Cisco Talospublished Oct 26, 19:25 UTC (Oct 26, 2018)ingested Sep 10, 06:19 UTC

Threat Roundup for October 19 to October 26

highRansomwareimportance 57

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article1,047 words · extracted from blog.talosintelligence.com · click to collapse

Friday, October 26, 2018 15:25

Today, Talos is is publishing a glimpse into the most prevalent threats we've observed between Oct. 19 and Oct. 26. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

You can find an additional JSON file here that includes the IOCs in this post, as well as all hashes associated with the cluster. That list is limited to 25 hashes in this blog post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

The most prevalent threats highlighted in this roundup are:

Win.Virus.Sality-6727001-0
Virus
Sality is a file infector that establishes a peer-to-peer botnet. Although it's been prevalent for more than a decade, we continue to see new samples that require marginal attention in order to remain consistent with detection. Once a Sality client bypasses perimeter security, its goal is to execute a downloader component capable of executing additional malware.
Win.Malware.Nymaim-6726894-0
Malware
Nymaim is malware that can be used to deliver ransomware and other malicious payloads. It uses a domain generation algorithm to generate potential command and control (C2) domains to connect to additional payloads.
Win.Malware.Xcnfe-6725509-0
Malware
This cluster provides generic detection for the Dridex banking trojan that's downloaded onto a target's machine.
Doc.Dropper.Stratos-6724145-0
Dropper
This is an obfuscated Microsoft Office macro downloader that attempts to download a malicious payload executable. The sample was unable to download the next stage, so no further analysis is available.
Win.Downloader.Upatre-6726679-0
Downloader
Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.
Win.Malware.Cerber-6725830-0
Malware
Cerber is ransomware that encrypts documents, photos, databases and other important files using the file extension ".cerber."
Doc.Malware.00536d-6731394-0
Malware
Doc.Malware.00536d-6731394-0 is a malicious Word document that drops malware. It attempts to download and run a second-stage executable from a number of known malicious domains and IP addresses.

Threats

Win.Virus.Sality-6727001-0

Indicators of Compromise
Registry Keys

N/AMutexes
uxJLpe1m
\BaseNamedObjects\uxJLpe1m IP Addresses contacted by malware. Does not indicate maliciousness
206[.]189[.]61[.]126
195[.]38[.]137[.]100
213[.]202[.]229[.]103
217[.]74[.]65[.]23
199[.]59[.]242[.]151 Domain Names contacted by malware. Does not indicate maliciousness
dewpoint-eg[.]com
suewyllie[.]com
724hizmetgrup[.]com
www[.]ceylanogullari[.]com
cevatpasa[.]com Files and or directories created
%SystemDrive%\autorun.inf
%System16%.ini
%LocalAppData%\Temp\ose00000.exe
%SystemDrive%\Documents and Settings\Administrator\Cookies\administrator@dewpoint-eg[1].txt
%SystemDrive%\Documents and Settings\Administrator\Cookies\administrator@dewpoint-eg[2].txt
%SystemDrive%\Documents and Settings\Administrator\Cookies\[email protected][1].txt
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kokfo.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ogtfa.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plkvrx.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qwet.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vfhqbt.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wdieh.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winauey.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winbmfbc.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winehogdk.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wineplbg.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winfeas.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wingwtgg.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winhsgjxg.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winiiff.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlamr.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winmucoe.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winoyjfrn.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winqvpnb.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winskeoqt.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wintilmn.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwlbet.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winwnwhq.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winybmal.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wooydt.exe
%LocalAppData%\Temp\jlwdt.exe
%LocalAppData%\Temp\ssink.exe
%LocalAppData%\Temp\ukpvl.exe
%LocalAppData%\Temp\winlobd.exe
%LocalAppData%\Temp\winmjeu.exe
%LocalAppData%\Temp\wintqpup.exe
%AppData%\Microsoft\Windows\Cookies\XTNNC6UJ.txt
%LocalAppData%\Temp\winlobd.exe
\sgfdr.pif
\vqwf.exe File Hashes
007474f524c04bcfef7bff656f7d673e22496caff0490a111596b5c1a60b61ef
0abf15a831537bd86b7e16ae5032a4813c6e9e9df4f1da7c074c4daa3672c3dd
0e82ae0199228f54e8308755024fa78e0a568f1423cec3cf21d9341a7c99dcb9
18a859dee990feefdcc6196052c1d2becba64fb43d07623e1e573b0f39e63095
18bce4611a9668a2660b0471459cd070361c85d71a4989c1bc967fe04bc54795
2642e382a6a216b518471ac182891b6973a4f4eb569ad4d13cb02b8a840d3f07
5b4c4e796a0e1c9344c3165af210d2b9edd2980de25bfec656bc918809b0be4c
689bdd8a91c2bfaa00de235933b38ca9477ea9aa2eaa880cba50235641376add
865e10fa2439380d7048a0ec2eebdef487f706239e464c47dadf930b22028b11
905e701032eaaa944ccb70d3db97a200d85befefe7faf99d525c9767e5c5d615
a2ca43843f5c03adbdb03b91e4cafc162781d8c7e707c7bc161b03f4163218e2
ad68745733f455935188c0100aaf057bf1d3454a24e0be0ffff262d2318f6265
b535ea6cc31dd9f8a66fbbedb61ed021520ff74f5b42f815eb84022cfb3e4435
c38b955f4a4eee3cca1c1bf1ae0f915f75080772c4ae597c2ed76649a056a5dc
c40d8c58cc63dc606a9fa854f1774d7f17546170fdfc2679c3b8f6387fa4be6d
c5fb97f7e577795bdc7a6076efca8f09e83bd4fb9e68c40916c6784040dbb485
d0381f5c52b605b7b43c8b9dce2341b622ed2528df6bd65d527104f3fc1f2f16
da77ddf6e01c4cb2694f055a5c69f48bf6546b6831f145297a5cfbb5f64c5563
f001f25a35fb04298750c58f37ca4158085c454d784778f9a9c601d9bbbf6b40
f0d47851346c738dd836fb6f43005a57305f04e078d07af3a6d84ee586dfdfc0

