Cisco Talospublished Jun 29, 15:42 UTC (Jun 29, 2018)ingested Sep 10, 06:19 UTC

Threat Roundup for June 22

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article840 words · extracted from blog.talosintelligence.com · click to collapse

Friday, June 29, 2018 11:42

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 22 and June 29. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

Win.Trojan.Remcos-6591502-0
Trojan
Remcos is a commercial RAT but it is also available for free with few functionalities. It can be configured to have anti-vm checks and hinder the analysis. This family is able to receive and execute commands from a C&C server. The commands may activate and record the microphone and the camera as well as the keylogger functionality. Remcos is spread with aggressive spam campaigns and by leveraging Word/Excel macros.
Win.Malware.Separ-6591487-0
Malware
This family is a spyware delivered via spam campaigns. The malware survives reboots and is able to collect confidential information by capturing login attempts. It disables the Windows firewall and it invokes scripts and has also FTP functionalities to upload the collected data.
Win.Malware.Tspy-6591475-0
Malware
Tspy family is a malware with several functionalities. It is able to execute itself after every reboot and in this way it is persistent. It contacts domains that are related to RATs and are generally C&C servers to upload data and receives additional commands. The samples are often packed and contain anti-debug tricks to complicate the manual analysis.
Win.Malware.Jaik-6591471-0
Malware
Jaik is a botnet with several functionalities. The samples are able to communicate with domains and perform code injection into other processes. The malware has many features and some samples have also DDoS capabilities as well as generic credential harvesting.
Win.Malware.Delf-6591417-0
Malware
This family is a generic malware and it is generally the first step of a more deep infection. The payload once executed on the machine downloads and runs new binaries. The malware is interested in credentials and focus its attention on well known applications such as Outlook, Thunderbird, Firefox etc.
Win.Malware.Ursu-6591377-0
Malware
Ursu is a generic malware and it has many functionalities. It contacts and C&C server and performs code injection in the address space of legitimate processes. It is able to achieve persistence as well as to collect confidential data. It is spread by email.

Threats

Win.Trojan.Remcos-6591502-0

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses
N/A Domain Names
N/AFiles and or directories created
%WinDir%\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
%System32%\winevt\Logs\Windows PowerShell.evtx File Hashes
0007bb868ae54ff5be81cf04d7ff4c38c1d36ee18fbc3ee166d1f6298b8e4176
00171a400fb86b6f6489875fdf65079b765255e2240c30f174b1f9aff6a17dac
04bb108e21aaa1b3832e2ff483237559c02dda2ddfc03e2b56e7bc818614d0e4
074dcfd66274bec7d3ac3e23fd77d21baca17efa497eb94d748e46add97e8c27
07b31ec3eabb4967f7ed54d437de2d4a3e9271810f4f9c2b238bb6ba7829f180
0913592e52b43087d0f2a23700e5c625c0cdd4d391354233dc692a5477416ca9
094e5d7bce863dcf7652873c15d18dfce918eca631c471bbe59f739fccb770c8
09a7a2aeb1af80aa666c5920765e4409e367a051c161d948f1a193adbe5040a3
0e953857e78b91fa30011d345fccf6f86a8697318935b227d69ac4dd4915889b
10173267784ffb1934d59ce8bd822f9f9260bbc7420eeafd0c8affa8a62e840b
1323533b1caa1537b50c0ddb43b5f692901d2bb3b38f11e0fb380d72149ef53d
13aeccc984e1570bf36d8440df9b293277b25f26bb299179d187ac47b3500488
13fbdc096406f0f975d02a160448d98fd9d49d3ce7d338151668001017dbe397
144b7841ed6f8181b99e6be48533a77db7ec1183cd3700fecda0cfdc4b5bf3bb
1623edf8271a3a77d74658adcf67d5f99f6102bf178c0665dd68bc932b0c1228
192f60438d4707d0edb60c2ab1b69df72943b7812bd77bb393182db0636be982
1a6c169c82fd99a1b607100c42cae0c39f964ea2dbe6e0216479171d479275df
297ce1753eb30ecc82b016aac7ab694eb0bd4ded06fdecc5cd42a2464e4831db
2a0d2df8c466bbe5bf538e9745286f124f3ca426d3ece80fbb675863281c46a5
2a4a9722a20800038438c88d240083b65c729004d30e0c993f67202541f60811
2a67165161c7cbeed1fb43aa27b770b627b0eabe7a647387382fa4cff0acbaa3
2bbed3835b0efc4efe05d8fc806ab9fa5313202d566d18060542d23a3cb80fed
2d834a721aa72e59378d795f16b179e6cc8fc0040441d72b293f19d863cd22ad
318d9318e4e204f378f8ffeb7d831a6f251d6ca4e827f8e48449be0812e2cb25
31aa91dfa01203239b8aa25649c05a084e62de8814e101c24f3fbd5f2d234014

