ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Cisco Talospublished ()ingested

Threat Round up for December 9 to December 16

highRansomwareimportance 57
Read the original
Tagsransomware

Indicators of compromiseAll →

TypeIndicatorContext
domainchangdeacorp.compaddress[.]com 6 optimurn[.]host 3 thammyvienanthea[.]com 2 changdeacorp[.]com 2 ip-api[.]com 1 checkip[.]amazonaws[.]com 1 rikolexx[.]c
domaincheckip.amazonaws.comhammyvienanthea[.]com 2 changdeacorp[.]com 2 ip-api[.]com 1 checkip[.]amazonaws[.]com 1 rikolexx[.]com 1 hooklinez[.]us 1 smtp[.]easterncarqo
domainchx031x.e2.luyouxia.nethrjx[.]e2[.]luyouxia[.]net 1 ovo520[.]e2[.]luyouxia[.]net 1 chx031x[.]e2[.]luyouxia[.]net 1 Files and or directories created Occurrences %Progr
domainguduo.xyzted by malware. Does not indicate maliciousness Occurrences guduo[.]xyz 8 lqwljs[.]cn 2 www[.]bing[.]com 1 ikun100[.]e2[.]luyouxi
domainhooklinez.usip-api[.]com 1 checkip[.]amazonaws[.]com 1 rikolexx[.]com 1 hooklinez[.]us 1 smtp[.]easterncarqo[.]co[.]in 1 mytradecrypto[.]ug 1 ww
domainikun100.e2.luyouxia.netOccurrences guduo[.]xyz 8 lqwljs[.]cn 2 www[.]bing[.]com 1 ikun100[.]e2[.]luyouxia[.]net 1 sjlwql[.]top 1 zxjice[.]e2[.]luyouxia[.]net 1 wbswc
domainip-api.commurn[.]host 3 thammyvienanthea[.]com 2 changdeacorp[.]com 2 ip-api[.]com 1 checkip[.]amazonaws[.]com 1 rikolexx[.]com 1 hooklinez[
domainlqwljs.cn. Does not indicate maliciousness Occurrences guduo[.]xyz 8 lqwljs[.]cn 2 www[.]bing[.]com 1 ikun100[.]e2[.]luyouxia[.]net 1 sjlw
domainmytradecrypto.ugxx[.]com 1 hooklinez[.]us 1 smtp[.]easterncarqo[.]co[.]in 1 mytradecrypto[.]ug 1 www[.]forgivers2019[.]tk 1 Files and or directories cre
domainoptimurn.hostndicate maliciousness Occurrences whatismyipaddress[.]com 6 optimurn[.]host 3 thammyvienanthea[.]com 2 changdeacorp[.]com 2 ip-api[.]
domainovo520.e2.luyouxia.nete[.]e2[.]luyouxia[.]net 1 wbswchrjx[.]e2[.]luyouxia[.]net 1 ovo520[.]e2[.]luyouxia[.]net 1 chx031x[.]e2[.]luyouxia[.]net 1 Files and or direct
domainrikolexx.comgdeacorp[.]com 2 ip-api[.]com 1 checkip[.]amazonaws[.]com 1 rikolexx[.]com 1 hooklinez[.]us 1 smtp[.]easterncarqo[.]co[.]in 1 mytrad
domainsjlwql.tops[.]cn 2 www[.]bing[.]com 1 ikun100[.]e2[.]luyouxia[.]net 1 sjlwql[.]top 1 zxjice[.]e2[.]luyouxia[.]net 1 wbswchrjx[.]e2[.]luyouxi
domainsmtp.easterncarqo.co.ineckip[.]amazonaws[.]com 1 rikolexx[.]com 1 hooklinez[.]us 1 smtp[.]easterncarqo[.]co[.]in 1 mytradecrypto[.]ug 1 www[.]forgivers2019[.]tk 1 Fil
domainthammyvienanthea.comess Occurrences whatismyipaddress[.]com 6 optimurn[.]host 3 thammyvienanthea[.]com 2 changdeacorp[.]com 2 ip-api[.]com 1 checkip[.]amazonaws
domainthevelvetpouch.comnot indicate maliciousness Occurrences waytoloans[.]com 20 thevelvetpouch[.]com 20 Files and or directories created Occurrences %TEMP%\fo
domainwaytoloans.comted by malware. Does not indicate maliciousness Occurrences waytoloans[.]com 20 thevelvetpouch[.]com 20 Files and or directories creat
domainwbswchrjx.e2.luyouxia.netouxia[.]net 1 sjlwql[.]top 1 zxjice[.]e2[.]luyouxia[.]net 1 wbswchrjx[.]e2[.]luyouxia[.]net 1 ovo520[.]e2[.]luyouxia[.]net 1 chx031x[.]e2[.]luyou
domainwhatismyipaddress.comted by malware. Does not indicate maliciousness Occurrences whatismyipaddress[.]com 6 optimurn[.]host 3 thammyvienanthea[.]com 2 changdeacorp
domainwww.bing.comicate maliciousness Occurrences guduo[.]xyz 8 lqwljs[.]cn 2 www[.]bing[.]com 1 ikun100[.]e2[.]luyouxia[.]net 1 sjlwql[.]top 1 zxjice
domainwww.forgivers2019.tk.]us 1 smtp[.]easterncarqo[.]co[.]in 1 mytradecrypto[.]ug 1 www[.]forgivers2019[.]tk 1 Files and or directories created Occurrences %APPDATA
domainzxjice.e2.luyouxia.netbing[.]com 1 ikun100[.]e2[.]luyouxia[.]net 1 sjlwql[.]top 1 zxjice[.]e2[.]luyouxia[.]net 1 wbswchrjx[.]e2[.]luyouxia[.]net 1 ovo520[.]e2[.]luy
ipv4111.67.207.155ek 1 lcaus786.e2.luyouxia.net:22785:21086:Rstezx rzpqcquk 1 111.67.207.155:2024:Rsieyo ysssmucy 1 192.168.1.45:80:Rswoae mymisigc 1 wb
ipv4171.214.11.140rences KyUffThOkYwRRtgPP 1 127.0.0.1:8888:Rscdxm riifdjka 1 171.214.11.140:6666:Rsmwis uuasausu 1 127.0.0.1:8888:Rsrajf bxvuoiyo 1 zxj
ipv4180.76.120.1912022:Rsrcpv rfbcwoyq 1 192.168.1.159:2022:Rsdetk yarseriw 1 180.76.120.191:8888:Rsgaqa miwweaek 1 lcaus786.e2.luyouxia.net:22785:21086
md57657c14284185fbd3fb108b43c7467baM Value Name: ConsentPromptBehaviorAdmin 10 <HKCU>\SOFTWARE\7657C14284185FBD3FB108B43C7467BA 9 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Valu
md5a12f2b7635caffde3957a7cc18cde5a984185FBD3FB108B43C7467BA Value Name: [kl] 9 <HKCU>\SOFTWARE\A12F2B7635CAFFDE3957A7CC18CDE5A9 1 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Valu
sha25600eb04840db63230036691b00cacffe5567aadd6b229d17393fc8c719cf48dabEMP%\OFFICE\WORD.exe 1 %TEMP%\OFFICE\WORD.vbs 1 File Hashes 00eb04840db63230036691b00cacffe5567aadd6b229d17393fc8c719cf48dab 05b6a0c3ab87724b04839a99ed6e25b3325df807106ebc7ce9066a4c77f
sha256027d80d4aef687ad5bcf965536b177137c0fc012b62e29dc247b315163beaef6e 1 %TEMP%\5426\5426.exe 1 %TEMP%\377\377.exe 1 File Hashes 027d80d4aef687ad5bcf965536b177137c0fc012b62e29dc247b315163beaef6 078cc1681e4c0cb4d0f61091390d81527c9748ec45a9f98118b3fe97051
sha25605b6a0c3ab87724b04839a99ed6e25b3325df807106ebc7ce9066a4c77fe326f4840db63230036691b00cacffe5567aadd6b229d17393fc8c719cf48dab 05b6a0c3ab87724b04839a99ed6e25b3325df807106ebc7ce9066a4c77fe326f 1182fc97b4bbff5c4e196604c56c432dbfd21333a298456429abf24c96c
sha256078cc1681e4c0cb4d0f61091390d81527c9748ec45a9f98118b3fe97051220b70d4aef687ad5bcf965536b177137c0fc012b62e29dc247b315163beaef6 078cc1681e4c0cb4d0f61091390d81527c9748ec45a9f98118b3fe97051220b7 166b08c9b00a86bb21418bd00d3e9c445fb99ca32d14fde2c69a25082c6
sha2561182fc97b4bbff5c4e196604c56c432dbfd21333a298456429abf24c96c2b5840c3ab87724b04839a99ed6e25b3325df807106ebc7ce9066a4c77fe326f 1182fc97b4bbff5c4e196604c56c432dbfd21333a298456429abf24c96c2b584 353dbb46d2a041ec26b1b56c51166bf733de21550ef8dcba55d03705713
sha256166b08c9b00a86bb21418bd00d3e9c445fb99ca32d14fde2c69a25082c6d7e5a1681e4c0cb4d0f61091390d81527c9748ec45a9f98118b3fe97051220b7 166b08c9b00a86bb21418bd00d3e9c445fb99ca32d14fde2c69a25082c6d7e5a 3220271f4c7423c530db8a7c1c9714c6f1fad1be0b803c48ca5514c7758
sha256180ece74b103cdbf59f0a8f37f80d86735e257de0c63748342abc10e88844877Vhipcno.bat 1 %ProgramFiles(x86)%\Mgucqww.exe 1 File Hashes 180ece74b103cdbf59f0a8f37f80d86735e257de0c63748342abc10e88844877 23925c212a1511b15601983e61c448f0a81d5ff2400aad2b0dfb2130f83
sha2561ee828baaa452d0318a1badef9d56f8a8ee05d3599c9f6c8dcb54ae322a392fdes created Occurrences %TEMP%\foxupdater.exe 20 File Hashes 1ee828baaa452d0318a1badef9d56f8a8ee05d3599c9f6c8dcb54ae322a392fd 25e06d5c6183431c27c5fb676df9299536afb875ed0f1c40b0971fa18dd
sha25623925c212a1511b15601983e61c448f0a81d5ff2400aad2b0dfb2130f83db26de74b103cdbf59f0a8f37f80d86735e257de0c63748342abc10e88844877 23925c212a1511b15601983e61c448f0a81d5ff2400aad2b0dfb2130f83db26d 39f7c40cdd521567c481ac4b6b876c2124aadc6068cb7706ea33097524a
sha25625e06d5c6183431c27c5fb676df9299536afb875ed0f1c40b0971fa18dd4e8958baaa452d0318a1badef9d56f8a8ee05d3599c9f6c8dcb54ae322a392fd 25e06d5c6183431c27c5fb676df9299536afb875ed0f1c40b0971fa18dd4e895 26456e576a208be3f0b95f5622a7b76c0af35f9544429fe1c358365db49