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Nymaim-6726894-0

Indicators of Compromise
Registry Keys

<HKCR>\LOCAL SETTINGS\MUICACHE\3E\52C64B7E
Value Name: LanguageList
<HKCU>\Software\Microsoft\GOCFK
<HKCU>\Software\Microsoft\KPQL Mutexes
N/A IP Addresses contacted by malware. Does not indicate maliciousness
N/A Domain Names contacted by malware. Does not indicate maliciousness
IOCXRQNM[.]COM
ZJGGMKGGA[.]COM
YEFHBEVI[.]PW
DCORFRLWW[.]NET
kercnnlwtg[.]in
JYWVEW[.]PW
ZQQSUQRPEJK[.]IN
xhphblba[.]pw
FSHAJK[.]COM
maffuwnln[.]net
RQMNLOKS[.]COM
MRHNDJI[.]IN
hbdfmtj[.]pw
GZKISDVBZQFE[.]IN
efntvrhq[.]net
QGWKUGNMSJF[.]PW
MAFFUWNLN[.]NET
dcorfrlww[.]net
NWAFZV[.]IN
usrhd[.]com
HBDFMTJ[.]PW
fshajk[.]com
QCNRQ[.]NET
iocxrqnm[.]com
firohrakais[.]in
nizrjl[.]in
vnouya[.]in
EFNTVRHQ[.]NET
zqqsuqrpejk[.]in
srdhfsdiju[.]com
gzkisdvbzqfe[.]in
OHMAQTXG[.]IN
jywvew[.]pw
jpltxxpcojo[.]in
MNEZKYAK[.]NET
euqsvd[.]net
jtcesxohkgm[.]net
JPLTXXPCOJO[.]IN
QMNMG[.]NET
swvpzwktpdxs[.]net
dzwuczn[.]net
bsedcx[.]pw
KERCNNLWTG[.]IN
FIROHRAKAIS[.]IN
myxnowb[.]com
jhfahntxtnus[.]in
JTCESXOHKGM[.]NET
XHPHBLBA[.]PW
zjggmkgga[.]com
iknvjbze[.]in
QGMBJF[.]IN
EUQSVD[.]NET
NIZRJL[.]IN
rwxryhij[.]net
qmnmg[.]net
nwafzv[.]in
USRHD[.]COM
mrhndji[.]in
IKNVJBZE[.]IN
ohmaqtxg[.]in
cprdqjxpp[.]net
SRDHFSDIJU[.]COM
yefhbevi[.]pw
VNOUYA[.]IN
LNTBF[.]COM
DZWUCZN[.]NET
cmmwoqknklxn[.]com
rqmnloks[.]com
mnezkyak[.]net
BSEDCX[.]PW
MYXNOWB[.]COM
qgwkugnmsjf[.]pw
RWXRYHIJ[.]NET
qcnrq[.]net
CPRDQJXPP[.]NET
qgmbjf[.]in
lntbf[.]com
JHFAHNTXTNUS[.]IN Files and or directories created
%AllUsersProfile%\ph
%AllUsersProfile%\ph\eqdw.dbc
%LocalAppData%\Temp\gocf.ksv
%LocalAppData%\Temp\kpqlnn.iuy
%AllUsersProfile%\ph\fktiipx.ftf
%LocalAppData%\Temp\gocf.ksv File Hashes
00570d9bd558b25ac628d4de140897954e3cc1ed3dae8818e3ef580544626e8f
006e51c87642cb26a7d6fb534d37c1d4c4d015934e67284e8e35053b0da8971c
007b40dab88434b29a0c3b92cca04cb13d9f1ddb29202770a2f657becfc939d2
01e202a72e6bf3954e98acf6c4cd8fe660de710e129cd9de425e1e5dcc876232
01fc65a13f2f8f6033e55f860b835361442dfd0ec1443c134b2a6558964a2a2d
0340d472ea1bf41f75e1cf94fc499ca3960518d5dc9fe8cc85f6f56a955ad702
03d97452886804d0bc32e0723b4024d91cc1a64357a74b529452ca007f1b07d4
0491517063ca33e47b325ba2c304f4c8fc3b45956b1bfdff0555936a3bb3678f
064173410c2ca5781a785fccc9457fdd59b25ba2c14aca5bee71f83f136c279d
0679f7d954654a74c02dca0754cffacdce6d4c7887f4976c85b6148033b9942d
06f001ddf5d2c3827b6f28936b2939f16df62745699551a155572433827ec381
07814f096bd2a889317ac70e66cadfe443df1ad96ed2b6452d4252d11d60c8b3
088dce2464cfa134fd0317a2e75f0057de8d60b547d72e66fc1926e9ad355074
08b4430a48bdebc89092cb4f90ad407e51002098a0eeb08574f92a8327e5a140
09007a9eedbb6b7116add49671499f238301ccd3fa763904512517d003cd3625
0d42e7f0984ea9b0be200420bd7221a92c76466c85ded7321cb69a8386db17ff
0de3ad246b5c52c96135f5804ae1118f7df1af1c6f937740d598334214fc1943
0e5b9ae6ee3041d89eefb88c6c868a1c9931391e91068de26720008c6b0c0bf2
0f59a622eb9998369364b47ddae969698a7975b877ce025b1214ccff8b59e7a7
0f724bbd47c80a2feb1f376d282ed84f39306293522656241abbf19532154928
0fa66bd126cb02a367d8ad392b6c446cc8f50922930804526d245784be001c51
0fff0dad13446c46cd2ff79c4fcc6e545df3e6e269917892d3d22bcbdbb7b741
140aa25448483a45722b1c874fbed44f70e2dd8ea9fe9ce1fb479de397c8a95e
1532bc5fd39a7f0a35d9f94bcbf0be36d5f04acfb46829d4163b00abb3c5eb04
15c03875c741546f5eb5d843c7515b1b10201ad5f9495b2f1eb91de5473602f1

