ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Cisco Talospublished ()ingested

Threat Round-up for Apr 21

highRansomwareimportance 57
Read the original
Tagsransomware

Indicators of compromiseAll →

TypeIndicatorContext
domain9966.orgin Names syhaw1516.codns[.]com wrop0422.codns[.]com ansbase.9966[.]org File Hashes fbbc6852ff1947fcd820b90e60ab71af93ffad079bd13
domaincodns.comMutexes Nationallwc IP Addresses N/A Domain Names syhaw1516.codns[.]com wrop0422.codns[.]com ansbase.9966[.]org File Hashes fbbc6
domainstorefronts.plRegistry Keys N/A Mutexes N/A IP Addresses N/A Domain Names storefronts[.]pl File Hashes 23b90b1c55fdbbd371655da0ccf359e891deb51ed5bbc
domaintmweb.ruutexes N/A IP Addresses 92.53.96[.]120 Domain Names cv42569.tmweb[.]ru File Hashes dddde27836842e0f950b5622e1be7a0f51072db573b2f
domaintranexestin.comN/A Mutexes N/A IP Addresses 212.129.14[.]211 Domain Names tranexestin[.]com File Hashes afc3ba4941b89a4467e2f1a4ab0df2c88ef5e39264182
sha25602481825e922c38ba797ebc18d5a8273ede8c5a4d52eecd2f58eb569533d780be273c4a8cc1cd7799d5558c58b8a08dfe160235dfa2eb2a8bad9bba40aa 02481825e922c38ba797ebc18d5a8273ede8c5a4d52eecd2f58eb569533d780b 06736e5f3127a54bbe6bb25f4a82ca95371e5cc8654a893c02d3d4e677e
sha25605c8de4b97737440913f5c714082ad647281fa50f1904b1bf11edb8560294facA Mutexes N/A IP Addresses N/A Domain Names N/A File Hashes 05C8DE4B97737440913F5C714082AD647281FA50F1904B1BF11EDB8560294FAC 07D9D6DA8C6CD162DD9FC78AC48EAF82BC49D4239908AF354E44C4822FE
sha25606736e5f3127a54bbe6bb25f4a82ca95371e5cc8654a893c02d3d4e677e0b916825e922c38ba797ebc18d5a8273ede8c5a4d52eecd2f58eb569533d780b 06736e5f3127a54bbe6bb25f4a82ca95371e5cc8654a893c02d3d4e677e0b916 21b039f3171f26911290dad3e1ce0da6d6d3545e11f9a119408922ac2ae
sha25607d9d6da8c6cd162dd9fc78ac48eaf82bc49d4239908af354e44c4822fe06d62E4B97737440913F5C714082AD647281FA50F1904B1BF11EDB8560294FAC 07D9D6DA8C6CD162DD9FC78AC48EAF82BC49D4239908AF354E44C4822FE06D62 099ADD24586D77C5F2B8EFB9C33A8A11B5A0C11001A8534D9635A674ADC
sha256099add24586d77c5f2b8efb9c33a8a11b5a0c11001a8534d9635a674adc260ad6DA8C6CD162DD9FC78AC48EAF82BC49D4239908AF354E44C4822FE06D62 099ADD24586D77C5F2B8EFB9C33A8A11B5A0C11001A8534D9635A674ADC260AD 0A155F4F20367E4D23B6D238208FA5F943A1341E47BDBB2DBC520CCB27A
sha2560a155f4f20367e4d23b6d238208fa5f943a1341e47bdbb2dbc520ccb27ad120bD24586D77C5F2B8EFB9C33A8A11B5A0C11001A8534D9635A674ADC260AD 0A155F4F20367E4D23B6D238208FA5F943A1341E47BDBB2DBC520CCB27AD120B 150420EDB4BF00DADCF71601781DBE3BD6E34CBA767153B9F82307EDDF3
sha256150420edb4bf00dadcf71601781dbe3bd6e34cba767153b9f82307eddf391395F4F20367E4D23B6D238208FA5F943A1341E47BDBB2DBC520CCB27AD120B 150420EDB4BF00DADCF71601781DBE3BD6E34CBA767153B9F82307EDDF391395 15F2BB3B4A12A6F5B0965FDE62AE21B2796D7659BBA8011FC22AF40D465
sha25615f2bb3b4a12a6f5b0965fde62ae21b2796d7659bba8011fc22af40d465984be0EDB4BF00DADCF71601781DBE3BD6E34CBA767153B9F82307EDDF391395 15F2BB3B4A12A6F5B0965FDE62AE21B2796D7659BBA8011FC22AF40D465984BE 318B2A4F06345E95C63E4623F52E0E7C57257548C74E0C7A272FCB64D3F
sha25621b039f3171f26911290dad3e1ce0da6d6d3545e11f9a119408922ac2ae06db6e5f3127a54bbe6bb25f4a82ca95371e5cc8654a893c02d3d4e677e0b916 21b039f3171f26911290dad3e1ce0da6d6d3545e11f9a119408922ac2ae06db6 2643f9f8dce45983eac80feeebd16adbd498e3a644ef8b05bc40448be93
sha25623b90b1c55fdbbd371655da0ccf359e891deb51ed5bbc0ac772c5d572f4b3a42IP Addresses N/A Domain Names storefronts[.]pl File Hashes 23b90b1c55fdbbd371655da0ccf359e891deb51ed5bbc0ac772c5d572f4b3a42 2471636a92daa0a54095aa66b55ad2fea5fd5d6372b0be9d65d1d1e2cef