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Malware.Separ-6591487-0

Indicators of Compromise
Registry Keys

<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
<HKLM>\System\CurrentControlSet\Services\NapAgent\LocalConfig
<HKLM>\System\CurrentControlSet\Control\DeviceClasses
<HKLM>\Software\Wow6432Node\Microsoft\Windows Script Host\Settings
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\EVENTLOG\APPLICATION\CHROME
Value Name: CategoryCount Mutexes
RasPbFile
DILLOOEP
DILLOCREATE
RAL716BCAD1
Global\GS-1-5-21-2580483871-590521980-3826313501-500{D19BAF17-7C87-467E-8D63-6C4B1C836373}
Global\G{D19BAF17-7C87-467E-8D63-6C4B1C836373} IP Addresses
198.23.57.8 Domain Names
ftp.freehostia.com Files and or directories created
ZREA.vbs
\wkssvc
BReader.exe
aijw01.bat
Adobeta.exe
adip2.klc
adbr02.ght
adbr01.ght
870.afr
%WinDir%\TEMP\gui9381.tmp
%WinDir%\Temp\gui9381.tmp
%WinDir%\TEMP\Crashpad\settings.dat
%WinDir%\TEMP\Crashpad\reports
%WinDir%\TEMP\Crashpad\metadata
PSTools\PsExec.exe
\scripts\PSTools\PsExec.exe
sendemail\sendEmail.exe
sendemail\sendEmail.pl File Hashes
0426b3265ac921a904ba9a2a4e23bf86c18863bd020f1b50b4b1f85eafed66c4
09ebe700700a0e5e49d994093786f6c1bc9d3c400edc94b31693ef5961250d81
12e2ba4b4a310edf9cd97405541565e20d9ea6259d86d96a36fc8b676babb228
14c4a3fd18cad81c55ff4aa192803b748d8810900602c89c26114eb80c9db988
21d006b8f12a6b2e3126f3a6cef4f621c314a9dc21be6ffe51950f816f6a88c9
306d1f5e2b8292344d86d611dff2704920fa44ddd6fdc0b67a3e7e0f34d29d18
354cf3031b2679f885969746afef780bb1765b0f32613afb6490d5e60b7fe6bc
3ef31d4a0bccee0994a4ee525b679da1fd2664f3d96d20371297f6f6645a2ced
3f735ba16d51af841f5a48c9be5a2cb004df275c71cbbdd3497bfe34460f9c93
403d91b31d44acb4a67b5b0dd7679971bedc722244f1b705adfa095632d18cf3
4f7b768262e30ac52c97566a03646de84081ea148c932aedb84ca5bb46a10da0
5b4afe3563869522e85cfab2ae3d2e57a55f98a9c565c915dac81aaa0282deb4
61540809d55eaa23ba0ac82ff4b530823c93fbc8e7097ccaeb8329e0eb1e48c1
64a76e220bdff00633c5cd8e0282ec61836a60cf6b2f9f1b135ce3a3b040ca52
675402f0a4a31c59011e4356207a3189b171f0dd81b0117adf59e6e120b90295
6d7019e4f1e02713046fedb121d15c9a423b8502e792ff42c7896c3b4d9f826d
6df2b4fc352d822b4df9c164e7282fe387adc6ab0b7e036a12f4c3c57641564d
6f13c5e83ae42cbb755a44c3c45075043983d0eba2846b63442471577bdf6a98
70a30928df9e590846105947070d1fde660aa4bb933e0468713a89960c587a9f
7115ea1ab97a7187b2a1bb6936fe3df44bc754ec06f70c9f880d9787e605ea60
79789706985bcb5afeffed63805994cbe09966da0544e18a0a059a57064d7039
7e4ed04b95f0b07272223308b8e49db2fd64b144db28d5322b51ae879f58f8aa
7eefcb90a82546e4b71895a11a95a8dc38f49fe4713fa7d7a52ec68f511533cd
81ca06e244e541b585ff763df011560dc2b58eb7ea434eeef74439ca8bfd01b2
82a5963922e08c70521648fbec9849f621bfd0d25b0d6193b1e9a39ecab05111

