Threat Roundup for Feb. 1 to Feb. 8
Tagsransomware
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | 5isohu.com | Does not indicate maliciousness maxcdn[.]bootstrapcdn[.]com 5isohu[.]com done[.]witchcraftcash[.]com thegoodcaster[.]com www[.]the |
| domain | 6nu2bfmath.mrzp97cmg3.com | Names contacted by malware. Does not indicate maliciousness 6nu2bfmath[.]mrzp97cmg3[.]com Files and or directories created %LocalAppData%\Temp\~D |
| domain | docksey.com | com[.]br www[.]intelhost[.]com[.]br restauranthub[.]co[.]uk docksey[.]com Files and or directories created %LocalAppData%\Microsoft |
| domain | done.witchcraftcash.com | cate maliciousness maxcdn[.]bootstrapcdn[.]com 5isohu[.]com done[.]witchcraftcash[.]com thegoodcaster[.]com www[.]theoffertop[.]com myecomworld |
| domain | estacaogourmetrs.com.br | Names contacted by malware. Does not indicate maliciousness estacaogourmetrs[.]com[.]br www[.]intelhost[.]com[.]br restauranthub[.]co[.]uk dock |
| domain | images.clickfunnels.com | heoffertop[.]com myecomworld[.]net wonderfulworldnow[.]club images[.]clickfunnels[.]com tac25[.]com track[.]rightsearchsmooth[.]club Files and |
| domain | maxcdn.bootstrapcdn.com | Names contacted by malware. Does not indicate maliciousness maxcdn[.]bootstrapcdn[.]com 5isohu[.]com done[.]witchcraftcash[.]com thegoodcaster[ |
| domain | myecomworld.net | craftcash[.]com thegoodcaster[.]com www[.]theoffertop[.]com myecomworld[.]net wonderfulworldnow[.]club images[.]clickfunnels[.]com tac2 |
| domain | restauranthub.co.uk | ness estacaogourmetrs[.]com[.]br www[.]intelhost[.]com[.]br restauranthub[.]co[.]uk docksey[.]com Files and or directories created %LocalAp |
| domain | sambosaxzx.ddns.net | malware. Does not indicate maliciousness x11[.]zapto[.]org sambosaxzx[.]ddns[.]net Files and or directories created %SystemDrive%\AUTOEXEC |
| domain | tac25.com | [.]net wonderfulworldnow[.]club images[.]clickfunnels[.]com tac25[.]com track[.]rightsearchsmooth[.]club Files and or directories |
| domain | thegoodcaster.com | bootstrapcdn[.]com 5isohu[.]com done[.]witchcraftcash[.]com thegoodcaster[.]com www[.]theoffertop[.]com myecomworld[.]net wonderfulworldn |
| domain | track.rightsearchsmooth.club | rfulworldnow[.]club images[.]clickfunnels[.]com tac25[.]com track[.]rightsearchsmooth[.]club Files and or directories created %LocalAppData%\Microso |
| domain | wonderfulworldnow.club | egoodcaster[.]com www[.]theoffertop[.]com myecomworld[.]net wonderfulworldnow[.]club images[.]clickfunnels[.]com tac25[.]com track[.]rightsear |
| domain | www.intelhost.com.br | Does not indicate maliciousness estacaogourmetrs[.]com[.]br www[.]intelhost[.]com[.]br restauranthub[.]co[.]uk docksey[.]com Files and or di |
| domain | www.theoffertop.com | isohu[.]com done[.]witchcraftcash[.]com thegoodcaster[.]com www[.]theoffertop[.]com myecomworld[.]net wonderfulworldnow[.]club images[.]cli |
| domain | x11.zapto.org | Names contacted by malware. Does not indicate maliciousness x11[.]zapto[.]org sambosaxzx[.]ddns[.]net Files and or directories create |
| sha256 | 03591121dcf83a4aeb5e5fa12a1c1b75c93f5a215780eb1ebf209cc9518f12d3 | 9-FE52D18D73F1}.tmp %SystemDrive%\~$6814370.doc File Hashes 03591121dcf83a4aeb5e5fa12a1c1b75c93f5a215780eb1ebf209cc9518f12d3 04c6555af6871c7818d3df3f0d5bbf9b85efac94e979c58234310b9a360 |
| sha256 | 04c6555af6871c7818d3df3f0d5bbf9b85efac94e979c58234310b9a36079e78 | 121dcf83a4aeb5e5fa12a1c1b75c93f5a215780eb1ebf209cc9518f12d3 04c6555af6871c7818d3df3f0d5bbf9b85efac94e979c58234310b9a36079e78 09be75647f21e12c0c4948ed45c68eb1db6667beece4e1d9748cddd5b4c |
| sha256 | 06386d249ae1b3cc4bc96281ae89e10a85f68dd7e350e3e52fab4c88a7c02375 | AppData%\Microsoft\Windows\Cookies\YO092G24.txt File Hashes 06386d249ae1b3cc4bc96281ae89e10a85f68dd7e350e3e52fab4c88a7c02375 1e81d5888f17947bcbe31a74b3761c31c4fd6b49cb02d3eb4f85e065d87 |
| sha256 | 09131ddb2cac0b4d4483b4bbbc76a26f244ab5a884350f733e1f60fc684da039 | AppData%\Temp\is-51KNV.tmp %LocalAppData%\Temp\is-51KNV.tmp\09131ddb2cac0b4d4483b4bbbc76a26f244ab5a884350f733e1f60fc684da039.tmp %LocalAppData%\Temp\is-9EHP6.tmp\_isetup\_isdecmp.dll % |
| sha256 | 09be75647f21e12c0c4948ed45c68eb1db6667beece4e1d9748cddd5b4c38eaa | 55af6871c7818d3df3f0d5bbf9b85efac94e979c58234310b9a36079e78 09be75647f21e12c0c4948ed45c68eb1db6667beece4e1d9748cddd5b4c38eaa 15968dcbcb0514e7fd5bb68ced13112a3f1d8b31cd948b967f3becce928 |
| sha256 | 15968dcbcb0514e7fd5bb68ced13112a3f1d8b31cd948b967f3becce9283508a | 5647f21e12c0c4948ed45c68eb1db6667beece4e1d9748cddd5b4c38eaa 15968dcbcb0514e7fd5bb68ced13112a3f1d8b31cd948b967f3becce9283508a 1920f3315544295d13a8c3366216b74514369bb31cea90a4659506c0c4c |
| sha256 | 1920f3315544295d13a8c3366216b74514369bb31cea90a4659506c0c4c549a1 | dcbcb0514e7fd5bb68ced13112a3f1d8b31cd948b967f3becce9283508a 1920f3315544295d13a8c3366216b74514369bb31cea90a4659506c0c4c549a1 1a4c6a9c9e4bcce9f83776f87f158d39cb21eb78ea839afaa01abf3f93c |
| sha256 | 1a4c6a9c9e4bcce9f83776f87f158d39cb21eb78ea839afaa01abf3f93c49a4c | 3315544295d13a8c3366216b74514369bb31cea90a4659506c0c4c549a1 1a4c6a9c9e4bcce9f83776f87f158d39cb21eb78ea839afaa01abf3f93c49a4c 1a7211b1d27124d3409b2d1346ba93fc2a91fd00ed3899c95c1e16fc849 |
| sha256 | 1a7211b1d27124d3409b2d1346ba93fc2a91fd00ed3899c95c1e16fc849c54a7 | a9c9e4bcce9f83776f87f158d39cb21eb78ea839afaa01abf3f93c49a4c 1a7211b1d27124d3409b2d1346ba93fc2a91fd00ed3899c95c1e16fc849c54a7 1e83dfa18cc1ccff50dd5118f710bcc16e6c4e178977435c62b4238554b |
