Cisco Talospublished Apr 14, 20:38 UTC (Apr 14, 2023)ingested Sep 10, 06:19 UTC

Threat Roundup for April 7 to April 14

highRansomwareimportance 57

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article1,497 words · extracted from blog.talosintelligence.com · click to collapse

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 7 and April 14. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. A visual depiction of the MITRE ATT&CK techniques associated with each threat is also shown. In these images, the brightness of the technique indicates how prevalent it is across all threat files where dynamic analysis was conducted. There are five distinct shades that are used, with the darkest indicating that no files exhibited technique behavior and the brightest indicating that technique behavior was observed from 75 percent or more of the files.

The most prevalent threats highlighted in this roundup are:

Threat Name	Type	Description
Win.Dropper.Shiz-9995579-0	Dropper	Shiz is a remote access trojan that allows an attacker to access an infected machine to harvest sensitive information. It is commonly spread via droppers or by visiting a malicious site.
Win.Ransomware.Cerber-9995641-0	Ransomware	Cerber is ransomware that encrypts documents, photos, databases and other important files. Historically, this malware would replace files with encrypted versions and add the file extension ".cerber," although in more recent campaigns, other file extensions are used.
Win.Virus.Xpiro-9995713-1	Virus	Expiro is a known file infector and information-stealer that hinders analysis with anti-debugging and anti-analysis tricks.
Win.Dropper.DarkComet-9995915-1	Dropper	DarkComet and related variants are a family of remote access trojans designed to provide an attacker with control over an infected system. Capabilities of this malware include the ability to download files from a user's machine, send back usernames and passwords from the infected systems, and mechanisms for persistence and hiding.
Win.Dropper.Dridex-9995967-0	Dropper	Dridex is a well-known banking trojan that steals credentials and other sensitive information from an infected machine.
Win.Dropper.Kuluoz-9996010-0	Dropper	Kuluoz, sometimes known as "Asprox," is a modular remote access trojan that is also known to download and execute follow-on malware, such as fake antivirus software. Kuluoz is often delivered via spam emails pretending to be shipment delivery notifications or flight booking confirmations.
Win.Virus.Ramnit-9996725-0	Virus	Ramnit is a banking trojan that monitors web browser activity on an infected machine and collects login information from financial websites. It also has the ability to steal browser cookies and attempts to hide from popular antivirus software.
Win.Dropper.XtremeRAT-9996042-0	Dropper	XtremeRAT is a remote access trojan active since 2010 that allows the attacker to eavesdrop on users and modify the running system. The source code for XtremeRAT, written in Delphi, was leaked online and has since been used by similar RATs.
Win.Dropper.TinyBanker-9996101-1	Dropper	TinyBanker, also known as Zusy or Tinba, is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" and "winver.exe." When the user accesses a banking website, it displays a form to trick the user into submitting personal information.

Threat Breakdown

Win.Dropper.Shiz-9995579-0

Indicators of Compromise

IOCs collected from dynamic analysis of 26 samples

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\MICROSOFT Value Name: 67497551a`	26
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: 98b68e3c`	26
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: userinit`	26
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: System`	26
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS Value Name: load`	26
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS Value Name: run`	26
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: userinit`	26

Mutexes	Occurrences
`Global\674972E3a`	26
`Global\MicrosoftSysenterGate7`	26
`internal_wutex_0x000004b4`	26
`internal_wutex_0x0000043c`	26
`internal_wutex_0x000004dc`	26
`internal_wutex_0x<random, matching [0-9a-f]{8}>`	26

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`85[.]94[.]194[.]169`	26
`13[.]107[.]21[.]200`	15

