ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Cisco Talospublished ()ingested

Threat Round-up for Aug 11

mediumVulnerabilityimportance 30
Read the original
Tagsvulnerability

Indicators of compromiseAll →

TypeIndicatorContext
sha2560419cd8e5884e2918c5f0746d54efe2e2d9f0385523ecdbc395200df4004d87aa674c751c65c15cbaab276c0fba8f3f1709750473b24e5d3c21e468617f 0419cd8e5884e2918c5f0746d54efe2e2d9f0385523ecdbc395200df4004d87a 29a7f99f81dd37bcbd196d635837c01d2aa48045ce4efd999a6d0da92bf
sha256046809ff996329f2bb539128d51a0c21179ac6d117688281dd927df4b0aaf85b7cbcc932ba68aa9abd4607ea81ba4feb167c3f333c800a56cb2620ffd9f 046809ff996329f2bb539128d51a0c21179ac6d117688281dd927df4b0aaf85b 9679b02ca07d40f2d2d84445b5683fe2c1a135ecf73886d2ed27dc387b1
sha2560524147db311dedc4631e0749bb79865ac673763bd5ebc576855fcb9431de98bc9ca29508aa89caf873ac9359ad579270c3b3025ab0ba8098dea9c3c459 0524147db311dedc4631e0749bb79865ac673763bd5ebc576855fcb9431de98b 0e5240bf70e304781511de29a000c308f675d6209735c118cd0054b519e
sha256056bce922fab367aabfd43f5e85bb5397755db08afcc8c38d992ffb4fe8f766f27b9c0b01a60eb94254d39ac5eeee24a2c10d0c59266252630202a36323 056bce922fab367aabfd43f5e85bb5397755db08afcc8c38d992ffb4fe8f766f 3ca148e6d17868544170351c7e0dbef38e58de9435a2f33fe174c83ea9a
sha256062bd1d88e7b5c08444de559961f68694a445bc69807f57aa4ac581c377bc4328967de0ca4d3a1d28530453e1c395a5166b469893f14c47fc6683033cb3 062bd1d88e7b5c08444de559961f68694a445bc69807f57aa4ac581c377bc432 22fc445798cd3481018c66b308af8545821b2f8f7f5a86133f562b362fc
sha2560752a00c66125520f78673e70af10123cb5b78fe4786d368f7beb586d5ce35314945e7f20e99efed18650d4a7c573f8902b32c10ae89639518f94e646d0 0752a00c66125520f78673e70af10123cb5b78fe4786d368f7beb586d5ce3531 ffc6c04d292e6618826bb09c8c63a06af3993e7b6b14171c45c7b44619b
sha25609f89667dbbd0f72478f317aed5196f743693190aa3afe1f1cfccc67dad88fb60bf70e304781511de29a000c308f675d6209735c118cd0054b519eaa096 09f89667dbbd0f72478f317aed5196f743693190aa3afe1f1cfccc67dad88fb6 4cf480e7bab22fdd7d64c43d8f18c3c5358c25fbd063bc2d2855885b886
sha2560ce6189ecd16fbf2f885a8516836c7bb9d0685f6ff2c4a3df80e236ef5d0d803directories created %AppData%\5E60878D\bin.exe File Hashes 0ce6189ecd16fbf2f885a8516836c7bb9d0685f6ff2c4a3df80e236ef5d0d803 33fd66f4cee5bdd9f30eb2e5bd7a65367e10f55495c1122430685a8ff0d
sha2560db7513e4ec8cea44afdce2d37991f5f9cbde0bb779856c10d9ffa75bed53d0ff26b9699622bde12c6b64a78e5446172e57c5a29c3ea0267a0df85bc1e3 0db7513e4ec8cea44afdce2d37991f5f9cbde0bb779856c10d9ffa75bed53d0f b1e4e3be5dd686424763f39f8930e28044a9cda7a48d8962ba6e8978ef5
sha2560e5240bf70e304781511de29a000c308f675d6209735c118cd0054b519eaa09647db311dedc4631e0749bb79865ac673763bd5ebc576855fcb9431de98b 0e5240bf70e304781511de29a000c308f675d6209735c118cd0054b519eaa096 09f89667dbbd0f72478f317aed5196f743693190aa3afe1f1cfccc67dad
sha256148b0ed81c95496d80778c7d3d093627a7395b76bf9b457f958201be66e8ea1f7b98551548002dd9cd977cd3f881f0496ab2f86ef1a90d6c7a13765366c 148b0ed81c95496d80778c7d3d093627a7395b76bf9b457f958201be66e8ea1f 9ba948417071478c1fa3fe89c46c19c56190f47f2ba141a446166eff5a7
sha2561496ddfb94f11120267fe9d6bf233ba4726754bebf3075340496a144777a6539069e1268801cb3afaee2523df1aca628fa791a666f1d05b6cb981913461 1496ddfb94f11120267fe9d6bf233ba4726754bebf3075340496a144777a6539 5f1827ab138eb25289a1a76910f5dc9c96aed87dd8aa2db7e3b0d310267
sha256168c49c8207019008bdf746d0fa4ab33a154277c5fe50fd4900e9d77ec6a2e7d19c8ea6e5d7546e6449e6aed748ce74359e7c0dbd1f9bd08e2e8b795c68 168c49c8207019008bdf746d0fa4ab33a154277c5fe50fd4900e9d77ec6a2e7d e92710c582f71c4a9cb127774fa4cce0d8abb837a38d50d22d17ef70616
sha256190cda0ade0c0348786652b7ee12fde595e12ab561d893224cfdafbd58ec7b756df607a29ef83bd035ee27fc424307712e59298f54803150a88ea5c5ece 190cda0ade0c0348786652b7ee12fde595e12ab561d893224cfdafbd58ec7b75 cccb32f7f0408b32f3ad7f5a75adf1b955ba83a712e59c64f16b07713a6
sha2561a1a48c35aee34ba91d83ae97865d75319112165ee8e7dad7cb7714ab57c40b78417071478c1fa3fe89c46c19c56190f47f2ba141a446166eff5a71fbb4 1a1a48c35aee34ba91d83ae97865d75319112165ee8e7dad7cb7714ab57c40b7 5b1e2ebb1baa600fba198e5c233ebb431311c976ef23f5c2f2c74ff0339
sha2561c364ed502fa3710d9fa3c5a4a2ac6688bea3610acee2a6f958220d8ffca908bf20ce7be29f5864a02d72bcfa54e215d3159bf381d05fac58d2fa703f0d 1c364ed502fa3710d9fa3c5a4a2ac6688bea3610acee2a6f958220d8ffca908b 36472a674c751c65c15cbaab276c0fba8f3f1709750473b24e5d3c21e46
sha25622fc445798cd3481018c66b308af8545821b2f8f7f5a86133f562b362fc17a051d88e7b5c08444de559961f68694a445bc69807f57aa4ac581c377bc432 22fc445798cd3481018c66b308af8545821b2f8f7f5a86133f562b362fc17a05 80d450ca5b01a086806855356611405b2c87b3822c0c1c38a118bca57d8
sha25627772ef48d027d7e23e1f78d8ea86cb1bbcf4240cd59a8dc7ebc82f8a3a8b6ddc56408a13f44d620971a60342bb0170ad78217c923c518fe4b58b4da365 27772ef48d027d7e23e1f78d8ea86cb1bbcf4240cd59a8dc7ebc82f8a3a8b6dd a31cbc1ce4abaa2ba7cab9ff97e1f647c3b1264c9cb7db0e20c74d151db
sha25629a7f99f81dd37bcbd196d635837c01d2aa48045ce4efd999a6d0da92bfbe917d8e5884e2918c5f0746d54efe2e2d9f0385523ecdbc395200df4004d87a 29a7f99f81dd37bcbd196d635837c01d2aa48045ce4efd999a6d0da92bfbe917 6451b45a4f8bdccdbce6bcd14e5fda1f976c81efed2c4dfd028386cce31
sha2562aaf7791ed0a57e48c3d363b46ba5247e78a2290549bfd7f98793e9bee4c3e5527b886d65c06a43f823511f0927b85dc5956dc7bd1bd16c59af548db6b8 2aaf7791ed0a57e48c3d363b46ba5247e78a2290549bfd7f98793e9bee4c3e55 9b6d3e01584f4d1238a55050c7ffad0e14299e911db8497b81529bd58af
sha25631755c56408a13f44d620971a60342bb0170ad78217c923c518fe4b58b4da3653be5dd686424763f39f8930e28044a9cda7a48d8962ba6e8978ef532fa0 31755c56408a13f44d620971a60342bb0170ad78217c923c518fe4b58b4da365 27772ef48d027d7e23e1f78d8ea86cb1bbcf4240cd59a8dc7ebc82f8a3a
sha25631b34ac21405f6450bef3c18249e83a7bc464dea5cd4fb239becfe0a800875a22f7f0408b32f3ad7f5a75adf1b955ba83a712e59c64f16b07713a6b44b8 31b34ac21405f6450bef3c18249e83a7bc464dea5cd4fb239becfe0a800875a2 db8ee4755c2b30756abb68e14e30b7c10d283b2f989fc7f3556f92389a2
sha25633fd66f4cee5bdd9f30eb2e5bd7a65367e10f55495c1122430685a8ff0d90fcc89ecd16fbf2f885a8516836c7bb9d0685f6ff2c4a3df80e236ef5d0d803 33fd66f4cee5bdd9f30eb2e5bd7a65367e10f55495c1122430685a8ff0d90fcc 51769c916a89522975cb1babb4c9c7b18f3530286c66f3d735751cbdac0
sha25636472a674c751c65c15cbaab276c0fba8f3f1709750473b24e5d3c21e468617fed502fa3710d9fa3c5a4a2ac6688bea3610acee2a6f958220d8ffca908b 36472a674c751c65c15cbaab276c0fba8f3f1709750473b24e5d3c21e468617f 0419cd8e5884e2918c5f0746d54efe2e2d9f0385523ecdbc395200df400
sha256366f1f331e940a462447e2b4abe9196ae7b977d281c2b9fe5e19bb0c2927b705c0942b08720073373536520b471229c918474cabb63fd19c3d006caaa1b 366f1f331e940a462447e2b4abe9196ae7b977d281c2b9fe5e19bb0c2927b705 9859e621b4d259798b2813377f9cd1736497f51cb501c6b3ea44ccae57d
sha2563728cecd2be075b09a3a6d8d8c5923fe14cf381e3070266cf05fa51585def305564a6a7ba8f4c97e2eaefbedafab6dd1424d56716f1255b03f8b5879161 3728cecd2be075b09a3a6d8d8c5923fe14cf381e3070266cf05fa51585def305 bec41e3e8d3093b58170d743ca905af81ed745a4828a42a9d39cd337325
sha25637e79b45ee53bc266d3602ec2cb79762a3c6360b5c173e89da045491150dbfb1ce6c484aef7d0d801c2f5ee31c984136d91636656a7e5425fbc4e848029 37e79b45ee53bc266d3602ec2cb79762a3c6360b5c173e89da045491150dbfb1 a4692d62273960b017d80e2b3ee9befe9b186d0609dbf4aedd1dcaf6d3a
sha2563a79a33855731c0066016de8baf9ef6b946b06b1ce4fda28f3c68265afa6c89a02ca07d40f2d2d84445b5683fe2c1a135ecf73886d2ed27dc387b108417 3a79a33855731c0066016de8baf9ef6b946b06b1ce4fda28f3c68265afa6c89a 3b0997b98551548002dd9cd977cd3f881f0496ab2f86ef1a90d6c7a1376
sha2563b0997b98551548002dd9cd977cd3f881f0496ab2f86ef1a90d6c7a13765366c33855731c0066016de8baf9ef6b946b06b1ce4fda28f3c68265afa6c89a 3b0997b98551548002dd9cd977cd3f881f0496ab2f86ef1a90d6c7a13765366c 148b0ed81c95496d80778c7d3d093627a7395b76bf9b457f958201be66e
sha2563ca148e6d17868544170351c7e0dbef38e58de9435a2f33fe174c83ea9a5a7f5e922fab367aabfd43f5e85bb5397755db08afcc8c38d992ffb4fe8f766f 3ca148e6d17868544170351c7e0dbef38e58de9435a2f33fe174c83ea9a5a7f5 6250f069e1268801cb3afaee2523df1aca628fa791a666f1d05b6cb9819
sha2563d081fe6a220b546af09139fda7deceb5e7f16b52fb47d15ff4e69bab917573407f98efa76de2b349c90084fbef6d40d9df32a41df98fc62e19fab5329d 3d081fe6a220b546af09139fda7deceb5e7f16b52fb47d15ff4e69bab9175734 f0b670afe4781d3e8899bf742fbd613636424681f56c4388168acea84ea
sha256404987cbcc932ba68aa9abd4607ea81ba4feb167c3f333c800a56cb2620ffd9ff2e7d972b47c5016dd755bfce2e794822ef6933ff9759fd70e72b137a16 404987cbcc932ba68aa9abd4607ea81ba4feb167c3f333c800a56cb2620ffd9f 046809ff996329f2bb539128d51a0c21179ac6d117688281dd927df4b0a
sha2564111dc9ca29508aa89caf873ac9359ad579270c3b3025ab0ba8098dea9c3c459e1ea1fc0c9846d21f643013fd934fd23b187ca1fd32c90334ff48a60372 4111dc9ca29508aa89caf873ac9359ad579270c3b3025ab0ba8098dea9c3c459 0524147db311dedc4631e0749bb79865ac673763bd5ebc576855fcb9431
sha256425e004b3c9034aa17071b137ca1d4ae7a35dde5f588c05295e491b716125e2afe1710b4b39866bebceb3660e1386e41df17b13a6055078b0ce7db74fbe 425e004b3c9034aa17071b137ca1d4ae7a35dde5f588c05295e491b716125e2a 8c4813043fa78b4aec7ada10556ddbe06eedbc81b115e4ff08371d8ee13
sha25644b6060a5406112556049bd3efef8d876fe335bb4aa0f0a6f7d0210184918c718c1f83d086fcb94b8ae7288f2acb85f6e441c66a3f1d09365a1018c80bd 44b6060a5406112556049bd3efef8d876fe335bb4aa0f0a6f7d0210184918c71 4e812653205426b75038ce2796be5b254b61ee02da376462f3ad1ac23d8
sha25645112ef00b7d34a471655f3a7318fd2b69de1ade1889647839ff897c6e6f1c67d7e92a3bb920456b149717c353c8779e45a947c0e756889956c6bc48d7a 45112ef00b7d34a471655f3a7318fd2b69de1ade1889647839ff897c6e6f1c67 9d52dd2437d0408e5971598b44c5dc1e1475004241bb5928d1eaee9a9ae
sha256454ed2ca7a116ad34864d4e8b232dcb50c063ffbd70f23753262aabb6b34d24e653205426b75038ce2796be5b254b61ee02da376462f3ad1ac23d898282 454ed2ca7a116ad34864d4e8b232dcb50c063ffbd70f23753262aabb6b34d24e bf958c7ba44b9dfdcba50eeb6f7b59fe3bd2948f1ab1a7c8ee0f162b7ca
sha2564808a9fc9a33cf5df06d5a56f85b6e2dfdb8fc5fbb4cbd2ede05488dd566f6f570451995a7dae4d5b741e291ce525aec2cf3144d9fdb8484f39079ef9e2 4808a9fc9a33cf5df06d5a56f85b6e2dfdb8fc5fbb4cbd2ede05488dd566f6f5 eb99cecc433a5134414024c98c227f52bae7660343a36469ccf0e6a8f5a
sha2564b495c54056aa68e91fd481168a7ddc5d5a6cae713ab359777340f1ba901ae659514afabc723da282f32ad1dcfe81796a83555b7b4a6738dd0254c06ccd 4b495c54056aa68e91fd481168a7ddc5d5a6cae713ab359777340f1ba901ae65 b588aa1d5901e2ded7dfc9fe8efbd13304f2bed37086b5c9aa498fdffae
sha2564cf480e7bab22fdd7d64c43d8f18c3c5358c25fbd063bc2d2855885b886718ac667dbbd0f72478f317aed5196f743693190aa3afe1f1cfccc67dad88fb6 4cf480e7bab22fdd7d64c43d8f18c3c5358c25fbd063bc2d2855885b886718ac 6ea7a564a6a7ba8f4c97e2eaefbedafab6dd1424d56716f1255b03f8b58
sha2564e812653205426b75038ce2796be5b254b61ee02da376462f3ad1ac23d89828260a5406112556049bd3efef8d876fe335bb4aa0f0a6f7d0210184918c71 4e812653205426b75038ce2796be5b254b61ee02da376462f3ad1ac23d898282 454ed2ca7a116ad34864d4e8b232dcb50c063ffbd70f23753262aabb6b3
sha25651769c916a89522975cb1babb4c9c7b18f3530286c66f3d735751cbdac02a1606f4cee5bdd9f30eb2e5bd7a65367e10f55495c1122430685a8ff0d90fcc 51769c916a89522975cb1babb4c9c7b18f3530286c66f3d735751cbdac02a160 56f91537753491cd32a250428b146d7685362c762c7e8f39703b4cf6cd9
sha2565624e26cace481fa4144f5ccd5bdcc7b5c3d42c035c88250312833041cf5580716ba1cfd870d1d72e75ab9ec1d0a08a7e11d9fe7ec6b32fa0ce468206e7 5624e26cace481fa4144f5ccd5bdcc7b5c3d42c035c88250312833041cf55807 b0610f20ce7be29f5864a02d72bcfa54e215d3159bf381d05fac58d2fa7
sha25656f91537753491cd32a250428b146d7685362c762c7e8f39703b4cf6cd92c020c916a89522975cb1babb4c9c7b18f3530286c66f3d735751cbdac02a160 56f91537753491cd32a250428b146d7685362c762c7e8f39703b4cf6cd92c020 6fd80f8da071c3dc482314cbc994b22f105bce22acdad9e9bd86bae5abe
sha2565b1e2ebb1baa600fba198e5c233ebb431311c976ef23f5c2f2c74ff03392a8248c35aee34ba91d83ae97865d75319112165ee8e7dad7cb7714ab57c40b7 5b1e2ebb1baa600fba198e5c233ebb431311c976ef23f5c2f2c74ff03392a824 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha2565dd873a5cd07c4ac6edc7bfad7c92e1111cbddab5e72de96291e2990e0ab62e01c782e6b9250035f922ebc80400f2d6515e5f343a933c6c12920eb89e92 5dd873a5cd07c4ac6edc7bfad7c92e1111cbddab5e72de96291e2990e0ab62e0 8c43427b886d65c06a43f823511f0927b85dc5956dc7bd1bd16c59af548
sha2565de158f2b9e0039b76588fd190565bcf4e02398ec8bff57d1c55bcc1626de5f3a5e7f30a1621e204669ffefe91f22a1619814c4ef40872cd750cffb9125 5de158f2b9e0039b76588fd190565bcf4e02398ec8bff57d1c55bcc1626de5f3 f8913513ec19ea386cb812e5e7249d44a4e4a3092fbfcea23fce692d7ed
sha2565df3016ba1cfd870d1d72e75ab9ec1d0a08a7e11d9fe7ec6b32fa0ce468206e7a2b7bd0a120b55e39b3107f934f9b76faa9e2679dbae1237f69f2c3f1b9 5df3016ba1cfd870d1d72e75ab9ec1d0a08a7e11d9fe7ec6b32fa0ce468206e7 5624e26cace481fa4144f5ccd5bdcc7b5c3d42c035c88250312833041cf
sha2565edbc08d4e919f7186aa2b8a6e3d49ef38035c2a55b6e226910fcc60fe26a335513.exe %TEMP%\7E94\3F4A.tmp \TEMP\fatt.348.doc File Hashes 5edbc08d4e919f7186aa2b8a6e3d49ef38035c2a55b6e226910fcc60fe26a335 bbe5988f2470a296186ca43a76636fceb523b45273a32e83aa14a8cc1f4
sha2565f1827ab138eb25289a1a76910f5dc9c96aed87dd8aa2db7e3b0d310267a5a67dfb94f11120267fe9d6bf233ba4726754bebf3075340496a144777a6539 5f1827ab138eb25289a1a76910f5dc9c96aed87dd8aa2db7e3b0d310267a5a67 d08c719c8ea6e5d7546e6449e6aed748ce74359e7c0dbd1f9bd08e2e8b7
sha2565f5e9e5952765887211883b42e508b4b14c62a1685092978f98c6619229796b54b6abe1473fd5a7f96c711a4270fbc364bc6e3b10b5b344e0a1bfb0e4d8 5f5e9e5952765887211883b42e508b4b14c62a1685092978f98c6619229796b5 5fe205ea4f5f975703e242e8079dc471a5363538535d76584e7138ed3fb
sha2565fd134b6abe1473fd5a7f96c711a4270fbc364bc6e3b10b5b344e0a1bfb0e4d822af917cb8aa58c14b8b78d4af112c9c78343da8f7aa3fbcb87be1a4de0 5fd134b6abe1473fd5a7f96c711a4270fbc364bc6e3b10b5b344e0a1bfb0e4d8 5f5e9e5952765887211883b42e508b4b14c62a1685092978f98c6619229
sha2565fe205ea4f5f975703e242e8079dc471a5363538535d76584e7138ed3fb67546e5952765887211883b42e508b4b14c62a1685092978f98c6619229796b5 5fe205ea4f5f975703e242e8079dc471a5363538535d76584e7138ed3fb67546 5ffa0097ebcba0e1921c6607a644e2649532ae07b1c7d6533a3cbef52ee
sha2565ffa0097ebcba0e1921c6607a644e2649532ae07b1c7d6533a3cbef52ee516205ea4f5f975703e242e8079dc471a5363538535d76584e7138ed3fb67546 5ffa0097ebcba0e1921c6607a644e2649532ae07b1c7d6533a3cbef52ee51620 Coverage Screenshots of Detection AMP ThreatGrid Win.Trojan
sha25660d2422af917cb8aa58c14b8b78d4af112c9c78343da8f7aa3fbcb87be1a4de0N/A Domain Names N/A Files and or directories created \TEMP\60d2422af917cb8aa58c14b8b78d4af112c9c78343da8f7aa3fbcb87be1a4de0.exe File Hashes 60d2422af917cb8aa58c14b8b78d4af112c9c78343d
sha2566250f069e1268801cb3afaee2523df1aca628fa791a666f1d05b6cb9819134618e6d17868544170351c7e0dbef38e58de9435a2f33fe174c83ea9a5a7f5 6250f069e1268801cb3afaee2523df1aca628fa791a666f1d05b6cb981913461 1496ddfb94f11120267fe9d6bf233ba4726754bebf3075340496a144777
sha2566451b45a4f8bdccdbce6bcd14e5fda1f976c81efed2c4dfd028386cce31250d199f81dd37bcbd196d635837c01d2aa48045ce4efd999a6d0da92bfbe917 6451b45a4f8bdccdbce6bcd14e5fda1f976c81efed2c4dfd028386cce31250d1 7a703a5e7f30a1621e204669ffefe91f22a1619814c4ef40872cd750cff
sha2566dc6070451995a7dae4d5b741e291ce525aec2cf3144d9fdb8484f39079ef9e2513ec19ea386cb812e5e7249d44a4e4a3092fbfcea23fce692d7ed88970 6dc6070451995a7dae4d5b741e291ce525aec2cf3144d9fdb8484f39079ef9e2 4808a9fc9a33cf5df06d5a56f85b6e2dfdb8fc5fbb4cbd2ede05488dd56
sha2566ea7a564a6a7ba8f4c97e2eaefbedafab6dd1424d56716f1255b03f8b58791610e7bab22fdd7d64c43d8f18c3c5358c25fbd063bc2d2855885b886718ac 6ea7a564a6a7ba8f4c97e2eaefbedafab6dd1424d56716f1255b03f8b5879161 3728cecd2be075b09a3a6d8d8c5923fe14cf381e3070266cf05fa51585d
sha2566fd80f8da071c3dc482314cbc994b22f105bce22acdad9e9bd86bae5abed53d9537753491cd32a250428b146d7685362c762c7e8f39703b4cf6cd92c020 6fd80f8da071c3dc482314cbc994b22f105bce22acdad9e9bd86bae5abed53d9 7607a0e1be2a8f50959ef42b78edd156aa76741fdc8ee2be9d375610c0b
sha256712a907f98efa76de2b349c90084fbef6d40d9df32a41df98fc62e19fab5329daae207f7a7a1f242d849bb61c7f4e98d84f74b228439d296e6a46b2f812 712a907f98efa76de2b349c90084fbef6d40d9df32a41df98fc62e19fab5329d 3d081fe6a220b546af09139fda7deceb5e7f16b52fb47d15ff4e69bab91
sha256717f927b9c0b01a60eb94254d39ac5eeee24a2c10d0c59266252630202a36323a1d5901e2ded7dfc9fe8efbd13304f2bed37086b5c9aa498fdffaed48ba 717f927b9c0b01a60eb94254d39ac5eeee24a2c10d0c59266252630202a36323 056bce922fab367aabfd43f5e85bb5397755db08afcc8c38d992ffb4fe8
sha256758a4e1ea1fc0c9846d21f643013fd934fd23b187ca1fd32c90334ff48a6037204d292e6618826bb09c8c63a06af3993e7b6b14171c45c7b44619b4421a 758a4e1ea1fc0c9846d21f643013fd934fd23b187ca1fd32c90334ff48a60372 4111dc9ca29508aa89caf873ac9359ad579270c3b3025ab0ba8098dea9c
sha2567a703a5e7f30a1621e204669ffefe91f22a1619814c4ef40872cd750cffb912545a4f8bdccdbce6bcd14e5fda1f976c81efed2c4dfd028386cce31250d1 7a703a5e7f30a1621e204669ffefe91f22a1619814c4ef40872cd750cffb9125 5de158f2b9e0039b76588fd190565bcf4e02398ec8bff57d1c55bcc1626
sha2567ffabe10f4147ce48fc9ae40cdc7778d08ac7881b779743720e2c4313592445bngs\Administrator\Local Settings\Temp\plzea.exe File Hashes 7ffabe10f4147ce48fc9ae40cdc7778d08ac7881b779743720e2c4313592445b c2a3dcd915905c09026044e8da533455a2742196e4294cfffc000c048c1
sha25680d450ca5b01a086806855356611405b2c87b3822c0c1c38a118bca57d87c41045798cd3481018c66b308af8545821b2f8f7f5a86133f562b362fc17a05 80d450ca5b01a086806855356611405b2c87b3822c0c1c38a118bca57d87c410 8f6939ac776dac54c2433b33386169b4d45cfea9b8eb59fef3b922d9943
sha2568c43427b886d65c06a43f823511f0927b85dc5956dc7bd1bd16c59af548db6b83a5cd07c4ac6edc7bfad7c92e1111cbddab5e72de96291e2990e0ab62e0 8c43427b886d65c06a43f823511f0927b85dc5956dc7bd1bd16c59af548db6b8 2aaf7791ed0a57e48c3d363b46ba5247e78a2290549bfd7f98793e9bee4
sha2568c4813043fa78b4aec7ada10556ddbe06eedbc81b115e4ff08371d8ee132d64504b3c9034aa17071b137ca1d4ae7a35dde5f588c05295e491b716125e2a 8c4813043fa78b4aec7ada10556ddbe06eedbc81b115e4ff08371d8ee132d645 c7cab605153ac4718af23d87c506e46b8f62ee2bc7e7a3e6140210c0aeb
sha2568f6939ac776dac54c2433b33386169b4d45cfea9b8eb59fef3b922d994313b710ca5b01a086806855356611405b2c87b3822c0c1c38a118bca57d87c410 8f6939ac776dac54c2433b33386169b4d45cfea9b8eb59fef3b922d994313b71 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha25694395a2b7bd0a120b55e39b3107f934f9b76faa9e2679dbae1237f69f2c3f1b9621b4d259798b2813377f9cd1736497f51cb501c6b3ea44ccae57d4e4fa 94395a2b7bd0a120b55e39b3107f934f9b76faa9e2679dbae1237f69f2c3f1b9 5df3016ba1cfd870d1d72e75ab9ec1d0a08a7e11d9fe7ec6b32fa0ce468
sha256947ec2662ab377aca91f9ccb5b2a0e823ab5b814be719494c5cb8f0e7e228252d2437d0408e5971598b44c5dc1e1475004241bb5928d1eaee9a9aea51e1 947ec2662ab377aca91f9ccb5b2a0e823ab5b814be719494c5cb8f0e7e228252 d076c672bdb9bd3b738edb882560482bebde469d02acd1ccda11e9c9cb6
sha2569679b02ca07d40f2d2d84445b5683fe2c1a135ecf73886d2ed27dc387b1084179ff996329f2bb539128d51a0c21179ac6d117688281dd927df4b0aaf85b 9679b02ca07d40f2d2d84445b5683fe2c1a135ecf73886d2ed27dc387b108417 3a79a33855731c0066016de8baf9ef6b946b06b1ce4fda28f3c68265afa
sha256976c6ce6c484aef7d0d801c2f5ee31c984136d91636656a7e5425fbc4e8480290afe4781d3e8899bf742fbd613636424681f56c4388168acea84ea344af 976c6ce6c484aef7d0d801c2f5ee31c984136d91636656a7e5425fbc4e848029 37e79b45ee53bc266d3602ec2cb79762a3c6360b5c173e89da045491150
sha2569859e621b4d259798b2813377f9cd1736497f51cb501c6b3ea44ccae57d4e4faf331e940a462447e2b4abe9196ae7b977d281c2b9fe5e19bb0c2927b705 9859e621b4d259798b2813377f9cd1736497f51cb501c6b3ea44ccae57d4e4fa 94395a2b7bd0a120b55e39b3107f934f9b76faa9e2679dbae1237f69f2c
sha2569b6d3e01584f4d1238a55050c7ffad0e14299e911db8497b81529bd58afa4bc7791ed0a57e48c3d363b46ba5247e78a2290549bfd7f98793e9bee4c3e55 9b6d3e01584f4d1238a55050c7ffad0e14299e911db8497b81529bd58afa4bc7 d526ffe1710b4b39866bebceb3660e1386e41df17b13a6055078b0ce7db
sha2569ba948417071478c1fa3fe89c46c19c56190f47f2ba141a446166eff5a71fbb4ed81c95496d80778c7d3d093627a7395b76bf9b457f958201be66e8ea1f 9ba948417071478c1fa3fe89c46c19c56190f47f2ba141a446166eff5a71fbb4 1a1a48c35aee34ba91d83ae97865d75319112165ee8e7dad7cb7714ab57
sha2569d52dd2437d0408e5971598b44c5dc1e1475004241bb5928d1eaee9a9aea51e1ef00b7d34a471655f3a7318fd2b69de1ade1889647839ff897c6e6f1c67 9d52dd2437d0408e5971598b44c5dc1e1475004241bb5928d1eaee9a9aea51e1 947ec2662ab377aca91f9ccb5b2a0e823ab5b814be719494c5cb8f0e7e2
sha2569f404502e944f4cd76b902abf67717054732528a9399e23b3d90e2825316818dae3c710674f0e73ea2ed1e72085d790a653e249e1b5e4d8e6696e110041 9f404502e944f4cd76b902abf67717054732528a9399e23b3d90e2825316818d f6c2aea9dbc12ff2dbf77637560093234465cdae03c40ee4f0afcf8365e
sha256a31cbc1ce4abaa2ba7cab9ff97e1f647c3b1264c9cb7db0e20c74d151db2634def48d027d7e23e1f78d8ea86cb1bbcf4240cd59a8dc7ebc82f8a3a8b6dd a31cbc1ce4abaa2ba7cab9ff97e1f647c3b1264c9cb7db0e20c74d151db2634d c685f1c782e6b9250035f922ebc80400f2d6515e5f343a933c6c12920eb
sha256a4692d62273960b017d80e2b3ee9befe9b186d0609dbf4aedd1dcaf6d3aef671b45ee53bc266d3602ec2cb79762a3c6360b5c173e89da045491150dbfb1 a4692d62273960b017d80e2b3ee9befe9b186d0609dbf4aedd1dcaf6d3aef671 c3e6a58e8a68518ffb43ee9026508b6520016e8d7096bf94ec2d1ed5cd3
sha256a5eb0f2e7d972b47c5016dd755bfce2e794822ef6933ff9759fd70e72b137a16d or directories created %TEMP%\CVRDF32.tmp.cvr File Hashes a5eb0f2e7d972b47c5016dd755bfce2e794822ef6933ff9759fd70e72b137a16 404987cbcc932ba68aa9abd4607ea81ba4feb167c3f333c800a56cb2620
sha256acdae0dde63863e8be98935254c901439b5fc36fb45f974fd7ce7c298e3ca0ca88f2470a296186ca43a76636fceb523b45273a32e83aa14a8cc1f4e3a8e acdae0dde63863e8be98935254c901439b5fc36fb45f974fd7ce7c298e3ca0ca b05c34ffdc8c82862b408a1f628b21bb08362de4340d768a08c511132ce
sha256b05c34ffdc8c82862b408a1f628b21bb08362de4340d768a08c511132ce7d34d0dde63863e8be98935254c901439b5fc36fb45f974fd7ce7c298e3ca0ca b05c34ffdc8c82862b408a1f628b21bb08362de4340d768a08c511132ce7d34d cad134945e7f20e99efed18650d4a7c573f8902b32c10ae89639518f94e
sha256b0610f20ce7be29f5864a02d72bcfa54e215d3159bf381d05fac58d2fa703f0d26cace481fa4144f5ccd5bdcc7b5c3d42c035c88250312833041cf55807 b0610f20ce7be29f5864a02d72bcfa54e215d3159bf381d05fac58d2fa703f0d 1c364ed502fa3710d9fa3c5a4a2ac6688bea3610acee2a6f958220d8ffc
sha256b1e4e3be5dd686424763f39f8930e28044a9cda7a48d8962ba6e8978ef532fa013e4ec8cea44afdce2d37991f5f9cbde0bb779856c10d9ffa75bed53d0f b1e4e3be5dd686424763f39f8930e28044a9cda7a48d8962ba6e8978ef532fa0 31755c56408a13f44d620971a60342bb0170ad78217c923c518fe4b58b4
sha256b3dc9a164f1548ca0fd4618dbaae44c6a9ea05f66aafcf67758d9985b1409cb0ecc433a5134414024c98c227f52bae7660343a36469ccf0e6a8f5af4a6d b3dc9a164f1548ca0fd4618dbaae44c6a9ea05f66aafcf67758d9985b1409cb0 e14472604877ad85c119703225fb6086053bcaa2ebae60d38762bbdd192
sha256b3fffd7e92a3bb920456b149717c353c8779e45a947c0e756889956c6bc48d7aea9dbc12ff2dbf77637560093234465cdae03c40ee4f0afcf8365ebfab7 b3fffd7e92a3bb920456b149717c353c8779e45a947c0e756889956c6bc48d7a 45112ef00b7d34a471655f3a7318fd2b69de1ade1889647839ff897c6e6
sha256b588aa1d5901e2ded7dfc9fe8efbd13304f2bed37086b5c9aa498fdffaed48bac54056aa68e91fd481168a7ddc5d5a6cae713ab359777340f1ba901ae65 b588aa1d5901e2ded7dfc9fe8efbd13304f2bed37086b5c9aa498fdffaed48ba 717f927b9c0b01a60eb94254d39ac5eeee24a2c10d0c59266252630202a
sha256bbe5988f2470a296186ca43a76636fceb523b45273a32e83aa14a8cc1f4e3a8e08d4e919f7186aa2b8a6e3d49ef38035c2a55b6e226910fcc60fe26a335 bbe5988f2470a296186ca43a76636fceb523b45273a32e83aa14a8cc1f4e3a8e acdae0dde63863e8be98935254c901439b5fc36fb45f974fd7ce7c298e3
sha256bd7ed9514afabc723da282f32ad1dcfe81796a83555b7b4a6738dd0254c06ccde3e8d3093b58170d743ca905af81ed745a4828a42a9d39cd3373252a84d bd7ed9514afabc723da282f32ad1dcfe81796a83555b7b4a6738dd0254c06ccd 4b495c54056aa68e91fd481168a7ddc5d5a6cae713ab359777340f1ba90
sha256bec41e3e8d3093b58170d743ca905af81ed745a4828a42a9d39cd3373252a84decd2be075b09a3a6d8d8c5923fe14cf381e3070266cf05fa51585def305 bec41e3e8d3093b58170d743ca905af81ed745a4828a42a9d39cd3373252a84d bd7ed9514afabc723da282f32ad1dcfe81796a83555b7b4a6738dd0254c
sha256bf958c7ba44b9dfdcba50eeb6f7b59fe3bd2948f1ab1a7c8ee0f162b7cac3b2c2ca7a116ad34864d4e8b232dcb50c063ffbd70f23753262aabb6b34d24e bf958c7ba44b9dfdcba50eeb6f7b59fe3bd2948f1ab1a7c8ee0f162b7cac3b2c de0e7aae207f7a7a1f242d849bb61c7f4e98d84f74b228439d296e6a46b
sha256c16408967de0ca4d3a1d28530453e1c395a5166b469893f14c47fc6683033cb3ealer[.]ru Files and or directories created N/A File Hashes c16408967de0ca4d3a1d28530453e1c395a5166b469893f14c47fc6683033cb3 062bd1d88e7b5c08444de559961f68694a445bc69807f57aa4ac581c377
sha256c2a3dcd915905c09026044e8da533455a2742196e4294cfffc000c048c1ea9cce10f4147ce48fc9ae40cdc7778d08ac7881b779743720e2c4313592445b c2a3dcd915905c09026044e8da533455a2742196e4294cfffc000c048c1ea9cc f756ea3c00d7a3dc3ff1c0224add01e8189375a64fbcd5c97f551d64c80
sha256c3e6a58e8a68518ffb43ee9026508b6520016e8d7096bf94ec2d1ed5cd328d76d62273960b017d80e2b3ee9befe9b186d0609dbf4aedd1dcaf6d3aef671 c3e6a58e8a68518ffb43ee9026508b6520016e8d7096bf94ec2d1ed5cd328d76 e8290589cab3707f80ada754a31263e239b870dac5bdece15bf2e331cae
sha256c685f1c782e6b9250035f922ebc80400f2d6515e5f343a933c6c12920eb89e92c1ce4abaa2ba7cab9ff97e1f647c3b1264c9cb7db0e20c74d151db2634d c685f1c782e6b9250035f922ebc80400f2d6515e5f343a933c6c12920eb89e92 5dd873a5cd07c4ac6edc7bfad7c92e1111cbddab5e72de96291e2990e0a
sha256c7cab605153ac4718af23d87c506e46b8f62ee2bc7e7a3e6140210c0aeb83d483043fa78b4aec7ada10556ddbe06eedbc81b115e4ff08371d8ee132d645 c7cab605153ac4718af23d87c506e46b8f62ee2bc7e7a3e6140210c0aeb83d48 d52318c1f83d086fcb94b8ae7288f2acb85f6e441c66a3f1d09365a1018
sha256cad134945e7f20e99efed18650d4a7c573f8902b32c10ae89639518f94e646d04ffdc8c82862b408a1f628b21bb08362de4340d768a08c511132ce7d34d cad134945e7f20e99efed18650d4a7c573f8902b32c10ae89639518f94e646d0 0752a00c66125520f78673e70af10123cb5b78fe4786d368f7beb586d5c
sha256cccb32f7f0408b32f3ad7f5a75adf1b955ba83a712e59c64f16b07713a6b44b8a0ade0c0348786652b7ee12fde595e12ab561d893224cfdafbd58ec7b75 cccb32f7f0408b32f3ad7f5a75adf1b955ba83a712e59c64f16b07713a6b44b8 31b34ac21405f6450bef3c18249e83a7bc464dea5cd4fb239becfe0a800
sha256d076c672bdb9bd3b738edb882560482bebde469d02acd1ccda11e9c9cb6feaeb2662ab377aca91f9ccb5b2a0e823ab5b814be719494c5cb8f0e7e228252 d076c672bdb9bd3b738edb882560482bebde469d02acd1ccda11e9c9cb6feaeb dcfddf26b9699622bde12c6b64a78e5446172e57c5a29c3ea0267a0df85
sha256d08c719c8ea6e5d7546e6449e6aed748ce74359e7c0dbd1f9bd08e2e8b795c687ab138eb25289a1a76910f5dc9c96aed87dd8aa2db7e3b0d310267a5a67 d08c719c8ea6e5d7546e6449e6aed748ce74359e7c0dbd1f9bd08e2e8b795c68 168c49c8207019008bdf746d0fa4ab33a154277c5fe50fd4900e9d77ec6
sha256d26ebbc2bdf6a6b59d805f7f1e9a9b505b6ff6e8b99e254f9c5c36413142d3f84755c2b30756abb68e14e30b7c10d283b2f989fc7f3556f92389a2c32b9 d26ebbc2bdf6a6b59d805f7f1e9a9b505b6ff6e8b99e254f9c5c36413142d3f8 f2fbac0942b08720073373536520b471229c918474cabb63fd19c3d006c
sha256d52318c1f83d086fcb94b8ae7288f2acb85f6e441c66a3f1d09365a1018c80bd605153ac4718af23d87c506e46b8f62ee2bc7e7a3e6140210c0aeb83d48 d52318c1f83d086fcb94b8ae7288f2acb85f6e441c66a3f1d09365a1018c80bd 44b6060a5406112556049bd3efef8d876fe335bb4aa0f0a6f7d02101849
sha256d526ffe1710b4b39866bebceb3660e1386e41df17b13a6055078b0ce7db74fbee01584f4d1238a55050c7ffad0e14299e911db8497b81529bd58afa4bc7 d526ffe1710b4b39866bebceb3660e1386e41df17b13a6055078b0ce7db74fbe 425e004b3c9034aa17071b137ca1d4ae7a35dde5f588c05295e491b7161
sha256db8ee4755c2b30756abb68e14e30b7c10d283b2f989fc7f3556f92389a2c32b9ac21405f6450bef3c18249e83a7bc464dea5cd4fb239becfe0a800875a2 db8ee4755c2b30756abb68e14e30b7c10d283b2f989fc7f3556f92389a2c32b9 d26ebbc2bdf6a6b59d805f7f1e9a9b505b6ff6e8b99e254f9c5c3641314
sha256dcfddf26b9699622bde12c6b64a78e5446172e57c5a29c3ea0267a0df85bc1e3672bdb9bd3b738edb882560482bebde469d02acd1ccda11e9c9cb6feaeb dcfddf26b9699622bde12c6b64a78e5446172e57c5a29c3ea0267a0df85bc1e3 0db7513e4ec8cea44afdce2d37991f5f9cbde0bb779856c10d9ffa75bed
sha256de0e7aae207f7a7a1f242d849bb61c7f4e98d84f74b228439d296e6a46b2f812c7ba44b9dfdcba50eeb6f7b59fe3bd2948f1ab1a7c8ee0f162b7cac3b2c de0e7aae207f7a7a1f242d849bb61c7f4e98d84f74b228439d296e6a46b2f812 712a907f98efa76de2b349c90084fbef6d40d9df32a41df98fc62e19fab
sha256e14472604877ad85c119703225fb6086053bcaa2ebae60d38762bbdd192e2244a164f1548ca0fd4618dbaae44c6a9ea05f66aafcf67758d9985b1409cb0 e14472604877ad85c119703225fb6086053bcaa2ebae60d38762bbdd192e2244 e631b1dd070f71e53dd7b5c36a1921c027257f0c79bc7964551f27d0f4e
sha256e342cae3c710674f0e73ea2ed1e72085d790a653e249e1b5e4d8e6696e1100411dd070f71e53dd7b5c36a1921c027257f0c79bc7964551f27d0f4ece78b e342cae3c710674f0e73ea2ed1e72085d790a653e249e1b5e4d8e6696e110041 9f404502e944f4cd76b902abf67717054732528a9399e23b3d90e282531
sha256e631b1dd070f71e53dd7b5c36a1921c027257f0c79bc7964551f27d0f4ece78b2604877ad85c119703225fb6086053bcaa2ebae60d38762bbdd192e2244 e631b1dd070f71e53dd7b5c36a1921c027257f0c79bc7964551f27d0f4ece78b e342cae3c710674f0e73ea2ed1e72085d790a653e249e1b5e4d8e6696e1
sha256e8290589cab3707f80ada754a31263e239b870dac5bdece15bf2e331cae5acf158e8a68518ffb43ee9026508b6520016e8d7096bf94ec2d1ed5cd328d76 e8290589cab3707f80ada754a31263e239b870dac5bdece15bf2e331cae5acf1 Coverage Screenshots of Detection AMP ThreatGrid Umbrella S
sha256e92710c582f71c4a9cb127774fa4cce0d8abb837a38d50d22d17ef7061646c929c8207019008bdf746d0fa4ab33a154277c5fe50fd4900e9d77ec6a2e7d e92710c582f71c4a9cb127774fa4cce0d8abb837a38d50d22d17ef7061646c92 f20256df607a29ef83bd035ee27fc424307712e59298f54803150a88ea5
sha256eb99cecc433a5134414024c98c227f52bae7660343a36469ccf0e6a8f5af4a6d9fc9a33cf5df06d5a56f85b6e2dfdb8fc5fbb4cbd2ede05488dd566f6f5 eb99cecc433a5134414024c98c227f52bae7660343a36469ccf0e6a8f5af4a6d b3dc9a164f1548ca0fd4618dbaae44c6a9ea05f66aafcf67758d9985b14
sha256f0b670afe4781d3e8899bf742fbd613636424681f56c4388168acea84ea344affe6a220b546af09139fda7deceb5e7f16b52fb47d15ff4e69bab9175734 f0b670afe4781d3e8899bf742fbd613636424681f56c4388168acea84ea344af 976c6ce6c484aef7d0d801c2f5ee31c984136d91636656a7e5425fbc4e8
sha256f20256df607a29ef83bd035ee27fc424307712e59298f54803150a88ea5c5ece0c582f71c4a9cb127774fa4cce0d8abb837a38d50d22d17ef7061646c92 f20256df607a29ef83bd035ee27fc424307712e59298f54803150a88ea5c5ece 190cda0ade0c0348786652b7ee12fde595e12ab561d893224cfdafbd58e
sha256f2fbac0942b08720073373536520b471229c918474cabb63fd19c3d006caaa1bbc2bdf6a6b59d805f7f1e9a9b505b6ff6e8b99e254f9c5c36413142d3f8 f2fbac0942b08720073373536520b471229c918474cabb63fd19c3d006caaa1b 366f1f331e940a462447e2b4abe9196ae7b977d281c2b9fe5e19bb0c292
sha256f6c2aea9dbc12ff2dbf77637560093234465cdae03c40ee4f0afcf8365ebfab7502e944f4cd76b902abf67717054732528a9399e23b3d90e2825316818d f6c2aea9dbc12ff2dbf77637560093234465cdae03c40ee4f0afcf8365ebfab7 b3fffd7e92a3bb920456b149717c353c8779e45a947c0e756889956c6bc
sha256f756ea3c00d7a3dc3ff1c0224add01e8189375a64fbcd5c97f551d64c80cbdbacd915905c09026044e8da533455a2742196e4294cfffc000c048c1ea9cc f756ea3c00d7a3dc3ff1c0224add01e8189375a64fbcd5c97f551d64c80cbdba Coverage Screenshots of Detection AMP ThreatGrid Umbrella S
sha256f8913513ec19ea386cb812e5e7249d44a4e4a3092fbfcea23fce692d7ed889708f2b9e0039b76588fd190565bcf4e02398ec8bff57d1c55bcc1626de5f3 f8913513ec19ea386cb812e5e7249d44a4e4a3092fbfcea23fce692d7ed88970 6dc6070451995a7dae4d5b741e291ce525aec2cf3144d9fdb8484f39079
sha256ffc6c04d292e6618826bb09c8c63a06af3993e7b6b14171c45c7b44619b4421a00c66125520f78673e70af10123cb5b78fe4786d368f7beb586d5ce3531 ffc6c04d292e6618826bb09c8c63a06af3993e7b6b14171c45c7b44619b4421a 758a4e1ea1fc0c9846d21f643013fd934fd23b187ca1fd32c90334ff48a
Full article711 words · extracted from blog.talosintelligence.com · click to collapse

Friday, August 18, 2017 14:15

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between August 11 and August 18. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

  • Doc.Downloader.Agent-6335676-0
    Office Macro Downloader
    This is an obfuscated Office Macro downloader that attempts to download a malicious payload executable. The execution chain typically is Word -> Shell function -> CMD -> PowerShell download and execute.
  • Doc.Dropper.Agent-6335671-0
    Office Macro Downloader
    This is an obfuscated Office Macro downloader that attempts to download a malicious payload executable.
  • Doc.Macro.JunkCode-6335442-0
    Office Macro
    Malicious Office Macros are obfuscated to prevent easy analysis. At times this results in no-operation like instructions. These no-operation (junk) instructions create artifacts that can be detected.
  • Win.Trojan.Expiro-6335658-0
    Trojan
    This sample is a Trojan. It complicates the automated analysis and the manual debugging by using anti-debug techniques. The sample needs a proper installation of the sandbox in order to run.
  • Win.Trojan.Ovidiy-6333880-0
    Trojan
    Ovidiy, or Ovidiy Stealer, is a Windows trojan that is still under active development. It serves as a credential stealer. Although modular in nature, it mostly targets credentials from web browser sessions. It does include some C2 functionality & will beacon out with select host information. The trojan itself is written in a .NET language & discovered samples are commonly protected with several packers specifically tailored to .NET binaries.
  • Win.Trojan.Tinba-6333828-1
    Trojan
    Tinba is a tiny banking trojan primarily focused on stealing sensitive information from its victims via javascript injected into web browsers. The source code for Tinba was leaked in 2014, making it very easy for malware developers to adopt and modify its functionality.

Threats

Doc.Downloader.Agent-6335676-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • 78[.]47[.]139[.]102
  • 193[.]227[.]248[.]241
  • 104[.]160[.]185[.]215 Domain Names
  • campusassas[.]com
  • campuslinne[.]com Files and or directories created
  • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\qdvjnh.bat
  • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\plzea.exe File Hashes
  • 7ffabe10f4147ce48fc9ae40cdc7778d08ac7881b779743720e2c4313592445b
  • c2a3dcd915905c09026044e8da533455a2742196e4294cfffc000c048c1ea9cc
  • f756ea3c00d7a3dc3ff1c0224add01e8189375a64fbcd5c97f551d64c80cbdba

Coverage

Screenshots of DetectionAMP


ThreatGrid


Umbrella


Screenshot

Doc.Dropper.Agent-6335671-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • iesimpianti[.]it
  • janssen-st[.]de Files and or directories created
  • %TEMP%\7E94\3F4A.bat
  • %AppData%\Microsoft\Office\Recent\270700481.doc.LNK
  • %AppData%\Microsoft\Office\Recent\fatt.348.LNK
  • \Users\Administrator\Documents\20170810\PowerShell_transcript.PC.PbSYjzuP.20170810091133.txt
  • %SystemDrive%\~$0700481.doc
  • %AppData%\Microsoft\CHxRthlp\api-pntw.exe
  • \TEMP\~$tt.348.doc
  • %TEMP%\33513.exe
  • %TEMP%\7E94\3F4A.tmp
  • \TEMP\fatt.348.doc File Hashes
  • 5edbc08d4e919f7186aa2b8a6e3d49ef38035c2a55b6e226910fcc60fe26a335
  • bbe5988f2470a296186ca43a76636fceb523b45273a32e83aa14a8cc1f4e3a8e
  • acdae0dde63863e8be98935254c901439b5fc36fb45f974fd7ce7c298e3ca0ca
  • b05c34ffdc8c82862b408a1f628b21bb08362de4340d768a08c511132ce7d34d
  • cad134945e7f20e99efed18650d4a7c573f8902b32c10ae89639518f94e646d0
  • 0752a00c66125520f78673e70af10123cb5b78fe4786d368f7beb586d5ce3531
  • ffc6c04d292e6618826bb09c8c63a06af3993e7b6b14171c45c7b44619b4421a
  • 758a4e1ea1fc0c9846d21f643013fd934fd23b187ca1fd32c90334ff48a60372
  • 4111dc9ca29508aa89caf873ac9359ad579270c3b3025ab0ba8098dea9c3c459
  • 0524147db311dedc4631e0749bb79865ac673763bd5ebc576855fcb9431de98b
  • 0e5240bf70e304781511de29a000c308f675d6209735c118cd0054b519eaa096
  • 09f89667dbbd0f72478f317aed5196f743693190aa3afe1f1cfccc67dad88fb6
  • 4cf480e7bab22fdd7d64c43d8f18c3c5358c25fbd063bc2d2855885b886718ac
  • 6ea7a564a6a7ba8f4c97e2eaefbedafab6dd1424d56716f1255b03f8b5879161
  • 3728cecd2be075b09a3a6d8d8c5923fe14cf381e3070266cf05fa51585def305
  • bec41e3e8d3093b58170d743ca905af81ed745a4828a42a9d39cd3373252a84d
  • bd7ed9514afabc723da282f32ad1dcfe81796a83555b7b4a6738dd0254c06ccd
  • 4b495c54056aa68e91fd481168a7ddc5d5a6cae713ab359777340f1ba901ae65
  • b588aa1d5901e2ded7dfc9fe8efbd13304f2bed37086b5c9aa498fdffaed48ba
  • 717f927b9c0b01a60eb94254d39ac5eeee24a2c10d0c59266252630202a36323
  • 056bce922fab367aabfd43f5e85bb5397755db08afcc8c38d992ffb4fe8f766f
  • 3ca148e6d17868544170351c7e0dbef38e58de9435a2f33fe174c83ea9a5a7f5
  • 6250f069e1268801cb3afaee2523df1aca628fa791a666f1d05b6cb981913461
  • 1496ddfb94f11120267fe9d6bf233ba4726754bebf3075340496a144777a6539
  • 5f1827ab138eb25289a1a76910f5dc9c96aed87dd8aa2db7e3b0d310267a5a67
  • d08c719c8ea6e5d7546e6449e6aed748ce74359e7c0dbd1f9bd08e2e8b795c68
  • 168c49c8207019008bdf746d0fa4ab33a154277c5fe50fd4900e9d77ec6a2e7d
  • e92710c582f71c4a9cb127774fa4cce0d8abb837a38d50d22d17ef7061646c92
  • f20256df607a29ef83bd035ee27fc424307712e59298f54803150a88ea5c5ece
  • 190cda0ade0c0348786652b7ee12fde595e12ab561d893224cfdafbd58ec7b75
  • cccb32f7f0408b32f3ad7f5a75adf1b955ba83a712e59c64f16b07713a6b44b8
  • 31b34ac21405f6450bef3c18249e83a7bc464dea5cd4fb239becfe0a800875a2
  • db8ee4755c2b30756abb68e14e30b7c10d283b2f989fc7f3556f92389a2c32b9
  • d26ebbc2bdf6a6b59d805f7f1e9a9b505b6ff6e8b99e254f9c5c36413142d3f8
  • f2fbac0942b08720073373536520b471229c918474cabb63fd19c3d006caaa1b
  • 366f1f331e940a462447e2b4abe9196ae7b977d281c2b9fe5e19bb0c2927b705
  • 9859e621b4d259798b2813377f9cd1736497f51cb501c6b3ea44ccae57d4e4fa
  • 94395a2b7bd0a120b55e39b3107f934f9b76faa9e2679dbae1237f69f2c3f1b9
  • 5df3016ba1cfd870d1d72e75ab9ec1d0a08a7e11d9fe7ec6b32fa0ce468206e7
  • 5624e26cace481fa4144f5ccd5bdcc7b5c3d42c035c88250312833041cf55807
  • b0610f20ce7be29f5864a02d72bcfa54e215d3159bf381d05fac58d2fa703f0d
  • 1c364ed502fa3710d9fa3c5a4a2ac6688bea3610acee2a6f958220d8ffca908b
  • 36472a674c751c65c15cbaab276c0fba8f3f1709750473b24e5d3c21e468617f
  • 0419cd8e5884e2918c5f0746d54efe2e2d9f0385523ecdbc395200df4004d87a
  • 29a7f99f81dd37bcbd196d635837c01d2aa48045ce4efd999a6d0da92bfbe917
  • 6451b45a4f8bdccdbce6bcd14e5fda1f976c81efed2c4dfd028386cce31250d1
  • 7a703a5e7f30a1621e204669ffefe91f22a1619814c4ef40872cd750cffb9125
  • 5de158f2b9e0039b76588fd190565bcf4e02398ec8bff57d1c55bcc1626de5f3
  • f8913513ec19ea386cb812e5e7249d44a4e4a3092fbfcea23fce692d7ed88970
  • 6dc6070451995a7dae4d5b741e291ce525aec2cf3144d9fdb8484f39079ef9e2
  • 4808a9fc9a33cf5df06d5a56f85b6e2dfdb8fc5fbb4cbd2ede05488dd566f6f5
  • eb99cecc433a5134414024c98c227f52bae7660343a36469ccf0e6a8f5af4a6d
  • b3dc9a164f1548ca0fd4618dbaae44c6a9ea05f66aafcf67758d9985b1409cb0
  • e14472604877ad85c119703225fb6086053bcaa2ebae60d38762bbdd192e2244
  • e631b1dd070f71e53dd7b5c36a1921c027257f0c79bc7964551f27d0f4ece78b
  • e342cae3c710674f0e73ea2ed1e72085d790a653e249e1b5e4d8e6696e110041
  • 9f404502e944f4cd76b902abf67717054732528a9399e23b3d90e2825316818d
  • f6c2aea9dbc12ff2dbf77637560093234465cdae03c40ee4f0afcf8365ebfab7
  • b3fffd7e92a3bb920456b149717c353c8779e45a947c0e756889956c6bc48d7a
  • 45112ef00b7d34a471655f3a7318fd2b69de1ade1889647839ff897c6e6f1c67
  • 9d52dd2437d0408e5971598b44c5dc1e1475004241bb5928d1eaee9a9aea51e1
  • 947ec2662ab377aca91f9ccb5b2a0e823ab5b814be719494c5cb8f0e7e228252
  • d076c672bdb9bd3b738edb882560482bebde469d02acd1ccda11e9c9cb6feaeb
  • dcfddf26b9699622bde12c6b64a78e5446172e57c5a29c3ea0267a0df85bc1e3
  • 0db7513e4ec8cea44afdce2d37991f5f9cbde0bb779856c10d9ffa75bed53d0f
  • b1e4e3be5dd686424763f39f8930e28044a9cda7a48d8962ba6e8978ef532fa0
  • 31755c56408a13f44d620971a60342bb0170ad78217c923c518fe4b58b4da365
  • 27772ef48d027d7e23e1f78d8ea86cb1bbcf4240cd59a8dc7ebc82f8a3a8b6dd
  • a31cbc1ce4abaa2ba7cab9ff97e1f647c3b1264c9cb7db0e20c74d151db2634d
  • c685f1c782e6b9250035f922ebc80400f2d6515e5f343a933c6c12920eb89e92
  • 5dd873a5cd07c4ac6edc7bfad7c92e1111cbddab5e72de96291e2990e0ab62e0
  • 8c43427b886d65c06a43f823511f0927b85dc5956dc7bd1bd16c59af548db6b8
  • 2aaf7791ed0a57e48c3d363b46ba5247e78a2290549bfd7f98793e9bee4c3e55
  • 9b6d3e01584f4d1238a55050c7ffad0e14299e911db8497b81529bd58afa4bc7
  • d526ffe1710b4b39866bebceb3660e1386e41df17b13a6055078b0ce7db74fbe
  • 425e004b3c9034aa17071b137ca1d4ae7a35dde5f588c05295e491b716125e2a
  • 8c4813043fa78b4aec7ada10556ddbe06eedbc81b115e4ff08371d8ee132d645
  • c7cab605153ac4718af23d87c506e46b8f62ee2bc7e7a3e6140210c0aeb83d48
  • d52318c1f83d086fcb94b8ae7288f2acb85f6e441c66a3f1d09365a1018c80bd
  • 44b6060a5406112556049bd3efef8d876fe335bb4aa0f0a6f7d0210184918c71
  • 4e812653205426b75038ce2796be5b254b61ee02da376462f3ad1ac23d898282
  • 454ed2ca7a116ad34864d4e8b232dcb50c063ffbd70f23753262aabb6b34d24e
  • bf958c7ba44b9dfdcba50eeb6f7b59fe3bd2948f1ab1a7c8ee0f162b7cac3b2c
  • de0e7aae207f7a7a1f242d849bb61c7f4e98d84f74b228439d296e6a46b2f812
  • 712a907f98efa76de2b349c90084fbef6d40d9df32a41df98fc62e19fab5329d
  • 3d081fe6a220b546af09139fda7deceb5e7f16b52fb47d15ff4e69bab9175734
  • f0b670afe4781d3e8899bf742fbd613636424681f56c4388168acea84ea344af
  • 976c6ce6c484aef7d0d801c2f5ee31c984136d91636656a7e5425fbc4e848029
  • 37e79b45ee53bc266d3602ec2cb79762a3c6360b5c173e89da045491150dbfb1
  • a4692d62273960b017d80e2b3ee9befe9b186d0609dbf4aedd1dcaf6d3aef671
  • c3e6a58e8a68518ffb43ee9026508b6520016e8d7096bf94ec2d1ed5cd328d76
  • e8290589cab3707f80ada754a31263e239b870dac5bdece15bf2e331cae5acf1

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella


Screenshot

Doc.Macro.JunkCode-6335442-0

Indicators of Compromise
Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value: internat.exe Mutexes
  • Local\_!MSFTHISTORY!_ IP Addresses
  • 52[.]173[.]193[.]166
  • 185[.]206[.]144[.]152
  • 190[.]107[.]177[.]115 Domain Names
  • plantatulapiz[.]cl
  • kalawatu[.]site Files and or directories created
  • %TEMP%\CVRDF32.tmp.cvr File Hashes
  • a5eb0f2e7d972b47c5016dd755bfce2e794822ef6933ff9759fd70e72b137a16
  • 404987cbcc932ba68aa9abd4607ea81ba4feb167c3f333c800a56cb2620ffd9f
  • 046809ff996329f2bb539128d51a0c21179ac6d117688281dd927df4b0aaf85b
  • 9679b02ca07d40f2d2d84445b5683fe2c1a135ecf73886d2ed27dc387b108417
  • 3a79a33855731c0066016de8baf9ef6b946b06b1ce4fda28f3c68265afa6c89a
  • 3b0997b98551548002dd9cd977cd3f881f0496ab2f86ef1a90d6c7a13765366c
  • 148b0ed81c95496d80778c7d3d093627a7395b76bf9b457f958201be66e8ea1f
  • 9ba948417071478c1fa3fe89c46c19c56190f47f2ba141a446166eff5a71fbb4
  • 1a1a48c35aee34ba91d83ae97865d75319112165ee8e7dad7cb7714ab57c40b7
  • 5b1e2ebb1baa600fba198e5c233ebb431311c976ef23f5c2f2c74ff03392a824

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Trojan.Expiro-6335658-0

Indicators of Compromise
Registry Keys

  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
  • Value: Collection Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • \TEMP\60d2422af917cb8aa58c14b8b78d4af112c9c78343da8f7aa3fbcb87be1a4de0.exe File Hashes
  • 60d2422af917cb8aa58c14b8b78d4af112c9c78343da8f7aa3fbcb87be1a4de0
  • 5fd134b6abe1473fd5a7f96c711a4270fbc364bc6e3b10b5b344e0a1bfb0e4d8
  • 5f5e9e5952765887211883b42e508b4b14c62a1685092978f98c6619229796b5
  • 5fe205ea4f5f975703e242e8079dc471a5363538535d76584e7138ed3fb67546
  • 5ffa0097ebcba0e1921c6607a644e2649532ae07b1c7d6533a3cbef52ee51620

Coverage

Screenshots of Detection AMP


ThreatGrid

Win.Trojan.Ovidiy-6333880-0

Indicators of Compromise
Registry Keys

  • <HKLM>\SOFTWARE\MICROSOFT\TRACING\6838BCE2F6C831414DF831040FC14287_RASAPI32
  • Value: EnableFileTracing
  • <HKLM>\SOFTWARE\MICROSOFT\TRACING\6838BCE2F6C831414DF831040FC14287_RASMANCS
  • Value: ConsoleTracingMask
  • <HKLM>\SOFTWARE\MICROSOFT\TRACING\6838BCE2F6C831414DF831040FC14287_RASAPI32
  • Value: EnableConsoleTracing
  • <HKLM>\SOFTWARE\MICROSOFT\TRACING\6838BCE2F6C831414DF831040FC14287_RASAPI32
  • Value: FileTracingMask
  • <HKLM>\Software\Microsoft\WBEM\CIMOM
  • <HKCU>\Software\Microsoft\SystemCertificates\My
  • <HKLM>\System\CurrentControlSet\Services\EventLog\System\Schannel
  • <HKLM>\Software\Microsoft\SystemCertificates\CA
  • <HKLM>\Software\Microsoft\SystemCertificates\Disallowed
  • <HKLM>\Software\Microsoft\SystemCertificates\TrustedPeople
  • <HKLM>\Software\Microsoft\SystemCertificates\trust
  • <HKLM>\Software\Microsoft\Tracing\6838bce2f6c831414df831040fc14287_RASMANCS Mutexes
  • N/A IP Addresses
  • 104[.]27[.]132[.]79
  • 104[.]27[.]133[.]79 Domain Names
  • ovidiystealer[.]ru Files and or directories created
  • N/A File Hashes
  • c16408967de0ca4d3a1d28530453e1c395a5166b469893f14c47fc6683033cb3
  • 062bd1d88e7b5c08444de559961f68694a445bc69807f57aa4ac581c377bc432
  • 22fc445798cd3481018c66b308af8545821b2f8f7f5a86133f562b362fc17a05
  • 80d450ca5b01a086806855356611405b2c87b3822c0c1c38a118bca57d87c410
  • 8f6939ac776dac54c2433b33386169b4d45cfea9b8eb59fef3b922d994313b71

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Trojan.Tinba-6333828-1

Indicators of Compromise
Registry Keys

  • HKU\Software\Microsoft\Windows\CurrentVersion\Run Mutexes
  • \BaseNamedObjects\5E60878D IP Addresses
  • N/A Domain Names
  • recdataoneveter[.]cc Files and or directories created
  • %AppData%\5E60878D\bin.exe File Hashes
  • 0ce6189ecd16fbf2f885a8516836c7bb9d0685f6ff2c4a3df80e236ef5d0d803
  • 33fd66f4cee5bdd9f30eb2e5bd7a65367e10f55495c1122430685a8ff0d90fcc
  • 51769c916a89522975cb1babb4c9c7b18f3530286c66f3d735751cbdac02a160
  • 56f91537753491cd32a250428b146d7685362c762c7e8f39703b4cf6cd92c020
  • 6fd80f8da071c3dc482314cbc994b22f105bce22acdad9e9bd86bae5abed53d9
  • 7607a0e1be2a8f50959ef42b78edd156aa76741fdc8ee2be9d375610c0b130b2
  • 7bbd6d3d6bf6e991e023395e3cb31c18b2a106eef036ad175736a17fb1099b39
  • 856ed534a7c32ab7799756c33f7ee104718c89add001428a41dc57e8449167c8
  • 968ff771eab9d14d1847f489f425e44532522c7b9fe7407b09d7cc594da0eb84
  • e2776a037dcad9e2c752ac4f07dfae0412312ba9b1b748a48922ed572f83eb9c

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-round-up-0811-0818/