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Malware.Xcnfe-6725509-0

Indicators of Compromise
Registry Keys

N/A Mutexes
HOejWmqMur
HPN518Ik4R
Lat3nHFoEE
OaLnVql4Xa
RsyK1I3lWG
V7BLDkG8tf
XQeR5Zn1SJ
hND27SW0LW
qJkjChBhfG
vXnp0AXNfH
wDSifyYhV5
wbQpF7mWCE
wcX8yaYh6B
wfwyjaJYsW
wxK54uwMfc IP Addresses contacted by malware. Does not indicate maliciousness
N/A Domain Names contacted by malware. Does not indicate maliciousness
www[.]brmbyczdra[.]com
www[.]pn8mtahzna[.]com
www[.]tqttwzog79[.]com
www[.]ril14w0qvn[.]com
www[.]mvbkhpmqux[.]com
www[.]uyrhnkdozb[.]com
www[.]nutatq5wla[.]com
www[.]tpu9fiuayd[.]com
www[.]5bc5xh1p5p[.]com
www[.]we3jnll0va[.]com
www[.]hrwzs9ake4[.]com
www[.]knx3hbiwyu[.]com
www[.]txovxotdxc[.]com
www[.]ean1heykxa[.]com
www[.]qjfvz6swvg[.]com
www[.]stq1ji6cas[.]com
www[.]xoiejztmpo[.]com
www[.]cldhtlfyhs[.]com
www[.]zhya3boggv[.]com
www[.]qvchgu0aax[.]com
www[.]brh6bbhql8[.]com
www[.]dirmuszaet[.]com Files and or directories created
%SystemDrive%\345791583.exe
%SystemDrive%\old_345791583.exe (copy)
%SystemDrive%\TEMP\55ddbadda5fe5c7f86a8f8ea7c9405413682686f8057e2b5369adee284e2ace2.exe
\TEMP\old_55ddbadda5fe5c7f86a8f8ea7c9405413682686f8057e2b5369adee284e2ace2.exe File Hashes
0462beb83c7410501f0fe309335b63bdb2197c828d8b3cac860329613fb92f18
07f0c7d1726aa998261db29451ea668364bd226080caf6ebc1e7cd1f65de1864
0eddfc2b11eabf9cf0186363f4727270cdc5ed3619cf8318caaeaf7370da5e10
1748dd5f70ed569ec358f707587718e8a980871e076aa1b1f344f84b7eee0587
255c3d259351d43392c8b01db2a830f50515e0c2672f5421934ade0433cbd6c3
3ea74553c24024b94412137d0337f1b22226af398579bb7f44e674649c18b480
55ddbadda5fe5c7f86a8f8ea7c9405413682686f8057e2b5369adee284e2ace2
68b35209e61e6558069706af6cfda39cbe24366c28e68d36279ce314f922d9b4
6af842bca80ca04a5c65e6fa9fbf85a3c7bf34a49b580397cc5955a0b9aa1134
6c75d30fa43d15ca9f2632e6a794d26de4fc35fcc1ba9fc250afea06f27ad653
719e40a705ffe31bff643a5254f52ca051d0657b59ee920f4b3e75fc83e3fe0c
77b11d472658825617c8520bc75e5084fa3a26a85f90b845270615ddff6622f4
8689c50f5e4cd1fd590a9c5eebc28ba81b5f0a1b52e357811975ac0f59d278db
95e82e623d7f1b34725c1c11026f8149741a4c506379954c6c9d171791302df6
9a624de996ba6e99eb59b50b2631e86057feb3bee9c54d1282705c4486530fbf
c556d0c97ae7b7be22f685e829394652401971a0e468eb0824b5ba5537928b96
f392f2e34534ef1e74cb911124ebfb531dbd045e4b6e20afc30e878674459131
ffc643e3c595c64053e50e0a1ccc2dace32134c3892fbb1a60e215410cdaf428