sha25626456e576a208be3f0b95f5622a7b76c0af35f9544429fe1c358365db49be4e9d5c6183431c27c5fb676df9299536afb875ed0f1c40b0971fa18dd4e895 26456e576a208be3f0b95f5622a7b76c0af35f9544429fe1c358365db49be4e9 2ff4fa86d4572329e55dcf36c8b652f0eb54a036d78992f6ea989f9815a
sha2562ff4fa86d4572329e55dcf36c8b652f0eb54a036d78992f6ea989f9815a7ce1ae576a208be3f0b95f5622a7b76c0af35f9544429fe1c358365db49be4e9 2ff4fa86d4572329e55dcf36c8b652f0eb54a036d78992f6ea989f9815a7ce1a 431ab948d4c702eb811be5a32453a6a0257ad2721db88e5b1b09c5817e8
sha2563220271f4c7423c530db8a7c1c9714c6f1fad1be0b803c48ca5514c77583f0c78c9b00a86bb21418bd00d3e9c445fb99ca32d14fde2c69a25082c6d7e5a 3220271f4c7423c530db8a7c1c9714c6f1fad1be0b803c48ca5514c77583f0c7 67b37834e66be76fb637be3ce10edbc02dc8067a7fbd7570a27d8d47c1b
sha256353dbb46d2a041ec26b1b56c51166bf733de21550ef8dcba55d03705713d5791c97b4bbff5c4e196604c56c432dbfd21333a298456429abf24c96c2b584 353dbb46d2a041ec26b1b56c51166bf733de21550ef8dcba55d03705713d5791 47f5e1a9b0b645de6a2c17f817e3563c2aa2b2a2d1c2eb7fa266503d187
sha25639f7c40cdd521567c481ac4b6b876c2124aadc6068cb7706ea33097524ac4be9c212a1511b15601983e61c448f0a81d5ff2400aad2b0dfb2130f83db26d 39f7c40cdd521567c481ac4b6b876c2124aadc6068cb7706ea33097524ac4be9 45789525d5ccc00b4a5148aed0d15e980059525a4ce1ffd1b52f18e9f06
sha256431ab948d4c702eb811be5a32453a6a0257ad2721db88e5b1b09c5817e8786fca86d4572329e55dcf36c8b652f0eb54a036d78992f6ea989f9815a7ce1a 431ab948d4c702eb811be5a32453a6a0257ad2721db88e5b1b09c5817e8786fc 486ddd85daaaca6fce26f5be2ae7eb6e4cf84356bfcda16e1be69419a5f
sha25645789525d5ccc00b4a5148aed0d15e980059525a4ce1ffd1b52f18e9f0606c2740cdd521567c481ac4b6b876c2124aadc6068cb7706ea33097524ac4be9 45789525d5ccc00b4a5148aed0d15e980059525a4ce1ffd1b52f18e9f0606c27 62512c22b06a8e3d2ceeff6e8a0acded0d2a45e476c1fda5abdb86704fc
sha25647f5e1a9b0b645de6a2c17f817e3563c2aa2b2a2d1c2eb7fa266503d1871ccf4b46d2a041ec26b1b56c51166bf733de21550ef8dcba55d03705713d5791 47f5e1a9b0b645de6a2c17f817e3563c2aa2b2a2d1c2eb7fa266503d1871ccf4 53e152a481cd7982ebe8e8e75a9c075f220262dfced375704e2ca22dfb3
sha256486ddd85daaaca6fce26f5be2ae7eb6e4cf84356bfcda16e1be69419a5f1711d948d4c702eb811be5a32453a6a0257ad2721db88e5b1b09c5817e8786fc 486ddd85daaaca6fce26f5be2ae7eb6e4cf84356bfcda16e1be69419a5f1711d 4f897c309f9776ecd32c026fd95730f3d800e75d66e2a2c7316e87b18a0
sha2564f897c309f9776ecd32c026fd95730f3d800e75d66e2a2c7316e87b18a0fde00d85daaaca6fce26f5be2ae7eb6e4cf84356bfcda16e1be69419a5f1711d 4f897c309f9776ecd32c026fd95730f3d800e75d66e2a2c7316e87b18a0fde00 5bb31cd6bc300b99aa3ffd75669c0d5db8e72ee5e92fd4da1a142bf6d53
sha25653e152a481cd7982ebe8e8e75a9c075f220262dfced375704e2ca22dfb3e7c871a9b0b645de6a2c17f817e3563c2aa2b2a2d1c2eb7fa266503d1871ccf4 53e152a481cd7982ebe8e8e75a9c075f220262dfced375704e2ca22dfb3e7c87 61bdf6a8fda9449af2d057b6f6c11487c5ca41389f19ecc1dfa809f4cb4
sha2565bb31cd6bc300b99aa3ffd75669c0d5db8e72ee5e92fd4da1a142bf6d535ecb8c309f9776ecd32c026fd95730f3d800e75d66e2a2c7316e87b18a0fde00 5bb31cd6bc300b99aa3ffd75669c0d5db8e72ee5e92fd4da1a142bf6d535ecb8 5bcb2180f9b47d6d47f3a34329abc443f2d3bda89bd473f99d1c9442281
sha2565bcb2180f9b47d6d47f3a34329abc443f2d3bda89bd473f99d1c9442281abc3acd6bc300b99aa3ffd75669c0d5db8e72ee5e92fd4da1a142bf6d535ecb8 5bcb2180f9b47d6d47f3a34329abc443f2d3bda89bd473f99d1c9442281abc3a 73ad9dbc8c06b67f3243d07694d080303b866df802240d107901405ae55
sha25661bdf6a8fda9449af2d057b6f6c11487c5ca41389f19ecc1dfa809f4cb4bdc332a481cd7982ebe8e8e75a9c075f220262dfced375704e2ca22dfb3e7c87 61bdf6a8fda9449af2d057b6f6c11487c5ca41389f19ecc1dfa809f4cb4bdc33 6c30fa3b8b0ab3bc9c9311d3af030214806b1e5acb04cebdb3a559e4e7b
sha25662512c22b06a8e3d2ceeff6e8a0acded0d2a45e476c1fda5abdb86704fc71ad6525d5ccc00b4a5148aed0d15e980059525a4ce1ffd1b52f18e9f0606c27 62512c22b06a8e3d2ceeff6e8a0acded0d2a45e476c1fda5abdb86704fc71ad6 6f3817e26b094cc3974970666a756edc4064ed535a347f04e74938a768c
sha25667b37834e66be76fb637be3ce10edbc02dc8067a7fbd7570a27d8d47c1b8c01771f4c7423c530db8a7c1c9714c6f1fad1be0b803c48ca5514c77583f0c7 67b37834e66be76fb637be3ce10edbc02dc8067a7fbd7570a27d8d47c1b8c017 7eccbc3ead189e38be91f2838c4e8954455563a2c63e19d75558e879161
sha2566c30fa3b8b0ab3bc9c9311d3af030214806b1e5acb04cebdb3a559e4e7bf11b36a8fda9449af2d057b6f6c11487c5ca41389f19ecc1dfa809f4cb4bdc33 6c30fa3b8b0ab3bc9c9311d3af030214806b1e5acb04cebdb3a559e4e7bf11b3 7385eb0f72f1aa66592d330fc64ed2d850c97abbf67d9e61206e29e646d
sha2566f3817e26b094cc3974970666a756edc4064ed535a347f04e74938a768cf8a27c22b06a8e3d2ceeff6e8a0acded0d2a45e476c1fda5abdb86704fc71ad6 6f3817e26b094cc3974970666a756edc4064ed535a347f04e74938a768cf8a27 78ca6de2cbde73fd0096e4f14311d439fee3a2f7646b0717a89fa2c14ad
sha2567385eb0f72f1aa66592d330fc64ed2d850c97abbf67d9e61206e29e646d2032fa3b8b0ab3bc9c9311d3af030214806b1e5acb04cebdb3a559e4e7bf11b3 7385eb0f72f1aa66592d330fc64ed2d850c97abbf67d9e61206e29e646d2032f 7a91d1ce466d52a1d498fad63e47f24771356bbb79cca25bd585026d78e
sha25673ad9dbc8c06b67f3243d07694d080303b866df802240d107901405ae555e83d180f9b47d6d47f3a34329abc443f2d3bda89bd473f99d1c9442281abc3a 73ad9dbc8c06b67f3243d07694d080303b866df802240d107901405ae555e83d 80641c380f6576daac3a5ed7365d4f244fdc78f2fbb3a4654b56deffbaf
sha25678ca6de2cbde73fd0096e4f14311d439fee3a2f7646b0717a89fa2c14addbcc97e26b094cc3974970666a756edc4064ed535a347f04e74938a768cf8a27 78ca6de2cbde73fd0096e4f14311d439fee3a2f7646b0717a89fa2c14addbcc9 905f03f2f3bb2f8138d3f31484a3ccdb462606303fbe93f6b9e161f329a
sha2567a91d1ce466d52a1d498fad63e47f24771356bbb79cca25bd585026d78ead807b0f72f1aa66592d330fc64ed2d850c97abbf67d9e61206e29e646d2032f 7a91d1ce466d52a1d498fad63e47f24771356bbb79cca25bd585026d78ead807 7ce3ee2f73f5a31415b558e28a46c05817ae82fb6e58b381d7d0d3a5eec
sha2567ce3ee2f73f5a31415b558e28a46c05817ae82fb6e58b381d7d0d3a5eec2f2931ce466d52a1d498fad63e47f24771356bbb79cca25bd585026d78ead807 7ce3ee2f73f5a31415b558e28a46c05817ae82fb6e58b381d7d0d3a5eec2f293 8009a2d6798bde4245567a8472beb123edfb5631c13f1d8e6ec62ef0ff2
sha2567eccbc3ead189e38be91f2838c4e8954455563a2c63e19d75558e8791619abf1834e66be76fb637be3ce10edbc02dc8067a7fbd7570a27d8d47c1b8c017 7eccbc3ead189e38be91f2838c4e8954455563a2c63e19d75558e8791619abf1 8171a5ec2079c8c1807b398b4f14c4d53a992d4d1ccbbbbf1d8ee60c1a5
sha2568009a2d6798bde4245567a8472beb123edfb5631c13f1d8e6ec62ef0ff20c617e2f73f5a31415b558e28a46c05817ae82fb6e58b381d7d0d3a5eec2f293 8009a2d6798bde4245567a8472beb123edfb5631c13f1d8e6ec62ef0ff20c617 8e9a4886218312983692cd92e8fc24cea285604b1ad4e933dbd572f8feb
sha25680641c380f6576daac3a5ed7365d4f244fdc78f2fbb3a4654b56deffbaf29a3ddbc8c06b67f3243d07694d080303b866df802240d107901405ae555e83d 80641c380f6576daac3a5ed7365d4f244fdc78f2fbb3a4654b56deffbaf29a3d 827590683047f223dad8f70661d8255f02f59c6153fb18d1e1d1e01347e
sha2568171a5ec2079c8c1807b398b4f14c4d53a992d4d1ccbbbbf1d8ee60c1a51dbedc3ead189e38be91f2838c4e8954455563a2c63e19d75558e8791619abf1 8171a5ec2079c8c1807b398b4f14c4d53a992d4d1ccbbbbf1d8ee60c1a51dbed 88f06b89e9e53160a944ab25a30d2f59a82807303a34767ae6c81714d06
sha256827590683047f223dad8f70661d8255f02f59c6153fb18d1e1d1e01347e46358c380f6576daac3a5ed7365d4f244fdc78f2fbb3a4654b56deffbaf29a3d 827590683047f223dad8f70661d8255f02f59c6153fb18d1e1d1e01347e46358 86fd57bf637914755e2a5465ebc731bc7592beaf8e9431e0e58242e292a
sha25686fd57bf637914755e2a5465ebc731bc7592beaf8e9431e0e58242e292ae1bcd0683047f223dad8f70661d8255f02f59c6153fb18d1e1d1e01347e46358 86fd57bf637914755e2a5465ebc731bc7592beaf8e9431e0e58242e292ae1bcd 897b7276724d6dcf490700bc2e0c8bcdc6c9d7b81cb129bcb0a964512ff
sha25688f06b89e9e53160a944ab25a30d2f59a82807303a34767ae6c81714d067640d5ec2079c8c1807b398b4f14c4d53a992d4d1ccbbbbf1d8ee60c1a51dbed 88f06b89e9e53160a944ab25a30d2f59a82807303a34767ae6c81714d067640d 8a72076cdb3cd82e07eca1a4282d46eb99515ee08400285a22dabcd88ea
sha256897b7276724d6dcf490700bc2e0c8bcdc6c9d7b81cb129bcb0a964512ffa65f97bf637914755e2a5465ebc731bc7592beaf8e9431e0e58242e292ae1bcd 897b7276724d6dcf490700bc2e0c8bcdc6c9d7b81cb129bcb0a964512ffa65f9 93ed23c90e7861a0d49b1dbf371a621552736c13a3cb9f9290aa19359ed
sha2568a72076cdb3cd82e07eca1a4282d46eb99515ee08400285a22dabcd88eab2e84b89e9e53160a944ab25a30d2f59a82807303a34767ae6c81714d067640d 8a72076cdb3cd82e07eca1a4282d46eb99515ee08400285a22dabcd88eab2e84 e774c8e0fab651c62ee5f0aea84759cc83065afa144ee39013fbee749d2
sha2568e9a4886218312983692cd92e8fc24cea285604b1ad4e933dbd572f8feb4a8d82d6798bde4245567a8472beb123edfb5631c13f1d8e6ec62ef0ff20c617 8e9a4886218312983692cd92e8fc24cea285604b1ad4e933dbd572f8feb4a8d8 a29a76409e778370383c89c0b69ce5291664268e9a65c3a7d3274a5a493
sha256905f03f2f3bb2f8138d3f31484a3ccdb462606303fbe93f6b9e161f329a0caa9de2cbde73fd0096e4f14311d439fee3a2f7646b0717a89fa2c14addbcc9 905f03f2f3bb2f8138d3f31484a3ccdb462606303fbe93f6b9e161f329a0caa9 96d6db813da96f1508ff61080d630ae46408cc609ab7c3a40be62814932
sha25693ed23c90e7861a0d49b1dbf371a621552736c13a3cb9f9290aa19359ed05e63276724d6dcf490700bc2e0c8bcdc6c9d7b81cb129bcb0a964512ffa65f9 93ed23c90e7861a0d49b1dbf371a621552736c13a3cb9f9290aa19359ed05e63 946d53247eb42ce346e399862371d235b997fd565b8823d39f82fa8c778
sha256946d53247eb42ce346e399862371d235b997fd565b8823d39f82fa8c7788a85b3c90e7861a0d49b1dbf371a621552736c13a3cb9f9290aa19359ed05e63 946d53247eb42ce346e399862371d235b997fd565b8823d39f82fa8c7788a85b d0c38e46f3903b1533741dfbb981944f4d10c7e273c6d3df8ba5b873ec7
sha25696d6db813da96f1508ff61080d630ae46408cc609ab7c3a40be628149325c11c3f2f3bb2f8138d3f31484a3ccdb462606303fbe93f6b9e161f329a0caa9 96d6db813da96f1508ff61080d630ae46408cc609ab7c3a40be628149325c11c 973c166822b4fb42e5f786842712f9688f34c2f6895d6a93e2fe926e39d
sha256973c166822b4fb42e5f786842712f9688f34c2f6895d6a93e2fe926e39d1e183b813da96f1508ff61080d630ae46408cc609ab7c3a40be628149325c11c 973c166822b4fb42e5f786842712f9688f34c2f6895d6a93e2fe926e39d1e183 a265cf3a258b2af0b0e136f08569ebdf2ccd3f34513ed600d07accf8c27
sha256a265cf3a258b2af0b0e136f08569ebdf2ccd3f34513ed600d07accf8c270529b66822b4fb42e5f786842712f9688f34c2f6895d6a93e2fe926e39d1e183 a265cf3a258b2af0b0e136f08569ebdf2ccd3f34513ed600d07accf8c270529b ba771c968b5a7f61320d6393753544ea54c4caf47204335ac805016e5dc
sha256a29a76409e778370383c89c0b69ce5291664268e9a65c3a7d3274a5a49398179886218312983692cd92e8fc24cea285604b1ad4e933dbd572f8feb4a8d8 a29a76409e778370383c89c0b69ce5291664268e9a65c3a7d3274a5a49398179 a86c38bebebc72b6749ad50c370c738a83fe3799a1c0357c14099d0e127
sha256a86c38bebebc72b6749ad50c370c738a83fe3799a1c0357c14099d0e1275750c6409e778370383c89c0b69ce5291664268e9a65c3a7d3274a5a49398179 a86c38bebebc72b6749ad50c370c738a83fe3799a1c0357c14099d0e1275750c aa1e0983c213de92652f85e8ba2f5f0d8a8cd7ceb395981495ba1762917
sha256aa1e0983c213de92652f85e8ba2f5f0d8a8cd7ceb395981495ba1762917dfa338bebebc72b6749ad50c370c738a83fe3799a1c0357c14099d0e1275750c aa1e0983c213de92652f85e8ba2f5f0d8a8cd7ceb395981495ba1762917dfa33 aa7079829cb7eaa96ef06d420f44ff2a834233ff9534c5dc8d4d04671b8
sha256aa7079829cb7eaa96ef06d420f44ff2a834233ff9534c5dc8d4d04671b873a59983c213de92652f85e8ba2f5f0d8a8cd7ceb395981495ba1762917dfa33 aa7079829cb7eaa96ef06d420f44ff2a834233ff9534c5dc8d4d04671b873a59 b82e08212cee722bc2d004a001523a97572823e1be786e0dc596bed10d5
sha256b82e08212cee722bc2d004a001523a97572823e1be786e0dc596bed10d52a8fd9829cb7eaa96ef06d420f44ff2a834233ff9534c5dc8d4d04671b873a59 b82e08212cee722bc2d004a001523a97572823e1be786e0dc596bed10d52a8fd c0b402a4f08b7d9a40d478350300d15c71de3da80c65d21e046a30ce37a
sha256ba771c968b5a7f61320d6393753544ea54c4caf47204335ac805016e5dcbec49f3a258b2af0b0e136f08569ebdf2ccd3f34513ed600d07accf8c270529b ba771c968b5a7f61320d6393753544ea54c4caf47204335ac805016e5dcbec49 bad7e73891556abd526f9cf32e4b2e961d2c8b911624c43158e6e641d8f
sha256bad7e73891556abd526f9cf32e4b2e961d2c8b911624c43158e6e641d8fdd093c968b5a7f61320d6393753544ea54c4caf47204335ac805016e5dcbec49 bad7e73891556abd526f9cf32e4b2e961d2c8b911624c43158e6e641d8fdd093 be79cac4f5fdef9437562409d9c4a37c985c3f9010f601efbbfe92d90c9
sha256be79cac4f5fdef9437562409d9c4a37c985c3f9010f601efbbfe92d90c95e45a73891556abd526f9cf32e4b2e961d2c8b911624c43158e6e641d8fdd093 be79cac4f5fdef9437562409d9c4a37c985c3f9010f601efbbfe92d90c95e45a f7f3f418df156e1a6d1ee27d611baf7d77b64f9ce309cb1cfd0052ead95
sha256c0b402a4f08b7d9a40d478350300d15c71de3da80c65d21e046a30ce37a459e38212cee722bc2d004a001523a97572823e1be786e0dc596bed10d52a8fd c0b402a4f08b7d9a40d478350300d15c71de3da80c65d21e046a30ce37a459e3 d4b206b6dff3baf8ead3fb174e80025d8f84edb4787813d0e7041470975
sha256d0c38e46f3903b1533741dfbb981944f4d10c7e273c6d3df8ba5b873ec7ed8213247eb42ce346e399862371d235b997fd565b8823d39f82fa8c7788a85b d0c38e46f3903b1533741dfbb981944f4d10c7e273c6d3df8ba5b873ec7ed821 dd3c60ded429342847acaa695775b8a12aa0e68a21e7de7405c0921ec19
sha256d4b206b6dff3baf8ead3fb174e80025d8f84edb4787813d0e704147097596c1b2a4f08b7d9a40d478350300d15c71de3da80c65d21e046a30ce37a459e3 d4b206b6dff3baf8ead3fb174e80025d8f84edb4787813d0e704147097596c1b f9a5b6cf55cfdf80c976902388c26e62bbf622cd3434baa49dff92ffca8
sha256dd3c60ded429342847acaa695775b8a12aa0e68a21e7de7405c0921ec19bb9e7e46f3903b1533741dfbb981944f4d10c7e273c6d3df8ba5b873ec7ed821 dd3c60ded429342847acaa695775b8a12aa0e68a21e7de7405c0921ec19bb9e7 e7edf096e5b0f47505a82e3224c9238305570075a7c1f270abf0762cf81
sha256e774c8e0fab651c62ee5f0aea84759cc83065afa144ee39013fbee749d20990476cdb3cd82e07eca1a4282d46eb99515ee08400285a22dabcd88eab2e84 e774c8e0fab651c62ee5f0aea84759cc83065afa144ee39013fbee749d209904 Coverage Product Protection Secure Endpoint Cloudlock N/A C
sha256e7edf096e5b0f47505a82e3224c9238305570075a7c1f270abf0762cf8149f470ded429342847acaa695775b8a12aa0e68a21e7de7405c0921ec19bb9e7 e7edf096e5b0f47505a82e3224c9238305570075a7c1f270abf0762cf8149f47 e95635e780e83bdcc9b067d3deac612bcabcc9fdb870730cddeddd3f34c
sha256e95635e780e83bdcc9b067d3deac612bcabcc9fdb870730cddeddd3f34c90d68096e5b0f47505a82e3224c9238305570075a7c1f270abf0762cf8149f47 e95635e780e83bdcc9b067d3deac612bcabcc9fdb870730cddeddd3f34c90d68 Coverage Product Protection Secure Endpoint Cloudlock N/A C
sha256f7f3f418df156e1a6d1ee27d611baf7d77b64f9ce309cb1cfd0052ead9542b0bac4f5fdef9437562409d9c4a37c985c3f9010f601efbbfe92d90c95e45a f7f3f418df156e1a6d1ee27d611baf7d77b64f9ce309cb1cfd0052ead9542b0b Coverage Product Protection Secure Endpoint Cloudlock N/A C
sha256f9a5b6cf55cfdf80c976902388c26e62bbf622cd3434baa49dff92ffca8f6a586b6dff3baf8ead3fb174e80025d8f84edb4787813d0e704147097596c1b f9a5b6cf55cfdf80c976902388c26e62bbf622cd3434baa49dff92ffca8f6a58 Coverage Product Protection Secure Endpoint Cloudlock N/A C
Full article1,622 words · extracted from blog.talosintelligence.com · click to collapse

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 9 and Dec. 16. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. A visual depiction of the MITRE ATT&CK techniques associated with each threat is also shown. In these images, the brightness of the technique indicates how prevalent it is across all threat files where dynamic analysis was conducted. There are five distinct shades that are used, with the darkest indicating that no files exhibited technique behavior and the brightest indicating that technique behavior was observed from 75 percent or more of the files.

The most prevalent threats highlighted in this roundup are:

Threat NameTypeDescription
Win.Dropper.Lokibot-9980537-1DropperLokibot is an information-stealing malware designed to siphon off sensitive information stored on an infected device. It is modular in nature, supporting the ability to steal sensitive information from a number of popular applications. It is commonly pushed via malicious documents delivered via spam emails.
Win.Packed.Upatre-9980519-1PackedUpatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.
Win.Dropper.Gh0stRAT-9980455-1DropperGh0stRAT is a well-known family of remote access trojans designed to provide an attacker with complete control over an infected system. Capabilities include monitoring keystrokes, collecting video footage from the webcam, and uploading/executing follow-on malware. The source code for Gh0stRAT has been publicly available on the Internet for years, significantly lowering the barrier for actors to modify and reuse the code in new attacks.
Win.Dropper.njRAT-9980427-0DroppernjRAT, also known as Bladabindi, is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.
Win.Ransomware.TeslaCrypt-9980413-0RansomwareTeslaCrypt is a well-known ransomware family that encrypts a user's files with strong encryption and demands Bitcoin in exchange for a file decryption service. A flaw in the encryption algorithm was discovered that allowed files to be decrypted without paying the ransomware, and eventually, the malware developers released the master key allowing all encrypted files to be recovered easily.
Win.Ransomware.Cerber-9980410-0RansomwareCerber is ransomware that encrypts documents, photos, databases and other important files. Historically, this malware would replace files with encrypted versions and add the file extension ".cerber," although in more recent campaigns other file extensions are used.
Win.Dropper.Nanocore-9980555-0DropperNanocore is a .NET remote access trojan. Its source code has been leaked several times, making it widely available. Like other RATs, it allows full control of the system, including recording video and audio, stealing passwords, downloading files and recording keystrokes.
Win.Dropper.HawkEye-9980407-0DropperHawkeye is an information stealing malware that specifically targets usernames and passwords stored by web browsers and mail clients on an infected machine. It is commonly spread via email and can also propagate through removable media.

Threat Breakdown

Win.Dropper.Lokibot-9980537-1

Indicators of Compromise

  • IOCs collected from dynamic analysis of 21 samples
Registry KeysOccurrences
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
Value Name: Hidden		6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Windows Update		6
<HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E
Value Name: LanguageList		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Registry Key Name		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: WORD		1
MutexesOccurrences
3749282D282E1E80C56CAE5A12
Global\<random guid>5
d19ab989-a35f-4710-83df-7b2db7efe7c5{846ee340-7039-11de-9d20-806e6f6e6963}1
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
104[.]16[.]154[.]364
104[.]16[.]155[.]362
172[.]105[.]103[.]2072
81[.]92[.]202[.]1361
81[.]17[.]18[.]1981
208[.]95[.]112[.]11
89[.]249[.]66[.]531
81[.]17[.]29[.]1471
3[.]232[.]63[.]711
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
whatismyipaddress[.]com6
optimurn[.]host3
thammyvienanthea[.]com2
changdeacorp[.]com2
ip-api[.]com1
checkip[.]amazonaws[.]com1
rikolexx[.]com1
hooklinez[.]us1
smtp[.]easterncarqo[.]co[.]in1
mytradecrypto[.]ug1
www[.]forgivers2019[.]tk1
Files and or directories createdOccurrences
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2580483871-590521980-3826313501-500\a18ca4003deb042bbee7a40f15e1970b_d19ab989-a35f-4710-83df-7b2db7efe7c512
%APPDATA%\D282E110
%APPDATA%\D282E1\1E80C5.lck10
%APPDATA%\pid.txt6
%APPDATA%\pidloc.txt6
%APPDATA%\WindowsUpdate.exe6
%TEMP%\holdermail.txt2
%System32%\drivers\etc\hosts1
%TEMP%\subfolder1
%ProgramData%1
%TEMP%\holderwb.txt1
%TEMP%\subfolder\chop.exe1
%TEMP%\subfolder\chop.vbs1
%ProgramData%\B21QM0NIFTICFK3T1SLF1
%ProgramData%\B21QM0NIFTICFK3T1SLF\US_d19ab989-a35f-4710-83df-7b2db7efe7c58659815602.zip1
%ProgramData%\B21QM0NIFTICFK3T1SLF\files1
%ProgramData%\B21QM0NIFTICFK3T1SLF\files\Soft1
%ProgramData%\B21QM0NIFTICFK3T1SLF\files\Soft\Authy1
%ProgramData%\B21QM0NIFTICFK3T1SLF\files\information.txt1
%ProgramData%\B21QM0NIFTICFK3T1SLF\files\outlook.txt1
%ProgramData%\B21QM0NIFTICFK3T1SLF\files\passwords.txt1
%TEMP%\OFFICE1
%TEMP%\OFFICE\WORD.exe1
%TEMP%\OFFICE\WORD.vbs1

File Hashes

00eb04840db63230036691b00cacffe5567aadd6b229d17393fc8c719cf48dab
05b6a0c3ab87724b04839a99ed6e25b3325df807106ebc7ce9066a4c77fe326f
1182fc97b4bbff5c4e196604c56c432dbfd21333a298456429abf24c96c2b584
353dbb46d2a041ec26b1b56c51166bf733de21550ef8dcba55d03705713d5791
47f5e1a9b0b645de6a2c17f817e3563c2aa2b2a2d1c2eb7fa266503d1871ccf4
53e152a481cd7982ebe8e8e75a9c075f220262dfced375704e2ca22dfb3e7c87
61bdf6a8fda9449af2d057b6f6c11487c5ca41389f19ecc1dfa809f4cb4bdc33
6c30fa3b8b0ab3bc9c9311d3af030214806b1e5acb04cebdb3a559e4e7bf11b3
7385eb0f72f1aa66592d330fc64ed2d850c97abbf67d9e61206e29e646d2032f
7a91d1ce466d52a1d498fad63e47f24771356bbb79cca25bd585026d78ead807
7ce3ee2f73f5a31415b558e28a46c05817ae82fb6e58b381d7d0d3a5eec2f293
8009a2d6798bde4245567a8472beb123edfb5631c13f1d8e6ec62ef0ff20c617
8e9a4886218312983692cd92e8fc24cea285604b1ad4e933dbd572f8feb4a8d8
a29a76409e778370383c89c0b69ce5291664268e9a65c3a7d3274a5a49398179
a86c38bebebc72b6749ad50c370c738a83fe3799a1c0357c14099d0e1275750c
aa1e0983c213de92652f85e8ba2f5f0d8a8cd7ceb395981495ba1762917dfa33
aa7079829cb7eaa96ef06d420f44ff2a834233ff9534c5dc8d4d04671b873a59
b82e08212cee722bc2d004a001523a97572823e1be786e0dc596bed10d52a8fd
c0b402a4f08b7d9a40d478350300d15c71de3da80c65d21e046a30ce37a459e3
d4b206b6dff3baf8ead3fb174e80025d8f84edb4787813d0e704147097596c1b
f9a5b6cf55cfdf80c976902388c26e62bbf622cd3434baa49dff92ffca8f6a58

Coverage

ProductProtection
Secure EndpointThis has coverage
CloudlockN/A
CWSThis has coverage
Email SecurityThis has coverage
Network SecurityThis has coverage
StealthwatchN/A
Stealthwatch CloudN/A
Secure Malware AnalyticsThis has coverage
UmbrellaThis has coverage
WSAThis has coverage

Screenshots of Detection

Secure Endpoint

Secure Malware Analytics

MITRE ATT&CK

Win.Packed.Upatre-9980519-1

Indicators of Compromise

  • IOCs collected from dynamic analysis of 20 samples
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
34[.]102[.]136[.]18020
3[.]64[.]163[.]5020
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
waytoloans[.]com20
thevelvetpouch[.]com20
Files and or directories createdOccurrences
%TEMP%\foxupdater.exe20

File Hashes

1ee828baaa452d0318a1badef9d56f8a8ee05d3599c9f6c8dcb54ae322a392fd
25e06d5c6183431c27c5fb676df9299536afb875ed0f1c40b0971fa18dd4e895
26456e576a208be3f0b95f5622a7b76c0af35f9544429fe1c358365db49be4e9
2ff4fa86d4572329e55dcf36c8b652f0eb54a036d78992f6ea989f9815a7ce1a
431ab948d4c702eb811be5a32453a6a0257ad2721db88e5b1b09c5817e8786fc
486ddd85daaaca6fce26f5be2ae7eb6e4cf84356bfcda16e1be69419a5f1711d
4f897c309f9776ecd32c026fd95730f3d800e75d66e2a2c7316e87b18a0fde00
5bb31cd6bc300b99aa3ffd75669c0d5db8e72ee5e92fd4da1a142bf6d535ecb8
5bcb2180f9b47d6d47f3a34329abc443f2d3bda89bd473f99d1c9442281abc3a
73ad9dbc8c06b67f3243d07694d080303b866df802240d107901405ae555e83d
80641c380f6576daac3a5ed7365d4f244fdc78f2fbb3a4654b56deffbaf29a3d
827590683047f223dad8f70661d8255f02f59c6153fb18d1e1d1e01347e46358
86fd57bf637914755e2a5465ebc731bc7592beaf8e9431e0e58242e292ae1bcd
897b7276724d6dcf490700bc2e0c8bcdc6c9d7b81cb129bcb0a964512ffa65f9
93ed23c90e7861a0d49b1dbf371a621552736c13a3cb9f9290aa19359ed05e63
946d53247eb42ce346e399862371d235b997fd565b8823d39f82fa8c7788a85b
d0c38e46f3903b1533741dfbb981944f4d10c7e273c6d3df8ba5b873ec7ed821
dd3c60ded429342847acaa695775b8a12aa0e68a21e7de7405c0921ec19bb9e7
e7edf096e5b0f47505a82e3224c9238305570075a7c1f270abf0762cf8149f47
e95635e780e83bdcc9b067d3deac612bcabcc9fdb870730cddeddd3f34c90d68

Coverage

ProductProtection
Secure EndpointThis has coverage
CloudlockN/A
CWSThis has coverage
Email SecurityThis has coverage
Network SecurityThis has coverage
StealthwatchN/A
Stealthwatch CloudN/A
Secure Malware AnalyticsThis has coverage
UmbrellaN/A
WSAN/A

Screenshots of Detection

Secure Endpoint

Secure Malware Analytics

MITRE ATT&CK

Win.Dropper.Gh0stRAT-9980455-1

Indicators of Compromise

  • IOCs collected from dynamic analysis of 15 samples
Registry KeysOccurrences
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\RS<random, matching '[A-Z]{4} [A-Z]{8}'>7
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\RS<random, matching '[A-Z]{4} [A-Z]{8}'>
Value Name: Type		7
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\RS<random, matching '[A-Z]{4} [A-Z]{8}'>
Value Name: Start		7
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\RS<random, matching '[A-Z]{4} [A-Z]{8}'>
Value Name: ErrorControl		7
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\RS<random, matching '[A-Z]{4} [A-Z]{8}'>
Value Name: ImagePath		7
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\RS<random, matching '[A-Z]{4} [A-Z]{8}'>
Value Name: DisplayName		7
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\RS<random, matching '[A-Z]{4} [A-Z]{8}'>
Value Name: WOW64		7
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\RS<random, matching '[A-Z]{4} [A-Z]{8}'>
Value Name: ObjectName		7
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\RS<random, matching '[A-Z]{4} [A-Z]{8}'>
Value Name: Description		7
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\RS<random, matching '[A-Z]{4} [A-Z]{8}'>
Value Name: FailureActions		7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN4
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSKSIG WCUGIQYA1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSGAQA MIWWEAEK1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSKSIG WCUGIQYA
Value Name: ConnectGroup		1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSKSIG WCUGIQYA
Value Name: MarkTime		1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSGAQA MIWWEAEK
Value Name: ConnectGroup		1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSRCPV RFBCWOYQ1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSRCPV RFBCWOYQ
Value Name: ConnectGroup		1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSGAQA MIWWEAEK
Value Name: MarkTime		1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSRCPV RFBCWOYQ
Value Name: MarkTime		1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSDETK YARSERIW1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSDETK YARSERIW
Value Name: ConnectGroup		1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSDETK YARSERIW
Value Name: MarkTime		1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSTEZX RZPQCQUK1
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\RSTEZX RZPQCQUK
Value Name: ConnectGroup		1
MutexesOccurrences
KyUffThOkYwRRtgPP1
127.0.0.1:8888:Rscdxm riifdjka1
171.214.11.140:6666:Rsmwis uuasausu1
127.0.0.1:8888:Rsrajf bxvuoiyo1
zxjice.e2.luyouxia.net:26000:Rsksig wcugiqya1
127.0.0.1:2022:Rsrcpv rfbcwoyq1
192.168.1.159:2022:Rsdetk yarseriw1
180.76.120.191:8888:Rsgaqa miwweaek1
lcaus786.e2.luyouxia.net:22785:21086:Rstezx rzpqcquk1
111.67.207.155:2024:Rsieyo ysssmucy1
192.168.1.45:80:Rswoae mymisigc1
wbswchrjx.e2.luyouxia.net:28720:Rsdivy soncwnqq1
ovo520.e2.luyouxia.net:20012:Rsqeiw yqkquikq1
chx031x.e2.luyouxia.net:6471:Rsflnl ppdpdwhy1
127.0.0.1:8000:Rsqqss iiqmoqcy1
ikun100.e2.luyouxia.net:28249:Rsghzj kmnmrnla1
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
47[.]52[.]162[.]138
124[.]70[.]9[.]1493
123[.]99[.]198[.]2013
43[.]248[.]129[.]492
154[.]19[.]202[.]1861
120[.]26[.]55[.]1791
171[.]214[.]11[.]1401
180[.]76[.]120[.]1911
111[.]67[.]207[.]1551
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
guduo[.]xyz8
lqwljs[.]cn2
www[.]bing[.]com1
ikun100[.]e2[.]luyouxia[.]net1
sjlwql[.]top1
zxjice[.]e2[.]luyouxia[.]net1
wbswchrjx[.]e2[.]luyouxia[.]net1
ovo520[.]e2[.]luyouxia[.]net1
chx031x[.]e2[.]luyouxia[.]net1
Files and or directories createdOccurrences
%ProgramFiles(x86)%\Microsoft1
%ProgramFiles(x86)%\Microsoft\DesktopLayer.exe1
%ProgramFiles(x86)%\Cayeqau.exe1
%ProgramFiles(x86)%\Microsoft\px7B89.tmp1
\TEMP\62c619724cfde20c7571df62d38331b6Srv.exe1
%ProgramFiles(x86)%\Thrnvvd.exe1
%ProgramFiles(x86)%\Ygkuwmk.exe1
%ProgramFiles(x86)%\Gkykrps.exe1
%ProgramFiles(x86)%\Bwfjsue.exe1
%ProgramFiles(x86)%\Microsoft Fazazl1
%ProgramFiles(x86)%\Microsoft Fazazl\Vhipcno.bat1
%ProgramFiles(x86)%\Mgucqww.exe1

File Hashes

180ece74b103cdbf59f0a8f37f80d86735e257de0c63748342abc10e88844877
23925c212a1511b15601983e61c448f0a81d5ff2400aad2b0dfb2130f83db26d
39f7c40cdd521567c481ac4b6b876c2124aadc6068cb7706ea33097524ac4be9
45789525d5ccc00b4a5148aed0d15e980059525a4ce1ffd1b52f18e9f0606c27
62512c22b06a8e3d2ceeff6e8a0acded0d2a45e476c1fda5abdb86704fc71ad6
6f3817e26b094cc3974970666a756edc4064ed535a347f04e74938a768cf8a27
78ca6de2cbde73fd0096e4f14311d439fee3a2f7646b0717a89fa2c14addbcc9
905f03f2f3bb2f8138d3f31484a3ccdb462606303fbe93f6b9e161f329a0caa9
96d6db813da96f1508ff61080d630ae46408cc609ab7c3a40be628149325c11c
973c166822b4fb42e5f786842712f9688f34c2f6895d6a93e2fe926e39d1e183
a265cf3a258b2af0b0e136f08569ebdf2ccd3f34513ed600d07accf8c270529b
ba771c968b5a7f61320d6393753544ea54c4caf47204335ac805016e5dcbec49
bad7e73891556abd526f9cf32e4b2e961d2c8b911624c43158e6e641d8fdd093
be79cac4f5fdef9437562409d9c4a37c985c3f9010f601efbbfe92d90c95e45a
f7f3f418df156e1a6d1ee27d611baf7d77b64f9ce309cb1cfd0052ead9542b0b

Coverage

ProductProtection
Secure EndpointThis has coverage
CloudlockN/A
CWSThis has coverage
Email SecurityThis has coverage
Network SecurityThis has coverage
StealthwatchN/A
Stealthwatch CloudN/A
Secure Malware AnalyticsThis has coverage
UmbrellaThis has coverage
WSAThis has coverage

Screenshots of Detection

Secure Endpoint

Secure Malware Analytics

MITRE ATT&CK

Win.Dropper.njRAT-9980427-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 10 samples
Registry KeysOccurrences
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value Name: EnableLUA		10
<HKU>\S-1-5-21-2580483871-590521980-3826313501-500
Value Name: di		10
<HKCU>\ENVIRONMENT
Value Name: SEE_MASK_NOZONECHECKS		10
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value Name: ConsentPromptBehaviorAdmin		10
<HKCU>\SOFTWARE\7657C14284185FBD3FB108B43C7467BA9
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: 7657c14284185fbd3fb108b43c7467ba		9
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: 7657c14284185fbd3fb108b43c7467ba		9
<HKCU>\SOFTWARE\7657C14284185FBD3FB108B43C7467BA
Value Name: [kl]		9
<HKCU>\SOFTWARE\A12F2B7635CAFFDE3957A7CC18CDE5A91
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: a12f2b7635caffde3957a7cc18cde5a9		1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: a12f2b7635caffde3957a7cc18cde5a9		1
<HKCU>\SOFTWARE\A12F2B7635CAFFDE3957A7CC18CDE5A9
Value Name: [kl]		1
MutexesOccurrences
7657c14284185fbd3fb108b43c7467ba9
a12f2b7635caffde3957a7cc18cde5a91
Files and or directories createdOccurrences
%TEMP%\server.exe10
%TEMP%\<random, matching [A-F0-9]{3,4}>10
%TEMP%\4108\4108.exe1
%TEMP%\3355\3355.exe1
%TEMP%\5654\5654.exe1
%TEMP%\700\700.exe1
%TEMP%\5102\5102.exe1
%TEMP%\3539\3539.exe1
%TEMP%\6788\6788.exe1
%TEMP%\3217\3217.exe1
%TEMP%\5426\5426.exe1
%TEMP%\377\377.exe1

File Hashes

027d80d4aef687ad5bcf965536b177137c0fc012b62e29dc247b315163beaef6
078cc1681e4c0cb4d0f61091390d81527c9748ec45a9f98118b3fe97051220b7
166b08c9b00a86bb21418bd00d3e9c445fb99ca32d14fde2c69a25082c6d7e5a
3220271f4c7423c530db8a7c1c9714c6f1fad1be0b803c48ca5514c77583f0c7
67b37834e66be76fb637be3ce10edbc02dc8067a7fbd7570a27d8d47c1b8c017
7eccbc3ead189e38be91f2838c4e8954455563a2c63e19d75558e8791619abf1
8171a5ec2079c8c1807b398b4f14c4d53a992d4d1ccbbbbf1d8ee60c1a51dbed
88f06b89e9e53160a944ab25a30d2f59a82807303a34767ae6c81714d067640d
8a72076cdb3cd82e07eca1a4282d46eb99515ee08400285a22dabcd88eab2e84
e774c8e0fab651c62ee5f0aea84759cc83065afa144ee39013fbee749d209904

Coverage

ProductProtection
Secure EndpointThis has coverage
CloudlockN/A
CWSThis has coverage
Email SecurityThis has coverage
Network SecurityN/A
StealthwatchN/A
Stealthwatch CloudN/A
Secure Malware AnalyticsThis has coverage
UmbrellaN/A
WSAN/A

Screenshots of Detection

Secure Endpoint

Secure Malware Analytics

MITRE ATT&CK

Win.Ransomware.TeslaCrypt-9980413-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 16 samples
Registry KeysOccurrences
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value Name: EnableLinkedConnections		16
<HKCU>\SOFTWARE\XXXSYS16
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.CHECK.0
Value Name: CheckSetting		16
<HKCU>\SOFTWARE\XXXSYS
Value Name: ID		16
<HKCU>\Software\<random, matching '[A-Z0-9]{14,16}'>16
<HKCU>\Software\<random, matching '[A-Z0-9]{14,16}'>
Value Name: data		16
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: nljubyedlnab		2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: tdwkvyomimyb		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: hrajdeafhsjv		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: deafhsjvbsfl		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: lbkguwsbtylb		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: fkrqlfvsauct		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: hexececgsnlj		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: rbdybcshwwth		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: fjklmqygvwoa		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: krqlfvsauctw		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: xvblbkguwsbt		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: hqijwghjvpgt		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: veeqiqypcbef		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: croscewyhlyq		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: qiqypcbefwpf		1
MutexesOccurrences
ityeofm9234-2342316
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
110[.]45[.]144[.]17316
50[.]87[.]147[.]7316
35[.]205[.]61[.]6716
2[.]57[.]138[.]4715
3[.]33[.]152[.]1479
15[.]197[.]142[.]1737
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
ikstrade[.]co[.]kr16
lutheranph[.]com16
salesandmarketing101[.]net16
salaeigroup[.]com16
dustywinslow[.]com15
lovemydress[.]pl15
Files and or directories createdOccurrences
%ProgramFiles%\7-Zip\Lang\lv.txt16
%ProgramFiles%\7-Zip\Lang\mk.txt16
%ProgramFiles%\7-Zip\Lang\mn.txt16
%ProgramFiles%\7-Zip\Lang\mng.txt16
%ProgramFiles%\7-Zip\Lang\mng2.txt16
%ProgramFiles%\7-Zip\Lang\mr.txt16
%ProgramFiles%\7-Zip\Lang\ms.txt16
%ProgramFiles%\7-Zip\Lang\nb.txt16
%ProgramFiles%\7-Zip\Lang\ne.txt16
%ProgramFiles%\7-Zip\Lang\nl.txt16
%ProgramFiles%\7-Zip\Lang\nn.txt16
%ProgramFiles%\7-Zip\Lang\pa-in.txt16
%ProgramFiles%\7-Zip\Lang\pl.txt16
%ProgramFiles%\7-Zip\Lang\ps.txt16
%ProgramFiles%\7-Zip\Lang\pt-br.txt16
%ProgramFiles%\7-Zip\Lang\pt.txt16
%ProgramFiles%\7-Zip\Lang\ro.txt16
%ProgramFiles%\7-Zip\Lang\ru.txt16
%ProgramFiles%\7-Zip\Lang\sa.txt16
%ProgramFiles%\7-Zip\Lang\si.txt16
%ProgramFiles%\7-Zip\Lang\sk.txt16
%ProgramFiles%\7-Zip\Lang\sl.txt16
%ProgramFiles%\7-Zip\Lang\sq.txt16
%ProgramFiles%\7-Zip\Lang\sr-spc.txt16
%ProgramFiles%\7-Zip\Lang\sr-spl.txt16

*See JSON for more IOCs

File Hashes

152d8dfacdec0ebe7008b0ec41f110111209a69bda12c7e011ea824544479e10
1b25c660f2dbb2be0ba596bb2697f486b92a961bba24226aeb82d8f0ac2f8d47
324b40debcda6f4b9795a3880ff35b56a92d865abb7c3525f6b40e28c52d9594
5063d5e6f90dbb6e360259ac24c11c62b1439f90966bdc72dedf60e243b9e87a
521294a88093ea2b7a2b89ec3005b6398f20780874d410663b63429e58b1555a
66e3b4babf44c3168e1524e84dafd4f19bbfd25feff600422f18553c0dc9c75d
7dc78a81de59dc3f666c25c6d10ae730b50d6d2ee341088371f92f137a938530
9c4498d0ed0c9941d61fed83e91942b40ac298b12acfccaeb9d84526103ff4c8
a4cecd9cad126bbb98545d8bdb471fd1971187945eb71e5ccb873e90a84ee7ae
ad3a9d7402d494048c934b5af612bdf8da822fa7b22e57b8fe48e98a92f772b8
cd07e3707ed997f08cea9f73113be57561dd3d6286310fd096904deb8fc465c7
d27df86a574f9e5e3f6b0a6ffd180da3c8d46e3ee94ea65eff4d1e782be9a915
e302839fbcbdc6da9e8235013a8abce6425eba48eaf4dac3390360334ebe756e
ea3d4eae7eea6f718c8d6999c847f81d046d5a2800f90db40a12c1b2788d630f
ee10b9a36e59990b0a49cf0044f2f23f4fc0e9f7b56057d74c96d99b0736a584
fa22998a51ea7dbbd88a0e1d1c11e88e1c0a801125d2e330348323987d00ccaa

Coverage

ProductProtection
Secure EndpointThis has coverage
CloudlockN/A
CWSThis has coverage
Email SecurityThis has coverage
Network SecurityThis has coverage
StealthwatchN/A
Stealthwatch CloudN/A
Secure Malware AnalyticsThis has coverage
UmbrellaN/A
WSAN/A

Screenshots of Detection

Secure Endpoint

Secure Malware Analytics

MITRE ATT&CK

Win.Ransomware.Cerber-9980410-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 25 samples
Registry KeysOccurrences
<HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E
Value Name: LanguageList		25
MutexesOccurrences
shell.{381828AA-8B28-3374-1B67-35680555C5EF}25
Global\C::Users:Administrator:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!16613a825
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
91[.]119[.]216[.]0/2725
91[.]120[.]216[.]0/2725
91[.]121[.]216[.]0/2225
178[.]128[.]255[.]17916
172[.]66[.]42[.]23813
104[.]20[.]20[.]25110
104[.]20[.]21[.]25110
172[.]67[.]2[.]885
172[.]66[.]41[.]183
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
api[.]blockcypher[.]com25
bitaps[.]com16
chain[.]so16
btc[.]blockr[.]io16
p27dokhpz2n7nvgr[.]1lseoi[.]top16
hjhqmbxyinislkkt[.]1j9r76[.]top9
Files and or directories createdOccurrences
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2580483871-590521980-3826313501-500\a18ca4003deb042bbee7a40f15e1970b_d19ab989-a35f-4710-83df-7b2db7efe7c525
%TEMP%\d19ab98925
%TEMP%\d19ab989\4710.tmp25
%TEMP%\d19ab989\a35f.tmp25
%LOCALAPPDATA%\Microsoft\Office\Groove1\System\CSMIPC.dat25
%TEMP%\tmp<random, matching [A-F0-9]{1,4}>.tmp25
%TEMP%\tmp<random, matching [A-F0-9]{1,4}>.bmp25
<dir>\_HELP_HELP_HELP_<random, matching '[A-F0-9]{4,8}'>_.hta25
<dir>\_HELP_HELP_HELP_<random, matching '[A-F0-9]{4,8}'>_.png25

File Hashes

16ebbbbd2d978523d5a3aab8bd061eb664758aa22450ad965591b0972c1bd1e5
1fb3c24f7e64a802af37174a49e8fb4a93a65458918552c54c93c5794a852fe2
20c1fc5368a95da72dcd4260873d0bc3cc5fe7a0a70ead28de3f3925bc27aa32
2750f0c9766c949e73a28d9be59ec227e476efc81ccbf9a2180c78491324f8b7
415fec7c4f2787631477a71a585003391201c8a2f25228fe34f7f14da451607d
4b2fbc99af8bee1e7c8d6dfa31c758a464949b072def63379b54698c2bcb0295
51720195800c617254987a2cd380dd2917fc286b0e60202798fbf4969012b570
55375bebf365b8f173a1af478725c273440f5bac83939da9d196a83d564ccf50
57397ad4a1cd1f70971dab52e5efa14cdc370489e5672e18ee54b71da88d25ca
5a8bfb98f3025a2cd0b432272f7e611914d4bcbaad861afd55e08e5a26c577ba
60d04a29b992ed24711d2f240cacc63f34ab48bcf1332ac7b732d3de2edeb26a
68e66db7f8cb147a6aa5cbc6b3cb7b0ad6a5569f8eabb662bfecddf9b58bdef1
73a322b14d0adcd35c2b77e6931f58e28edf2d79de499dffe93e411416930c00
7cc6160a71803a5e7fc8b01c0fed45b049081ddb3aeac9b1db7ae360f2f20af6
7d844d2401d7065a005fe109510e2263f60a0bbd11072f1c2e97434b033a4f0f
817f0e050402f396b770b3ab4346e0c7ac067d478ccbe57f88277cb9fa07afcb
85dfc22a0b450f06b46de29ccef88cab8e4466fa6653bdd3b03f421a0f8ce4da
8f9a1c56809d5c7dbcdfe6697fafe81038bd2162956eb442c8978b04e7e6f4c9
974b226b88a378aee906e397da4c8b8e849845cdf01b7a7ef1bdef73b1cb37a6
9f429762c580897cb4a71271725483d7d75bbb6d0840dbbe323140b31b1d2b0d
bce7d560358ec4421bd73e2d00259c52866b171181f2a4a12844d4174769b725
c6e240ea678b1f1b6f3a185fc1407f50de6eb8585579614ca2ce3731bc8070d3
da3567e0f7c091e1707cbbd7909cfd9fe835fb48dcfb9d1efaaec49ebf5a737d
daca60c3f4577bc641c1b25f2bfb220649476db0999e81e3d4d7306069a7d6f6
df4d3ff367a2f4d89d40586b8d44102bf1c3de97ab7ccef18c7f43b4993c1be3
*See JSON for more IOCs

Coverage

ProductProtection
Secure EndpointThis has coverage
CloudlockN/A
CWSThis has coverage
Email SecurityThis has coverage
Network SecurityThis has coverage
StealthwatchN/A
Stealthwatch CloudN/A
Secure Malware AnalyticsThis has coverage
UmbrellaN/A
WSAN/A

Screenshots of Detection

Secure Endpoint

Secure Malware Analytics

MITRE ATT&CK

Win.Dropper.Nanocore-9980555-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 47 samples
Registry KeysOccurrences
<HKCR>\LOCAL SETTINGS\MUICACHE\82\52C64B7E
Value Name: LanguageList		45
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: AutoUpdate		19
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: AGP Manager		12
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Chrome		12
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: WindowsUpdate		10
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value Name: DisableTaskMgr		6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: newapp		1
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\INTELLIFORMS\STORAGE21
<HKLM>\SOFTWARE\WOW6432NODE\MOZILLA\MOZILLA FIREFOX1
<HKLM>\SOFTWARE\WOW6432NODE\MOZILLA\MOZILLA FIREFOX\20.0.1 (EN-US)\MAIN1
<HKLM>\SOFTWARE\WOW6432NODE\MOZILLA\MOZILLA THUNDERBIRD1
<HKCU>\SOFTWARE\NETWIRE1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\ENUM1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: 7_64		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: 10_61		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DISCARDABLE\POSTSETUP\COMPONENT CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\ENUM
Value Name: Implementing		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: 6_74		1
<HKCU>\SOFTWARE\RMCW-KMC20U1
<HKCU>\SOFTWARE\RMCW-KMC20U
Value Name: exepath		1
<HKCU>\SOFTWARE\RMCW-KMC20U
Value Name: licence		1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: ddate		1
<HKCU>\SOFTWARE\NETWIRE
Value Name: HostId		1
<HKCU>\SOFTWARE\NETWIRE
Value Name: Install Date		1
MutexesOccurrences
Global\{042723c4-0804-4212-bf56-4b1b2669ca7c}12
8-3503835SZBFHHZ1
-1
1L2N233BRY01J7GZ1
J1P86SR380H1-G0M1
Global\96f3acc1-6da6-11ed-9660-001517dcb4c81
S-1-5-21-2580483-124424456293441
Global\d6071d80-6d05-11ed-9660-001517fac4b01
KL8ATO734X14Z-LY1
134bd404e63d2b071716d1ceddb584851
Rmcw-KMC20U1
Global\d4f7b8e1-7b75-11ed-9660-001517a920c41
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
192[.]169[.]69[.]2612
194[.]5[.]98[.]21912
162[.]55[.]60[.]28
52[.]20[.]78[.]2403
3[.]232[.]242[.]1703
77[.]88[.]21[.]1582
54[.]91[.]59[.]1992
3[.]220[.]57[.]2242
185[.]209[.]160[.]472
103[.]15[.]48[.]1101
50[.]87[.]253[.]1251
2[.]57[.]90[.]161
34[.]102[.]136[.]1801
79[.]134[.]225[.]161
3[.]18[.]7[.]811
45[.]33[.]6[.]2231
107[.]189[.]4[.]2531
35[.]208[.]225[.]541
156[.]254[.]174[.]1201
85[.]10[.]159[.]41
217[.]21[.]72[.]1101
103[.]79[.]76[.]1521
38[.]48[.]189[.]901
64[.]185[.]227[.]1561
198[.]12[.]91[.]2451
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
411speed[.]duckdns[.]org12
lowaspeed[.]ddnsfree[.]com12
api[.]ipify[.]org11
showip[.]net8
smtp[.]yandex[.]com2
alice2019[.]myftp[.]biz1
www[.]sqlite[.]org1
www[.]aaronmachado[.]com1
www[.]ashakendra[.]org1
www[.]665zzz[.]com1
www[.]njdshl[.]com1
www[.]manciniballroom[.]com1
www[.]cure-finder[.]org1
www[.]cryptopers[.]com1
www[.]teoshotthis[.]com1
www[.]denmarktennessee[.]com1
www[.]positiveenergyart[.]com1
www[.]nicodemusandcrow[.]com1
www[.]pluik[.]com1
mail[.]chabiant[.]az1
mail[.]springhotelhn[.]com1
Files and or directories createdOccurrences
%HOMEPATH%\temp45
%TEMP%\tmp<random, matching [A-F0-9]{1,4}>.tmp24
%TEMP%\RegSvcs.exe19
%ProgramFiles(x86)%\AGP Manager12
%ProgramFiles(x86)%\AGP Manager\agpmgr.exe12
%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C512
%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\Logs12
%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\Logs\Administrator12
%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\run.dat12
%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\task.dat12
%System32%\Tasks\AGP Manager12
%System32%\Tasks\AGP Manager Task12
%APPDATA%\A1EB383543D3F00657D78
%PUBLIC%\Libraries\vbsqlite3.dll8
%APPDATA%\A1EB383543D3F00657D7\Files7
%APPDATA%\A1EB383543D3F00657D7\Files.zip7
%APPDATA%\A1EB383543D3F00657D7\Files\10_147_20121129071628.RTF7
%APPDATA%\A1EB383543D3F00657D7\Files\127SYLLABUSFA07.PDF7
%APPDATA%\A1EB383543D3F00657D7\Files\13ACX.PDF7
%APPDATA%\A1EB383543D3F00657D7\Files\143.PDF7
%APPDATA%\A1EB383543D3F00657D7\Files\15_DIPLOMSKI2006.RTF7
%APPDATA%\A1EB383543D3F00657D7\Files\167_VAN_OORD_V_THE_PORT_OF_.PDF7
%APPDATA%\A1EB383543D3F00657D7\Files\1_ANKITAMISHRA_ESSAY.DOC7
%APPDATA%\A1EB383543D3F00657D7\Files\2329444014.DOC7
%APPDATA%\A1EB383543D3F00657D7\Files\2590OTHERSUPPORT.DOC7

*See JSON for more IOCs

File Hashes

02d6acf24555c866c6fa3c37b06c8ff3b546a5b8f97e1e8cab2110c29e51c897
069e629347920fa169623bf55556bf50da6d73b6d8129da71ed7832e76ec0774
08f06965c39cb6f46e18f1df24e72e06fea964197174ac839476d3957e4de495
171777fc7d1801670cdc576c7cb7460fd4f4ad4eac5d00bc14b3a2f799a56ca2
237f4691c8e3937129080c8d1a39e9a33df965f63c90977aab5348606f03ad48
275adb18333faf91f3124dc54af4c201c11c8d25ecde94aed6ea5f373517c000
356b30df4bbe9a2f99a450769fee9a947f5879868d6b60b183fb3faba39f6470
3a4ef6610b647f545e862e03d03df7a89b171831fa685a978b9d76dd09224406
3daa2ea1bfd5b57eabe55cc156a072ea901ff7c809648dd4d7aa6897c7a9bf3c
5ab5b8f885449933f394fc287c5d224e7cb1c1e3f6f89d9d0abb812bb7d3d805
5c9f6daab90ddba678686ebb3562b200be25bdbc5b8bf997aae9888372df3001
5e3eb3b01f08a5860eb53b7ef54c51378fbfc21584687d82ce8a0c7bfdf0bf74
6427b1234b3182b21cfe73e027a9943505033e0ca9c557504051581d77191158
649ba0fa2b0d5b7835a732f9f52b2cc8536e730e224817b02218daebd4b08848
65202bb1c6bc23e5e4297b0b00b1317a375f08134175e5b7e015a6d829dec596
664eb04ce9a07761a925f6cf8d2b4895b04fe5a85593ca0208d995b438c8b5f7
6763500aabf5bb650acee7e50fb2b28559c25e46e43a67e84e849cfb6748968b
690e2244879b7cdddc4b6208c8bcfae41548c1f651dae8fd576e281ddb30381b
6a7d82c112ed34aecaf4b3aa622d946ccd5fdfd8141437c8410b7c36e4d4d4b5
6aa8a7e9eaaad38773e294e1334edd60fa25564999efdbb2e27beddc705cbe3d
73f9758f83bfe78bbd7c137f3c2d92f6813e8f97e09a05da42e8897715313ae3
7b16e2c7b49690e83bb4140b3e0f29418c64a6aae02dc0c324b607ae048b7ebd
7c749b55555779c476f8e206751528e729bed0069f7a9b91f7766a78b8c22792
8034fed4db2081f34b8048bab000a23044d35061868f53cb37a0f9de4951bdaf
88c35140b891ab68d50c39cba262f80e48038a90e92f46b685240b07494714a6
*See JSON for more IOCs

Coverage

ProductProtection
Secure EndpointThis has coverage
CloudlockN/A
CWSThis has coverage
Email SecurityThis has coverage
Network SecurityThis has coverage
StealthwatchN/A
Stealthwatch CloudN/A
Secure Malware AnalyticsThis has coverage
UmbrellaThis has coverage
WSAThis has coverage

Screenshots of Detection

Secure Endpoint

Secure Malware Analytics

MITRE ATT&CK

Win.Dropper.HawkEye-9980407-0

Indicators of Compromise

  • IOCs collected from dynamic analysis of 17 samples
Registry KeysOccurrences
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
Value Name: Hidden		1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Windows Update		1
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
104[.]16[.]155[.]361
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
whatismyipaddress[.]com1
mail[.]curtisjnr[.]org1
Files and or directories createdOccurrences
%APPDATA%\pid.txt1
%APPDATA%\pidloc.txt1
%TEMP%\holdermail.txt1
%TEMP%\holderwb.txt1
%APPDATA%\WindowsUpdate.exe1
%APPDATA%\WindowsUpdate.exe\:ZoneIdentifier:$DATA1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\gykjt.vbs1
%APPDATA%\gykjt1
%APPDATA%\gykjt\hhuyi.exe1
%APPDATA%\gykjt\hhuyi.exe:ZoneIdentifier1

File Hashes

0afc35bdc7a3c309c2d318c17fb022f4cb273b54f0e985214f35d78d2777b0b6
0da2d12cb707f7dc768729a23151d848f3b55a478c4f5ef2ad291438d7fd8819
1000dae94027ea5274106454778d70f0bc7763b787cab16a017cd846e76e47a9
1fb8d035253a9e76f108a7ffddf701cf15949ec012e4c26f0a6ecf67fc0af01c
2a19ae94bf110da3cb0c99d67fa313d12f5e4518d1bd2d88b0e8213c9c7e8c2b
35f21ad3e2219dbf3936cecc2d8db36686467b87a5984c842a08214f3ab1e3c8
3abccc8e7db8eb44d8baae4b98675c657901c080c5f79160f9cbe8ed9c3f2a4c
42e162ab2cc30abb0197559cd158ed6fc614be33b6e9d1357917356b057f4ca7
757d1ccf4061ca76d7b7de49d9124a74738c7835d9df0ad1074c8643da562aa1
9957b34b6ae296fb384c1a9af0656706b057dfd6f256095a555acaa875a1335a
aaa39c2e014b8c48cd156777516987ae3ddde1c5993b47c07e6171e8ffa7733a
be0d39b9872aaf2a65ec3ee3dbfae1250384af42af67722bd295f12700e120aa
c1d04473949f3e1018cf7bdf6117a3bd788c27932a0c304f09364983b96d689d
c31306ed75a78889320033bdf936c9d801fd9da3b7cdda4aead41f8c8fbaa14b
d2b9c63c6bc5b982cb25afe657fefe121593803e38cb60eb40484b6aed65ce87
e34558232611b82301ed2aa168242353b3f079e3e1eb5cf31fe6fee06a6d9174
f432a979674be1f744b5392c5034115f9761ecf7001c772d43516bc83e4bffdd

Coverage

ProductProtection
Secure EndpointThis has coverage
CloudlockN/A
CWSThis has coverage
Email SecurityThis has coverage
Network SecurityN/A
StealthwatchN/A
Stealthwatch CloudN/A
Secure Malware AnalyticsThis has coverage
UmbrellaN/A
WSAN/A

Screenshots of Detection

Secure Endpoint

Secure Malware Analytics

MITRE ATT&CK

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-1209-1216/