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Tspy-6591475-0

Indicators of Compromise
Registry Keys

<HKLM>\SOFTWARE\MICROSOFT\RAS AUTODIAL\Default Mutexes
3749282D282E1E80C56CAE5A IP Addresses
207.174.215.154 Domain Names
azmiry.com Files and or directories created
\samr
%WinDir%\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
\lsass
%AppData%\D282E1\1E80C5.lck
%AppData%\D282E1\1E80C5.lck File Hashes
05a6a94d66a8b222553c9210b4e370d02a6fffe8ee49be8142d75dd37c5c7fab
0f11515c0a57068b0636a8a4283b8e25bf7c72fe55c486fc108a8cbf02b50c41
16ae2ef60aad481f1a340a9e6e7421258a57e7cbba46d9dca8c1dc063a699ef3
19c97ae2501ccebf5e2e4e5f88d3323141aeca73e9016d69eacc11f79fd4e803
1d8cda39dcf193f04d41ca364e038ddf7ae51ff5cabc56c687a38c41773b5d95
2ec87871a0a83639fc814ab764d69147f2dccc13cdcd6dd6af4a9aaaebdb5283
3651567230a6f02d69659133e1e915d87903994f20ac3108310c214d9cab163c
36f23f39d5bf737e10c2a253f046741f530ebabe20216ec535b3aab4bc9efe5c
4ec361e23ab8e05a13532c2c669bf8a37adb1e918124b308f83e3ed59a4c2abc
4ed4a8509a45db8c5ff416c738cb25a877b47bd1066b30b1c611644f92b051d6
4f44cbd14878c3f8d6415c0d7d103224354323d624ef3e0906f3695d3c9c06e9
505086a1799dc039d72a0e691641af6660ed9b2b97e7ff9b1379b59971fc9701
574e0c9876b887373cb06e5873f99decb58c10e97d87f930b86d4156a4585e97
5b037ffcf5d7627fd5e722fa9b24f9a7108fd65069f47bed25e0c72618450774
61847bfbc04c932876fa453db940c2ae04c71476f4852f1799fd1de2e8a649af
6dba2d229e5170601495ae923bff1f46ec581b6d858bc2b19a8db3ed210b8791
7a93669bdf9192314b505e49e3d80e3974683a024f12f92ba0103e8b640a7d2d
7e113d90f3f9a6dff9a99479d7377ee1b19fa3534ba3874c98495cc8b5ef3a3e
86d5dff17cefb0f8c99c92a4e5890086d2674ccfb46ad80bf202df6961ed5d4b
87f83003dbefa877b6256c34ceddb4447880d4db632656a3718fea5a0428515d
9617d56a748b5f29e7e97260fb61ee99b9035521ec4e4d134fad9411e74d950b
b29235fc7596b5ba81c8edac236b03e8ab86b0457297151b4f410277939f12ee
c421dd4f20f4b7d99e740352db8e727a0b3c88c34ab2053849f039b508d73f71
d454f075a83bd4d4541ed25898a4cb8ac5ef903b5b4269790a911450ff0a76ff
ea09bb3b764c057f45134b132793654e0937701d4cc731298cc7791b1e1b1b88