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`fobyqyhezem[.]eu`	26
`gacucuhumeg[.]eu`	26
`maxilumiriz[.]eu`	26
`jelojujopen[.]eu`	26
`qekafuqafit[.]eu`	26
`ryhyruqeliz[.]eu`	26
`kejepujajeg[.]eu`	26
`tufibiqunit[.]eu`	26
`lygumujycen[.]eu`	26
`xudoxijiwef[.]eu`	26
`pupoliqotul[.]eu`	26
`citahikodab[.]eu`	26
`direfiwahur[.]eu`	26
`vowypikelaf[.]eu`	26
`foqurowyxul[.]eu`	26
`nomimokubab[.]eu`	26
`ganovowuqur[.]eu`	26
`mavaxokitad[.]eu`	26
`jecekorosuk[.]eu`	26
`qexeholagav[.]eu`	26
`cilicofahev[.]eu`	26
`vojajofyced[.]eu`	26
`dikolobeliw[.]eu`	26
`fogefobunik[.]eu`	26
`gadurabotiw[.]eu`	26

*See JSON for more IOCs

Files and or directories created	Occurrences
`%TEMP%\<random, matching [A-F0-9]{1,4}>.tmp`	26

File Hashes

068d644b9b7235586167057d266c5a1a91ae65c815e6ebf8c507a302f62dc3cf
08956248ac031ddec7e91d369383005a3e28658e5f7df2e96608ec48db350022
0e8064493dd2bdcbdbca2fe6b3b24cb2bd8ca1a986f3af91b41ef3799c8506ba
102364dee6af1ee0fd51b1c6334ffc9b98ac09ee5a4f7944479983f023f7ec7f
11fdf3b279e74b1edb4113ed0c915a0036d58c8daa0c35e01bd9b2e459a2dacb
13b48d20f75458f89fb5ffd17c78aab1da965b3adacb5a4d180e5f13742af38f
17c5296cbfe5d684c62ca1e5e42f88dcfe808f0279e28cb474ce5e12a7949ffc
1b553ace2cb8a8f52e85cd1426c88b0935875bffed100e3ab85964f08beb87a5
1f6808ef75efc5f9dd8ceefbe64419d3aee9227ea9acb284847083e1e6b4bab9
21c687d07078f7074d72c92d6f71090175c44c2ab5984c5e02c65ef2658835fb
2fd3d2a3389db1d81cc060004780951dd342aa732c040f3bbb3d1c712845ecb7
33315dd18879cc9df6e3846c8bf6c14c3e62be2df8b019bcb03a9d81e082b5c6
35e96b87fc6cf18df36cc81484646847ca82595a8bdeb9edc416114005dfcc7a
3e78983f6aebe750f0d6c68a271e181a4fab42a3ac7ee03175978efb31deab87
46479e0841295c9aecdbd689c77ea0f6ffe8dde9f711fe8a489efb3ccebec85f
46f717eb75a5f0759731fda1837e33f42e05c61ae5684d0b8b1c444395cd94b4
47e0e6e0e50be3647896c3348295a39704df29f410014c511cb473d9c3ae793d
4c7efbbc7df32938f5f78f86a4b0d06585fdc1cff20fed1cf16339815f8e7fd0
55b3ebe3ffab9d6444b3fc421dc805ead41354d24f3cd78ec54b78550cc5779e
56975c17ab0b602e247ddce9d0240e0e5b7578b457f9b4c29fb6b574c65c104a
56e291a38441d33e987f87d1fe9e14a3d0ed6c9a8ce5d657bdb2a34faf0483c0
5f57e49fbe9a4f7c1c3a6dfc26a4157b4c353ac6dcee708a6a52588ebeee6690
6041b3299179a15c0fa9d22b4a7f2d8d83e9796e580e635e99eae097f0c2ace2
659a73a75a0c3e83f51812ed3b0d68ca7bc36404b89dc4417ec56cb5f9857ea1
66415be060a7fdedd814b1ec50b69bfdecbfd4c692335e3dd1eecc4de60b219d
*See JSON for more IOCs

Coverage

Product	Protection
Secure Endpoint
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Secure Malware Analytics
Umbrella
WSA

Screenshots of Detection

Secure Endpoint

Secure Malware Analytics

MITRE ATT&CK