Coverage

Screenshots of Detection AMP

ThreatGrid

Doc.Dropper.Stratos-6724145-0

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses contacted by malware. Does not indicate maliciousness
88[.]217[.]189[.]35 Domain Names contacted by malware. Does not indicate maliciousness
www[.]kum[.]net Files and or directories created
%UserProfile%\Documents\20181025
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\PowerShellTrace.format.ps1xml
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\QsheHY.exe (copy)
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\Registry.format.ps1xml
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\System.Management.Automation.dll-Help.xml
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\WSMan.format.ps1xml
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\about_execution_policies.help.txt
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\powershell.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\powershell.exe.mui
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\powershell_ise.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\powershell_ise.resources.dll
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\pspluginwkr.dll
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\pwrshsip.dll
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kdinwwrgg\ONSEXGA\types.ps1xml
%TEMP%orary Internet Files\Content.Word\~WRS{68695D36-6967-4FDB-A2FF-84784E101F5C}.tmp
%SystemDrive%\~$4900185.doc
%LocalAppData%\Temp\kdinwwrgg\ONSEXGA\powershell.exe
\TEMP\~$a24d5a55e3d33b0a4d183141758c409b639fcd077cfcd062dc53cb8d03d378.doc
%LocalAppData%\Temp\onexzlc.exe
%LocalAppData%\Temp\kdinwwrgg\ONSEXGA\QsheHY.exe
%LocalAppData%\Temp\onexzlc.exe File Hashes
00d3e76c7614df1533cbb40d0b3977cfce6e5f01b8cc0aa6ea858891ef104715
16079ba3e75ebbc34e3ef692277332d41ee0d1aa248a24c7f5ba74d88f28d01b
1ded830b66a15ef7288f088b3b4b1a84fa55bf0700538953614f5e2369128fdc
217d2260555214d8e6e72dd5dd7ade95b206efebdd948ad05a1dd88e4e39730e
33a99f39eb8a1d9fe223b4ca61d21fe8086b2a908e00954959b971868424e46b
35a24d5a55e3d33b0a4d183141758c409b639fcd077cfcd062dc53cb8d03d378
3927bc5e8064ab1fedd6e0b9826aef4fda01e6be3b218b9b482d4ae60d929d67
402a1bd3bd18102d3955b0e5dcab8b76b8c1025fb828d410c1fa93a872a2f1f9
42c74a8a4e195017753e917153702bbd4d6812576cd94f0fc0035bed6aa1ce1f
42ff1fdd87f84e321a4348a5b113ba72634fade79646df750ec72f907d787db9
523de9a89e6d2f5713fcc4b7e3ea1d27fa27d13e5d17a0f08aab6d86d9e2a9b6
55953f034bc3edf5248b9c978916a2eb45bbf641892baffd7744ce0027cdaa2c
5ed8c51ce0a7706599d5f7bbe843fbdb8fed579591012146fb2fbd92bfece4f8
616d166cd0fc20ce5e583b9c0c306833fc4a371214bc9a3b5f9d33deac385c68
781c06eeafa87a7a27b573fde822faae4ac0ebd7a19ad7400ac8595e1a89fcaa
83245b8849c886659767d6227051ea8b48ead681cbe62c12a4557cf8c3a2b61d
934a7d7edf49198d685569e2f5e40e225f90e407a87478243379ef71d7f4f6c2
9653288c0ca91e1b968a39e2f8b2e7c7b5b881e064c0bf2d234ea0b0619911ce
b15f383006ceff832ef575057a0a75cba726822864d37aef5feabc43ca316971
b41b3a7b83f22af9892cc69801086343924d8ee23f5bf8062cc2748c9301f1a8
c08ea9800cdb66012a4adfc3a5bba200f7f1db8cc37f50c133201f5ce46660c3
d182a022ed754bb7c963540d0a8d9cd7579b458d4c2057d5f72caeb11566b2b9
d3a40ec14f52e1e7e1494ee7e04ad651e38618e29284d3205ec21cef6e9699f2
da9f374901e55c225f03ec68dadc672e13e9f0dc36508fe416cec8faf87795af
e8c4870bb9d6e7cb597a86c97f2a64c71734aecbd9c72f7302b730dcdeffabe0

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Malware

Win.Downloader.Upatre-6726679-0

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses contacted by malware. Does not indicate maliciousness
83[.]136[.]254[.]57 Domain Names contacted by malware. Does not indicate maliciousness
cardiffpower[.]com Files and or directories created
%LocalAppData%\Temp\kgfdfjdk.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kgfdfjdk.exe
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\lrtsdnn.exe File Hashes
02c04966bbd775626d1738bf454148543e8cc4564ff9f1ba3110395f96b05ab9
031edbb534d9bf394bebf4cc7f64338d7212b05a7a7bf2a75f5348feaeabb9c5
11e046d9a88238806a7458c5f17dfec74c1038dcacb7a345f492f5d9b285255f
1273cdf1e5440ec05d61930132df0152be89eff4e28ac59de8e653022f664579
184e4171672a8eba20a357aabd274a454ed1c71a0aed1efbb028b9676c53ccd3
2556e8e75d5c1cb3f6fd2e716242c991dc9af8138561483993ce179c3d50e48b
2eb229efaa5a043263e6546583c811738d5695a8afbb035f3c76fe80929c18eb
32867f896bd20600c6712759889c031984e933ef1b0b4dfa9e061bfa0b6e994a
4b8d61f0af68f03e586773b1226e635df5f6b2a417c88131885aa4201ad96c6b
4caf12084718881f7d0fee2c4655b7afb8c27803f0c1bbeceb4c48a9532cb3c8
4e07e7190e98511ba11637eeff341227aaed60ca58e96bbd69fd5659f808b56c
6d8fabfefcb131b3535940fab547c10e5de430a079113671d2d09cf0c9582ed1
826a5879182924c1f00f72885583baddcb8cd3ce9596a5bdab44abeea5f02ab9
9c7e51d51513e337bba8b4fcb88264203986e387a8b9d820b9d6a0f2cfca26ef
c71f83b153fb1e488930375d7a62eb77c34493f617b415447cd6b6e7cefb68e3
f1a99a424971247e557d9f2d6c90e1e27f1c3407ced0913701f5f6bd40cdc4bb