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Jaik-6591471-0

Indicators of Compromise
Registry Keys

<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters Mutexes
N/A IP Addresses
N/A Domain Names
meteor1174.hopto.org Files and or directories created
N/A File Hashes
07bef3ef1d45fe1bbc7c16f7e7ad211e1e81264cf9ef119232d10bfd2245e778
2ae2fcade0f57faf7fbabbde56e60ad080df9011ed70dee957aa7fe13a961c80
2bab01741cc5796155d61543a7efe5cdfa96bde3507f1d85ea2c96ec0f1f7c0b
3329a848c569b7048f60a733cdf217d84baa1820fb4c1c423662e799fa1b9331
36ac6881149050ac9aec57972ccc3e8063c51e66529d16b0a2647b9ab8700715
49646325555c83e70ced5a1b4b2ef7f128ff912593c95c017703f332c83e0914
58a9f5613ece73717b322ab7518d887fdd391011cef6afbcb311eef74b677df9
5c20c7e6b9aa1dacafff644088c71388374329a9e0a218fdc944fb802fc5928c
5eb6c33a3e6dbf7067de22799ef42d58fc8696f74a29bef655993508e9b9d018
622fa10ffe94bff99be638991472cbfda178d186d6d95adc2bb87c39d2f9c1fb
709da9c32f18848efbd955bef0d1717a5adf56435a3bf0d1fdac34aeab25b725
70e53202023b2615c92a7987590161ab2a18410e827a6535ffc1df83eec6821d
ab551f56024f9443b83107091fe741ab301052c03c34c167717f781f9fab36a7
ad459b9f19ce38d60470ed2889895d23f618f2be1aae8e49b172e83faa69c2c4
af9f5370fa6758440ef40215c4412b1b266c33effc541c97766b7c6f4dd076b8
d0a55070ae9fdb2b7ac3b113025200257d4e02c223606038e5f19e963bf2c9e4
db5025e926aefee22c19bea499ed4e79c8d28dac511ac82016823a34ae9f20b3
e35cda507a9d6fc95a409f8e9946bae206a02063d51296017d82382ff28ead88
ec67e3754964d9c2ffb67837cf56eacdd51557012e31014fcbf29a01254d6fe5
f10fd36eb803b00e3173b20a2c19fc99a82a51fdecb7eb5b41417ca8365a98c4

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Delf-6591417-0

Indicators of Compromise
Registry Keys

<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
<HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\
<HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion
<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
<HKCU>\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\
<HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\20.0.1 (en-US)\Main
<HKCU>\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook_2016\ Mutexes
S-1-5-21-2580483-2483680211483
8-3503835SZBFHHZ
O40QO-SR7BC0x74z IP Addresses
162.255.119.150
93.89.226.17
198.54.117.212
50.63.202.36
52.5.103.164
54.80.160.147
184.168.221.32 Domain Names
www.exodusenerlytics.technology
www.davenunn.com
www.bkinfoprosdiscountworld.com
www.szccf360.com
www.diligence.agency
www.curry.estate
www.nordraack.com
www.titandevelopmentgroup.com
www.iqtlab.net
www.dem45.com
www.sinevizyonajans.comFiles and or directories created
\TEMP\tmp8gR_uW.exe
%ProgramFiles% (x86)\Nldp\colorcpl8pjxn.exe
%AppData%\O40QO-SR\O40logrv.ini
%LocalAppData%\Temp\Nldp\colorcpl8pjxn.exe
%LocalAppData%\Temp\Nldp\colorcpl8pjxn.exe File Hashes
05e73d8ba52f08aec1a2ef518882919038bafc5de2ed55d392b6ccea42ea2dd3
09a45c4027bda13479438300bc335bce71d55867062c959c73ce5403ff00c612
0b23ebf80d0733874699afe7ce80553b6b4a61a1e624e1e07b623b51f7860691
0d0f137cb556858c93f1997cbaca1be7cf6ef24cb727fae6a0c803960c584eb0
14a68cb7a2930e6646657e26dd45fb5a78516756b7109ee12003bcdc822ad9a6
173fbe68a341e3ee14ae0d1b28668200573f48062621e76ca5dda051effd4e05
17fec1525d222eee566d9659723e31758615f38f11737f92e553bcbd1e38536b
1bd6c972c2e3d832da416d007c99a29c262eae2e8f33fe01a8a21e28351e35cb
23387c5a36e1238a0c7d0c2d5e085104633c5d241b640ce5c0c141298e690bb6
253a4ae4cbf315b3b22bb9c17dc10c56ebeb81a9b5b9f7914f6fa5fd427b5f06
28ba614d48c8193e3281dd382b2e20572ec74dd1f3566aa587f8b4f3e245a7a0
2b2ef2273c974fb2645c6f89780f227f9361f3d70ea7c016ce04cb9723d8b35a
2bf9a152694a78137a1a65528ba0ec59d4d104353ff8546e81f95dc93c057836
2c5b196d892dc0ced1b53bab03a485b7b8e82bc94a8f3117ab4eed0eca98d1a2
2cfce9a60463f25ce69d2a0ed56e026db274be7d55215c8dd02de6df6e9b51a4
31c70b829486f54898eb15bb28dfcf2c56f3860a9dca3872ddf2c1b0a8f52e99
31e7fd07d03a0e11510f49056d99252abfaa1cc326ded44fe8c3b21a22fde5f9
3342fab27758ae8bd7acb18aa622b0c0e2cc5425b38c404059f742eaa5c437ee
34058b038b01acf371ff2124cc8090c078514cb90bc40aa71e6147cafe9323e3
39b16f474008113649b0177624a320ce91b7522c791985eee9c044aabb888802
42635253472eab8f4e242db7705ba5de5ab3088bb6d366696219974ed2817383
4292e8ecea77bd64adb39b58e02c24745d52485c376a1f950aa5adc2e8a3cc44
4372ad95f57701da72c2fd9e191beef564d613d473a53cb3034eab407229eb8f
441d9da5829e5e263ef7c0bd43dc097d6e4221273be576072335e8c3226d7309
44d6b38d0cfac3a4f96c2c65997d203fa6d45b8de07fcf0908ca6eb8771d5286