sha2562471636a92daa0a54095aa66b55ad2fea5fd5d6372b0be9d65d1d1e2cef31bd5b1c55fdbbd371655da0ccf359e891deb51ed5bbc0ac772c5d572f4b3a42 2471636a92daa0a54095aa66b55ad2fea5fd5d6372b0be9d65d1d1e2cef31bd5 2b24221aabc8cd18e756a579b29a005fc9c33213f5ec963b9b6ccf4e618
sha2562643f9f8dce45983eac80feeebd16adbd498e3a644ef8b05bc40448be9342ddf9f3171f26911290dad3e1ce0da6d6d3545e11f9a119408922ac2ae06db6 2643f9f8dce45983eac80feeebd16adbd498e3a644ef8b05bc40448be9342ddf 2ac6b5487c69427476b48bcbbddd7646842e02363a0d4ebe1b1998da6d1
sha2562992c6ce7ccda6fef751a912eafb8a31e3426bde8964ccf31b0512390bd616155c529002b85ae756a9e7b7da7a538026583f0886a235cf48b72c378551a 2992c6ce7ccda6fef751a912eafb8a31e3426bde8964ccf31b0512390bd61615 Coverage Detection Screenshots AMP ThreatGrid Umbrella Win.
sha2562ac6b5487c69427476b48bcbbddd7646842e02363a0d4ebe1b1998da6d1f55a89f8dce45983eac80feeebd16adbd498e3a644ef8b05bc40448be9342ddf 2ac6b5487c69427476b48bcbbddd7646842e02363a0d4ebe1b1998da6d1f55a8 2dad87b69ee91bfa71d911b791e5468efb6ce689ccc4cde3e91626cbfcf
sha2562b24221aabc8cd18e756a579b29a005fc9c33213f5ec963b9b6ccf4e6187b23b36a92daa0a54095aa66b55ad2fea5fd5d6372b0be9d65d1d1e2cef31bd5 2b24221aabc8cd18e756a579b29a005fc9c33213f5ec963b9b6ccf4e6187b23b 4b781b8370f973b9204b44c8ce3615692fc66c1613967a44924984d35fb
sha2562dad87b69ee91bfa71d911b791e5468efb6ce689ccc4cde3e91626cbfcfc14ab5487c69427476b48bcbbddd7646842e02363a0d4ebe1b1998da6d1f55a8 2dad87b69ee91bfa71d911b791e5468efb6ce689ccc4cde3e91626cbfcfc14ab 2f4853b54c36adf9ca9fbb163dacedee78b6b027fac3c24c72120e9d8cc
sha2562f4853b54c36adf9ca9fbb163dacedee78b6b027fac3c24c72120e9d8cc6f01e7b69ee91bfa71d911b791e5468efb6ce689ccc4cde3e91626cbfcfc14ab 2f4853b54c36adf9ca9fbb163dacedee78b6b027fac3c24c72120e9d8cc6f01e Coverage Detection Screenshots AMP ThreatGrid Umbrella Malw
sha256318b2a4f06345e95c63e4623f52e0e7c57257548c74e0c7a272fcb64d3f49692B3B4A12A6F5B0965FDE62AE21B2796D7659BBA8011FC22AF40D465984BE 318B2A4F06345E95C63E4623F52E0E7C57257548C74E0C7A272FCB64D3F49692 4B0BB06E09ED0B2EDB085641E125490E9B1A6CC5652C05C77C78E47CF94
sha2563be7ab79f032cf24b09fc05b08544fd61ec7e3fd355f8ab7b4580eb43d8c3e556eff17da1c18ab3fed1692628756a8f41f3145877f895b7ef950055262f 3be7ab79f032cf24b09fc05b08544fd61ec7e3fd355f8ab7b4580eb43d8c3e55 ff6b7320d6b75a638c0f2d024f43853dd78993276a8f6b5f7463d631785
sha25640eddfac964b69ee2e26742faaacfe50960fa0232a1b9a11c382e61cecd700ff852ff1947fcd820b90e60ab71af93ffad079bd13a0d2b514955bb1c9d62 40eddfac964b69ee2e26742faaacfe50960fa0232a1b9a11c382e61cecd700ff 6106eda3ae39449fec42db2caf4f1b5f994d72b5a759dddfd77a8a29ebb
sha2564b0bb06e09ed0b2edb085641e125490e9b1a6cc5652c05c77c78e47cf9448d35A4F06345E95C63E4623F52E0E7C57257548C74E0C7A272FCB64D3F49692 4B0BB06E09ED0B2EDB085641E125490E9B1A6CC5652C05C77C78E47CF9448D35 507874BA705282183F928D3AE11ED5497A0F1EAC3368DE75C392D17749C
sha2564b781b8370f973b9204b44c8ce3615692fc66c1613967a44924984d35fba7bc421aabc8cd18e756a579b29a005fc9c33213f5ec963b9b6ccf4e6187b23b 4b781b8370f973b9204b44c8ce3615692fc66c1613967a44924984d35fba7bc4 4ee6b9bb8e903bed9a82c7dad6d62163e3a4f759ade5f5f8fcf899945bf
sha2564ee6b9bb8e903bed9a82c7dad6d62163e3a4f759ade5f5f8fcf899945bfd9264b8370f973b9204b44c8ce3615692fc66c1613967a44924984d35fba7bc4 4ee6b9bb8e903bed9a82c7dad6d62163e3a4f759ade5f5f8fcf899945bfd9264 564c37dcd8322bd6e8cabc788f982a35f7d3e335c3d736ce544fc17a6b0
sha256507874ba705282183f928d3ae11ed5497a0f1eac3368de75c392d17749cb8ee906E09ED0B2EDB085641E125490E9B1A6CC5652C05C77C78E47CF9448D35 507874BA705282183F928D3AE11ED5497A0F1EAC3368DE75C392D17749CB8EE9 55FDFC65C0C10A958239E0447E5696989FE66557437EB725849BB578D88