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Cerber-6725830-0

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses contacted by malware. Does not indicate maliciousness
N/A Domain Names contacted by malware. Does not indicate maliciousness
ip-api[.]com
ipinfo[.]io
freegeoip[.]net Files and or directories created
%SystemDrive%\Temp\HncDownload\# DECRYPT MY FILES #.html
%SystemDrive%\Temp\HncDownload\# DECRYPT MY FILES #.txt
%SystemDrive%\Temp\HncDownload\# DECRYPT MY FILES #.url
%SystemDrive%\Temp\HncDownload\# DECRYPT MY FILES #.vbs
%SystemDrive%\Temp\HncDownload\Update.log
%SystemDrive%\Temp\HncDownload\Rmp7-WGqEy.cerber (copy) File Hashes
0015a572f00b8ec6f68bb6a3683f7741a1a35d436c868ef545e016a279c7740d
00200aac1922a420afc4390974ad1f099bf86eb6294e757ab22004628f2be226
00528962871098906eb33d0422c1a9b7bdd0cbe481af1bc058d1c2a09793f055
01ef8b829770bea681075ea9b9ad648c5cf8c9db42aba719d921c6841d0ffa6f
04eb627d86eeff6c9314fac423f535d798ed95d3384df9e0944447af7898ab0a
05506752a964566bc3ec936db6da6e577bf3e1c04d2dadb1143cd137ff66e715
059eced85a1c189ec1eceb9cb642e801db20cc61d40782afd7fc479169e0a799
0655f2a8831b5aaece1fe2af39583c6261564a13fffec7354857ae440c824786
065c909c3c855be6646202eaaaad38e47c234be5927f8b635b9e9a0482c99965
06f20532a0285a7e01634e319a78db15d3eb08e39c72ee92412c161be3c87d33
072114ad12468fb6610c20c9912bd40b5e25e0183dab9edff8b93aff79cfa846
078d4a7287160344439bd701f2fbf027c76dbc85e2d9ae98a586d69ebdca712f
07bbda40f1bfd84bc619fdaa05ac029251d919b8bd100f724905400fb107beb7
07d09bac351855dd383ed882657241b3db150d1a24019af08233b1b73795cdb6
081f9d0b1bd3ea8e7b69d0ff6c93c27e9e76c29124cdb539141a439bdb2bf8ab
08b4cd3370515fe4936d3126b12c738b2acd704ce24830119b1d69faef6c7291
08c0234c26c9b8576d428b2fc177ca4e9140ddfae8c213369a86bb4ae2fc4b06
097db35097f7ef2d8b91a517980e399c92e9938208110846561581d2bf5bb96f
09abc80ec4c160755e133f356e909219b2939f78ebb7896973094c78de55f42b
0b07fbacc4450198d6f430bff653791c43417af9e6d11f46b6ac75711e89c2a1
0b4123bc026cc6ac0282295c5d7bd9271514cdc771c9a84e359f3ee5858bf811
0b62139f8be2e7640c17e4c6ddc5c4c7812fd061480ea112718ac5e12ea70838
0bf510cbc1ee26748f285b6dd9f5e8d96b26ba5d732e6f9b1ad4e6b1695292ed
0c90601d82e2725a11bba65b9eb98c2154d6e2b27aa813936e75e7f740128971
0cdc982e7c0fe5c5d9100ff621c424af79ec3dd49e718a454af3a14f9add4c54

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Doc.Malware.00536d-6731394-0

Indicators of Compromise
Registry Keys

N/A Mutexes
Local\WinSpl64To32Mutex_e162_0_3000
Local\MSIMGSIZECacheMutex
Local\VERMGMTBlockListFileMutex
Local\URLBLOCK_DOWNLOAD_MUTEX
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1860
Local\URLBLOCK_HASHFILESWITCH_MUTEX
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_576
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1224
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1560 IP Addresses contacted by malware. Does not indicate maliciousness
204[.]79[.]197[.]200
144[.]217[.]0[.]194
54[.]39[.]74[.]124
8[.]208[.]9[.]98 Domain Names contacted by malware. Does not indicate maliciousness
tt[.]zicino[.]at
doom[.]matr[.]at
ovellonist[.]com
ut[.]ritpur[.]at
app[.]xenope[.]at
u2[.]tip5top[.]atFiles and or directories created
%LocalAppData%\Temp\~DFA1AFEB97E8C0B1FD.TMP
%LocalAppData%\Temp\~DFFFF0E8FCA29DD7E1.TMP
%AppData%\20938.exe
%AppData%\Microsoft\Office\Recent\346748415.doc.LNK
%LocalAppData%\Temp\n3j5vfst.vvc.psm1
%AppData%\99fc8a68.exe
%LocalAppData%\Temp\1fxpdoag.uzv.ps1 File Hashes
4e6c2a6715fd91a76a06321eebd22430fa47e1a298a12e6d5134327e62215c07
57b3f97cf7f8d8bfc4aef53f82cc1b1e154d7fcad2302048192e44afd47cf07b
6ca1773b14b136dd7b3e7906f73d0d05f21d00e1f829303ac9167454f1b22bee
7ca67da6488d5e5acf74919348ebfe4a780a7f70cc3b49455d0f588a2150ad8e
88fe8fc07008bdbd6a87f96184cc3ced3e2df8a1678d7d145ef6affb62683cbb
a3c3656b7c7471d26a98acc02233ef906cb3bc20f4225c81fd3ff07111498ce5
a72f70f2b0ea6638b3da69ed3807059ec98bc258deeb17fe3fdfa392b3c606a8
c9aade2865566b50d1827c45b070f32c1db891101ed4783fcb471f43fa043958
ca9b78bb32da00431081f4385ac85ee341e7e668aa934dbea8f5ab44b9621179
ce31ffafe8ea619a703e04f7b16559999530f89ddb8fc78545bcee8f4e3c45ec
f6feed4b063c2e25fdaf7af79954d78fbd6db361916f512a8e73f6665f8fb3e4