| sha256 | 1a74519d1568dece3bc64889f177df271b1bf93c0db86d97bb81e44a45403c2f | ted %LocalAppData%\Temp\~DF38A714DABA77BAE2.TMP File Hashes 1a74519d1568dece3bc64889f177df271b1bf93c0db86d97bb81e44a45403c2f 1a93550fd9e061d7b572ca6269934ae5d0747e82855420895d41547680e |
| sha256 | 1a93550fd9e061d7b572ca6269934ae5d0747e82855420895d41547680e372b7 | 19d1568dece3bc64889f177df271b1bf93c0db86d97bb81e44a45403c2f 1a93550fd9e061d7b572ca6269934ae5d0747e82855420895d41547680e372b7 1e8a9c8f07050897420bccfc612fe39dc11acec47dbb11a9b6d17876c0f |
| sha256 | 1e81d5888f17947bcbe31a74b3761c31c4fd6b49cb02d3eb4f85e065d8729e08 | d249ae1b3cc4bc96281ae89e10a85f68dd7e350e3e52fab4c88a7c02375 1e81d5888f17947bcbe31a74b3761c31c4fd6b49cb02d3eb4f85e065d8729e08 298b8e26c83ba9fd1bb1faeb5b0df909f1d163e7896e26c48d35e041aae |
| sha256 | 1e83dfa18cc1ccff50dd5118f710bcc16e6c4e178977435c62b4238554bcf7f4 | 1b1d27124d3409b2d1346ba93fc2a91fd00ed3899c95c1e16fc849c54a7 1e83dfa18cc1ccff50dd5118f710bcc16e6c4e178977435c62b4238554bcf7f4 2287689165547b27ed983152dd781bc53777060a8dd911b18671b605093 |
| sha256 | 1e8a9c8f07050897420bccfc612fe39dc11acec47dbb11a9b6d17876c0f1c748 | 50fd9e061d7b572ca6269934ae5d0747e82855420895d41547680e372b7 1e8a9c8f07050897420bccfc612fe39dc11acec47dbb11a9b6d17876c0f1c748 22db5127ccb49f274ab3f46f6a845bcbe693e2ed4069220c9b33c4ba7cb |
| sha256 | 2287689165547b27ed983152dd781bc53777060a8dd911b18671b60509329ebf | fa18cc1ccff50dd5118f710bcc16e6c4e178977435c62b4238554bcf7f4 2287689165547b27ed983152dd781bc53777060a8dd911b18671b60509329ebf 247adbdf9950ad6e592f0276ae72625818f87b41ce1bb7596aa89181e0c |
| sha256 | 22db5127ccb49f274ab3f46f6a845bcbe693e2ed4069220c9b33c4ba7cb6e7db | c8f07050897420bccfc612fe39dc11acec47dbb11a9b6d17876c0f1c748 22db5127ccb49f274ab3f46f6a845bcbe693e2ed4069220c9b33c4ba7cb6e7db 2da64c580965f9d0454b9004181ed7fdd5903e93cc41d06578cc968ac42 |
| sha256 | 247adbdf9950ad6e592f0276ae72625818f87b41ce1bb7596aa89181e0ce99d4 | 89165547b27ed983152dd781bc53777060a8dd911b18671b60509329ebf 247adbdf9950ad6e592f0276ae72625818f87b41ce1bb7596aa89181e0ce99d4 267af9baaa1401ae4034200940bad6c1f8cb622a7e731ed28fe84fe0682 |
| sha256 | 267af9baaa1401ae4034200940bad6c1f8cb622a7e731ed28fe84fe0682a6616 | bdf9950ad6e592f0276ae72625818f87b41ce1bb7596aa89181e0ce99d4 267af9baaa1401ae4034200940bad6c1f8cb622a7e731ed28fe84fe0682a6616 3bc75dd152bea2d4670d22e2844731646cc4a83024a3cd2349d465d5c16 |
| sha256 | 298b8e26c83ba9fd1bb1faeb5b0df909f1d163e7896e26c48d35e041aae6320e | 5888f17947bcbe31a74b3761c31c4fd6b49cb02d3eb4f85e065d8729e08 298b8e26c83ba9fd1bb1faeb5b0df909f1d163e7896e26c48d35e041aae6320e 641432c889189c393edf97cda9b08e5b083cbb8eecc5ac09b9d476f8872 |
| sha256 | 2da64c580965f9d0454b9004181ed7fdd5903e93cc41d06578cc968ac4215836 | 127ccb49f274ab3f46f6a845bcbe693e2ed4069220c9b33c4ba7cb6e7db 2da64c580965f9d0454b9004181ed7fdd5903e93cc41d06578cc968ac4215836 30ff57307b5d4456c64ee80eaacb717cdc1804c1f1c49409c7d583ec9f3 |
| sha256 | 30ff57307b5d4456c64ee80eaacb717cdc1804c1f1c49409c7d583ec9f3de1e3 | c580965f9d0454b9004181ed7fdd5903e93cc41d06578cc968ac4215836 30ff57307b5d4456c64ee80eaacb717cdc1804c1f1c49409c7d583ec9f3de1e3 3ff2a4f01f7bfc31db3a54ecb98c0df737cd575cc11301af3b19ed99bc0 |
| sha256 | 3bc75dd152bea2d4670d22e2844731646cc4a83024a3cd2349d465d5c16020ef | 9baaa1401ae4034200940bad6c1f8cb622a7e731ed28fe84fe0682a6616 3bc75dd152bea2d4670d22e2844731646cc4a83024a3cd2349d465d5c16020ef 607f94f56ab7d2e2b01a0b8ee0bed7379144363d65e3040f44a197e8245 |
| sha256 | 3c6a39eee1d6b61e2c1d94332b55819182bc189fcdbe06d79bcafa2ea0febc43 | ddb2cac0b4d4483b4bbbc76a26f244ab5a884350f733e1f60fc684da039 3c6a39eee1d6b61e2c1d94332b55819182bc189fcdbe06d79bcafa2ea0febc43 47d1bd0892f91a1c65f5e6f06fe6969cd8db1f1473760c23e668ac1cb83 |
| sha256 | 3ff2a4f01f7bfc31db3a54ecb98c0df737cd575cc11301af3b19ed99bc0e075b | 7307b5d4456c64ee80eaacb717cdc1804c1f1c49409c7d583ec9f3de1e3 3ff2a4f01f7bfc31db3a54ecb98c0df737cd575cc11301af3b19ed99bc0e075b 473f7dd0173bafa5de751493de7c7e2cc57fc290aac0ae4d2947cc57dcb |
| sha256 | 473f7dd0173bafa5de751493de7c7e2cc57fc290aac0ae4d2947cc57dcb8008d | 4f01f7bfc31db3a54ecb98c0df737cd575cc11301af3b19ed99bc0e075b 473f7dd0173bafa5de751493de7c7e2cc57fc290aac0ae4d2947cc57dcb8008d 5492869d71c62c3ade2750e79de155104329cc08fdd9e65f9ba7d213868 |
| sha256 | 47d1bd0892f91a1c65f5e6f06fe6969cd8db1f1473760c23e668ac1cb831bc7f | 9eee1d6b61e2c1d94332b55819182bc189fcdbe06d79bcafa2ea0febc43 47d1bd0892f91a1c65f5e6f06fe6969cd8db1f1473760c23e668ac1cb831bc7f 4e5e5d3bea988e7c39542245f3a1bc1046153ebefc18ee0b4d743dd8b2f |
| sha256 | 4e5e5d3bea988e7c39542245f3a1bc1046153ebefc18ee0b4d743dd8b2f93e28 | d0892f91a1c65f5e6f06fe6969cd8db1f1473760c23e668ac1cb831bc7f 4e5e5d3bea988e7c39542245f3a1bc1046153ebefc18ee0b4d743dd8b2f93e28 51c839a1fe25c31ba3903cc47f32880741dd1e708c9e97c81a2ea050802 |
| sha256 | 51c839a1fe25c31ba3903cc47f32880741dd1e708c9e97c81a2ea050802f84db | d3bea988e7c39542245f3a1bc1046153ebefc18ee0b4d743dd8b2f93e28 51c839a1fe25c31ba3903cc47f32880741dd1e708c9e97c81a2ea050802f84db 68b15033f398389c45903085677e375dcaed3a3225d0854f6cbb5a2b452 |
| sha256 | 5492869d71c62c3ade2750e79de155104329cc08fdd9e65f9ba7d213868714c8 | dd0173bafa5de751493de7c7e2cc57fc290aac0ae4d2947cc57dcb8008d 5492869d71c62c3ade2750e79de155104329cc08fdd9e65f9ba7d213868714c8 54d8cb379579ab2063b223f0011d8fa2838368b4b68f070a54b7e06ca62 |
| sha256 | 54d8cb379579ab2063b223f0011d8fa2838368b4b68f070a54b7e06ca62c1f03 | 69d71c62c3ade2750e79de155104329cc08fdd9e65f9ba7d213868714c8 54d8cb379579ab2063b223f0011d8fa2838368b4b68f070a54b7e06ca62c1f03 5b5c9fd28470e81d23fcd6e5b2ea1bdf7c537ca610535d2f69a23fbd11f |