sha2565598fdcc6c0c2e7bdb095193a5f986e6cf22fdcca26c2e8451c46d787ef1843592ba6ce12d803ecfccd01432f855e6fd9ad19825602a74a081459e25389 5598fdcc6c0c2e7bdb095193a5f986e6cf22fdcca26c2e8451c46d787ef18435 Coverage Detection Screenshots AMP ThreatGrid Umbrella
sha25655fdfc65c0c10a958239e0447e5696989fe66557437eb725849bb578d882d74e4BA705282183F928D3AE11ED5497A0F1EAC3368DE75C392D17749CB8EE9 55FDFC65C0C10A958239E0447E5696989FE66557437EB725849BB578D882D74E 5D31C073C4B7322A7DE871D533D520DE2444466D0C944CB06F6244D2CE5
sha256564c37dcd8322bd6e8cabc788f982a35f7d3e335c3d736ce544fc17a6b0901839bb8e903bed9a82c7dad6d62163e3a4f759ade5f5f8fcf899945bfd9264 564c37dcd8322bd6e8cabc788f982a35f7d3e335c3d736ce544fc17a6b090183 59b54e7c4e052adbc1d64dc61623af6f55db1a8692b373cb6ca871ba087
sha25659b54e7c4e052adbc1d64dc61623af6f55db1a8692b373cb6ca871ba087feaac7dcd8322bd6e8cabc788f982a35f7d3e335c3d736ce544fc17a6b090183 59b54e7c4e052adbc1d64dc61623af6f55db1a8692b373cb6ca871ba087feaac 6930d456c506c94b9e19a08659181b7d376254dca652d0e56c305764867
sha2565d31c073c4b7322a7de871d533d520de2444466d0c944cb06f6244d2ce57d49dC65C0C10A958239E0447E5696989FE66557437EB725849BB578D882D74E 5D31C073C4B7322A7DE871D533D520DE2444466D0C944CB06F6244D2CE57D49D 6597E2DD82FC203BA2C609B358B2E0CAE37A4309808626DA27BD5861407
sha2566106eda3ae39449fec42db2caf4f1b5f994d72b5a759dddfd77a8a29ebb3f497fac964b69ee2e26742faaacfe50960fa0232a1b9a11c382e61cecd700ff 6106eda3ae39449fec42db2caf4f1b5f994d72b5a759dddfd77a8a29ebb3f497 c106435a2aced27d03ee5531eda025b14cec106106a1c7ca750127090f6
sha2566597e2dd82fc203ba2c609b358b2e0cae37a4309808626da27bd58614077d646073C4B7322A7DE871D533D520DE2444466D0C944CB06F6244D2CE57D49D 6597E2DD82FC203BA2C609B358B2E0CAE37A4309808626DA27BD58614077D646 6A23031FDD70C6D57D8FE9C8D3EFE6A423C38BF2D46B9B24959E5CA7D07
sha2566930d456c506c94b9e19a08659181b7d376254dca652d0e56c305764867578d2e7c4e052adbc1d64dc61623af6f55db1a8692b373cb6ca871ba087feaac 6930d456c506c94b9e19a08659181b7d376254dca652d0e56c305764867578d2 6a0eae0addd6ce84966ac1bd006e9582036eaaa1011a38190f700871cc3
sha2566a0eae0addd6ce84966ac1bd006e9582036eaaa1011a38190f700871cc37de24456c506c94b9e19a08659181b7d376254dca652d0e56c305764867578d2 6a0eae0addd6ce84966ac1bd006e9582036eaaa1011a38190f700871cc37de24 7045d8f339cab73cf0ec7f31a7b3a31a84057f0b275f789f4bfed9dffee
sha2566a23031fdd70c6d57d8fe9c8d3efe6a423c38bf2d46b9b24959e5ca7d0714fca2DD82FC203BA2C609B358B2E0CAE37A4309808626DA27BD58614077D646 6A23031FDD70C6D57D8FE9C8D3EFE6A423C38BF2D46B9B24959E5CA7D0714FCA 6C652B0E4998456F150515EBF50CA569CF373BA709442F6909DD7D4330C
sha2566c652b0e4998456f150515ebf50ca569cf373ba709442f6909dd7d4330c83d2e31FDD70C6D57D8FE9C8D3EFE6A423C38BF2D46B9B24959E5CA7D0714FCA 6C652B0E4998456F150515EBF50CA569CF373BA709442F6909DD7D4330C83D2E 6EB12C46F0605D8F915C8E895FC70D189D9E8825775EBDB464A9A248348
sha2566d4fa878e2930cb3bedc2078855f6d7db7b6b136464f6dff256d8c62657b505fffa38e3f9d30833d201b542422aed15a41253b2a72797ad38dfba8fe535 6d4fa878e2930cb3bedc2078855f6d7db7b6b136464f6dff256d8c62657b505f 8ad1c1655d6d3b2a4931ae2dd9eb4e3b7be488a7f39b9c396fe1eeda2ed
sha2566eb12c46f0605d8f915c8e895fc70d189d9e8825775ebdb464a9a24834887e60B0E4998456F150515EBF50CA569CF373BA709442F6909DD7D4330C83D2E 6EB12C46F0605D8F915C8E895FC70D189D9E8825775EBDB464A9A24834887E60 776B2679819B1E0385E1630EEEC50190DAAAEC0EEF9F659EE728C47991F
sha2567045d8f339cab73cf0ec7f31a7b3a31a84057f0b275f789f4bfed9dffee35564e0addd6ce84966ac1bd006e9582036eaaa1011a38190f700871cc37de24 7045d8f339cab73cf0ec7f31a7b3a31a84057f0b275f789f4bfed9dffee35564 7638745d08de218fa16e9c0828ed0a1139223d3ebddf4bb528bc3ae185c
sha2567638745d08de218fa16e9c0828ed0a1139223d3ebddf4bb528bc3ae185cea90e8f339cab73cf0ec7f31a7b3a31a84057f0b275f789f4bfed9dffee35564 7638745d08de218fa16e9c0828ed0a1139223d3ebddf4bb528bc3ae185cea90e 81cdded9aa21513ad9c6ae04455a7fce68129135f3358b9c5e28a80139e
sha256776b2679819b1e0385e1630eeec50190daaaec0eef9f659ee728c47991fabfbbC46F0605D8F915C8E895FC70D189D9E8825775EBDB464A9A24834887E60 776B2679819B1E0385E1630EEEC50190DAAAEC0EEF9F659EE728C47991FABFBB 77FA104262E3FF983B3418540FF744E0EAAE5E66388333ED785EF6F5AA2
sha25677fa104262e3ff983b3418540ff744e0eaae5e66388333ed785ef6f5aa2801f9679819B1E0385E1630EEEC50190DAAAEC0EEF9F659EE728C47991FABFBB 77FA104262E3FF983B3418540FF744E0EAAE5E66388333ED785EF6F5AA2801F9 7D6765A1F6589A554457D9363F702F65E81DDDA52EB62C600250E0F94C4
sha2567d6765a1f6589a554457d9363f702f65e81ddda52eb62c600250e0f94c473a1604262E3FF983B3418540FF744E0EAAE5E66388333ED785EF6F5AA2801F9 7D6765A1F6589A554457D9363F702F65E81DDDA52EB62C600250E0F94C473A16 8590486CD299DAA9BF42497EF28028364E4E18B6C60B725736A7D2DDC73
sha25681cdded9aa21513ad9c6ae04455a7fce68129135f3358b9c5e28a80139e78f2145d08de218fa16e9c0828ed0a1139223d3ebddf4bb528bc3ae185cea90e 81cdded9aa21513ad9c6ae04455a7fce68129135f3358b9c5e28a80139e78f21 93472e054b4b4fcc54a71a32b6275f8b35c8ef84490248d21c094f19a53
sha2568590486cd299daa9bf42497ef28028364e4e18b6c60b725736a7d2ddc73bbc2f5A1F6589A554457D9363F702F65E81DDDA52EB62C600250E0F94C473A16 8590486CD299DAA9BF42497EF28028364E4E18B6C60B725736A7D2DDC73BBC2F 92EABA06563800BA670249E90D91C32F9D315889439BCAA73F24D2C08E2
sha2568ad1c1655d6d3b2a4931ae2dd9eb4e3b7be488a7f39b9c396fe1eeda2eda05a7878e2930cb3bedc2078855f6d7db7b6b136464f6dff256d8c62657b505f 8ad1c1655d6d3b2a4931ae2dd9eb4e3b7be488a7f39b9c396fe1eeda2eda05a7 c0e8a92ba6ce12d803ecfccd01432f855e6fd9ad19825602a74a081459e
sha2568d4366eff17da1c18ab3fed1692628756a8f41f3145877f895b7ef950055262f35a2aced27d03ee5531eda025b14cec106106a1c7ca750127090f6d2039 8d4366eff17da1c18ab3fed1692628756a8f41f3145877f895b7ef950055262f 3be7ab79f032cf24b09fc05b08544fd61ec7e3fd355f8ab7b4580eb43d8
sha25692eaba06563800ba670249e90d91c32f9d315889439bcaa73f24d2c08e285b8486CD299DAA9BF42497EF28028364E4E18B6C60B725736A7D2DDC73BBC2F 92EABA06563800BA670249E90D91C32F9D315889439BCAA73F24D2C08E285B84 Coverage Detection Screenshots AMP ThreatGrid Win.Trojan.Se
sha256932d8d5829570237e9ab7688dd2d3c03812a05157f72af124cabf530be5837893d273f606860bee0dd4a878a6421233b05ac4c6faf357d9324f0d6a575a 932d8d5829570237e9ab7688dd2d3c03812a05157f72af124cabf530be583789 ba07a79a2f4d51eaac585b0f50e3b1e61d8fc555592aadb1e5d3916fb26
sha25693472e054b4b4fcc54a71a32b6275f8b35c8ef84490248d21c094f19a537c773ed9aa21513ad9c6ae04455a7fce68129135f3358b9c5e28a80139e78f21 93472e054b4b4fcc54a71a32b6275f8b35c8ef84490248d21c094f19a537c773 a0bfeb90468ddf50a3c85d5074e002b1d89995d6377eceeb0781ba5292f
sha25697cd05c529002b85ae756a9e7b7da7a538026583f0886a235cf48b72c378551af745c35b2abe58675e546b475ed64f15ea6e9d4492a0502476f784ea85c 97cd05c529002b85ae756a9e7b7da7a538026583f0886a235cf48b72c378551a 2992c6ce7ccda6fef751a912eafb8a31e3426bde8964ccf31b0512390bd
sha256a0bfeb90468ddf50a3c85d5074e002b1d89995d6377eceeb0781ba5292facbcce054b4b4fcc54a71a32b6275f8b35c8ef84490248d21c094f19a537c773 a0bfeb90468ddf50a3c85d5074e002b1d89995d6377eceeb0781ba5292facbcc b3dfdfcfea160ed34eb69da55909294f78d2b5a6320cbf5151a3da01c64
sha256afc3ba4941b89a4467e2f1a4ab0df2c88ef5e39264182a4b3a2dbbfa5b022e3f212.129.14[.]211 Domain Names tranexestin[.]com File Hashes afc3ba4941b89a4467e2f1a4ab0df2c88ef5e39264182a4b3a2dbbfa5b022e3f Coverage Detection Screenshots AMP ThreatGrid Umbrella Win.
sha256b3dfdfcfea160ed34eb69da55909294f78d2b5a6320cbf5151a3da01c6449631b90468ddf50a3c85d5074e002b1d89995d6377eceeb0781ba5292facbcc b3dfdfcfea160ed34eb69da55909294f78d2b5a6320cbf5151a3da01c6449631 c185559d0a38e782167beacff78a7a72544d82890b5e5723e6a25a70e6e
sha256ba07a79a2f4d51eaac585b0f50e3b1e61d8fc555592aadb1e5d3916fb26b0e27d5829570237e9ab7688dd2d3c03812a05157f72af124cabf530be583789 ba07a79a2f4d51eaac585b0f50e3b1e61d8fc555592aadb1e5d3916fb26b0e27 Coverage Detection Screenshots AMP ThreatGrid Umbrella Win.
sha256c0e8a92ba6ce12d803ecfccd01432f855e6fd9ad19825602a74a081459e253891655d6d3b2a4931ae2dd9eb4e3b7be488a7f39b9c396fe1eeda2eda05a7 c0e8a92ba6ce12d803ecfccd01432f855e6fd9ad19825602a74a081459e25389 5598fdcc6c0c2e7bdb095193a5f986e6cf22fdcca26c2e8451c46d787ef
sha256c106435a2aced27d03ee5531eda025b14cec106106a1c7ca750127090f6d2039da3ae39449fec42db2caf4f1b5f994d72b5a759dddfd77a8a29ebb3f497 c106435a2aced27d03ee5531eda025b14cec106106a1c7ca750127090f6d2039 8d4366eff17da1c18ab3fed1692628756a8f41f3145877f895b7ef95005
sha256c185559d0a38e782167beacff78a7a72544d82890b5e5723e6a25a70e6e16d59fcfea160ed34eb69da55909294f78d2b5a6320cbf5151a3da01c6449631 c185559d0a38e782167beacff78a7a72544d82890b5e5723e6a25a70e6e16d59 d2c1b89129e3e26544bfbef3fac4567c3629817a98ded9ce5c7dee485d0
sha256c9a193d273f606860bee0dd4a878a6421233b05ac4c6faf357d9324f0d6a575a320d6b75a638c0f2d024f43853dd78993276a8f6b5f7463d6317858dd9c c9a193d273f606860bee0dd4a878a6421233b05ac4c6faf357d9324f0d6a575a 932d8d5829570237e9ab7688dd2d3c03812a05157f72af124cabf530be5
sha256d2c1b89129e3e26544bfbef3fac4567c3629817a98ded9ce5c7dee485d0364a959d0a38e782167beacff78a7a72544d82890b5e5723e6a25a70e6e16d59 d2c1b89129e3e26544bfbef3fac4567c3629817a98ded9ce5c7dee485d0364a9 f2e4fe273c4a8cc1cd7799d5558c58b8a08dfe160235dfa2eb2a8bad9bb
sha256dc086f745c35b2abe58675e546b475ed64f15ea6e9d4492a0502476f784ea85c27836842e0f950b5622e1be7a0f51072db573b2f2e41d20d4b4c45028d8 dc086f745c35b2abe58675e546b475ed64f15ea6e9d4492a0502476f784ea85c 97cd05c529002b85ae756a9e7b7da7a538026583f0886a235cf48b72c37
sha256dda1fffa38e3f9d30833d201b542422aed15a41253b2a72797ad38dfba8fe535dc382f6988599cb16894d8a9a92e291d83574834de705d6367b520b6b50 dda1fffa38e3f9d30833d201b542422aed15a41253b2a72797ad38dfba8fe535 6d4fa878e2930cb3bedc2078855f6d7db7b6b136464f6dff256d8c62657
sha256dddde27836842e0f950b5622e1be7a0f51072db573b2f2e41d20d4b4c45028d892.53.96[.]120 Domain Names cv42569.tmweb[.]ru File Hashes dddde27836842e0f950b5622e1be7a0f51072db573b2f2e41d20d4b4c45028d8 dc086f745c35b2abe58675e546b475ed64f15ea6e9d4492a0502476f784
sha256f2e4fe273c4a8cc1cd7799d5558c58b8a08dfe160235dfa2eb2a8bad9bba40aa89129e3e26544bfbef3fac4567c3629817a98ded9ce5c7dee485d0364a9 f2e4fe273c4a8cc1cd7799d5558c58b8a08dfe160235dfa2eb2a8bad9bba40aa 02481825e922c38ba797ebc18d5a8273ede8c5a4d52eecd2f58eb569533
sha256f566fdc382f6988599cb16894d8a9a92e291d83574834de705d6367b520b6b50IP Addresses 188.165.220[.]214 Domain Names N/A File Hashes f566fdc382f6988599cb16894d8a9a92e291d83574834de705d6367b520b6b50 dda1fffa38e3f9d30833d201b542422aed15a41253b2a72797ad38dfba8
sha256fbbc6852ff1947fcd820b90e60ab71af93ffad079bd13a0d2b514955bb1c9d62s[.]com wrop0422.codns[.]com ansbase.9966[.]org File Hashes fbbc6852ff1947fcd820b90e60ab71af93ffad079bd13a0d2b514955bb1c9d62 40eddfac964b69ee2e26742faaacfe50960fa0232a1b9a11c382e61cecd
sha256ff6b7320d6b75a638c0f2d024f43853dd78993276a8f6b5f7463d6317858dd9cb79f032cf24b09fc05b08544fd61ec7e3fd355f8ab7b4580eb43d8c3e55 ff6b7320d6b75a638c0f2d024f43853dd78993276a8f6b5f7463d6317858dd9c c9a193d273f606860bee0dd4a878a6421233b05ac4c6faf357d9324f0d6
Full article706 words · extracted from blog.talosintelligence.com · click to collapse

Friday, April 28, 2017 16:36

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 21 and April 28. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

  • Doc.Macro.MaliciousHeuristic-6298845-0
    Office Macro
    Office macro code is used to further compromise a target system. Macros can leverage external system binaries to execute other binaries to further compromise the system. This signature looks for code associated with hiding the core functionality by including junk code.
  • Win.Dropper.DarkComet-6301230-0
    Trojan/RAT dropper
    This is a malware dropper. It currently drops the DarkComet RAT. The file is a slightly modified version of wextract.exe, a legitimate Windows tool to unpack archives. The malware payload is stored in the resource section of the binary. The dropper binary is actually a multi-format file, and can be interpreted both as a PE executable as well as a cab archive. The modified Windows binary will extract the payload binary from itself and run the extracted file.
  • Win.Trojan.ServStart
    Trojan
    ServStart is a trojan that installs a persistent service on the victim’s machine. The service exfiltrates information about the infected computer including machine name, username, keyboard language, and computer performance specifications. The malware server can respond with commands to download and execute files, or execute shell commands. ServStart has been observed using multiple dynamic DNS providers for its command and control infrastructure.
  • Win.Trojan.Agent-6298180-0
    Trojan (credential stealer)
    This sample attempts to collect stored credentials from a number of installed applications and then attempts to transmit those credentials back to a PHP application on a possibly compromised server.
  • Win.Trojan.PWS-6299789-0
    Password stealer, injector
    PWS (also known as Fareit or Chisburg) is a credential & sensitive information harvester. Select information such as banking credentials or web browser password databases are queried for on the infected host. Any discovered data is propagated to a C2. These recent samples are protected with the Armadillo packer & rely on both code injections & dropped VBScript code.
  • Win.Dropper.Emotet-6301061-0
    Dropper
    This dropper is delivered through different mechanism, most of the time the victims is redirected to a website to get it through malicious pdf, http iframe injected. Once running on the computer the binary is gathering details on volume disk drive and other details, injecting process, dropping itself and contacting internet to execute more. Websites observed delivering ransomware and trojan banker.

Threats

Doc.Macro.MaliciousHeuristic-6298845-0

Indicators of Compromise Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • storefronts[.]pl File Hashes
  • 23b90b1c55fdbbd371655da0ccf359e891deb51ed5bbc0ac772c5d572f4b3a42
  • 2471636a92daa0a54095aa66b55ad2fea5fd5d6372b0be9d65d1d1e2cef31bd5
  • 2b24221aabc8cd18e756a579b29a005fc9c33213f5ec963b9b6ccf4e6187b23b
  • 4b781b8370f973b9204b44c8ce3615692fc66c1613967a44924984d35fba7bc4
  • 4ee6b9bb8e903bed9a82c7dad6d62163e3a4f759ade5f5f8fcf899945bfd9264
  • 564c37dcd8322bd6e8cabc788f982a35f7d3e335c3d736ce544fc17a6b090183
  • 59b54e7c4e052adbc1d64dc61623af6f55db1a8692b373cb6ca871ba087feaac
  • 6930d456c506c94b9e19a08659181b7d376254dca652d0e56c305764867578d2
  • 6a0eae0addd6ce84966ac1bd006e9582036eaaa1011a38190f700871cc37de24
  • 7045d8f339cab73cf0ec7f31a7b3a31a84057f0b275f789f4bfed9dffee35564
  • 7638745d08de218fa16e9c0828ed0a1139223d3ebddf4bb528bc3ae185cea90e
  • 81cdded9aa21513ad9c6ae04455a7fce68129135f3358b9c5e28a80139e78f21
  • 93472e054b4b4fcc54a71a32b6275f8b35c8ef84490248d21c094f19a537c773
  • a0bfeb90468ddf50a3c85d5074e002b1d89995d6377eceeb0781ba5292facbcc
  • b3dfdfcfea160ed34eb69da55909294f78d2b5a6320cbf5151a3da01c6449631
  • c185559d0a38e782167beacff78a7a72544d82890b5e5723e6a25a70e6e16d59
  • d2c1b89129e3e26544bfbef3fac4567c3629817a98ded9ce5c7dee485d0364a9
  • f2e4fe273c4a8cc1cd7799d5558c58b8a08dfe160235dfa2eb2a8bad9bba40aa
  • 02481825e922c38ba797ebc18d5a8273ede8c5a4d52eecd2f58eb569533d780b
  • 06736e5f3127a54bbe6bb25f4a82ca95371e5cc8654a893c02d3d4e677e0b916
  • 21b039f3171f26911290dad3e1ce0da6d6d3545e11f9a119408922ac2ae06db6
  • 2643f9f8dce45983eac80feeebd16adbd498e3a644ef8b05bc40448be9342ddf
  • 2ac6b5487c69427476b48bcbbddd7646842e02363a0d4ebe1b1998da6d1f55a8
  • 2dad87b69ee91bfa71d911b791e5468efb6ce689ccc4cde3e91626cbfcfc14ab
  • 2f4853b54c36adf9ca9fbb163dacedee78b6b027fac3c24c72120e9d8cc6f01e

Coverage

Detection Screenshots AMP

ThreatGrid

Umbrella

Malware

Win.Dropper.DarkComet-6301230-0

Indicators of Compromise Registry Keys

  • N/A  Mutexes
  • N/A  IP Addresses
  • N/A  Domain Names
  • N/A  File Hashes
  • 05C8DE4B97737440913F5C714082AD647281FA50F1904B1BF11EDB8560294FAC
  • 07D9D6DA8C6CD162DD9FC78AC48EAF82BC49D4239908AF354E44C4822FE06D62
  • 099ADD24586D77C5F2B8EFB9C33A8A11B5A0C11001A8534D9635A674ADC260AD
  • 0A155F4F20367E4D23B6D238208FA5F943A1341E47BDBB2DBC520CCB27AD120B
  • 150420EDB4BF00DADCF71601781DBE3BD6E34CBA767153B9F82307EDDF391395
  • 15F2BB3B4A12A6F5B0965FDE62AE21B2796D7659BBA8011FC22AF40D465984BE
  • 318B2A4F06345E95C63E4623F52E0E7C57257548C74E0C7A272FCB64D3F49692
  • 4B0BB06E09ED0B2EDB085641E125490E9B1A6CC5652C05C77C78E47CF9448D35
  • 507874BA705282183F928D3AE11ED5497A0F1EAC3368DE75C392D17749CB8EE9
  • 55FDFC65C0C10A958239E0447E5696989FE66557437EB725849BB578D882D74E
  • 5D31C073C4B7322A7DE871D533D520DE2444466D0C944CB06F6244D2CE57D49D
  • 6597E2DD82FC203BA2C609B358B2E0CAE37A4309808626DA27BD58614077D646
  • 6A23031FDD70C6D57D8FE9C8D3EFE6A423C38BF2D46B9B24959E5CA7D0714FCA
  • 6C652B0E4998456F150515EBF50CA569CF373BA709442F6909DD7D4330C83D2E
  • 6EB12C46F0605D8F915C8E895FC70D189D9E8825775EBDB464A9A24834887E60
  • 776B2679819B1E0385E1630EEEC50190DAAAEC0EEF9F659EE728C47991FABFBB
  • 77FA104262E3FF983B3418540FF744E0EAAE5E66388333ED785EF6F5AA2801F9
  • 7D6765A1F6589A554457D9363F702F65E81DDDA52EB62C600250E0F94C473A16
  • 8590486CD299DAA9BF42497EF28028364E4E18B6C60B725736A7D2DDC73BBC2F
  • 92EABA06563800BA670249E90D91C32F9D315889439BCAA73F24D2C08E285B84

Coverage

Detection Screenshots
AMP

ThreatGrid

Win.Trojan.ServStart

Indicators of Compromise Registry Keys

  • HKLM\SYSTEM\CONTROLSET001\SERVICES\NATIONALLWC\Description
    "Providesufl a domain server for NI security." Mutexes
  • Nationallwc IP Addresses
  • N/A Domain Names
  • syhaw1516.codns[.]com
  • wrop0422.codns[.]com
  • ansbase.9966[.]org File Hashes
  • fbbc6852ff1947fcd820b90e60ab71af93ffad079bd13a0d2b514955bb1c9d62
  • 40eddfac964b69ee2e26742faaacfe50960fa0232a1b9a11c382e61cecd700ff
  • 6106eda3ae39449fec42db2caf4f1b5f994d72b5a759dddfd77a8a29ebb3f497
  • c106435a2aced27d03ee5531eda025b14cec106106a1c7ca750127090f6d2039
  • 8d4366eff17da1c18ab3fed1692628756a8f41f3145877f895b7ef950055262f
  • 3be7ab79f032cf24b09fc05b08544fd61ec7e3fd355f8ab7b4580eb43d8c3e55
  • ff6b7320d6b75a638c0f2d024f43853dd78993276a8f6b5f7463d6317858dd9c
  • c9a193d273f606860bee0dd4a878a6421233b05ac4c6faf357d9324f0d6a575a
  • 932d8d5829570237e9ab7688dd2d3c03812a05157f72af124cabf530be583789
  • ba07a79a2f4d51eaac585b0f50e3b1e61d8fc555592aadb1e5d3916fb26b0e27

Coverage

Detection Screenshots AMP

ThreatGrid

Umbrella

Win.Trojan.Agent-6298180-0

Indicators of Compromise Registry Keys

  • N/A Mutexes
  • N/AIP Addresses
  • 212.129.14[.]211 Domain Names
  • tranexestin[.]com File Hashes
  • afc3ba4941b89a4467e2f1a4ab0df2c88ef5e39264182a4b3a2dbbfa5b022e3f

Coverage

Detection Screenshots AMP

ThreatGrid

Umbrella

Win.Trojan.PWS-6299789-0

Indicators of Compromise Registry Keys

  • USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • \MACHINE\Software\Wow6432Node\Microsoft\Tracing
  • \MACHINE\Software\Wow6432Node\Microsoft\Tracing\tmpVtFw4a_RASMANCS
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\Software\Microsoft\Visual Basic\6.0
  • \MACHINE\Software\Wow6432Node\Microsoft\Tracing\tmpVtFw4a_RASAPI32
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\Software
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History
  • MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\Visual Basic
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2 Mutexes
  • N/A IP Addresses
  • 92.53.96[.]120 Domain Names
  • cv42569.tmweb[.]ru File Hashes
  • dddde27836842e0f950b5622e1be7a0f51072db573b2f2e41d20d4b4c45028d8
  • dc086f745c35b2abe58675e546b475ed64f15ea6e9d4492a0502476f784ea85c
  • 97cd05c529002b85ae756a9e7b7da7a538026583f0886a235cf48b72c378551a
  • 2992c6ce7ccda6fef751a912eafb8a31e3426bde8964ccf31b0512390bd61615

Coverage

Detection Screenshots AMP

ThreatGrid

Umbrella

Win.Dropper.Emotet-6301061-0

Indicators of Compromise Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • 188.165.220[.]214 Domain Names
  • N/A File Hashes
  • f566fdc382f6988599cb16894d8a9a92e291d83574834de705d6367b520b6b50
  • dda1fffa38e3f9d30833d201b542422aed15a41253b2a72797ad38dfba8fe535
  • 6d4fa878e2930cb3bedc2078855f6d7db7b6b136464f6dff256d8c62657b505f
  • 8ad1c1655d6d3b2a4931ae2dd9eb4e3b7be488a7f39b9c396fe1eeda2eda05a7
  • c0e8a92ba6ce12d803ecfccd01432f855e6fd9ad19825602a74a081459e25389
  • 5598fdcc6c0c2e7bdb095193a5f986e6cf22fdcca26c2e8451c46d787ef18435

Coverage

Detection Screenshots AMP

ThreatGrid

Umbrella

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0421-0428/