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Ursu-6591377-0

Indicators of Compromise
Registry Keys

<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
<HKLM>\System\CurrentControlSet\Control\DeviceClasses
<HKLM>\Software\Microsoft\RAS AutoDial Mutexes
3749282D282E1E80C56CAE5A IP Addresses
104.27.133.70 Domain Names
saferfreedom.tk Files and or directories created
%AppData%\D282E1\1E80C5.lck
%AppData%\D282E1\1E80C5.lck File Hashes
00671219067cecc386d3b250b4ff757a5497a4b3722aeb0dd3befe3b452d422d
04a91380d6eb48d9f2379fc2cac383dbe259144966206869dda719a66242bf0b
095244d601513670f12b135767eefc69bb321a36d04c2a2f930631dc972bf2fa
2551d70b3860021190a1261539cc7f95fe9a9e4e38491f3c57f7547ad8e908a3
3c19f663bd6a3e2bc4a9532d087b8df17e2b2ac13c601b61cdbb484df6573210
55e214ccca87524499ce3b9cda713412671acc465fd89d37e05aeed883235e67
7b298711a73ca51baa7ae7150b70e0be7753e8cdf1ec0cfd051a59f30e4b0676
848b95a4454433a35d600de4fca65d177daf06c0c049d7c8e0419cca7145e0b9
afe462e1e36845bb140053d0697d30df68228b57657451d31807ffb6596189ac
b126c7530385ff1842b2db06161ee5cb09afc368d486f679b6e88bf62199ed34
b961c0416728d78d875807fce6313c1eafecffde4d0b586227498edc09b8bc35
ba0e40371cefac1880961c60a33c54f1cca57e883da1a603df04f162941f9b28
bff4edac75f61c111017c92e248e977adf795afee9e8b9b4dad9accb5650060c
d1ede616a2a66853bdf7603f56f4e128e722883a2ef4b9b54de8d2fd1e79f3b6
d69ece607dc234195e07a4df139aaa83b8958b3ac3bcaee1d1af19f22b1ee049