| sha256 | 5b5c9fd28470e81d23fcd6e5b2ea1bdf7c537ca610535d2f69a23fbd11f8d0cb | b379579ab2063b223f0011d8fa2838368b4b68f070a54b7e06ca62c1f03 5b5c9fd28470e81d23fcd6e5b2ea1bdf7c537ca610535d2f69a23fbd11f8d0cb 5e69b36b133ca551c46014c80afbb8fe2d9f6edd1e49cebcd22ca7bbec8 |
| sha256 | 5e69b36b133ca551c46014c80afbb8fe2d9f6edd1e49cebcd22ca7bbec82d9ff | fd28470e81d23fcd6e5b2ea1bdf7c537ca610535d2f69a23fbd11f8d0cb 5e69b36b133ca551c46014c80afbb8fe2d9f6edd1e49cebcd22ca7bbec82d9ff 6e43c79b858a27b93c87498faba5f60edd11d6472da142229bef6fb1d13 |
| sha256 | 607f94f56ab7d2e2b01a0b8ee0bed7379144363d65e3040f44a197e8245b842c | dd152bea2d4670d22e2844731646cc4a83024a3cd2349d465d5c16020ef 607f94f56ab7d2e2b01a0b8ee0bed7379144363d65e3040f44a197e8245b842c 72da32c1bec496a54885f38802c429bc1aed434651bc67dc4acbac637c0 |
| sha256 | 641432c889189c393edf97cda9b08e5b083cbb8eecc5ac09b9d476f8872ecf3b | e26c83ba9fd1bb1faeb5b0df909f1d163e7896e26c48d35e041aae6320e 641432c889189c393edf97cda9b08e5b083cbb8eecc5ac09b9d476f8872ecf3b 6fbe635039debcb4eccf4d9c24cf009b8405fbe8cf9fcc5c5f24d0ca8bf |
| sha256 | 68b15033f398389c45903085677e375dcaed3a3225d0854f6cbb5a2b45217cb7 | 9a1fe25c31ba3903cc47f32880741dd1e708c9e97c81a2ea050802f84db 68b15033f398389c45903085677e375dcaed3a3225d0854f6cbb5a2b45217cb7 6985e3313e82b8cc6b450bb4cb6fcdebfc1b26ec83b0ace499c836d79b0 |
| sha256 | 6985e3313e82b8cc6b450bb4cb6fcdebfc1b26ec83b0ace499c836d79b0b4fbe | 033f398389c45903085677e375dcaed3a3225d0854f6cbb5a2b45217cb7 6985e3313e82b8cc6b450bb4cb6fcdebfc1b26ec83b0ace499c836d79b0b4fbe 72a1cb206beae974f8d3504128e7892ba6fcbba38f31d7714f0fd811618 |
| sha256 | 6e43c79b858a27b93c87498faba5f60edd11d6472da142229bef6fb1d1310372 | 36b133ca551c46014c80afbb8fe2d9f6edd1e49cebcd22ca7bbec82d9ff 6e43c79b858a27b93c87498faba5f60edd11d6472da142229bef6fb1d1310372 78ca808e8428963d80d651655c6f79c8df44448a0d0613eb442a20a3081 |
| sha256 | 6fbe635039debcb4eccf4d9c24cf009b8405fbe8cf9fcc5c5f24d0ca8bffd53a | 2c889189c393edf97cda9b08e5b083cbb8eecc5ac09b9d476f8872ecf3b 6fbe635039debcb4eccf4d9c24cf009b8405fbe8cf9fcc5c5f24d0ca8bffd53a a073171d46e57c4e308b6a62c0d14e597e95c030c019f428a26ee6c07f4 |
| sha256 | 72a1cb206beae974f8d3504128e7892ba6fcbba38f31d7714f0fd811618bb439 | 3313e82b8cc6b450bb4cb6fcdebfc1b26ec83b0ace499c836d79b0b4fbe 72a1cb206beae974f8d3504128e7892ba6fcbba38f31d7714f0fd811618bb439 7384060612fcb8c40a324c136c571295f361a2e6d7f5b470206b574aed5 |
| sha256 | 72da32c1bec496a54885f38802c429bc1aed434651bc67dc4acbac637c0c94ce | 4f56ab7d2e2b01a0b8ee0bed7379144363d65e3040f44a197e8245b842c 72da32c1bec496a54885f38802c429bc1aed434651bc67dc4acbac637c0c94ce 76b02247cf6c9a6c436532a536ccd2711fa876c15312dd6e0b3863e070e |
| sha256 | 7384060612fcb8c40a324c136c571295f361a2e6d7f5b470206b574aed5fe0f4 | b206beae974f8d3504128e7892ba6fcbba38f31d7714f0fd811618bb439 7384060612fcb8c40a324c136c571295f361a2e6d7f5b470206b574aed5fe0f4 817ee49531f980991336c020e3d99f67796a38ff88aff948f07f658b083 |
| sha256 | 76b02247cf6c9a6c436532a536ccd2711fa876c15312dd6e0b3863e070e8595c | 2c1bec496a54885f38802c429bc1aed434651bc67dc4acbac637c0c94ce 76b02247cf6c9a6c436532a536ccd2711fa876c15312dd6e0b3863e070e8595c 7fb24419176dd9aa58bb53a4246398d40c260c253b4772cb8fdc600324f |
| sha256 | 78ca808e8428963d80d651655c6f79c8df44448a0d0613eb442a20a3081d0b21 | 79b858a27b93c87498faba5f60edd11d6472da142229bef6fb1d1310372 78ca808e8428963d80d651655c6f79c8df44448a0d0613eb442a20a3081d0b21 7db57b97495b59e84bca9e7f48b472e7412751b20780f17f453e4cf8c96 |
| sha256 | 7db57b97495b59e84bca9e7f48b472e7412751b20780f17f453e4cf8c9694543 | 08e8428963d80d651655c6f79c8df44448a0d0613eb442a20a3081d0b21 7db57b97495b59e84bca9e7f48b472e7412751b20780f17f453e4cf8c9694543 7fbd028726e320fddbf67a00ac1a43e8d2f7fdc98dcb53c84fbbd77871c |
| sha256 | 7fb24419176dd9aa58bb53a4246398d40c260c253b4772cb8fdc600324f24318 | 247cf6c9a6c436532a536ccd2711fa876c15312dd6e0b3863e070e8595c 7fb24419176dd9aa58bb53a4246398d40c260c253b4772cb8fdc600324f24318 ad6b9cb00268157013c2b547a379a836609f5c7e01ce6893df16cf1db8f |
| sha256 | 7fbd028726e320fddbf67a00ac1a43e8d2f7fdc98dcb53c84fbbd77871c88afb | b97495b59e84bca9e7f48b472e7412751b20780f17f453e4cf8c9694543 7fbd028726e320fddbf67a00ac1a43e8d2f7fdc98dcb53c84fbbd77871c88afb 881497c1db786286caae56f5055909c1bba6ccb24628773805f0f3a3a91 |
| sha256 | 817ee49531f980991336c020e3d99f67796a38ff88aff948f07f658b083e6801 | 60612fcb8c40a324c136c571295f361a2e6d7f5b470206b574aed5fe0f4 817ee49531f980991336c020e3d99f67796a38ff88aff948f07f658b083e6801 888888ec0980085d2a89f43fc32f543dfbe283d7ad0186e5c1089a08795 |
| sha256 | 881497c1db786286caae56f5055909c1bba6ccb24628773805f0f3a3a91c0993 | 28726e320fddbf67a00ac1a43e8d2f7fdc98dcb53c84fbbd77871c88afb 881497c1db786286caae56f5055909c1bba6ccb24628773805f0f3a3a91c0993 8a70ba0afe5efa6f633d97f51043d6be2ff3b3a2e6c5fba979f88a6bce4 |
| sha256 | 888888ec0980085d2a89f43fc32f543dfbe283d7ad0186e5c1089a08795d86b8 | 49531f980991336c020e3d99f67796a38ff88aff948f07f658b083e6801 888888ec0980085d2a89f43fc32f543dfbe283d7ad0186e5c1089a08795d86b8 9d6c6642a75a6328ef321212b482519ef74c767d9a02d1538debc53f031 |
| sha256 | 8a70ba0afe5efa6f633d97f51043d6be2ff3b3a2e6c5fba979f88a6bce4813e3 | 7c1db786286caae56f5055909c1bba6ccb24628773805f0f3a3a91c0993 8a70ba0afe5efa6f633d97f51043d6be2ff3b3a2e6c5fba979f88a6bce4813e3 92fbd91b969e6f94853430cb11a7ab2eaeaa05faefd2856a4aa55861f03 |
| sha256 | 92fbd91b969e6f94853430cb11a7ab2eaeaa05faefd2856a4aa55861f035beb0 | a0afe5efa6f633d97f51043d6be2ff3b3a2e6c5fba979f88a6bce4813e3 92fbd91b969e6f94853430cb11a7ab2eaeaa05faefd2856a4aa55861f035beb0 93b2e125a810723a7bc4e268dccbd784cd95e593077ae59fd9ac4daa9e1 |
| sha256 | 93b2e125a810723a7bc4e268dccbd784cd95e593077ae59fd9ac4daa9e1a8094 | 91b969e6f94853430cb11a7ab2eaeaa05faefd2856a4aa55861f035beb0 93b2e125a810723a7bc4e268dccbd784cd95e593077ae59fd9ac4daa9e1a8094 99b1320bd421b716118e2aa11ff0044be4bb8849f96b099c6d7ff106ad8 |
| sha256 | 99b1320bd421b716118e2aa11ff0044be4bb8849f96b099c6d7ff106ad80833b | 125a810723a7bc4e268dccbd784cd95e593077ae59fd9ac4daa9e1a8094 99b1320bd421b716118e2aa11ff0044be4bb8849f96b099c6d7ff106ad80833b 9ec1af22463376ceaf3468b88b000a155aa674ff27910c4a2d7188fb4ed |
| sha256 | 9d6c6642a75a6328ef321212b482519ef74c767d9a02d1538debc53f031ee293 | 8ec0980085d2a89f43fc32f543dfbe283d7ad0186e5c1089a08795d86b8 9d6c6642a75a6328ef321212b482519ef74c767d9a02d1538debc53f031ee293 b0d1ef5415c13028a6fbe16900e255b599781bf3824144413f9364e6194 |
| sha256 | 9ec1af22463376ceaf3468b88b000a155aa674ff27910c4a2d7188fb4ed5b315 | 20bd421b716118e2aa11ff0044be4bb8849f96b099c6d7ff106ad80833b 9ec1af22463376ceaf3468b88b000a155aa674ff27910c4a2d7188fb4ed5b315 a0ea6c233f4da2e161eb3108b9534d297cb15ec8d17eaf2d22132b0e67e |
| sha256 | a073171d46e57c4e308b6a62c0d14e597e95c030c019f428a26ee6c07f43557d | 35039debcb4eccf4d9c24cf009b8405fbe8cf9fcc5c5f24d0ca8bffd53a a073171d46e57c4e308b6a62c0d14e597e95c030c019f428a26ee6c07f43557d a5b2ea50f8dceec4752888c5e50e364b16253160dd7fb20932d8e5e5a56 |
| sha256 | a0ea6c233f4da2e161eb3108b9534d297cb15ec8d17eaf2d22132b0e67e99c4a | f22463376ceaf3468b88b000a155aa674ff27910c4a2d7188fb4ed5b315 a0ea6c233f4da2e161eb3108b9534d297cb15ec8d17eaf2d22132b0e67e99c4a a1caca2e8b3b96935fcde41509753f4531ec3b9c5f436c7291c422fdf4c |
| sha256 | a1caca2e8b3b96935fcde41509753f4531ec3b9c5f436c7291c422fdf4c1d7ec | c233f4da2e161eb3108b9534d297cb15ec8d17eaf2d22132b0e67e99c4a a1caca2e8b3b96935fcde41509753f4531ec3b9c5f436c7291c422fdf4c1d7ec b2917e4031446976cdba6958df9d7c2d594f657232e0786b0e39039477b |
| sha256 | a5b2ea50f8dceec4752888c5e50e364b16253160dd7fb20932d8e5e5a56ac719 | 71d46e57c4e308b6a62c0d14e597e95c030c019f428a26ee6c07f43557d a5b2ea50f8dceec4752888c5e50e364b16253160dd7fb20932d8e5e5a56ac719 c1f44c795198b23f8058492bb82a29addd2eeae623a53296f0195777d6a |
| sha256 | ad6b9cb00268157013c2b547a379a836609f5c7e01ce6893df16cf1db8fd3965 | 419176dd9aa58bb53a4246398d40c260c253b4772cb8fdc600324f24318 ad6b9cb00268157013c2b547a379a836609f5c7e01ce6893df16cf1db8fd3965 af8e1169f130baf122b25aae81d95d62cd3506bae39673652d91ac4c493 |
| sha256 | af8e1169f130baf122b25aae81d95d62cd3506bae39673652d91ac4c4936049d | cb00268157013c2b547a379a836609f5c7e01ce6893df16cf1db8fd3965 af8e1169f130baf122b25aae81d95d62cd3506bae39673652d91ac4c4936049d b5d83480ad61ce204743ef0904cbd2995991944efd3d0d2c9daaca9385f |
| sha256 | b0d1ef5415c13028a6fbe16900e255b599781bf3824144413f9364e619480194 | 642a75a6328ef321212b482519ef74c767d9a02d1538debc53f031ee293 b0d1ef5415c13028a6fbe16900e255b599781bf3824144413f9364e619480194 bb87882c8e8c87e3f0f2accf837d141550fc0a048409b6c0a4aaec4b982 |
| sha256 | b2917e4031446976cdba6958df9d7c2d594f657232e0786b0e39039477b13534 | a2e8b3b96935fcde41509753f4531ec3b9c5f436c7291c422fdf4c1d7ec b2917e4031446976cdba6958df9d7c2d594f657232e0786b0e39039477b13534 Coverage Screenshots of Detection AMP ThreatGrid Umbrella M |
| sha256 | b5d83480ad61ce204743ef0904cbd2995991944efd3d0d2c9daaca9385f4b290 | 169f130baf122b25aae81d95d62cd3506bae39673652d91ac4c4936049d b5d83480ad61ce204743ef0904cbd2995991944efd3d0d2c9daaca9385f4b290 b9cbad9b3cd4a1f08c3284d479ff40093454e9f76d23783901087cd0add |
| sha256 | b9cbad9b3cd4a1f08c3284d479ff40093454e9f76d23783901087cd0add5d468 | 480ad61ce204743ef0904cbd2995991944efd3d0d2c9daaca9385f4b290 b9cbad9b3cd4a1f08c3284d479ff40093454e9f76d23783901087cd0add5d468 fd46fb328e72ebe81cb97846b846051a95d2012630a3ee37bf55002c390 |
| sha256 | bb87882c8e8c87e3f0f2accf837d141550fc0a048409b6c0a4aaec4b9829f1a0 | f5415c13028a6fbe16900e255b599781bf3824144413f9364e619480194 bb87882c8e8c87e3f0f2accf837d141550fc0a048409b6c0a4aaec4b9829f1a0 fa64e7db69b070ef8bad8046cd7539dd1fca1bb63349f04c0e94584cf0a |
| sha256 | c1f44c795198b23f8058492bb82a29addd2eeae623a53296f0195777d6a5fde5 | AppData%\Temp\is-B01CK.tmp %LocalAppData%\Temp\is-B01CK.tmp\c1f44c795198b23f8058492bb82a29addd2eeae623a53296f0195777d6a5fde5.tmp %LocalAppData%\Temp\A1D26E2\116E56C6A8.tmp %LocalAppDat |
| sha256 | c488c9a61f7be3a4e7b9c51dbefa36c2fe7b53904d30c38f58dcc1900aec098b | c795198b23f8058492bb82a29addd2eeae623a53296f0195777d6a5fde5 c488c9a61f7be3a4e7b9c51dbefa36c2fe7b53904d30c38f58dcc1900aec098b c72e78abc54e7b785e666e0e61181c107a4cf6b9c0519146f9f2b9fbf47 |
| sha256 | c72e78abc54e7b785e666e0e61181c107a4cf6b9c0519146f9f2b9fbf47ba841 | 9a61f7be3a4e7b9c51dbefa36c2fe7b53904d30c38f58dcc1900aec098b c72e78abc54e7b785e666e0e61181c107a4cf6b9c0519146f9f2b9fbf47ba841 f1aa892c158ea1779a210d52b9a4311245544868343d27c91454566d730 |
| sha256 | f1aa892c158ea1779a210d52b9a4311245544868343d27c91454566d730aa4ee | 8abc54e7b785e666e0e61181c107a4cf6b9c0519146f9f2b9fbf47ba841 f1aa892c158ea1779a210d52b9a4311245544868343d27c91454566d730aa4ee Coverage Screenshots of Detection AMP ThreatGrid Umbrella P |
| sha256 | fa64e7db69b070ef8bad8046cd7539dd1fca1bb63349f04c0e94584cf0a2a7d7 | 82c8e8c87e3f0f2accf837d141550fc0a048409b6c0a4aaec4b9829f1a0 fa64e7db69b070ef8bad8046cd7539dd1fca1bb63349f04c0e94584cf0a2a7d7 Coverage Screenshots of Detection AMP ThreatGrid Malware PU |
| sha256 | fd46fb328e72ebe81cb97846b846051a95d2012630a3ee37bf55002c3908883e | d9b3cd4a1f08c3284d479ff40093454e9f76d23783901087cd0add5d468 fd46fb328e72ebe81cb97846b846051a95d2012630a3ee37bf55002c3908883e Coverage Screenshots of Detection AMP ThreatGrid Umbrella M |
Full article1,097 words · extracted from blog.talosintelligence.com · click to collapse
Friday, February 8, 2019 14:44
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 01 and Feb. 08. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.
For each threat described below, this blog post only lists 25 of the associated file hashes. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.
The most prevalent threats highlighted in this roundup are:
- PUA.Win.Adware.Softpulse-6848587-0
Adware
SoftPulse is an adware that installs malicious software, leverages anti-virtual machine techniques and may access potentially sensitive information from local browsers. - Doc.Downloader.Emotet-6846065-0
Downloader
Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a wide variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails. - PUA.Win.Adware.Razy-6847375-0
Adware
Razy is oftentimes a generic detection name for a Windows trojan. This cluster of samples contains encrypted code in the resources section that could be injected to a legitimate process. - PUA.Win.Trojan.00519ead-6847245-0
Trojan
PUA.Win.Trojan.00519ead is the denomination of a set of malicious adware samples that could leverage the AppInit DLL technique to achieve persistence and perform several DNS queries. - PUA.Win.Adware.Sanctionedmedia-6818436-0
Adware
This cluster includes .NET adware samples capable of code injection, opening a port to listen for incoming connections, disabling system restore, modifying files inside system directories, contacting blocklisted domains, modifying the registry and, in some cases, even copying itself to USB drives. - Win.Ransomware.Gandcrab-6843341-0
Ransomware
GandCrab is ransomware that encrypts documents, photos, databases and other important files using the file extension ".GDCB", ".CRAB" or ".KRAB". GandCrab is spread through both traditional spam campaigns, as well as multiple exploit kits, including Rig and GrandSoft.
Threats
PUA.Win.Adware.Softpulse-6848587-0
Indicators of Compromise
Registry Keys
- <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
- Value Name: PnpInstanceID
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value Name: ProxyBypass
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
- Value Name: IntranetName Mutexes
- N/A IP Addresses contacted by malware. Does not indicate maliciousness
- N/A Domain Namescontacted by malware. Does not indicate maliciousness
- 6nu2bfmath[.]mrzp97cmg3[.]com Files and or directories created
- %LocalAppData%\Temp\~DF38A714DABA77BAE2.TMP File Hashes
- 1a74519d1568dece3bc64889f177df271b1bf93c0db86d97bb81e44a45403c2f
- 1a93550fd9e061d7b572ca6269934ae5d0747e82855420895d41547680e372b7
- 1e8a9c8f07050897420bccfc612fe39dc11acec47dbb11a9b6d17876c0f1c748
- 22db5127ccb49f274ab3f46f6a845bcbe693e2ed4069220c9b33c4ba7cb6e7db
- 2da64c580965f9d0454b9004181ed7fdd5903e93cc41d06578cc968ac4215836
- 30ff57307b5d4456c64ee80eaacb717cdc1804c1f1c49409c7d583ec9f3de1e3
- 3ff2a4f01f7bfc31db3a54ecb98c0df737cd575cc11301af3b19ed99bc0e075b
- 473f7dd0173bafa5de751493de7c7e2cc57fc290aac0ae4d2947cc57dcb8008d
- 5492869d71c62c3ade2750e79de155104329cc08fdd9e65f9ba7d213868714c8
- 54d8cb379579ab2063b223f0011d8fa2838368b4b68f070a54b7e06ca62c1f03
- 5b5c9fd28470e81d23fcd6e5b2ea1bdf7c537ca610535d2f69a23fbd11f8d0cb
- 5e69b36b133ca551c46014c80afbb8fe2d9f6edd1e49cebcd22ca7bbec82d9ff
- 6e43c79b858a27b93c87498faba5f60edd11d6472da142229bef6fb1d1310372
- 78ca808e8428963d80d651655c6f79c8df44448a0d0613eb442a20a3081d0b21
- 7db57b97495b59e84bca9e7f48b472e7412751b20780f17f453e4cf8c9694543
- 7fbd028726e320fddbf67a00ac1a43e8d2f7fdc98dcb53c84fbbd77871c88afb
- 881497c1db786286caae56f5055909c1bba6ccb24628773805f0f3a3a91c0993
- 8a70ba0afe5efa6f633d97f51043d6be2ff3b3a2e6c5fba979f88a6bce4813e3
- 92fbd91b969e6f94853430cb11a7ab2eaeaa05faefd2856a4aa55861f035beb0
- 93b2e125a810723a7bc4e268dccbd784cd95e593077ae59fd9ac4daa9e1a8094
- 99b1320bd421b716118e2aa11ff0044be4bb8849f96b099c6d7ff106ad80833b
- 9ec1af22463376ceaf3468b88b000a155aa674ff27910c4a2d7188fb4ed5b315
- a0ea6c233f4da2e161eb3108b9534d297cb15ec8d17eaf2d22132b0e67e99c4a
- a1caca2e8b3b96935fcde41509753f4531ec3b9c5f436c7291c422fdf4c1d7ec
- b2917e4031446976cdba6958df9d7c2d594f657232e0786b0e39039477b13534
Coverage
Screenshots of Detection AMP
ThreatGrid
Umbrella
Malware
Doc.Downloader.Emotet-6846065-0
Indicators of Compromise
Registry Keys
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value Name: ProxyEnable
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value Name: ProxyServer
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value Name: ProxyOverride
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value Name: AutoConfigURL
- <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value Name: AutoDetect Mutexes
- Global\I98B68E3C
- Global\M98B68E3C
- Global\552FFA80-3393-423d-8671-7BA046BB5906
- PEMD4
- PEM19C
- PEM4F0
- PEM240 IP Addresses contacted by malware. Does not indicate maliciousness
- 177[.]11[.]50[.]52
- 195[.]201[.]46[.]139
- 216[.]119[.]181[.]170
- 71[.]78[.]24[.]146
- 217[.]78[.]5[.]120 Domain Names contacted by malware. Does not indicate maliciousness
- estacaogourmetrs[.]com[.]br
- www[.]intelhost[.]com[.]br
- restauranthub[.]co[.]uk
- docksey[.]com Files and or directories created
- %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B106E8EE-597B-49CA-A6A4-5BA8ABCC8F6A}.tmp
- %SystemDrive%\TEMP\~$LE1922193.doc
- %LocalAppData%\Temp\CVR3B09.tmp
- %LocalAppData%\Temp\~DF0EC263132EE87D9F.TMP
- %LocalAppData%\Temp\~DF93E860FA48DCAA9A.TMP
- %LocalAppData%\Temp\~DFCEAA78F57CC3DA47.TMP
- %LocalAppData%\Temp\~DFDE0E179FA1A94A5D.TMP
- %AppData%\Microsoft\Office\Recent\FILE1922193.LNK
- %LocalAppData%\Temp\p24is3bq.j0q.ps1
- %LocalAppData%\Temp\zjkgwiwg.sq0.psm1
- %UserProfile%\Documents\20190204
- %UserProfile%\Documents\20190204\PowerShell_transcript.PC.0Py_SQrs.20190204204359.txt
- %WinDir%\temp\putty.exe
- %AppData%\Microsoft\Office\Recent\366814370.doc.LNK
- %TEMP%orary Internet Files\Content.Word\~WRS{E2A82E27-8296-44EC-B019-FE52D18D73F1}.tmp
- %SystemDrive%\~$6814370.doc File Hashes
- 03591121dcf83a4aeb5e5fa12a1c1b75c93f5a215780eb1ebf209cc9518f12d3
- 04c6555af6871c7818d3df3f0d5bbf9b85efac94e979c58234310b9a36079e78
- 09be75647f21e12c0c4948ed45c68eb1db6667beece4e1d9748cddd5b4c38eaa
- 15968dcbcb0514e7fd5bb68ced13112a3f1d8b31cd948b967f3becce9283508a
- 1920f3315544295d13a8c3366216b74514369bb31cea90a4659506c0c4c549a1
- 1a4c6a9c9e4bcce9f83776f87f158d39cb21eb78ea839afaa01abf3f93c49a4c
- 1a7211b1d27124d3409b2d1346ba93fc2a91fd00ed3899c95c1e16fc849c54a7
- 1e83dfa18cc1ccff50dd5118f710bcc16e6c4e178977435c62b4238554bcf7f4
- 2287689165547b27ed983152dd781bc53777060a8dd911b18671b60509329ebf
- 247adbdf9950ad6e592f0276ae72625818f87b41ce1bb7596aa89181e0ce99d4
- 267af9baaa1401ae4034200940bad6c1f8cb622a7e731ed28fe84fe0682a6616
- 3bc75dd152bea2d4670d22e2844731646cc4a83024a3cd2349d465d5c16020ef
- 607f94f56ab7d2e2b01a0b8ee0bed7379144363d65e3040f44a197e8245b842c
- 72da32c1bec496a54885f38802c429bc1aed434651bc67dc4acbac637c0c94ce
- 76b02247cf6c9a6c436532a536ccd2711fa876c15312dd6e0b3863e070e8595c
- 7fb24419176dd9aa58bb53a4246398d40c260c253b4772cb8fdc600324f24318
- ad6b9cb00268157013c2b547a379a836609f5c7e01ce6893df16cf1db8fd3965
- af8e1169f130baf122b25aae81d95d62cd3506bae39673652d91ac4c4936049d
- b5d83480ad61ce204743ef0904cbd2995991944efd3d0d2c9daaca9385f4b290
- b9cbad9b3cd4a1f08c3284d479ff40093454e9f76d23783901087cd0add5d468
- fd46fb328e72ebe81cb97846b846051a95d2012630a3ee37bf55002c3908883e
Coverage
Screenshots of Detection AMP
ThreatGrid
Umbrella
Malware
PUA.Win.Adware.Razy-6847375-0
Indicators of Compromise
Registry Keys
- N/A Mutexes
- Local\MSCTF.Asm.MutexDefault1
- Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
- Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511 IP Addresses contacted by malware. Does not indicate maliciousness
- N/A Domain Names contacted by malware. Does not indicate maliciousness
- N/A Files and or directories created
- %System32%\drivers\etc\hosts
- %LocalAppData%\Temp\is-51KNV.tmp
- %LocalAppData%\Temp\is-51KNV.tmp\09131ddb2cac0b4d4483b4bbbc76a26f244ab5a884350f733e1f60fc684da039.tmp
- %LocalAppData%\Temp\is-9EHP6.tmp\_isetup\_isdecmp.dll
- %LocalAppData%\Temp\is-9EHP6.tmp\_isetup\_setup64.tmp
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-CA60C.tmp\367042276.tmp
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-JAN27.tmp\Asian.exe
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-JAN27.tmp\Asian.exe.config
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-JAN27.tmp\FallOffLone.exe
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-JAN27.tmp\FallOffLone.exe.config
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-JAN27.tmp\_isetup\_isdecmp.dll
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-JAN27.tmp\is-0J9ED.tmp
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-JAN27.tmp\is-D4UQV.tmp
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-JAN27.tmp\is-ECQFB.tmp
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-JAN27.tmp\is-T0KA5.tmp
- %ProgramFiles%\Luckey\213384307.exe
- %ProgramFiles%\Luckey\213384307.exe.config File Hashes
- 09131ddb2cac0b4d4483b4bbbc76a26f244ab5a884350f733e1f60fc684da039
- 3c6a39eee1d6b61e2c1d94332b55819182bc189fcdbe06d79bcafa2ea0febc43
- 47d1bd0892f91a1c65f5e6f06fe6969cd8db1f1473760c23e668ac1cb831bc7f
- 4e5e5d3bea988e7c39542245f3a1bc1046153ebefc18ee0b4d743dd8b2f93e28
- 51c839a1fe25c31ba3903cc47f32880741dd1e708c9e97c81a2ea050802f84db
- 68b15033f398389c45903085677e375dcaed3a3225d0854f6cbb5a2b45217cb7
- 6985e3313e82b8cc6b450bb4cb6fcdebfc1b26ec83b0ace499c836d79b0b4fbe
- 72a1cb206beae974f8d3504128e7892ba6fcbba38f31d7714f0fd811618bb439
- 7384060612fcb8c40a324c136c571295f361a2e6d7f5b470206b574aed5fe0f4
- 817ee49531f980991336c020e3d99f67796a38ff88aff948f07f658b083e6801
- 888888ec0980085d2a89f43fc32f543dfbe283d7ad0186e5c1089a08795d86b8
- 9d6c6642a75a6328ef321212b482519ef74c767d9a02d1538debc53f031ee293
- b0d1ef5415c13028a6fbe16900e255b599781bf3824144413f9364e619480194
- bb87882c8e8c87e3f0f2accf837d141550fc0a048409b6c0a4aaec4b9829f1a0
- fa64e7db69b070ef8bad8046cd7539dd1fca1bb63349f04c0e94584cf0a2a7d7
Coverage
Screenshots of Detection AMP
ThreatGrid
Malware
PUA.Win.Trojan.00519ead-6847245-0
Indicators of Compromise
Registry Keys
- <HKCR>\LOCAL SETTINGS\MUICACHE\3E\52C64B7E
- Value Name: LanguageList
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
- Value Name: AppInit_DLLs
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
- Value Name: LoadAppInit_DLLs
- <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
- Value Name: RequireSignedAppInit_DLLs Mutexes
- {5312EE61-79E3-4A24-BFE1-132B85B23C3A}
- {66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}
- Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
- IsoScope_10c_IESQMMUTEX_0_274
- IsoScope_10c_IESQMMUTEX_0_519
- IsoScope_10c_IESQMMUTEX_0_303
- IsoScope_10c_IESQMMUTEX_0_331 IP Addressescontacted by malware. Does not indicate maliciousness
- 13[.]107[.]21[.]200
- 104[.]200[.]23[.]95
- 204[.]79[.]197[.]200
- 209[.]197[.]3[.]15
- 188[.]72[.]202[.]44
- 34[.]226[.]238[.]42
- 158[.]69[.]244[.]165
- 212[.]32[.]250[.]31
- 144[.]202[.]40[.]125
- 104[.]16[.]13[.]194 Domain Names contacted by malware. Does not indicate maliciousness
- maxcdn[.]bootstrapcdn[.]com
- 5isohu[.]com
- done[.]witchcraftcash[.]com
- thegoodcaster[.]com
- www[.]theoffertop[.]com
- myecomworld[.]net
- wonderfulworldnow[.]club
- images[.]clickfunnels[.]com
- tac25[.]com
- track[.]rightsearchsmooth[.]club Files and or directories created
- %LocalAppData%\Microsoft\Internet Explorer\imagestore\aowwxkh\imagestore.dat
- %LocalAppData%\Temp\A1D26E2
- %LocalAppData%\Temp\update.exe
- %LocalAppData%\Temp\~DF32A074D75E28FF74.TMP
- %ProgramFiles% (x86)\Internet Explorer\IEShims.dll.tmp
- %ProgramFiles% (x86)\Internet Explorer\ieproxy.dll.tmp
- %ProgramFiles% (x86)\Java\jre7\bin\ssv.dll.tmp
- %LocalAppData%\Temp\~DF832EC54C42A76DA7.TMP
- %AppData%\Microsoft\Windows\Cookies\2XVNLMCY.txt
- %LocalAppData%\Temp\is-0UA26.tmp\idp.dll.tmp
- %LocalAppData%\Temp\is-B01CK.tmp
- %LocalAppData%\Temp\is-B01CK.tmp\c1f44c795198b23f8058492bb82a29addd2eeae623a53296f0195777d6a5fde5.tmp
- %LocalAppData%\Temp\A1D26E2\116E56C6A8.tmp
- %LocalAppData%\Temp\is-0UA26.tmp\_isetup\_setup64.tmp
- %LocalAppData%\Temp\is-0UA26.tmp\idp.dll
- %LocalAppData%\Temp\is-0UA26.tmp\itdownload.dll
- %LocalAppData%\Temp\is-0UA26.tmp\psvince.dll
- %LocalAppData%\Temp\~DF12E5A698F292B5F8.TMP
- %AppData%\Microsoft\Windows\Cookies\YO092G24.txt File Hashes
- 06386d249ae1b3cc4bc96281ae89e10a85f68dd7e350e3e52fab4c88a7c02375
- 1e81d5888f17947bcbe31a74b3761c31c4fd6b49cb02d3eb4f85e065d8729e08
- 298b8e26c83ba9fd1bb1faeb5b0df909f1d163e7896e26c48d35e041aae6320e
- 641432c889189c393edf97cda9b08e5b083cbb8eecc5ac09b9d476f8872ecf3b
- 6fbe635039debcb4eccf4d9c24cf009b8405fbe8cf9fcc5c5f24d0ca8bffd53a
- a073171d46e57c4e308b6a62c0d14e597e95c030c019f428a26ee6c07f43557d
- a5b2ea50f8dceec4752888c5e50e364b16253160dd7fb20932d8e5e5a56ac719
- c1f44c795198b23f8058492bb82a29addd2eeae623a53296f0195777d6a5fde5
- c488c9a61f7be3a4e7b9c51dbefa36c2fe7b53904d30c38f58dcc1900aec098b
- c72e78abc54e7b785e666e0e61181c107a4cf6b9c0519146f9f2b9fbf47ba841
- f1aa892c158ea1779a210d52b9a4311245544868343d27c91454566d730aa4ee
Coverage
Screenshots of Detection AMP
ThreatGrid
Umbrella
PUA.Win.Adware.Sanctionedmedia-6818436-0
Indicators of Compromise
Registry Keys
- <HKU>\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\appsvc.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastUI.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\instup.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgidsagent.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe
- <HKLM>\SYSTEM\CONTROLSET001\SERVICES\SCHEDULE
- Value Name: Start
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keyscrambler.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blindman.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFiles.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDMain.exe
- <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWinSec.exe
- <HKU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
- <HKU>\Software\Microsoft\Windows\CurrentVersion\RunOnce
- <HKU>\Software\Microsoft\Windows\CurrentVersion\ime Mutexes
- Global\CLR_CASOFF_MUTEX
- \BaseNamedObjects\Global\.net clr networking
- RV_MUTEX
- \BaseNamedObjects\RV_MUTEX IP Addresses contacted by malware. Does not indicate maliciousness
- 158[.]69[.]30[.]89
- 188[.]70[.]31[.]241 Domain Names contacted by malware. Does not indicate maliciousness
- x11[.]zapto[.]org
- sambosaxzx[.]ddns[.]net Files and or directories created
- %SystemDrive%\AUTOEXEC.BAT.exe
- %SystemDrive%\boot.ini.exe
- \??\E:\$RECYCLE.BIN.exe
- \??\E:\$RECYCLE.BIN
- %LocalAppData%\Temp\xkkr5i_9.out
- %AllUsersProfile%\miner
- %AllUsersProfile%\miner\sHXJvbCG.ico
- %LocalAppData%\Temp\xkkr5i_9.0.vb
- %LocalAppData%\Temp\xkkr5i_9.cmdline
- %LocalAppData%\Temp\xkkr5i_9.tmp
- %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\Torrent.exe
- %SystemDrive%\miner
- %SystemDrive%\miner\nvidia.exe
- \??\E:\miner
- \??\E:\miner\nvidia.exe
- \miner\nvidia.exe
- \$Recycle.Bin.exe
- %SystemDrive%\Documents and Settings.exe
- \Documents and Settings.exe
- %SystemDrive%\Recovery.exe
- %SystemDrive%\366832936.exe
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RESE.tmp
- %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vbcF.tmp
- %TEMP%\_ecw9cm3.0.vb
- %TEMP%\_ecw9cm3.cmdline
- %TEMP%\_ecw9cm3.out
- %TEMP%\n02x2nc3.0.vb
- %TEMP%\n02x2nc3.cmdline
- %TEMP%\n02x2nc3.out
- %TEMP%\nyf8h2nv.0.vb
- %TEMP%\nyf8h2nv.cmdline
- %TEMP%\nyf8h2nv.out
- %TEMP%\q8tnr4an.0.vb
- %TEMP%\q8tnr4an.cmdline
- %TEMP%\q8tnr4an.out
- %TEMP%\rykc4pie.0.vb
- %TEMP%\rykc4pie.cmdline
- %TEMP%\rykc4pie.out
- %TEMP%\yjua3drf.0.vb
- %TEMP%\yjua3drf.cmdline
- %TEMP%\yjua3drf.out
- %SystemDrive%\Documents and Settings\Administrator\Start Menu\Programs\Startup\ Torrent.exe
- %SystemDrive%\I386.exe
- %SystemDrive%\IO.SYS.exe
- %AllUsersProfile%.exe
- %AllUsersProfile%\miner\366832936.ico
- %AllUsersProfile%\miner\CONFIG.ico
- %AllUsersProfile%\miner\IO.ico
- %AllUsersProfile%\miner\MSDOS.ico
- %AllUsersProfile%\miner\NTDETECT.ico
- %AllUsersProfile%\miner\boot.ico
- %AllUsersProfile%\miner\ntldr.ico
- %SystemDrive%\RECYCLER.exe
- %SystemDrive%\Temp.exe
- %SystemDrive%\Users.exe
- %SystemDrive%\c2d124b8466cec6b3e47c4.exe File Hashes
- 0489f71417400080c1ebf6f5cf76655470a83f0f964a2ad54c242daf3012fa7a
- 0e15e99295dcf13eae0d5a4d7a04a55f7fab24e8f189f5ac37cc1007346007ad
- 1127cc0f06797cd128aa3724b5ecead3613c41fabebd143fcbf19a8d236a8fef
- 137b894b7f9992f26dd4e6c8d8c2a09e886466305384b444aac2e2d9e3ee7a19
- 1f5b1a8b9f7fb4d83bbd012d42fdc725468dc0ed29341bee4c5aa122d83f69f2
- 3357239b0cb8a4683eca02fd8bf8c0de9cd3372a2222f096d7b527b39fcf8987
- 372a2fde40ef021834c7d7718f2f2faf63ee372ee75a795ce3ff0e1156c57a8d
- 39bbcd06380d793eb655a015e04ed122d160b6d469495a3b172a89809e5c1c1c
- 3b3db732aa7ea25346da5ac1a4f0cb56357baf265259c9046885f889b56830da
- 3cf72a19a5dbca5da318ca758b07f8c1e729dd3035f1f31223c8c05fa8826faa
- 3f7eb77d67e6a7e2e410993234cc2bf649b3efb311931774e4c5dff3bbfcb1f7
- 43983381c09f51babb1b684db1c0f804c3f00ba6c5159e99bb5a68b32e4718f5
- 4a7bdf882b10e093cb0d82c61e71daaff97971f0cbaf16f61093acdfe149734f
- 4b08ea2461afbf58ef946d1897ee5d4b2873ad2b261db005a85c4aa43ffeca09
- 5a85a897a9e5aabf518bd1ff19339cca80543a90cefdcca5397ac09014fc71be
- 5da2bf905b77f3b9c4d957458cfb9f133860ddfe5dec741aac55bced51184c1c
- 5e01d3fbd260656eaf2eb22631ec30ce8433f8288911ef552855108c773580bd
- 638c303a097d02c40e3790e506234cd36ea4c907166f4447f50e6f92b7429436
- 63af1d420682171b535f222861b3bcc90c4da86363ad94a4b666bf489a245e11
- 66a2ed3db3c55603be3a2ce301cdc71be803b18da51731373a4d23c1d5b0b1a5
- 6e0a7315797b5add6dc3b23abdc8d96d0d43e9470bee64f3f5fd12721acd62f9
- 7051fca8dfa96b8ee78111d72f6945d14f82aceb94f93a891dfe6e5641512b1e
- 71a577218ae440efb0c6b2a624d90a8713e60ab01c525a180c15b5b2b9fa8d4e
- 726787ed97a97d4057caa986bd0956a80ecb446bcbdd9a1c009fb4d1ebccaee2
- 76b63d0d32b961663c20a01bd478d5cb1358eb1441bea38e2cb8e57c36e0ac41
Coverage
Screenshots of Detection AMP
ThreatGrid
Umbrella
Malware
Win.Ransomware.Gandcrab-6843341-0
Indicators of Compromise
Registry Keys
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value Name: ProxyEnable
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value Name: ProxyServer
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
- Value Name: ProxyOverride
- <HKU>\Software\Microsoft\Windows\CurrentVersion\RunOnce Mutexes
- Global\pc_group=WORKGROUP&ransom_id=4a6a799098b68e3c
- \BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=ab8e4b3e3c28b0e4 IP Addresses contacted by malware. Does not indicate maliciousness
- 66[.]171[.]248[.]178 Domain Names contacted by malware. Does not indicate maliciousness
- ipv4bot[.]whatismyipaddress[.]com
- nomoreransom[.]coin
- nomoreransom[.]bit
- gandcrab[.]bit
- dns1[.]soprodns[.]ru
- dns2[.]soprodns[.]ru Files and or directories created
- %AppData%\Microsoft\Crypto\RSA\S-1-5-21-2580483871-590521980-3826313501-500\a18ca4003deb042bbee7a40f15e1970b_d19ab989-a35f-4710-83df-7b2db7efe7c5
- %AppData%\Microsoft\Protect\S-1-5-21-2580483871-590521980-3826313501-500\Preferred
- %TEMP%orary Internet Files\Content.IE5\C5MZMU22\ipv4bot_whatismyipaddress_com[1].htm
- %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\A71QDCIP.htm
- %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\A71QDCIP.htm
- %AppData%\Microsoft\psznzp.exe
- \Win32Pipes.00000328.0000003d
- \Win32Pipes.00000328.00000041
- \Win32Pipes.00000328.00000049
- %AppData%\Microsoft\Protect\S-1-5-21-2580483871-590521980-3826313501-500\bb5ca9a3-5378-4a8e-8196-42a28d9ef0c9
- %AppData%\Microsoft\hjunhw.exe File Hashes
- 00e77dd692525ac51843e571dc4401ad383b01f3789a96ad952ad46e9bc30d5d
- 01ad099c08042d05bcc5c708aeca7a3479f93def36318469c05b3fe2c25a202d
- 01d3aedbbcfde336cf132fa52fb87f0a39a7e1c55cf8e30e8f79df6fa6cf2a28
- 021f152e82d84617ac2ba999f436fcf85f35c9c17da8f7adff51d6f6c332c63f
- 072a1a933df1fe1e0c90b07b30bf82dcc16fd860e47ac94877c25c05b89a1147
- 087af2abcf44ec68d9f1f55bcbae03e12ff0380ceea4f2197fff9b8d353f417e
- 098af1ba0b5cf4d27f8122eb37bc7ab009be4f6c812e990639931d8504d3619c
- 0d20371ebb39d45616ecdc0ebd1ae457f98641a14c8cd3c94e553fe5cb71e128
- 0e90f5195c0f0c81cd631c90809790490a7a5cac5eae61bf27332b9707f9e3f3
- 0ffd01cae290d5ff33af6dcd087646bf86a065fd02f196b7dd3afe0bb5c08d75
- 103f6e49c97ec73d623231fa92f418032ad223c565a7fadb238cc676a6bee79a
- 110084e96789b6e657a8453d8614c14344e03ca4dac55076afe7ba605a68ca06
- 112dcf3ef406642f9b2459a27dc79f626d28ac93db3482691eda8db3bbafd80b
- 119238f37579434b540e2a4cda59261d86e9a9ac0c059dfd2daf699c5a3e6094
- 1388310e5f683da4ad3e774923c2616a7137dc1da691efea313fccd2a0f88da1
- 1694e9584805e55badf8da9ce6f8b4122e3bf419bfb22070d3e97b83be0caa73
- 17517aac50cfcb9b6cd779f466d6ece0ec930071fc58e7b4b391a8e79a7ef49d
- 1c4b31ea552e67d0e573cc3c4f4c93387e79e931e41742129dcf7b1cdc55d4d5
- 1c700576a51cdbee44a25972503a64ebc9d4fef602b4702fca9eb02e8622a7dc
- 1ced683893408d370315083efe988043cb72a864a03a3ded4a94d047d2bec262
- 1d4f89c1ecd931c4b5cecfba15b76f1d6607417af487654da1d50497bcda1cd9
- 1e1b83c79a5d2ff5ec3ca325debdb29f66d83f362d2bf0ec4e18c6fbafd6c179
- 1eff09710c639869bef51b90404569a7917aa23afdd290c8668e617b1757a231
- 20be9f6a086f07dfc3fbd8a5e6a060e50f360629e428077665980f6e6e401079
- 20c45b4970eddc186e8e77266e5b2282c6faf4d53559482200c4d43404d23f7a
Coverage
Screenshots of Detection AMP
ThreatGrid
Umbrella
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0201-0208/