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-1019-1026/

Type	Indicator	Context
sha256	0015a572f00b8ec6f68bb6a3683f7741a1a35d436c868ef545e016a279c7740d	rive%\Temp\HncDownload\Rmp7-WGqEy.cerber (copy) File Hashes 0015a572f00b8ec6f68bb6a3683f7741a1a35d436c868ef545e016a279c7740d 00200aac1922a420afc4390974ad1f099bf86eb6294e757ab22004628f2
sha256	00200aac1922a420afc4390974ad1f099bf86eb6294e757ab22004628f2be226	572f00b8ec6f68bb6a3683f7741a1a35d436c868ef545e016a279c7740d 00200aac1922a420afc4390974ad1f099bf86eb6294e757ab22004628f2be226 00528962871098906eb33d0422c1a9b7bdd0cbe481af1bc058d1c2a0979
sha256	00528962871098906eb33d0422c1a9b7bdd0cbe481af1bc058d1c2a09793f055	aac1922a420afc4390974ad1f099bf86eb6294e757ab22004628f2be226 00528962871098906eb33d0422c1a9b7bdd0cbe481af1bc058d1c2a09793f055 01ef8b829770bea681075ea9b9ad648c5cf8c9db42aba719d921c6841d0
sha256	00570d9bd558b25ac628d4de140897954e3cc1ed3dae8818e3ef580544626e8f	le%\ph\fktiipx.ftf %LocalAppData%\Temp\gocf.ksv File Hashes 00570d9bd558b25ac628d4de140897954e3cc1ed3dae8818e3ef580544626e8f 006e51c87642cb26a7d6fb534d37c1d4c4d015934e67284e8e35053b0da
sha256	006e51c87642cb26a7d6fb534d37c1d4c4d015934e67284e8e35053b0da8971c	d9bd558b25ac628d4de140897954e3cc1ed3dae8818e3ef580544626e8f 006e51c87642cb26a7d6fb534d37c1d4c4d015934e67284e8e35053b0da8971c 007b40dab88434b29a0c3b92cca04cb13d9f1ddb29202770a2f657becfc
sha256	007474f524c04bcfef7bff656f7d673e22496caff0490a111596b5c1a60b61ef	lAppData%\Temp\winlobd.exe \sgfdr.pif \vqwf.exe File Hashes 007474f524c04bcfef7bff656f7d673e22496caff0490a111596b5c1a60b61ef 0abf15a831537bd86b7e16ae5032a4813c6e9e9df4f1da7c074c4daa367
sha256	007b40dab88434b29a0c3b92cca04cb13d9f1ddb29202770a2f657becfc939d2	1c87642cb26a7d6fb534d37c1d4c4d015934e67284e8e35053b0da8971c 007b40dab88434b29a0c3b92cca04cb13d9f1ddb29202770a2f657becfc939d2 01e202a72e6bf3954e98acf6c4cd8fe660de710e129cd9de425e1e5dcc8
sha256	00d3e76c7614df1533cbb40d0b3977cfce6e5f01b8cc0aa6ea858891ef104715	EXGA\QsheHY.exe %LocalAppData%\Temp\onexzlc.exe File Hashes 00d3e76c7614df1533cbb40d0b3977cfce6e5f01b8cc0aa6ea858891ef104715 16079ba3e75ebbc34e3ef692277332d41ee0d1aa248a24c7f5ba74d88f2
sha256	01e202a72e6bf3954e98acf6c4cd8fe660de710e129cd9de425e1e5dcc876232	0dab88434b29a0c3b92cca04cb13d9f1ddb29202770a2f657becfc939d2 01e202a72e6bf3954e98acf6c4cd8fe660de710e129cd9de425e1e5dcc876232 01fc65a13f2f8f6033e55f860b835361442dfd0ec1443c134b2a6558964
sha256	01ef8b829770bea681075ea9b9ad648c5cf8c9db42aba719d921c6841d0ffa6f	962871098906eb33d0422c1a9b7bdd0cbe481af1bc058d1c2a09793f055 01ef8b829770bea681075ea9b9ad648c5cf8c9db42aba719d921c6841d0ffa6f 04eb627d86eeff6c9314fac423f535d798ed95d3384df9e0944447af789
sha256	01fc65a13f2f8f6033e55f860b835361442dfd0ec1443c134b2a6558964a2a2d	2a72e6bf3954e98acf6c4cd8fe660de710e129cd9de425e1e5dcc876232 01fc65a13f2f8f6033e55f860b835361442dfd0ec1443c134b2a6558964a2a2d 0340d472ea1bf41f75e1cf94fc499ca3960518d5dc9fe8cc85f6f56a955
sha256	02c04966bbd775626d1738bf454148543e8cc4564ff9f1ba3110395f96b05ab9	ve%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\lrtsdnn.exe File Hashes 02c04966bbd775626d1738bf454148543e8cc4564ff9f1ba3110395f96b05ab9 031edbb534d9bf394bebf4cc7f64338d7212b05a7a7bf2a75f5348feaea
sha256	031edbb534d9bf394bebf4cc7f64338d7212b05a7a7bf2a75f5348feaeabb9c5	966bbd775626d1738bf454148543e8cc4564ff9f1ba3110395f96b05ab9 031edbb534d9bf394bebf4cc7f64338d7212b05a7a7bf2a75f5348feaeabb9c5 11e046d9a88238806a7458c5f17dfec74c1038dcacb7a345f492f5d9b28
sha256	0340d472ea1bf41f75e1cf94fc499ca3960518d5dc9fe8cc85f6f56a955ad702	5a13f2f8f6033e55f860b835361442dfd0ec1443c134b2a6558964a2a2d 0340d472ea1bf41f75e1cf94fc499ca3960518d5dc9fe8cc85f6f56a955ad702 03d97452886804d0bc32e0723b4024d91cc1a64357a74b529452ca007f1
sha256	03d97452886804d0bc32e0723b4024d91cc1a64357a74b529452ca007f1b07d4	472ea1bf41f75e1cf94fc499ca3960518d5dc9fe8cc85f6f56a955ad702 03d97452886804d0bc32e0723b4024d91cc1a64357a74b529452ca007f1b07d4 0491517063ca33e47b325ba2c304f4c8fc3b45956b1bfdff0555936a3bb
sha256	0462beb83c7410501f0fe309335b63bdb2197c828d8b3cac860329613fb92f18	8ea7c9405413682686f8057e2b5369adee284e2ace2.exe File Hashes 0462beb83c7410501f0fe309335b63bdb2197c828d8b3cac860329613fb92f18 07f0c7d1726aa998261db29451ea668364bd226080caf6ebc1e7cd1f65d
sha256	0491517063ca33e47b325ba2c304f4c8fc3b45956b1bfdff0555936a3bb3678f	452886804d0bc32e0723b4024d91cc1a64357a74b529452ca007f1b07d4 0491517063ca33e47b325ba2c304f4c8fc3b45956b1bfdff0555936a3bb3678f 064173410c2ca5781a785fccc9457fdd59b25ba2c14aca5bee71f83f136
sha256	04eb627d86eeff6c9314fac423f535d798ed95d3384df9e0944447af7898ab0a	b829770bea681075ea9b9ad648c5cf8c9db42aba719d921c6841d0ffa6f 04eb627d86eeff6c9314fac423f535d798ed95d3384df9e0944447af7898ab0a 05506752a964566bc3ec936db6da6e577bf3e1c04d2dadb1143cd137ff6
sha256	05506752a964566bc3ec936db6da6e577bf3e1c04d2dadb1143cd137ff66e715	27d86eeff6c9314fac423f535d798ed95d3384df9e0944447af7898ab0a 05506752a964566bc3ec936db6da6e577bf3e1c04d2dadb1143cd137ff66e715 059eced85a1c189ec1eceb9cb642e801db20cc61d40782afd7fc479169e
sha256	059eced85a1c189ec1eceb9cb642e801db20cc61d40782afd7fc479169e0a799	752a964566bc3ec936db6da6e577bf3e1c04d2dadb1143cd137ff66e715 059eced85a1c189ec1eceb9cb642e801db20cc61d40782afd7fc479169e0a799 0655f2a8831b5aaece1fe2af39583c6261564a13fffec7354857ae440c8
sha256	064173410c2ca5781a785fccc9457fdd59b25ba2c14aca5bee71f83f136c279d	17063ca33e47b325ba2c304f4c8fc3b45956b1bfdff0555936a3bb3678f 064173410c2ca5781a785fccc9457fdd59b25ba2c14aca5bee71f83f136c279d 0679f7d954654a74c02dca0754cffacdce6d4c7887f4976c85b6148033b
sha256	0655f2a8831b5aaece1fe2af39583c6261564a13fffec7354857ae440c824786	ed85a1c189ec1eceb9cb642e801db20cc61d40782afd7fc479169e0a799 0655f2a8831b5aaece1fe2af39583c6261564a13fffec7354857ae440c824786 065c909c3c855be6646202eaaaad38e47c234be5927f8b635b9e9a0482c
sha256	065c909c3c855be6646202eaaaad38e47c234be5927f8b635b9e9a0482c99965	2a8831b5aaece1fe2af39583c6261564a13fffec7354857ae440c824786 065c909c3c855be6646202eaaaad38e47c234be5927f8b635b9e9a0482c99965 06f20532a0285a7e01634e319a78db15d3eb08e39c72ee92412c161be3c
sha256	0679f7d954654a74c02dca0754cffacdce6d4c7887f4976c85b6148033b9942d	3410c2ca5781a785fccc9457fdd59b25ba2c14aca5bee71f83f136c279d 0679f7d954654a74c02dca0754cffacdce6d4c7887f4976c85b6148033b9942d 06f001ddf5d2c3827b6f28936b2939f16df62745699551a155572433827
sha256	06f001ddf5d2c3827b6f28936b2939f16df62745699551a155572433827ec381	7d954654a74c02dca0754cffacdce6d4c7887f4976c85b6148033b9942d 06f001ddf5d2c3827b6f28936b2939f16df62745699551a155572433827ec381 07814f096bd2a889317ac70e66cadfe443df1ad96ed2b6452d4252d11d6
sha256	06f20532a0285a7e01634e319a78db15d3eb08e39c72ee92412c161be3c87d33	09c3c855be6646202eaaaad38e47c234be5927f8b635b9e9a0482c99965 06f20532a0285a7e01634e319a78db15d3eb08e39c72ee92412c161be3c87d33 072114ad12468fb6610c20c9912bd40b5e25e0183dab9edff8b93aff79c
sha256	072114ad12468fb6610c20c9912bd40b5e25e0183dab9edff8b93aff79cfa846	532a0285a7e01634e319a78db15d3eb08e39c72ee92412c161be3c87d33 072114ad12468fb6610c20c9912bd40b5e25e0183dab9edff8b93aff79cfa846 078d4a7287160344439bd701f2fbf027c76dbc85e2d9ae98a586d69ebdc
sha256	07814f096bd2a889317ac70e66cadfe443df1ad96ed2b6452d4252d11d60c8b3	1ddf5d2c3827b6f28936b2939f16df62745699551a155572433827ec381 07814f096bd2a889317ac70e66cadfe443df1ad96ed2b6452d4252d11d60c8b3 088dce2464cfa134fd0317a2e75f0057de8d60b547d72e66fc1926e9ad3
sha256	078d4a7287160344439bd701f2fbf027c76dbc85e2d9ae98a586d69ebdca712f	4ad12468fb6610c20c9912bd40b5e25e0183dab9edff8b93aff79cfa846 078d4a7287160344439bd701f2fbf027c76dbc85e2d9ae98a586d69ebdca712f 07bbda40f1bfd84bc619fdaa05ac029251d919b8bd100f724905400fb10
sha256	07bbda40f1bfd84bc619fdaa05ac029251d919b8bd100f724905400fb107beb7	a7287160344439bd701f2fbf027c76dbc85e2d9ae98a586d69ebdca712f 07bbda40f1bfd84bc619fdaa05ac029251d919b8bd100f724905400fb107beb7 07d09bac351855dd383ed882657241b3db150d1a24019af08233b1b7379
sha256	07d09bac351855dd383ed882657241b3db150d1a24019af08233b1b73795cdb6	a40f1bfd84bc619fdaa05ac029251d919b8bd100f724905400fb107beb7 07d09bac351855dd383ed882657241b3db150d1a24019af08233b1b73795cdb6 081f9d0b1bd3ea8e7b69d0ff6c93c27e9e76c29124cdb539141a439bdb2
sha256	07f0c7d1726aa998261db29451ea668364bd226080caf6ebc1e7cd1f65de1864	eb83c7410501f0fe309335b63bdb2197c828d8b3cac860329613fb92f18 07f0c7d1726aa998261db29451ea668364bd226080caf6ebc1e7cd1f65de1864 0eddfc2b11eabf9cf0186363f4727270cdc5ed3619cf8318caaeaf7370d
sha256	081f9d0b1bd3ea8e7b69d0ff6c93c27e9e76c29124cdb539141a439bdb2bf8ab	bac351855dd383ed882657241b3db150d1a24019af08233b1b73795cdb6 081f9d0b1bd3ea8e7b69d0ff6c93c27e9e76c29124cdb539141a439bdb2bf8ab 08b4cd3370515fe4936d3126b12c738b2acd704ce24830119b1d69faef6
sha256	088dce2464cfa134fd0317a2e75f0057de8d60b547d72e66fc1926e9ad355074	f096bd2a889317ac70e66cadfe443df1ad96ed2b6452d4252d11d60c8b3 088dce2464cfa134fd0317a2e75f0057de8d60b547d72e66fc1926e9ad355074 08b4430a48bdebc89092cb4f90ad407e51002098a0eeb08574f92a8327e
sha256	08b4430a48bdebc89092cb4f90ad407e51002098a0eeb08574f92a8327e5a140	e2464cfa134fd0317a2e75f0057de8d60b547d72e66fc1926e9ad355074 08b4430a48bdebc89092cb4f90ad407e51002098a0eeb08574f92a8327e5a140 09007a9eedbb6b7116add49671499f238301ccd3fa763904512517d003c
sha256	08b4cd3370515fe4936d3126b12c738b2acd704ce24830119b1d69faef6c7291	d0b1bd3ea8e7b69d0ff6c93c27e9e76c29124cdb539141a439bdb2bf8ab 08b4cd3370515fe4936d3126b12c738b2acd704ce24830119b1d69faef6c7291 08c0234c26c9b8576d428b2fc177ca4e9140ddfae8c213369a86bb4ae2f
sha256	09007a9eedbb6b7116add49671499f238301ccd3fa763904512517d003cd3625	30a48bdebc89092cb4f90ad407e51002098a0eeb08574f92a8327e5a140 09007a9eedbb6b7116add49671499f238301ccd3fa763904512517d003cd3625 0d42e7f0984ea9b0be200420bd7221a92c76466c85ded7321cb69a8386d
sha256	0abf15a831537bd86b7e16ae5032a4813c6e9e9df4f1da7c074c4daa3672c3dd	4f524c04bcfef7bff656f7d673e22496caff0490a111596b5c1a60b61ef 0abf15a831537bd86b7e16ae5032a4813c6e9e9df4f1da7c074c4daa3672c3dd 0e82ae0199228f54e8308755024fa78e0a568f1423cec3cf21d9341a7c9
sha256	0d42e7f0984ea9b0be200420bd7221a92c76466c85ded7321cb69a8386db17ff	a9eedbb6b7116add49671499f238301ccd3fa763904512517d003cd3625 0d42e7f0984ea9b0be200420bd7221a92c76466c85ded7321cb69a8386db17ff 0de3ad246b5c52c96135f5804ae1118f7df1af1c6f937740d598334214f
sha256	0de3ad246b5c52c96135f5804ae1118f7df1af1c6f937740d598334214fc1943	7f0984ea9b0be200420bd7221a92c76466c85ded7321cb69a8386db17ff 0de3ad246b5c52c96135f5804ae1118f7df1af1c6f937740d598334214fc1943 0e5b9ae6ee3041d89eefb88c6c868a1c9931391e91068de26720008c6b0

Threat Roundup for October 19 to October 26

Indicators of compromiseauto-extracted · verify before use · export allAll →

Threats

Win.Virus.Sality-6727001-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Nymaim-6726894-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Xcnfe-6725509-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Doc.Dropper.Stratos-6724145-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Downloader.Upatre-6726679-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Cerber-6725830-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Doc.Malware.00536d-6731394-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys