Threat Roundup for Jan. 18 to Jan. 25

Friday, January 25, 2019 14:52

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 18 and Jan. 25. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

The most prevalent threats highlighted in this roundup are:

• Doc.Downloader.Emotet-6826494-0
  Downloader
  Emotet is a banking trojan that has remained relevant due to its continual evolution to bypass antivirus products.
  
• Win.Worm.Vobfus-6825980-0
  Worm
  Vobfus is a worm that copies itself to external drives and attempts to gain automatic code execution via autorun.inf files. It also modifies the registry so that it will launch when the system is booted. Once installed, it attempts to download follow-on malware from its command and control (C2) servers.
  
• Win.Packed.Razy-6824365-0
  Packed
  Razy is oftentimes a generic detection name for a Windows trojan. Although more recent cases have found it attributed to ransomware that uses the .razy file extension when writing encrypted files to disk, these samples are the former case. They collect sensitive information from the infected host, format and encrypt the data, and send it to a C2 server.
  
• Win.Ransomware.Genkryptik-6824111-0
  Ransomware
  Win.Malware.Genkryptik is oftentimes a generic detection name for a Windows trojan. Some of the malicious activities that could be performed by these samples, without the user's knowledge, include collecting system information, downloading/uploading files and dropping additional samples.
  
• Win.Malware.Ponystealer-6823878-0
  Malware
  Ponystealer is known to be able to steal credentials from more than 100 different applications and may also install other malware such as a remote access tool (RAT).
  
• Doc.Malware.Valyria-6821700-0
  Malware
  These variants of Valyria are malicious Microsoft Office files that contain embedded VBA macros used to distribute other malware.
  
• Win.Malware.Zusy-6822787-0
  Malware
  Zusy is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" and "winver.exe". When the user accesses a banking website, it displays a form to trick the user into submitting personal information.
  
• Win.Malware.Ursu-6822222-0
  Malware
  Ursu is a generic malware that has numerous functions. It contacts a C2 server and performs code injection in the address space of legitimate processes. It is able to achieve persistence and collect confidential data. It is spread via email.
  

Threats

Doc.Downloader.Emotet-6826494-0

Indicators of Compromise
Registry Keys

• N/A Mutexes
  
• Local\10MU_ACB10_S-1-5-5-0-57527
• Local\10MU_ACBPIDS_S-1-5-5-0-57527 IP Addresses contacted by malware. Does not indicate maliciousness
  
• 52[.]31[.]99[.]185
• 47[.]52[.]19[.]221
• 91[.]209[.]78[.]110
• 46[.]30[.]213[.]132Domain Names contacted by malware. Does not indicate maliciousness
  
• www[.]seine-et-marne[.]fr
• TLEXTREME[.]COM
• vanherreweghen[.]be
• www[.]tzen2[.]com
• www[.]addthis[.]com
• www[.]iledefrance[.]fr
• www[.]stif[.]info
• www[.]camenisch-software[.]ch
• tlextreme[.]com
• sh2017[.]chancemkt[.]com Files and or directories created
  
• %LocalAppData%\Temp\736.exe
• %LocalAppData%\Temp\j02khkb2.lmy.ps1
• %LocalAppData%\Temp\q30h0dfn.q03.psm1
• %LocalAppData%\Temp\CVR8B7E.tmp File Hashes
  
• 02961b9b1846411364a0c00b6546aeaceec7e7156a89662ae81a2223c9a612ca
• 0acd52e7f92f125d8fec5d78db296ee3c88079456dfb66b84fa92be944dc1293
• 11d52b1ee5c330911ed98ba86a4560c67cba2bd70427c8d33a0b793ddeb5c11e
• 16ef10e1f741ca1cb22b657dda69b7d15e6c016a667602fb8fe825b5846eb4b5
• 175b20d5f2079f86b1fe4ef91d5a84ce3fb71939b3c8297e4de6587875dca6d5
• 18c74f2852985acd6a5b35d21d12e8e852d54003b4e5d3714243e045969c434f
• 1a4dc5022a6b5296fe5d03597782a985bd721e3651b010c06b9be205b5c9f97d
• 1c7813fcdec02ae9bf9bb816d87f66eca49cffa1df2de22aac19d2b365e59df2
• 1f5e9f1c173cc8611a5d34e801c0a26ce7365cb1c7b660bcd88816153b76d467
• 2210bb4262bd6f02c2c1b836ea7372c28b35f7e31d81dcf4749fbd4fe71676fb
• 22b521f4fad5c39e0d84729f3e194782f2a802c03f6e24ef013e7e33d299703f
• 2311a0274a3edf0a79d422ba126d2a1e23e98b13c40762e2aac7b40686a308c2
• 26fba2bd9792cbe6aa14f3baa9a2ffb57344d7348805648a53dcf92644a8b973
• 3cebbd85235c819ec92210572035f2973b54740f306b8b0607e03c84eb7b0914
• 3ebc758a0186db99545ab2614b2a96544ab4509bf7d24c8d11dca06b2d17adbd
• 42df2ceda548dbd95ed4cf8176dfb8817e7350ea9b296adb33a3e6c3f2fb272e
• 4dfb9830a14e1e92ca88b40189fb05be60a42be886c9ca1cd2f6a3f5f09e0208
• 51cd6bdb18da6dc94549e067b04e727b9e947f2f189f5c27da67eb56f77c5f54
• 547ee4142a9088eba58961d0bfdae6a32f501affcff9dce7e3f424f47b8fd4a1
• 5d3e5a9b7730bd40f0cd4392367744bb7a3ddefd3b316d603e56369a7813ee68
• 680d56d915ec028d4d0e33cd63e90f58c1f67c4e8b92d11eabf2576702d5b3bd
• 687d3887779bf147f8ab6637c28f76559f3a1cbe0899cfa07d0ac33733fc74ef
• 6c9f60643913ae688fc163d8e09a71268c0bd527ca5e9330c163108aafac5944
• 729777e3d2a3bc3e6846bdf89f4480052c3e5877a8dbd3d93c7a7d9f38d90311
• 7575b3de182b5ad8b92eabad4f5307e27280729f81ab692d20633dac2f786d8c
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Malware

Win.Worm.Vobfus-6825980-0

Indicators of Compromise
Registry Keys

• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
• Value Name: internat.exe
• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
• Value Name: ShowSuperHidden
• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
• Value Name: raaitay Mutexes
  
• N/A IP Addresses contacted by malware. Does not indicate maliciousness
  
• N/A Domain Names contacted by malware. Does not indicate maliciousness
  
• ns1[.]boxonline2[.]net
• ns1[.]boxonline3[.]com
• ns1[.]boxonline1[.]com
• ns1[.]boxonline3[.]org
• ns1[.]boxonline2[.]com
• ns1[.]boxonline3[.]net
• ns1[.]boxonline1[.]net
• ns1[.]boxonline1[.]org
• ns1[.]boxonline2[.]org Files and or directories created
  
• \??\E:\autorun.inf
• \autorun.inf
• \??\E:\System Volume Information.exe
• \??\E:\$RECYCLE.BIN.exe
• \Secret.exe
• \??\E:\Passwords.exe
• \??\E:\Porn.exe
• \??\E:\Secret.exe
• \??\E:\Sexy.exe
• \??\E:\x.mpeg
• \Passwords.exe
• \Porn.exe
• \Sexy.exe
• %UserProfile%\Secret.exe
• %UserProfile%\Sexy.exe
• %UserProfile%\c\Passwords.exe
• %UserProfile%\c\Porn.exe
• %UserProfile%\c\Secret.exe
• %UserProfile%\c\autorun.inf
• %UserProfile%\Passwords.exe
• %UserProfile%\Porn.exe
• %UserProfile%\Secret.exe
• %UserProfile%\Sexy.exe
• %UserProfile%\c\Sexy.exe
• %UserProfile%\raaitay.exe
• %UserProfile%\RCX6E9B.tmp
• %UserProfile%\c\RCX7DE8.tmp
• %UserProfile%\c\RCX7E08.tmp
• %UserProfile%\c\RCX7E38.tmp
• %UserProfile%\c\RCX7E68.tmp
• %UserProfile%\c\RCX7E97.tmp
• %UserProfile%\c\RCX7ED7.tmp
• \??\E:\raaitay.exe
• %UserProfile%\RCX6D8D.tmp
• %UserProfile%\RCX6DDC.tmp
• %UserProfile%\RCX6E0C.tmp
• %UserProfile%\RCX6E3C.tmp
• %UserProfile%\RCX6E6B.tmp
• \raaitay.exe File Hashes
  
• 0037d65faac14ac7334d7945e27569d7cc3d5dc523721e6663250a12cae30970
• 004cc9d4425a0e10fff6239ae475488707ebaf7f2a6e4a3dee7b34ce5695c321
• 0067963d2aceffee9ef4f6e721810751dca83d21d0712abfa833a25e22ba4dbb
• 0095c53a8472b4a6c607cb35a3c6a1a6b6b9bdb73411982877cd36bb337fe622
• 012f637a2ecc4fcd7bb899d15bd3154da2e57990b06a2220a70275e4d71f6f1b
• 014a73b4e83e353606d90832f8ed0531621a9f1b18ff8886f6ae4f0ac7fea1f9
• 0168589ab988762e304160c1185d9f0cfda9fbae862d49b287151e2867434698
• 0174a979de62c49713dc26bf492bfb8e938663b6678718b31b93a1ccf74a7c0a
• 01833d63634a87bc656d3cb19e81a595c1ff2f9b576881d938d94276a3b19421
• 01bb231426f9f04f1fcc15816758ae71cbbfaa4402ae208f2d97393f5e169eaa
• 01f729500c940572e0fffc33813e6b390a11702f0023fa23e2a699f090843ca8
• 01fabdf325a2cc93b441ad0f6fd5045d60f4948d1a675efab4ae6b6dd3d09e84
• 033634d5e256d0c401521f689f02298c03161d93a73d6ee7516728e312346e59
• 0405dd8730790632cc9af7a163bcf2edfe53dca323e2bbe51eebb1176e3d88c8
• 040f4aa4129dbbc8fc35fa755d54819cd879cc1df72717c7326b3dfd2419fe68
• 047a78afc2d81bf8c214cd3ec65c993f8a20d530e317e75364a6a8406b527259
• 04cdd36585f184a6f00628a41e06df4e6d48e14405bdb1cfeefd32d6abece39d
• 06180c973c1907270017c6c4d49f75fdedce5e0b303324b001db54321776bfc6
• 06237a002970ae7de3bf9f30e3d7555366cb10f3e56a2df9a8cd19ed682f138a
• 06318d4771dde1557bb1ef47bce6326768e83a5124051e296ca2463f9693bd50
• 07ba24b2c6e0d1480180221ddb1854cfd5ccfef50487e13f71134669d0027e0e
• 0885ba5f2be768f907c88b520c412d76734e90cd2104f36cbc14bf59c28875a3
• 08876ed5bb3db929653ebd493da0bcd89d876d3ed96f0f8d897daa31719cf150
• 0939e8b87435767e67f2b6850a54d6abe3b037639e8c076465a167f1f4673306
• 0a9b4d6c0f1b0f87cf7e953c06d4684607e688252cd6d8b9bda28ea4bf8c871f  
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Packed.Razy-6824365-0

Indicators of Compromise
Registry Keys

• <HKCU>\Software\Microsoft\GOCFK
• <HKCU>\SOFTWARE\MICROSOFT\GOCFK
• Value Name: mbijg Mutexes
  
• N/A IP Addresses contacted by malware. Does not indicate maliciousness
  
• 66[.]220[.]23[.]114
• 64[.]71[.]188[.]178
• 184[.]105[.]76[.]250 Domain Names contacted by malware. Does not indicate maliciousness
  
• kwowwauubfk[.]com
• bqwzunofd[.]pw Files and or directories created
  
• %AllUsersProfile%\ph
• %AllUsersProfile%\ph\fktiipx.ftf
• %LocalAppData%\Temp\gocf.ksv
• %AllUsersProfile%\b95c
• %AllUsersProfile%\gvpax
• %LocalAppData%\1596
• %AppData%\f2s9398
• %AllUsersProfile%\0n48x8
• %LocalAppData%\o1me3
• %AppData%\d991m59
• %AllUsersProfile%\3qy3
• %LocalAppData%\7a92
• %AppData%\98u3
• %LocalAppData%\31m53w
• %AppData%\4o5w356 File Hashes
  
• 00958b0eb7138a5cc3901f47ce902f6216b076fa341f9f7cda1bcfc62191b42b
• 0ddb4e64337d7a3b5e7980bc3d8b2e3d1a8870bac611de6b7fd4ea04e4b13834
• 16981b12217330adebe7b6d4ff08649f5ca2559b18331a0d0a6b79bc6f65cdcc
• 1b2c133834c1edf5a9696671bc555209abcdf17936c851942892015622f21c50
• 1da3d125ce62a7317cb80f4d48764995c8f7a84a15aa3a37abef6e03b4d8d071
• 30bc3bf1588a0ffa91ca8e494a5e7e40cc35c80eeb3a77c23d9fb98a251a7e98
• 3a1b58d54b6580a3d81fc5fc9cddd6f7eccfcab8f9f41fff81e45200d9d9294a
• 449c7ac8be0256b2ca573101eeb65cb0a5be0af883974f68574625f2f6bff7f8
• 44d438154cee044e36cb2a539261b3549d9cd16bfbf4d512073bba36a21d92d8
• 5033ca548036bc7fc8a988dafab88c0e7694701b12202522207d5cf3d194a31c
• 5c36d36a367eb555fcf3373121ec0ba2884ef92741471a65643cbd29f2877b9c
• 65a753ef5c366e3c79c989948d25504822ae31754d2af381c2c2039a2f5d52cc
• 78058316dd668f0052f9c8753cfb2c85c31a86bf9cf17fb9989de7efa6f34f3e
• 7ca95a22275a3f76ab51720871d3fff23b57a640c628e940230efb05cd0a32f8
• 7de1ddc87cc6956e6e20231d708073b011f5d03f79acd7dbc40052a3f05d60ea
• 856dd8f3138a9dc5858bcb80efa1abe8634b995b7f597eb6235002f13371c176
• 88528338d3eb4452c37548280f1c36d7e13eaf63cac1c320ea72f1f99403fa57
• 891088ed7a0e386a1c84b332b0aadce6f4709958aa07614c7cc83797518a95f7
• 9e5a684a10fb0f567bed0cbb71488bc9bb79d7fc15500a0da48c34caee6a804f
• 9ef872a783502bb47d5a461d231e26e301cc9f6e4625e7bd0ef7a01620f89b47
• a8cd581c54ecf14da45460fa8fd8e5f5e43133b78135df9e2e8ae5c36af635a3
• af7b095f795a599e83c94d41432b2755d7289159075147aae6931cc622dac30a
• bd354725cb308fe831075414d4e9f2a2dcddbd16c900484f9aa9e1bcf2bfc6cc
• c03a12f494da082c5c108fd80c1e1a2a1bd8be7cc8dcf3fae02f8bb39bb11944
• c088e5a96993d5361c5c0b138dd17d658de50a4c1007b4d6e5a971df8a8c39bb
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Ransomware.Genkryptik-6824111-0

Indicators of Compromise
Registry Keys

• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
• Value Name: internat.exe
• <HKCU>\Software\Remcos-69PU1K\
• <HKCU>\SOFTWARE\REMCOS-69PU1K
• Value Name: exepath
• <HKCU>\SOFTWARE\REMCOS-69PU1K
• Value Name: licence
• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
• Value Name: SKIVESKYDNINGENunenterpris Mutexes
  
• Remcos_Mutex_Inj
• Remcos-69PU1K IP Addresses contacted by malware. Does not indicate maliciousness
  
• 84[.]38[.]135[.]91 Domain Names contacted by malware. Does not indicate maliciousness
  
• top[.]pubgplayzonejoco[.]waw[.]pl Files and or directories created
  
• %AppData%\remcos
• %AppData%\remcos\logs.dat
• %AppData%\Imgburn\imgburn.exe
• %LocalAppData%\Temp\WEALTH2019.exe
• %AppData%\Imgburn
• %LocalAppData%\Temp\Mirijana9nyhedsgruppeskitte.exe
• %LocalAppData%\Temp\~DFE751F75B3A32A556.TMP
• %LocalAppData%\Temp\~DFDEB24D10F9017BE2.TMP
• %LocalAppData%\Temp\~DFE5FA503DE0D2D852.TMP
• %LocalAppData%\Temp\~DFEE43B3EEDEE2644E.TMP
• %LocalAppData%\Temp\~DFD949DB000F4368B2.TMP
• %LocalAppData%\Temp\~DFCD42A77CD5F06772.TMP File Hashes
  
• 049f02b69493dcfa1c2740519a965f5b3cdad94319480787f608df39646d4a45
• 08703057fe22c4df53c83e1406c772d24148a570efb9b636307420c56a506fea
• 0f52ae41d65fb4790aa778431fa32cc037cc4d31f734b6a540bd37668deb4df5
• 1102ae383bafc64ff90b952f8f96797801396ad00b12e62ece8c5bf667bd7917
• 136c0293daba6aecf870d253aa9393c085b8ff1dd6d47d71ae7aebd296c715b3
• 149022bc418cf2110bc02bd03d65bc5c8e62c811b94361afe48a95c5a2649e64
• 300c7f5229eccb18cef38365f7567ffa0d5a2226b2a338083f069e4349ee83d9
• 311da3fa5daee4b28327edd53ab5aa57f061708b2dfa8fb755fd08854e2798a6
• 4d652ede13a7424582090164c5d453a08610848aa6c2b34a2cd9641f2f9e4761
• 5147bffb5e30bf2e6b0c38af954aa7de64ff15964b32df334a2881b3d34a88c9
• 546c3e1bb5b13f369f8aa7333d7209d736c90edb7db2f41410ce42ceb264bf30
• 561c6fadb78eb3c1ab18596a61a348af4e052b0a33754b1587f7e8f07ebb864d
• 5724e9dbdc024c683ea3bfc2726c951fbbaf8faf46f4c61d7f1b5d24e0df0c19
• 5bdb3e691c8f07c16392e5077601bb445110cc6e0aea0d5547b4469d82e06f42
• 5d5d0f07cc4358b44291c6ee3455a3bc19ccea06fa66364bacd3ad051a368758
• 5dc30dc295fd5a286c6ab6ba287d4b04373c16e1de75182a6ea221394dae1137
• 6178f9c685e131ec20d7981f461e9947201b8ed5edd7ff64514d4b0daac78a7b
• 6447cb09817b37ddb3b107e97060e9becac9ccfca8662cd3a193eec06ba1c35e
• 6d5ff7b6af5fcab6b9a12a5213426b1d2fe93c06a039d25676bb00f2b3ea1231
• 74625b4620d8233adf151b7c7797384e12e22df6fb67006482bcc8437c070838
• 7733201b8330bffd8a41dee35a3ef2005e8424df477a5fd08fb52651093e7700
• 77b8aa573a3967891d4cd3e93ec76a1004ec8294f0c479ae8043e821d06dc78a
• 7ee37ca283d2cb7ef6fa8a8e507de85875b5796d5c006ea599d55c11f5e6a7ec
• 86b98581605b1b0c5286f307bfd79338c74fc5bc73ac11e1abb0cb37f97d98d5
• 8bf4d086da3f18e4c537e107ebc802056d0b0dc4813eee8c884671c9a68d587b
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Malware.Ponystealer-6823878-0

Indicators of Compromise
Registry Keys

• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
• Value Name: Adobe
• <HKCU>\Software\Remcos-L409SR\
• <HKCU>\SOFTWARE\REMCOS-L409SR
• Value Name: exepath
• <HKCU>\SOFTWARE\REMCOS-L409SR
• Value Name: lic Mutexes
  
• Remcos_Mutex_Inj
• Remcos-L409SR  IP Addresses contacted by malware. Does not indicate maliciousness
  
• N/A Domain Names contacted by malware. Does not indicate maliciousness
  
• 1010[.]http01[.]com Files and or directories created
  
• %AppData%\remcos
• %AppData%\remcos\logs.dat
• %LocalAppData%\Temp\subfolder
• %LocalAppData%\Temp\subfolder\adobepdf.scr
• %LocalAppData%\Temp\subfolder\adobepdf.vbs File Hashes
  
• 057500aaa50232337866b4470e930a698d96c97d446f2737bb9e69807e13fcd0
• 26df92ebf43f0dda98bd34d5f72841717bbe9c524bded8d3d77bede19baedfc2
• 2a5608a0d642fd23f0b49c6436886e937d4ba4a40e048bcd57338e74d7815a81
• 2aee79633fda123830fe7061900dc9deb2af0c45d1ad97bebea2e853e0f6ce17
• 424217fcced5f9a8a35c9de9a66e0c06b761cd2e46db6a042f325835104fcc47
• 439e2e22cb2ff1879dd19c1efe2c2d8e2897d6cef866ce6fb9a33c84165253fe
• 539c084c60d1d5e901aea6240f113a021c7cd7e447ac9cf35953d05666f3cc22
• 634dc330090c9f2b5d7b1c670102d5c1cd3389cb676ff04cdbe87df50bfcfba7
• 736b02c049a77d35435fb18fab0067544c4d6cc0cb2e0bfb9bf5152f65a8db93
• 8269d87f90e2d401e0ac70d2f9e32aef62db5a70f7a0165646f44534edc9c265
• 93411f9ee4535cba7e1c0e288a3188d9d1679d5b2b0bdd4e3b862d49e53510e4
• a1436dfb3efb320afadb5355b305794a330284c5515283dceaaf70dc09450c73
• c1e8d791958e9943798a6f28fa6a9563519d0d5a49d37f834af14b4074f2efec
• c920ed42aae02a1536408fd3513dc1694fed093091a5655529149c989c7d6744
• c95d501830e87c470c7d731a7be78fae90b38d4eb8aa8365d981d8397407fbac
• d59d2b4a4b6473f7a82109b6768d3ce62fde8ec8f6da786986a2545da0245e49
• ec8abd35fd1e3c8f29f4187d9ddcb7c6c3c35a838c688d8a08553d46ca091cd1
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Doc.Malware.Valyria-6821700-0

Indicators of Compromise
Registry Keys

• N/A Mutexes
  
• N/A IP Addresses contacted by malware. Does not indicate maliciousness
  
• 191[.]6[.]194[.]81
• 177[.]185[.]194[.]161
• 157[.]7[.]188[.]229
• 45[.]60[.]22[.]20
• 54[.]164[.]54[.]199 Domain Names contacted by malware. Does not indicate maliciousness
  
• cm2[.]com[.]br
• heteml[.]jp
• secure[.]heteml[.]jp
• snowdoll[.]net
• www[.]plano-b[.]com[.]br
• ecojusticepress[.]com
• craftww[.]pl
• lavoroproducoes[.]com[.]br Files and or directories created
  
• %LocalAppData%\Temp\619.exe
• %LocalAppData%\Temp\rucrrluq.3nn.psm1
• %LocalAppData%\Temp\wjyt5a53.3uh.ps1
• %LocalAppData%\Temp\CVRD0AC.tmp File Hashes
  
• 006527ed4540d3e8b684bdc110cb1f738ca696e8706b748892930994de3dedef
• 11f7710f8cabe988168078cd6ba83c2544d1d06c9a8a3583fabe164e87f7048b
• 23f1b03ee66fb8dd1a515afd7adeb8f85b260ef5e20a7d80ad1697865f59f794
• 243a87a44e767e8d5b788c29bb0dbec9986956b40c407074f670bcc9b206d730
• 2b201210a7ea524a3d65c7d2ee2e7d322479657076a1c30f8ec6994eb97f269b
• 3f7f15af2c3736d94f62e8d58bad269d29198eaffc40ccdbfd166878daeef652
• 400d6b89b8026f39de9c80b89aae66e49afebf153c8b5b9d480307ada0f4c428
• 5bdac880fac6d0b90751b1f2f7dd97b50ddf2759926a414b940dff6fb8117833
• 5fefc488c0bb534fe5de5eb5244524ab5138474609c6363f959845a35b2fa94e
• 73d4c1dafc168a36218d215548bdcc87b0ecb667acaf685b044b680f4f678dca
• 775b96aa12728bfc5f6f68bf11d8ff34e252107d8f63440a471495e8ecd9f1f7
• 79f220cc40a6d9d27adc27374ebf0263792e86b64061a709357233b88bb847e0
• 7ca6572429e9aeeedaeb810c5752f1ee4f300435eedb55efc6128a3c5cb40028
• 7d1452ab28a32b82e29a27b02f3881ed4eb7e33e47c65791753b6f9f6b0da364
• 7d50253b1168a61a502890fdd13e7245b5f7aa8465da25e3bed00a8fa0a3b4fd
• 8f0dae9f191c55289ab80783e68c0e03e97f391cd86ae283304555f20d8f2d31
• a09a6e4a65a174787ec889f5e9d9024cdce88d46577d022a012ee4f86fb472cb
• a77b90d16bbdd99569309b37cdae642159e8761ae9f8fb0853b193c0d3db7565
• a8e856a69c9eb0074a418c67d575b91b49caea488574529a40e3b129cefde689
• b438c81b2ada4914b77fb936ca70aa4fa1cb4cb6867c2171e9d21989a4419350
• bd48756252ebf449627761f36c813dde9d57c0cdb82210e864afe4530353a362
• c0c3c539411f9d602316f053a8c68bc78461be9c7b305107c2da072ebe1384a6
• c77196231630b535ef5f0d46f78b7be22a27954daf395065b8f448829bcbbdff
• caa71fe55c039c34b917a568a5325dee1ab6bbd7e343672b23dd3a498b2c21c6
• e8f63eab9292aeb9f3b6adb62df6eb338ff28ff06faefa7fbbeae10e7e04927b
  

Coverage

Screenshots of Detection ThreatGrid

Umbrella

Malware

Win.Malware.Zusy-6822787-0

Indicators of Compromise
Registry Keys

• N/A Mutexes
  
• N/A IP Addresses contacted by malware. Does not indicate maliciousness
  
• N/A Domain Names contacted by malware. Does not indicate maliciousness
  
• N/A Files and or directories created
  
• %System32%\config\SYSTEM
• %System32%\config\SOFTWARE
• %System32%\Tasks\Update
• %LocalAppData%\Temp\A1DE8592.tmp
• %LocalAppData%\Microsoft Help\restewbes.exe File Hashes
  
• 066d2ec864546e803031799ceb753c0729fd3fea5fee39ea32c7663cbc49ac4c
• 0acd289c882b13ee2ab19fc065e675257f1be2795c5a9335db1be072b91137cc
• 131c42eed549e4ac2995b6490cf5850e8713c7cacd3a5f6e8e0663d6e66a8bdb
• 17ee81bccd57621bfaf7da158b68c11da1d3fd633f632ee1505823b022b7aeaa
• 1deea19fa1060fdd6c5be36b6e8fd0dab37d17f4bf8e3adc418d4a28bc2e7753
• 1f794910366228e4e66c3accd298d7159de6709370060edab157dceff6366fd9
• 383c76d17194d3f95579b607f472f8b7eeef27280ab71f17c13f6d02c5e9891d
• 4292bb14f28f0b6c2caf51f765a2c923caf4ff23f4ded0d791859b295cd8ca6f
• 47b371a3cdeb0aff41456ba7597044a01f1aaac1ede2070fe6549b1cbda78f39
• 4b5def0798881f70fb99cd1d96bcaffadc552652205264a6a14b7661dd5c260f
• 5189b875f1f85c6b6d6ae3cc6d2922df8d8126269c32904e66af2f93081cb0f5
• 51ef4bd2753e8ca2eefcf0c106110bb5e0191270ba94852d0df9267e7545535d
• 558980fb1ae5ebef3efab8dfec1659a0407b243e3ea80ce9206cdbb821e8307a
• 5664f44cf690e8084108f87f63ec9485cf7197846eed744a0e6d5a9a50b727e3
• 5aabbed6b1e0973a02a33e35317b8acd09902b009c2bd6d1826098c1399ca1b8
• 5fbe5fa066cb326ad3449dda72d41c3f7c13e7e53994f8783c398cf50b565bbb
• 5ff9243d8d9d9d91a0b808e5a48e49577673a7bc490ff2d932c95ad97861e260
• 6e0e7073accb6f820d47af977f502ae090c9a485a01e2f4844fa23b630aba3b5
• 7df09dd5811ae5b81ff5a7b8f24058fde4d4033774733b9c944f9333636eca4a
• 7eabab9ef1146639dc2c5ff6b81745741483a62df6453386f045f5ac011e2fbd
• 82b95a38e9b61a85ef38b821f1f061bf2e089f21e53b39a76b040358f0803c5f
• 8a61accd073ef7868fdfed4e18833f8edcfca716afac37cec88e03130617d3ca
• 8eb4332282fde7742e91f4e4652842d95e953e9921b0580a17e2f9fa70a0bcf3
• 8f3b61b93e8f2a2e5c20cfd9dfefd836ab5fc1fff5e60bba7e4d291c190afb87
• 92c07c6c53d2eceba6b5563c6b701b10a5d74af3e82f06e7caddeb5e74ae7f0f
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Malware.Ursu-6822222-0

Indicators of Compromise
Registry Keys

• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\ibpvucix
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
• Value Name: Type
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
• Value Name: Start
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
• Value Name: ErrorControl
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
• Value Name: DisplayName
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
• Value Name: WOW64
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
• Value Name: ObjectName
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
• Value Name: Description
• <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
• Value Name: ImagePath Mutexes
  
• N/A IP Addresses contacted by malware. Does not indicate maliciousness
  
• 216[.]239[.]34[.]21
• 255[.]255[.]255[.]255
• 239[.]255[.]255[.]250
• 69[.]55[.]5[.]250
• 68[.]178[.]213[.]37
• 172[.]217[.]6[.]196
• 66[.]218[.]85[.]52
• 66[.]218[.]85[.]151
• 212[.]82[.]101[.]46
• 104[.]47[.]2[.]33
• 74[.]6[.]141[.]40
• 74[.]6[.]137[.]65
• 98[.]136[.]102[.]54
• 5[.]9[.]32[.]166
• 46[.]4[.]52[.]109
• 208[.]71[.]35[.]137
• 98[.]137[.]159[.]25
• 74[.]6[.]137[.]63
• 176[.]111[.]49[.]43
• 85[.]25[.]119[.]25
• 144[.]76[.]199[.]2
• 144[.]76[.]199[.]43
• 98[.]137[.]159[.]26
• 104[.]47[.]44[.]33
• 172[.]217[.]197[.]27
• 66[.]218[.]85[.]139
• 67[.]195[.]228[.]141
• 212[.]227[.]17[.]8
• 98[.]137[.]157[.]43
• 208[.]76[.]51[.]51
• 144[.]160[.]235[.]144
• 104[.]47[.]9[.]33
• 98[.]137[.]159[.]27
• 43[.]231[.]4[.]7
• 194[.]25[.]134[.]72
• 213[.]209[.]1[.]129
• 188[.]125[.]73[.]87
• 64[.]136[.]52[.]37
• 193[.]201[.]76[.]57
• 98[.]136[.]101[.]117
• 67[.]195[.]229[.]59
• 98[.]137[.]159[.]28
• 74[.]208[.]5[.]20
• 74[.]208[.]236[.]137
• 104[.]47[.]10[.]33
• 192[.]0[.]47[.]59
• 216[.]146[.]35[.]35
• 74[.]6[.]137[.]64
• 208[.]76[.]50[.]50
• 144[.]160[.]159[.]22
• 82[.]165[.]229[.]15
• 40[.]76[.]4[.]15
• 67[.]195[.]229[.]58
• 8[.]20[.]247[.]20
• 89[.]39[.]105[.]12
• 213[.]180[.]147[.]146
• 68[.]114[.]188[.]69
• 203[.]138[.]180[.]240
• 195[.]46[.]39[.]40
• 199[.]212[.]0[.]46
• 157[.]240[.]18[.]174
• 167[.]181[.]46[.]232
• 109[.]69[.]8[.]51
• 212[.]77[.]101[.]4
• 209[.]85[.]203[.]26
• 17[.]133[.]229[.]14
• 17[.]133[.]229[.]13
• 17[.]57[.]8[.]135
• 17[.]57[.]8[.]138
• 17[.]57[.]8[.]136
• 17[.]178[.]97[.]79
• 17[.]172[.]34[.]70
• 216[.]40[.]42[.]4
• 17[.]142[.]163[.]10
• 195[.]4[.]92[.]217
• 173[.]194[.]76[.]27
• 117[.]46[.]9[.]103
• 157[.]240[.]18[.]63
• 142[.]169[.]1[.]45
• 64[.]233[.]166[.]26
• 87[.]240[.]190[.]68
• 87[.]240[.]180[.]136
• 172[.]217[.]192[.]26
• 207[.]69[.]189[.]229
• 104[.]47[.]53[.]36
• 69[.]168[.]106[.]65
• 104[.]44[.]194[.]232
• 104[.]44[.]194[.]236
• 168[.]95[.]5[.]113
• 168[.]95[.]5[.]218
• 207[.]46[.]8[.]199
• 70[.]169[.]223[.]215
• 168[.]95[.]6[.]60
• 85[.]13[.]131[.]232
• 208[.]80[.]206[.]91
• 204[.]96[.]26[.]100
• 94[.]229[.]138[.]130
• 79[.]96[.]161[.]121
• 66[.]175[.]131[.]136
• 204[.]246[.]122[.]94
• 74[.]126[.]144[.]79
• 212[.]159[.]9[.]200
• 52[.]206[.]51[.]15
• 185[.]164[.]14[.]22 Domain Names contacted by malware. Does not indicate maliciousness
  
• t-online[.]de
• sbcglobal[.]net
• myway[.]com
• searchsingleshere[.]com
• emig[.]freenet[.]de
• charter[.]net
• ff-ip4-mx-vip2[.]prodigy[.]net
• excellentrxinc[.]su
• freenet[.]de
• fastonlinevalue[.]com
• ev1[.]net
• cableone[.]net
• globetrotter[.]net
• relay[.]globetrotter[.]net
• bexldo[.]net
• e-timetoroar[.]net
• genericpillsinc[.]com
• buziaczek[.]pl
• rulovers[.]cn
• karina[.]rubeauty[.]cn
• kristina93[.]loversru[.]cn
• bestprivateinc[.]ru
• bestdrugassist[.]ru
• bestfamilyeshop[.]com
• hb[.]tinkerfcu[.]org
• curingbestvalue[.]com
• fastfastvalue[.]su
• fastpharmeshop[.]com
• acninc[.]net
• curinghotsale[.]su
• fastgenericsdeal[.]su
• goodbestdeal[.]su
• globalcarestore[.]su
• fastremedymall[.]ru
• ameritech[.]net
• classoneequipment[.]com
• chiclleida[.]com
• ferbravo[.]euskalnet[.]net
• scan-associates[.]net
• condor2[.]telapex[.]com
• commonhouse[.]net
• codasoundusa[.]com
• newonthenet[.]net
• e-wholesaler[.]net
• cgce[.]net
• chopanov[.]com
• westbournehouse[.]w-sussex[.]sch[.]uk
• spideroak[.]com
• cfw[.]me[.]uk
• banking[.]achievacu[.]com
• lucky-star[.]com[.]pl
• franjadeponent[.]net
• coffincheatersmc[.]org Files and or directories created
  
• %WinDir%\SysWOW64\config\systemprofile:.repos
• %WinDir%\SysWOW64\config\systemprofile
• %WinDir%\SysWOW64\ibpvucix\
• %LocalAppData%\Temp\gphgpbfw.exe File Hashes
  
• 06331cb6eb8673a49614b3cf67f302cf7a3b5ea18b8bb7d004884cea8f196a83
• 15ce5b3be486d7fe23f3115531ed6642587e3dff9bbfb5fef43ece0ed0cdb3f4
• 198afede85accadb3c147dc92ac2f04866e2e2bbeea7ec1333f73e6a8d76a04d
• 20edb680512a8741667e2652de74649da18542399acdd8dbdc9bc7121f422f40
• 23c8d65f46d2aeb395e25e63dcf0d417703f7a54b501fb40aebc554061384bfa
• 25f41a5ebb1175763d5eeb509a9b2fe559fdfd94a0d1a4736b7b766f9ba6363b
• 2c224aa21be4c3f8bce2e13c0ddb04ce5ec9cdc1480c172d5e0e4e15fdee2c44
• 2e889d267181a338b3c100a69417ee0a145820ab2aea59939d8bb6ccf56f3aef
• 3223a9b86a93b8869b44d7d8d2a7e98de99ddd0e1a5050dd7d708c087f18458e
• 32d7daae4063be4c3cf70d4cb43f0079d53c66170edbcba8282da98d49a7dbbe
• 33def1029bdf7c6675d05d5f224749026a32717392ef848bb0a35b7d6a8f29b9
• 40ad8820abac31fcf2219adb68218cb93765895995cb66f50dca15908d364752
• 471866dd10a5be75f2119d718325aa4026ed267bae3ad29cb08cec747b11e4ea
• 49f79b464c4130f0ff3a0c2b0d3336b0f6b8f51f56164f21b5ca7315424ea39e
• 536c227b86419e3a60bc53b317001b6b8cb9894215a8431542867f4fd10f98ec
• 53802104e558d3689a2f99347a69302fd459ee82615428cde09c28b4f7543541
• 54064cacc8929ef3581370dd311be773d6f3cc45fab81d3a37552b1e854b770d
• 61cfcad8b188a5dda449b76b070092eaa48ecad62c059b4795d3bcbb1e9581e6
• 66ed081ce04cc7e9b321695e153f237f0f430a1dd103e719c8a3812afe148455
• 6fb3f86955fd966f04ede90e33d2b9ae749b7b44a0a5fea78dca6a66387b5b92
• 747cae3430aeeecc86f846ba3bcaad9645ac6a6c0cedc5c027c2b8b3ad1d561e
• 75d9e8e6bc72e53881b4b8cd9daba1c13da9761cfafa560f57410ec8078ad675
• 7e08971c510b3fd9d85876a9a057ba601c38da13173bbda1abe54e05074b22b1
• 8a0b4a3b97122043e1ab8225b331fc4069ba150a275bc77316abc23841feda69
• 8c3de5bbdd6542a6d0c828764b1f47a37a4cad07834bec2fc9c7ac31316834f0  
  

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella