca0b23200e62d6847d6e63b584d552aa7e73cbeb693de816ad0e7398
sha2565f23072d7826fa01e40f03cf61f414766a47ec1f356b6ccfdb38e2d070e41d2c5691aac6fb4fb6b5455a8aaf519a9ccfe58a0711ebd80f2fda578d7a695 5f23072d7826fa01e40f03cf61f414766a47ec1f356b6ccfdb38e2d070e41d2c 6efac03160a2ca2b69827d8c86c625e68bf0f1d72f981fc4c8ec69fd5cd
sha25662852003a07eaac1dab52df33a58cc979dd8fff6cc240b5feb330b3f7ffa27553c388e1ac3dc9d4dd0e427590ce4a1f977787b7a2c5bd846b9d984008f0 62852003a07eaac1dab52df33a58cc979dd8fff6cc240b5feb330b3f7ffa2755 63d6e4a25bd071d8c62f4741a76cad0fe8ca4c03253bc351d82e8f6abf1
sha25663d6e4a25bd071d8c62f4741a76cad0fe8ca4c03253bc351d82e8f6abf1336e8003a07eaac1dab52df33a58cc979dd8fff6cc240b5feb330b3f7ffa2755 63d6e4a25bd071d8c62f4741a76cad0fe8ca4c03253bc351d82e8f6abf1336e8 63eb562c673e24528af73f6d90ebf1b2fc575287d5f971dbff3e19200f4
sha25663eb562c673e24528af73f6d90ebf1b2fc575287d5f971dbff3e19200f4eae0a4a25bd071d8c62f4741a76cad0fe8ca4c03253bc351d82e8f6abf1336e8 63eb562c673e24528af73f6d90ebf1b2fc575287d5f971dbff3e19200f4eae0a 79d55737580d069816c1745d410caab32cba85dc9839683bc295b1df5de
sha2566efac03160a2ca2b69827d8c86c625e68bf0f1d72f981fc4c8ec69fd5cdabd8772d7826fa01e40f03cf61f414766a47ec1f356b6ccfdb38e2d070e41d2c 6efac03160a2ca2b69827d8c86c625e68bf0f1d72f981fc4c8ec69fd5cdabd87 9785045b4b9a6da30e786ac0c387787bc8e2b52b730eb8a0fcc9c9eb209
sha256704d7bbc772efcaa18b585c1ab782da7a643e0c45bc19bb18ef7cf258abb22f72cd50f3a5e563f37af14a525ef675ca98b7f38c49c5809d1d42b51e9519 704d7bbc772efcaa18b585c1ab782da7a643e0c45bc19bb18ef7cf258abb22f7 7c8be40eb56a11302d8490bd6d72203ab213ce34e17db004e568f578711
sha256786dba298d82bb0b39404f5885bf5d9ae00db54ea34d337a628eca0aa6eab1faa252212601cee8b63ee5b9a2ce06a33d20964debe19bd656495ee7598ee 786dba298d82bb0b39404f5885bf5d9ae00db54ea34d337a628eca0aa6eab1fa 7c00d5a389b840bde49372c8c2eb2470607e916a899e0f03dbb441200a2
sha25679d55737580d069816c1745d410caab32cba85dc9839683bc295b1df5de6f92962c673e24528af73f6d90ebf1b2fc575287d5f971dbff3e19200f4eae0a 79d55737580d069816c1745d410caab32cba85dc9839683bc295b1df5de6f929 7f38bbf4562cf0e03aa11a1c9ec229fdd5c52b173f14584552f234f80a8
sha2567aaca0b23200e62d6847d6e63b584d552aa7e73cbeb693de816ad0e73989849cabbaf18265f6e70031308979b3eed61d28da49dfd3bfe7789b52d63d593 7aaca0b23200e62d6847d6e63b584d552aa7e73cbeb693de816ad0e73989849c 80f00a79fc76f6c4686d136517a6f5e62e93f19edb427ea774e7b2f9f7b
sha2567c00d5a389b840bde49372c8c2eb2470607e916a899e0f03dbb441200a2967c7a298d82bb0b39404f5885bf5d9ae00db54ea34d337a628eca0aa6eab1fa 7c00d5a389b840bde49372c8c2eb2470607e916a899e0f03dbb441200a2967c7 afa7d63202387891c1727a6fafd5e30ae0be97c617c3eef38f650a76556
sha2567c8be40eb56a11302d8490bd6d72203ab213ce34e17db004e568f578711b7327bbc772efcaa18b585c1ab782da7a643e0c45bc19bb18ef7cf258abb22f7 7c8be40eb56a11302d8490bd6d72203ab213ce34e17db004e568f578711b7327 8522e1a14f9938d30096bd7b50fee6d03dae7acaf660202b3e037d1a37c
sha2567f38bbf4562cf0e03aa11a1c9ec229fdd5c52b173f14584552f234f80a826853737580d069816c1745d410caab32cba85dc9839683bc295b1df5de6f929 7f38bbf4562cf0e03aa11a1c9ec229fdd5c52b173f14584552f234f80a826853 7f6d6308a0fe8a6d4898d56dbfc7a32bd6850acd6fd774b8e0827240859
sha2567f6d6308a0fe8a6d4898d56dbfc7a32bd6850acd6fd774b8e0827240859c2e41bf4562cf0e03aa11a1c9ec229fdd5c52b173f14584552f234f80a826853 7f6d6308a0fe8a6d4898d56dbfc7a32bd6850acd6fd774b8e0827240859c2e41 8318315039d9fcb04ee94442b07180cdda204de131bfb7cb9a69fa27054
sha25680f00a79fc76f6c4686d136517a6f5e62e93f19edb427ea774e7b2f9f7b6e4ca0b23200e62d6847d6e63b584d552aa7e73cbeb693de816ad0e73989849c 80f00a79fc76f6c4686d136517a6f5e62e93f19edb427ea774e7b2f9f7b6e4ca 8341a9af1d9ba6a84cb77b52a064ac8fd6ee9bfee39fd46e740e80720ef
sha2568318315039d9fcb04ee94442b07180cdda204de131bfb7cb9a69fa270545085a308a0fe8a6d4898d56dbfc7a32bd6850acd6fd774b8e0827240859c2e41 8318315039d9fcb04ee94442b07180cdda204de131bfb7cb9a69fa270545085a a68842e74598619367c06558d42495bc861a1f6404545f7e66731ccaeef
sha2568341a9af1d9ba6a84cb77b52a064ac8fd6ee9bfee39fd46e740e80720efbafb0a79fc76f6c4686d136517a6f5e62e93f19edb427ea774e7b2f9f7b6e4ca 8341a9af1d9ba6a84cb77b52a064ac8fd6ee9bfee39fd46e740e80720efbafb0 8a3421926d5e66c331dbc32d47c99164b68e55fce84005ab602f52ad9ce
sha2568522e1a14f9938d30096bd7b50fee6d03dae7acaf660202b3e037d1a37c7bc8440eb56a11302d8490bd6d72203ab213ce34e17db004e568f578711b7327 8522e1a14f9938d30096bd7b50fee6d03dae7acaf660202b3e037d1a37c7bc84 953e5ab16bcf1558588f3ea041800007dfcc119f64792ed659bd303f8c2
sha2568a3421926d5e66c331dbc32d47c99164b68e55fce84005ab602f52ad9ce280549af1d9ba6a84cb77b52a064ac8fd6ee9bfee39fd46e740e80720efbafb0 8a3421926d5e66c331dbc32d47c99164b68e55fce84005ab602f52ad9ce28054 e9cc6a849aed6306da590ed8de295b5a8f22519d323ee7300f09261ddf7
sha256953e5ab16bcf1558588f3ea041800007dfcc119f64792ed659bd303f8c20a68b1a14f9938d30096bd7b50fee6d03dae7acaf660202b3e037d1a37c7bc84 953e5ab16bcf1558588f3ea041800007dfcc119f64792ed659bd303f8c20a68b 96f45f959120a926231a9a1ebef0e16d09de9519fd0d93f35b099697330
sha25696f45f959120a926231a9a1ebef0e16d09de9519fd0d93f35b0996973305f8b0ab16bcf1558588f3ea041800007dfcc119f64792ed659bd303f8c20a68b 96f45f959120a926231a9a1ebef0e16d09de9519fd0d93f35b0996973305f8b0 98cf27a77174fb7287ec781d9edb9b81670d52bd02923ae24bb2e3522d5
sha2569785045b4b9a6da30e786ac0c387787bc8e2b52b730eb8a0fcc9c9eb2093cdce03160a2ca2b69827d8c86c625e68bf0f1d72f981fc4c8ec69fd5cdabd87 9785045b4b9a6da30e786ac0c387787bc8e2b52b730eb8a0fcc9c9eb2093cdce 9c6965c2b2d7db282de183d631693cabcc8a64ac50d8e2d9a28bba6dae7
sha25698cf27a77174fb7287ec781d9edb9b81670d52bd02923ae24bb2e3522d5743acf959120a926231a9a1ebef0e16d09de9519fd0d93f35b0996973305f8b0 98cf27a77174fb7287ec781d9edb9b81670d52bd02923ae24bb2e3522d5743ac 9c08285d4d9043c372e5758358964ea75ba55e3455575c5785b6065806c
sha2569c08285d4d9043c372e5758358964ea75ba55e3455575c5785b6065806c379407a77174fb7287ec781d9edb9b81670d52bd02923ae24bb2e3522d5743ac 9c08285d4d9043c372e5758358964ea75ba55e3455575c5785b6065806c37940 ae8d0d4996f4d722748d28e5495101a223e9fdd0829656f23c7d98011da
sha2569c6965c2b2d7db282de183d631693cabcc8a64ac50d8e2d9a28bba6dae7140b845b4b9a6da30e786ac0c387787bc8e2b52b730eb8a0fcc9c9eb2093cdce 9c6965c2b2d7db282de183d631693cabcc8a64ac50d8e2d9a28bba6dae7140b8 a221912cebea541e80bc04bf11a1b79169e2143dd4f98529a9e1ffe2ef5
sha256a221912cebea541e80bc04bf11a1b79169e2143dd4f98529a9e1ffe2ef5142805c2b2d7db282de183d631693cabcc8a64ac50d8e2d9a28bba6dae7140b8 a221912cebea541e80bc04bf11a1b79169e2143dd4f98529a9e1ffe2ef514280 aad0d72aa2b0b52ef45f6ce12ca2c0cdab082a70f03b4675ebd479c1d37
sha256a68842e74598619367c06558d42495bc861a1f6404545f7e66731ccaeef2e45d15039d9fcb04ee94442b07180cdda204de131bfb7cb9a69fa270545085a a68842e74598619367c06558d42495bc861a1f6404545f7e66731ccaeef2e45d a76026549238f7a716ab32de68d09a2b8e14d975d6f8ae170b3d0b8a05f
sha256a76026549238f7a716ab32de68d09a2b8e14d975d6f8ae170b3d0b8a05fab2822e74598619367c06558d42495bc861a1f6404545f7e66731ccaeef2e45d a76026549238f7a716ab32de68d09a2b8e14d975d6f8ae170b3d0b8a05fab282 b5196c00282c2bad55540793382b00661edc9d121fd28b473d98042f686
sha256aad0d72aa2b0b52ef45f6ce12ca2c0cdab082a70f03b4675ebd479c1d376e04812cebea541e80bc04bf11a1b79169e2143dd4f98529a9e1ffe2ef514280 aad0d72aa2b0b52ef45f6ce12ca2c0cdab082a70f03b4675ebd479c1d376e048 b740f63d827ae99159c51f04f2c247273573d4db19578ff16405284e701
sha256ae8d0d4996f4d722748d28e5495101a223e9fdd0829656f23c7d98011da8044785d4d9043c372e5758358964ea75ba55e3455575c5785b6065806c37940 ae8d0d4996f4d722748d28e5495101a223e9fdd0829656f23c7d98011da80447 b2d2bfea661ed1fff2bb8ab465d0dff71106136505febe5040a7a27e2ce
sha256afa7d63202387891c1727a6fafd5e30ae0be97c617c3eef38f650a7655605a565a389b840bde49372c8c2eb2470607e916a899e0f03dbb441200a2967c7 afa7d63202387891c1727a6fafd5e30ae0be97c617c3eef38f650a7655605a56 b22e72a5875b8ce68d15f74bc454186171f920374e7dd13a57991cdd8e4
sha256b22e72a5875b8ce68d15f74bc454186171f920374e7dd13a57991cdd8e45d24b63202387891c1727a6fafd5e30ae0be97c617c3eef38f650a7655605a56 b22e72a5875b8ce68d15f74bc454186171f920374e7dd13a57991cdd8e45d24b cc6d69ab51542ffbe4986797a6f1b36644a5ba7d2728d32ae1978b138ae
sha256b2d2bfea661ed1fff2bb8ab465d0dff71106136505febe5040a7a27e2ce44c7ad4996f4d722748d28e5495101a223e9fdd0829656f23c7d98011da80447 b2d2bfea661ed1fff2bb8ab465d0dff71106136505febe5040a7a27e2ce44c7a c8b7316ce2e3c30145f469ca30d8b051392237e9f99cf6cf731f592582d
sha256b5196c00282c2bad55540793382b00661edc9d121fd28b473d98042f6860aa7a6549238f7a716ab32de68d09a2b8e14d975d6f8ae170b3d0b8a05fab282 b5196c00282c2bad55540793382b00661edc9d121fd28b473d98042f6860aa7a d9e0a3afbf6250e23c6cbfee3126ec8b40a4a7663159b96de88ea7c80ba
sha256b740f63d827ae99159c51f04f2c247273573d4db19578ff16405284e701cd1a172aa2b0b52ef45f6ce12ca2c0cdab082a70f03b4675ebd479c1d376e048 b740f63d827ae99159c51f04f2c247273573d4db19578ff16405284e701cd1a1 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha256c8b7316ce2e3c30145f469ca30d8b051392237e9f99cf6cf731f592582d9b78ffea661ed1fff2bb8ab465d0dff71106136505febe5040a7a27e2ce44c7a c8b7316ce2e3c30145f469ca30d8b051392237e9f99cf6cf731f592582d9b78f c9bdf7fee2f610c90127564b409f69f9931ea1e6957026dca45ff30bc6f
sha256c9bdf7fee2f610c90127564b409f69f9931ea1e6957026dca45ff30bc6f8bb9316ce2e3c30145f469ca30d8b051392237e9f99cf6cf731f592582d9b78f c9bdf7fee2f610c90127564b409f69f9931ea1e6957026dca45ff30bc6f8bb93 d164f9ef0a8e1f36798b0543d8978eee384dd992c3da90c3640f716958a
sha256cc6d69ab51542ffbe4986797a6f1b36644a5ba7d2728d32ae1978b138ae8cd192a5875b8ce68d15f74bc454186171f920374e7dd13a57991cdd8e45d24b cc6d69ab51542ffbe4986797a6f1b36644a5ba7d2728d32ae1978b138ae8cd19 d2e091f59406dd59211f81756f08d8baaf255615001b64afd57f8b79357
sha256d164f9ef0a8e1f36798b0543d8978eee384dd992c3da90c3640f716958ae42817fee2f610c90127564b409f69f9931ea1e6957026dca45ff30bc6f8bb93 d164f9ef0a8e1f36798b0543d8978eee384dd992c3da90c3640f716958ae4281 d90c453ba89ee35f04b5344490b201fad5fda97b442f40a2c9d710e7a06
sha256d2e091f59406dd59211f81756f08d8baaf255615001b64afd57f8b7935775cf19ab51542ffbe4986797a6f1b36644a5ba7d2728d32ae1978b138ae8cd19 d2e091f59406dd59211f81756f08d8baaf255615001b64afd57f8b7935775cf1 dfd0180feab22a765d735e4c4e022e79f313ed177013e9d506f29aeeba9
sha256d90c453ba89ee35f04b5344490b201fad5fda97b442f40a2c9d710e7a06fe9d49ef0a8e1f36798b0543d8978eee384dd992c3da90c3640f716958ae4281 d90c453ba89ee35f04b5344490b201fad5fda97b442f40a2c9d710e7a06fe9d4 ef870ddf8b97e256e229303eb71e2189c881e8269330978c10cad77518a
sha256d9e0a3afbf6250e23c6cbfee3126ec8b40a4a7663159b96de88ea7c80ba3c783c00282c2bad55540793382b00661edc9d121fd28b473d98042f6860aa7a d9e0a3afbf6250e23c6cbfee3126ec8b40a4a7663159b96de88ea7c80ba3c783 ddd00f7ca8445e8c5b870d499599e105a1c3a95c2c1ef61622e9e3c4792
sha256ddd00f7ca8445e8c5b870d499599e105a1c3a95c2c1ef61622e9e3c4792d87a03afbf6250e23c6cbfee3126ec8b40a4a7663159b96de88ea7c80ba3c783 ddd00f7ca8445e8c5b870d499599e105a1c3a95c2c1ef61622e9e3c4792d87a0 eb4ae7da4cc7e83b8511b892860cdca5abc2bfb25e7280150bb401d593d
sha256dfd0180feab22a765d735e4c4e022e79f313ed177013e9d506f29aeeba9576f91f59406dd59211f81756f08d8baaf255615001b64afd57f8b7935775cf1 dfd0180feab22a765d735e4c4e022e79f313ed177013e9d506f29aeeba9576f9 e309e767073f099f8c0c2a187e641deaf76af4f78da784abb3441650ebc
sha256e309e767073f099f8c0c2a187e641deaf76af4f78da784abb3441650ebcb039d80feab22a765d735e4c4e022e79f313ed177013e9d506f29aeeba9576f9 e309e767073f099f8c0c2a187e641deaf76af4f78da784abb3441650ebcb039d e41ca39270846dba275b367a53f18ed98673d546f6c16a0010fc0fd8770
sha256e41ca39270846dba275b367a53f18ed98673d546f6c16a0010fc0fd877080232767073f099f8c0c2a187e641deaf76af4f78da784abb3441650ebcb039d e41ca39270846dba275b367a53f18ed98673d546f6c16a0010fc0fd877080232 e5ff9cb29268551c867506bd251e6c7ca80a3bb5d5dee8ca4f80822c14c
sha256e5ff9cb29268551c867506bd251e6c7ca80a3bb5d5dee8ca4f80822c14c94f6239270846dba275b367a53f18ed98673d546f6c16a0010fc0fd877080232 e5ff9cb29268551c867506bd251e6c7ca80a3bb5d5dee8ca4f80822c14c94f62 efed33e5c8d350f270c7ce3f80b33292f8ea861dd5c70b8ffa64c23a9a0
sha256e9cc6a849aed6306da590ed8de295b5a8f22519d323ee7300f09261ddf74a7bb1926d5e66c331dbc32d47c99164b68e55fce84005ab602f52ad9ce28054 e9cc6a849aed6306da590ed8de295b5a8f22519d323ee7300f09261ddf74a7bb Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha256eb4ae7da4cc7e83b8511b892860cdca5abc2bfb25e7280150bb401d593db1127f7ca8445e8c5b870d499599e105a1c3a95c2c1ef61622e9e3c4792d87a0 eb4ae7da4cc7e83b8511b892860cdca5abc2bfb25e7280150bb401d593db1127 Coverage Screenshots of Detection AMP ThreatGrid Win.Malwar
sha256ef870ddf8b97e256e229303eb71e2189c881e8269330978c10cad77518a3d09253ba89ee35f04b5344490b201fad5fda97b442f40a2c9d710e7a06fe9d4 ef870ddf8b97e256e229303eb71e2189c881e8269330978c10cad77518a3d092 Coverage Screenshots of Detection AMP ThreatGrid
sha256efed33e5c8d350f270c7ce3f80b33292f8ea861dd5c70b8ffa64c23a9a0c69b4cb29268551c867506bd251e6c7ca80a3bb5d5dee8ca4f80822c14c94f62 efed33e5c8d350f270c7ce3f80b33292f8ea861dd5c70b8ffa64c23a9a0c69b4 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
Full article650 words · extracted from blog.talosintelligence.com · click to collapse

Friday, July 13, 2018 11:23


Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we've observed this week — covering the dates between July 6 and 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is not exhaustive and is current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this roundup are:

  • Win.Malware.Jaik-6607437-0
    Malware
    Win.Malware.Jaik-6607437-0 delivers a powershell-based miner that may consume system resources without the user's notice.
  • Win.Malware.Generic-6607409-0
    Malware
    This trojan may execute malicious actions without the user's consent, such as collecting system information, monitoring keystrokes or the file system, or establishing remote connections.
  • Win.Malware.Dbel-6607389-2
    Malware
    Win.Malware.Dbel may display advertisements without the user's consent, and can perform other malicious actions.
  • Win.Ransomware.Hosts-6607383-0
    Ransomware
    Win.Ransomware.Hosts first gains persistence on the system and performs process injection to conceal its actions. It contacts an external site and downloads a sound file that it reproduces afterward.
  • Win.Malware.Daws-6606625-0
    Malware
    Win.Malware.Daws will gain persistence on the system by modifying the registry and dropping files into the disk. It will also contact a command and control (C2) server, which is flagged as malicious, that may allow it to control the infected system remotely.
  • Win.Trojan.Urelas-6606624-0
    Trojan
    Win.Trojan.Urelas gains persistance on the system, uses temporary batch scripts for its execution, and contacts IPs flagged as malicious. This trojan may perform different malicious actions on the infected system, such as monitoring user keystrokes and the file system, establishing remote connections or executing other software without the user's consent.

Threats

Win.Malware.Jaik-6607437-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • 104.25.206.114
  • 104.27.144.1 Domain Names
  • pool.hashrefinery.com
  • www.ahashpool.com
  • zpool.ca Files and or directories created
  • \TEMP\Engine.ps1
  • %LocalAppData%\Temp\yh1rekdj.kyw.ps1
  • %LocalAppData%\Temp\tvo434zg.kys.psm1
  • Engine.ps1
  • %LocalAppData%\Temp\53C4.tmp\53D5.bat
  • %LocalAppData%\Temp\53C4.tmp\53D5.bat File Hashes
  • 4b40436146cee215c59870e36f4f968345f877a3da99f25848d44afa3f1b31c7
  • 59ca65691aac6fb4fb6b5455a8aaf519a9ccfe58a0711ebd80f2fda578d7a695
  • 5f23072d7826fa01e40f03cf61f414766a47ec1f356b6ccfdb38e2d070e41d2c
  • 6efac03160a2ca2b69827d8c86c625e68bf0f1d72f981fc4c8ec69fd5cdabd87
  • 9785045b4b9a6da30e786ac0c387787bc8e2b52b730eb8a0fcc9c9eb2093cdce
  • 9c6965c2b2d7db282de183d631693cabcc8a64ac50d8e2d9a28bba6dae7140b8
  • a221912cebea541e80bc04bf11a1b79169e2143dd4f98529a9e1ffe2ef514280
  • aad0d72aa2b0b52ef45f6ce12ca2c0cdab082a70f03b4675ebd479c1d376e048
  • b740f63d827ae99159c51f04f2c247273573d4db19578ff16405284e701cd1a1

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Malware.Generic-6607409-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • Local\MSCTF.Asm.MutexDefault1 IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • %WinDir%\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
  • %WinDir%\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
  • %System32%\winevt\Logs\Windows PowerShell.evtx
  • %System32%\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx
  • %System32%\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx
  • %System32%\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx File Hashes
  • 0304c1aabe233566025b24140d43f882e002cbe74abea4c243d78bf8a04c1068
  • 139bd7f69953d5dccc274e6a6f2e958d11a43abb2281b8576f387b79dc19c197
  • 13a84666419bdcb611b1f1d361578d7abd9d0397325564b4ccb7b4a52d523935
  • 1d41d24f744d82aebb31db5757fb8b7b0c50e8b1de75e97717769968fa0d1d10
  • 1ee26bc768fbb572b9e690b6e3f41db4265e812800794197c8208c666767e59b
  • 2df1bd9cc78c2e9603c41b650ca606f99ef4ba52aebee9b39dbd2d110ad4c45a
  • 332870f1b71e77fd1521ceac1db6f72454d44bab3d8253f94359889a1a0f8322
  • 33c5bdcb00c39040bc42db0ddbb1d43540e446111dd344358cb166635a7b7875
  • 432d7c14056525b1de7bec20a9ed80f1744eccf9928d763d2948c0d5ae55b3f3
  • 4ea449f4ef2a4bdcd96d8cab961168a541ec7bbc51144503f47e2ed3e6bfad20
  • 50687a27477a80574af7b836e90083330d486815804e9b7a5eccf3547d62e8f8
  • 5b9aa3c388e1ac3dc9d4dd0e427590ce4a1f977787b7a2c5bd846b9d984008f0
  • 62852003a07eaac1dab52df33a58cc979dd8fff6cc240b5feb330b3f7ffa2755
  • 63d6e4a25bd071d8c62f4741a76cad0fe8ca4c03253bc351d82e8f6abf1336e8
  • 63eb562c673e24528af73f6d90ebf1b2fc575287d5f971dbff3e19200f4eae0a
  • 79d55737580d069816c1745d410caab32cba85dc9839683bc295b1df5de6f929
  • 7f38bbf4562cf0e03aa11a1c9ec229fdd5c52b173f14584552f234f80a826853
  • 7f6d6308a0fe8a6d4898d56dbfc7a32bd6850acd6fd774b8e0827240859c2e41
  • 8318315039d9fcb04ee94442b07180cdda204de131bfb7cb9a69fa270545085a
  • a68842e74598619367c06558d42495bc861a1f6404545f7e66731ccaeef2e45d
  • a76026549238f7a716ab32de68d09a2b8e14d975d6f8ae170b3d0b8a05fab282
  • b5196c00282c2bad55540793382b00661edc9d121fd28b473d98042f6860aa7a
  • d9e0a3afbf6250e23c6cbfee3126ec8b40a4a7663159b96de88ea7c80ba3c783
  • ddd00f7ca8445e8c5b870d499599e105a1c3a95c2c1ef61622e9e3c4792d87a0
  • eb4ae7da4cc7e83b8511b892860cdca5abc2bfb25e7280150bb401d593db1127

Coverage

Screenshots of Detection AMP


ThreatGrid

Win.Malware.Dbel-6607389-2

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • 13.32.81.92 Domain Names
  • all.fingersleep.bid Files and or directories created
  • N/A File Hashes
  • 091caa24acc44bd5898784480f2c3260982ded40ce62f48d4dbe38c45a4c0d4b
  • 09b987244a583826dc9bc222e26f8f3e65726eff2db388b55c04ae66b46c8eb9
  • 0a1bfce878c1bdd816537faaac7cc2353b2a936a77207a2a977367f258475049
  • 0dd1f6ee91132936f0dbf28de674daf0faf0f24fabacabb9b9dc774c37056f06
  • 0e44e2374c17aa24491a983697492b6959aa1fe8a88115941221e8bab7b1df35
  • 0fcd13d88db16457f9433406d4980c09618cca2f603814c93b8f0668d4750052
  • 0ff7deba9749c4052e44b2126ff0bc4b247aa705b0a08131e2796fcb0a8147e1
  • 1020c323397bb9bec65e2b407ac08ad60967a3b2274117d2ae8e0fd86ce3dc00
  • 11e5487b2871708ab06220dc24e11952bef82744ceb620895932b8a444f9fd17
  • 156e39ec36273b4ee35fd949ea73b22d4eaf8e30b3d6a5b769a17c7ff3328dbe
  • 1f5552f125424c23601987d9a7d08a7e408e2545e30c7fd678ccefbcb19d35cb
  • 20607e1efba4dd19618384a3cd81cf83ed9199cf98e95072695f3335b9f1edca
  • 230de1d3cbaec2530bdfa3baaaab3de627036e36de6d41ad8d722a178ee76e40
  • 2a5b2558b069a188168013d13fdae0140db5591042f0600aae96f791aeb10cc2
  • 2f1a27c79aac8a2832bbed6ab2eba63bd3af4e3cdae608fcfa2df473b43b3bc1
  • 33f13e96394048f90ba1171becc45b503352dd2f7c93ddfe6d4c1692f50ade0c
  • 340cb86784d60dcd8f181b52b70ed8840db818fd07f71b2e08123853db9110fb
  • 3e19a6dafc60c42bf2519e7f608b36b2bcc1fe49be79a7b90c2057334e1c7189
  • 3ef67512f826f552e8ed94a71ffec10605fafee6133bb456c9eb8cfebcc8ccd3
  • 41db8921036c29be08be7f894bd8596df6d9848f6754f82fad27c635f177abb1
  • 422f80129d4c71fcf4db6780cfc81b58f5c4e29b412046f0a17285d98284f5a8
  • 45547b35cadfea536f117f375f6a8c8dd7926a41f4be9be23fa4be983777c9f2
  • 4926f1a5e295d0498c6ece78dfc82443589aa541e57fb0d0cbb59ddc61bad57f
  • 4d4603ca66e76b8f5cafe5b1bf5368124836b6879734e3212f5fa94a2e632fbf

Coverage

Screenshots of DetectionAMP


ThreatGrid


Umbrella

Win.Ransomware.Hosts-6607383-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • Groove:PathMutex:tzanqCjN6dCs1QGzbKslin0UfIk= IP Addresses
  • 98.126.20.12 Domain Names
  • bbs.18wos.org Files and or directories created
  • %LocalAppData%\Temp\8ECHPOST.bat
  • %LocalAppData%\Temp\8ECHPOST.bat
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\Sean_Paul_-_Ya_Not_Ready_(;yanotready;)[1].mp3 File Hashes
  • 0bf91ab95e85012f58d4b9a67e09841f04ec21666bdceadc5f16a93e4c4a96e3
  • 1c3953149711add3b2335959c8c6579f29956ec02150b8a241af83c302c5ca59
  • 312418dededf7fa07ee39314ac977b06b9a7c22550b4f269852cd801cd062d49
  • 3b8a6b0dcbed99f23cdc57de2822fcbfabdabd82af3dfa664294f9e12cee8c97
  • 49d27a252212601cee8b63ee5b9a2ce06a33d20964debe19bd656495ee7598ee
  • 786dba298d82bb0b39404f5885bf5d9ae00db54ea34d337a628eca0aa6eab1fa
  • 7c00d5a389b840bde49372c8c2eb2470607e916a899e0f03dbb441200a2967c7
  • afa7d63202387891c1727a6fafd5e30ae0be97c617c3eef38f650a7655605a56
  • b22e72a5875b8ce68d15f74bc454186171f920374e7dd13a57991cdd8e45d24b
  • cc6d69ab51542ffbe4986797a6f1b36644a5ba7d2728d32ae1978b138ae8cd19
  • d2e091f59406dd59211f81756f08d8baaf255615001b64afd57f8b7935775cf1
  • dfd0180feab22a765d735e4c4e022e79f313ed177013e9d506f29aeeba9576f9
  • e309e767073f099f8c0c2a187e641deaf76af4f78da784abb3441650ebcb039d
  • e41ca39270846dba275b367a53f18ed98673d546f6c16a0010fc0fd877080232
  • e5ff9cb29268551c867506bd251e6c7ca80a3bb5d5dee8ca4f80822c14c94f62
  • efed33e5c8d350f270c7ce3f80b33292f8ea861dd5c70b8ffa64c23a9a0c69b4

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Malware.Daws-6606625-0

Indicators of Compromise
Registry Keys

  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: Kris
  • <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run  Mutexes
  • aa0533.3322.org IP Addresses
  • 157.122.62.205 Domain Names
  • aa0533.3322.org  Files and or directories created
  • %WinDir%\svchest000.exe
  • %WinDir%\BJ.exe
  • %WinDir%\BJ.exe File Hashes
  • 0a843d45cf437e0298edb7e1014528b3381eb65d054cf8904d23b8142f19dae6
  • 2ad4073ae1de153fa8a5b337c2ecbdb76a9ac21ea8ac242a05421cf354e7ab3c
  • 38589756ca7eec53222f1c5bc2a2e46dcaaa3628a52b779fcc7a61bcf6ccb596
  • 47ff4094684b1e2b01f5b76b8b97d7e5d30a62c286d461af985f2bc2ee4fad73
  • 5e18aabbaf18265f6e70031308979b3eed61d28da49dfd3bfe7789b52d63d593
  • 7aaca0b23200e62d6847d6e63b584d552aa7e73cbeb693de816ad0e73989849c
  • 80f00a79fc76f6c4686d136517a6f5e62e93f19edb427ea774e7b2f9f7b6e4ca
  • 8341a9af1d9ba6a84cb77b52a064ac8fd6ee9bfee39fd46e740e80720efbafb0
  • 8a3421926d5e66c331dbc32d47c99164b68e55fce84005ab602f52ad9ce28054
  • e9cc6a849aed6306da590ed8de295b5a8f22519d323ee7300f09261ddf74a7bb

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Trojan.Urelas-6606624-0

Indicators of Compromise
Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
  • Value Name: TrayKey
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
  • Value Name: Run Mutexes
  • N/A IP Addresses
  • 218.54.31.226
  • 218.54.31.165
  • 133.242.129.155
  • 1.234.83.146 Domain Names
  • N/A Files and or directories created
  • \TEMP\2871954827.exe
  • %LocalAppData%\Temp\ziufv.exe
  • %LocalAppData%\Temp\_uinsey.bat
  • %LocalAppData%\Temp\juexb.exe
  • %LocalAppData%\Temp\golfinfo.ini File Hashes
  • 0d57c750f39cbb9e4ee8504658348835b45dc4241d7c099ec58ed7bfe5a628a2
  • 260dcb0f2fffeb4ae9c3c7a200396f8264333d8cb63ba4c3f368dde36cdb98a4
  • 3149e9891bf310b3f4f8de7484f105ee407b58615af36baf67d62ad19218bdf4
  • 387ea2cd50f3a5e563f37af14a525ef675ca98b7f38c49c5809d1d42b51e9519
  • 704d7bbc772efcaa18b585c1ab782da7a643e0c45bc19bb18ef7cf258abb22f7
  • 7c8be40eb56a11302d8490bd6d72203ab213ce34e17db004e568f578711b7327
  • 8522e1a14f9938d30096bd7b50fee6d03dae7acaf660202b3e037d1a37c7bc84
  • 953e5ab16bcf1558588f3ea041800007dfcc119f64792ed659bd303f8c20a68b
  • 96f45f959120a926231a9a1ebef0e16d09de9519fd0d93f35b0996973305f8b0
  • 98cf27a77174fb7287ec781d9edb9b81670d52bd02923ae24bb2e3522d5743ac
  • 9c08285d4d9043c372e5758358964ea75ba55e3455575c5785b6065806c37940
  • ae8d0d4996f4d722748d28e5495101a223e9fdd0829656f23c7d98011da80447
  • b2d2bfea661ed1fff2bb8ab465d0dff71106136505febe5040a7a27e2ce44c7a
  • c8b7316ce2e3c30145f469ca30d8b051392237e9f99cf6cf731f592582d9b78f
  • c9bdf7fee2f610c90127564b409f69f9931ea1e6957026dca45ff30bc6f8bb93
  • d164f9ef0a8e1f36798b0543d8978eee384dd992c3da90c3640f716958ae4281
  • d90c453ba89ee35f04b5344490b201fad5fda97b442f40a2c9d710e7a06fe9d4
  • ef870ddf8b97e256e229303eb71e2189c881e8269330978c10cad77518a3d092

Coverage

Screenshots of DetectionAMP


ThreatGrid

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0706-0713/