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0622-0629/

Type	Indicator	Context
sha256	0007bb868ae54ff5be81cf04d7ff4c38c1d36ee18fbc3ee166d1f6298b8e4176	%System32%\winevt\Logs\Windows PowerShell.evtx File Hashes 0007bb868ae54ff5be81cf04d7ff4c38c1d36ee18fbc3ee166d1f6298b8e4176 00171a400fb86b6f6489875fdf65079b765255e2240c30f174b1f9aff6a
sha256	00171a400fb86b6f6489875fdf65079b765255e2240c30f174b1f9aff6a17dac	b868ae54ff5be81cf04d7ff4c38c1d36ee18fbc3ee166d1f6298b8e4176 00171a400fb86b6f6489875fdf65079b765255e2240c30f174b1f9aff6a17dac 04bb108e21aaa1b3832e2ff483237559c02dda2ddfc03e2b56e7bc81861
sha256	0426b3265ac921a904ba9a2a4e23bf86c18863bd020f1b50b4b1f85eafed66c4	sendemail\sendEmail.exe sendemail\sendEmail.pl File Hashes 0426b3265ac921a904ba9a2a4e23bf86c18863bd020f1b50b4b1f85eafed66c4 09ebe700700a0e5e49d994093786f6c1bc9d3c400edc94b31693ef59612
sha256	04bb108e21aaa1b3832e2ff483237559c02dda2ddfc03e2b56e7bc818614d0e4	a400fb86b6f6489875fdf65079b765255e2240c30f174b1f9aff6a17dac 04bb108e21aaa1b3832e2ff483237559c02dda2ddfc03e2b56e7bc818614d0e4 074dcfd66274bec7d3ac3e23fd77d21baca17efa497eb94d748e46add97
sha256	05a6a94d66a8b222553c9210b4e370d02a6fffe8ee49be8142d75dd37c5c7fab	%\D282E1\1E80C5.lck %AppData%\D282E1\1E80C5.lck File Hashes 05a6a94d66a8b222553c9210b4e370d02a6fffe8ee49be8142d75dd37c5c7fab 0f11515c0a57068b0636a8a4283b8e25bf7c72fe55c486fc108a8cbf02b
sha256	05e73d8ba52f08aec1a2ef518882919038bafc5de2ed55d392b6ccea42ea2dd3	.exe %LocalAppData%\Temp\Nldp\colorcpl8pjxn.exe File Hashes 05e73d8ba52f08aec1a2ef518882919038bafc5de2ed55d392b6ccea42ea2dd3 09a45c4027bda13479438300bc335bce71d55867062c959c73ce5403ff0
sha256	074dcfd66274bec7d3ac3e23fd77d21baca17efa497eb94d748e46add97e8c27	08e21aaa1b3832e2ff483237559c02dda2ddfc03e2b56e7bc818614d0e4 074dcfd66274bec7d3ac3e23fd77d21baca17efa497eb94d748e46add97e8c27 07b31ec3eabb4967f7ed54d437de2d4a3e9271810f4f9c2b238bb6ba782
sha256	07b31ec3eabb4967f7ed54d437de2d4a3e9271810f4f9c2b238bb6ba7829f180	fd66274bec7d3ac3e23fd77d21baca17efa497eb94d748e46add97e8c27 07b31ec3eabb4967f7ed54d437de2d4a3e9271810f4f9c2b238bb6ba7829f180 0913592e52b43087d0f2a23700e5c625c0cdd4d391354233dc692a54774
sha256	07bef3ef1d45fe1bbc7c16f7e7ad211e1e81264cf9ef119232d10bfd2245e778	.hopto.org Files and or directories created N/A File Hashes 07bef3ef1d45fe1bbc7c16f7e7ad211e1e81264cf9ef119232d10bfd2245e778 2ae2fcade0f57faf7fbabbde56e60ad080df9011ed70dee957aa7fe13a9
sha256	0913592e52b43087d0f2a23700e5c625c0cdd4d391354233dc692a5477416ca9	ec3eabb4967f7ed54d437de2d4a3e9271810f4f9c2b238bb6ba7829f180 0913592e52b43087d0f2a23700e5c625c0cdd4d391354233dc692a5477416ca9 094e5d7bce863dcf7652873c15d18dfce918eca631c471bbe59f739fccb
sha256	094e5d7bce863dcf7652873c15d18dfce918eca631c471bbe59f739fccb770c8	92e52b43087d0f2a23700e5c625c0cdd4d391354233dc692a5477416ca9 094e5d7bce863dcf7652873c15d18dfce918eca631c471bbe59f739fccb770c8 09a7a2aeb1af80aa666c5920765e4409e367a051c161d948f1a193adbe5
sha256	09a45c4027bda13479438300bc335bce71d55867062c959c73ce5403ff00c612	d8ba52f08aec1a2ef518882919038bafc5de2ed55d392b6ccea42ea2dd3 09a45c4027bda13479438300bc335bce71d55867062c959c73ce5403ff00c612 0b23ebf80d0733874699afe7ce80553b6b4a61a1e624e1e07b623b51f78
sha256	09a7a2aeb1af80aa666c5920765e4409e367a051c161d948f1a193adbe5040a3	d7bce863dcf7652873c15d18dfce918eca631c471bbe59f739fccb770c8 09a7a2aeb1af80aa666c5920765e4409e367a051c161d948f1a193adbe5040a3 0e953857e78b91fa30011d345fccf6f86a8697318935b227d69ac4dd491
sha256	09ebe700700a0e5e49d994093786f6c1bc9d3c400edc94b31693ef5961250d81	3265ac921a904ba9a2a4e23bf86c18863bd020f1b50b4b1f85eafed66c4 09ebe700700a0e5e49d994093786f6c1bc9d3c400edc94b31693ef5961250d81 12e2ba4b4a310edf9cd97405541565e20d9ea6259d86d96a36fc8b676ba
sha256	0b23ebf80d0733874699afe7ce80553b6b4a61a1e624e1e07b623b51f7860691	c4027bda13479438300bc335bce71d55867062c959c73ce5403ff00c612 0b23ebf80d0733874699afe7ce80553b6b4a61a1e624e1e07b623b51f7860691 0d0f137cb556858c93f1997cbaca1be7cf6ef24cb727fae6a0c803960c5
sha256	0d0f137cb556858c93f1997cbaca1be7cf6ef24cb727fae6a0c803960c584eb0	bf80d0733874699afe7ce80553b6b4a61a1e624e1e07b623b51f7860691 0d0f137cb556858c93f1997cbaca1be7cf6ef24cb727fae6a0c803960c584eb0 14a68cb7a2930e6646657e26dd45fb5a78516756b7109ee12003bcdc822
sha256	0e953857e78b91fa30011d345fccf6f86a8697318935b227d69ac4dd4915889b	2aeb1af80aa666c5920765e4409e367a051c161d948f1a193adbe5040a3 0e953857e78b91fa30011d345fccf6f86a8697318935b227d69ac4dd4915889b 10173267784ffb1934d59ce8bd822f9f9260bbc7420eeafd0c8affa8a62
sha256	0f11515c0a57068b0636a8a4283b8e25bf7c72fe55c486fc108a8cbf02b50c41	94d66a8b222553c9210b4e370d02a6fffe8ee49be8142d75dd37c5c7fab 0f11515c0a57068b0636a8a4283b8e25bf7c72fe55c486fc108a8cbf02b50c41 16ae2ef60aad481f1a340a9e6e7421258a57e7cbba46d9dca8c1dc063a6
sha256	10173267784ffb1934d59ce8bd822f9f9260bbc7420eeafd0c8affa8a62e840b	857e78b91fa30011d345fccf6f86a8697318935b227d69ac4dd4915889b 10173267784ffb1934d59ce8bd822f9f9260bbc7420eeafd0c8affa8a62e840b 1323533b1caa1537b50c0ddb43b5f692901d2bb3b38f11e0fb380d72149
sha256	12e2ba4b4a310edf9cd97405541565e20d9ea6259d86d96a36fc8b676babb228	700700a0e5e49d994093786f6c1bc9d3c400edc94b31693ef5961250d81 12e2ba4b4a310edf9cd97405541565e20d9ea6259d86d96a36fc8b676babb228 14c4a3fd18cad81c55ff4aa192803b748d8810900602c89c26114eb80c9
sha256	1323533b1caa1537b50c0ddb43b5f692901d2bb3b38f11e0fb380d72149ef53d	267784ffb1934d59ce8bd822f9f9260bbc7420eeafd0c8affa8a62e840b 1323533b1caa1537b50c0ddb43b5f692901d2bb3b38f11e0fb380d72149ef53d 13aeccc984e1570bf36d8440df9b293277b25f26bb299179d187ac47b35
sha256	13aeccc984e1570bf36d8440df9b293277b25f26bb299179d187ac47b3500488	33b1caa1537b50c0ddb43b5f692901d2bb3b38f11e0fb380d72149ef53d 13aeccc984e1570bf36d8440df9b293277b25f26bb299179d187ac47b3500488 13fbdc096406f0f975d02a160448d98fd9d49d3ce7d338151668001017d
sha256	13fbdc096406f0f975d02a160448d98fd9d49d3ce7d338151668001017dbe397	cc984e1570bf36d8440df9b293277b25f26bb299179d187ac47b3500488 13fbdc096406f0f975d02a160448d98fd9d49d3ce7d338151668001017dbe397 144b7841ed6f8181b99e6be48533a77db7ec1183cd3700fecda0cfdc4b5
sha256	144b7841ed6f8181b99e6be48533a77db7ec1183cd3700fecda0cfdc4b5bf3bb	c096406f0f975d02a160448d98fd9d49d3ce7d338151668001017dbe397 144b7841ed6f8181b99e6be48533a77db7ec1183cd3700fecda0cfdc4b5bf3bb 1623edf8271a3a77d74658adcf67d5f99f6102bf178c0665dd68bc932b0
sha256	14a68cb7a2930e6646657e26dd45fb5a78516756b7109ee12003bcdc822ad9a6	37cb556858c93f1997cbaca1be7cf6ef24cb727fae6a0c803960c584eb0 14a68cb7a2930e6646657e26dd45fb5a78516756b7109ee12003bcdc822ad9a6 173fbe68a341e3ee14ae0d1b28668200573f48062621e76ca5dda051eff
sha256	14c4a3fd18cad81c55ff4aa192803b748d8810900602c89c26114eb80c9db988	a4b4a310edf9cd97405541565e20d9ea6259d86d96a36fc8b676babb228 14c4a3fd18cad81c55ff4aa192803b748d8810900602c89c26114eb80c9db988 21d006b8f12a6b2e3126f3a6cef4f621c314a9dc21be6ffe51950f816f6
sha256	1623edf8271a3a77d74658adcf67d5f99f6102bf178c0665dd68bc932b0c1228	841ed6f8181b99e6be48533a77db7ec1183cd3700fecda0cfdc4b5bf3bb 1623edf8271a3a77d74658adcf67d5f99f6102bf178c0665dd68bc932b0c1228 192f60438d4707d0edb60c2ab1b69df72943b7812bd77bb393182db0636
sha256	16ae2ef60aad481f1a340a9e6e7421258a57e7cbba46d9dca8c1dc063a699ef3	15c0a57068b0636a8a4283b8e25bf7c72fe55c486fc108a8cbf02b50c41 16ae2ef60aad481f1a340a9e6e7421258a57e7cbba46d9dca8c1dc063a699ef3 19c97ae2501ccebf5e2e4e5f88d3323141aeca73e9016d69eacc11f79fd
sha256	173fbe68a341e3ee14ae0d1b28668200573f48062621e76ca5dda051effd4e05	cb7a2930e6646657e26dd45fb5a78516756b7109ee12003bcdc822ad9a6 173fbe68a341e3ee14ae0d1b28668200573f48062621e76ca5dda051effd4e05 17fec1525d222eee566d9659723e31758615f38f11737f92e553bcbd1e3
sha256	17fec1525d222eee566d9659723e31758615f38f11737f92e553bcbd1e38536b	e68a341e3ee14ae0d1b28668200573f48062621e76ca5dda051effd4e05 17fec1525d222eee566d9659723e31758615f38f11737f92e553bcbd1e38536b 1bd6c972c2e3d832da416d007c99a29c262eae2e8f33fe01a8a21e28351
sha256	192f60438d4707d0edb60c2ab1b69df72943b7812bd77bb393182db0636be982	df8271a3a77d74658adcf67d5f99f6102bf178c0665dd68bc932b0c1228 192f60438d4707d0edb60c2ab1b69df72943b7812bd77bb393182db0636be982 1a6c169c82fd99a1b607100c42cae0c39f964ea2dbe6e0216479171d479
sha256	19c97ae2501ccebf5e2e4e5f88d3323141aeca73e9016d69eacc11f79fd4e803	ef60aad481f1a340a9e6e7421258a57e7cbba46d9dca8c1dc063a699ef3 19c97ae2501ccebf5e2e4e5f88d3323141aeca73e9016d69eacc11f79fd4e803 1d8cda39dcf193f04d41ca364e038ddf7ae51ff5cabc56c687a38c41773
sha256	1a6c169c82fd99a1b607100c42cae0c39f964ea2dbe6e0216479171d479275df	0438d4707d0edb60c2ab1b69df72943b7812bd77bb393182db0636be982 1a6c169c82fd99a1b607100c42cae0c39f964ea2dbe6e0216479171d479275df 297ce1753eb30ecc82b016aac7ab694eb0bd4ded06fdecc5cd42a2464e4
sha256	1bd6c972c2e3d832da416d007c99a29c262eae2e8f33fe01a8a21e28351e35cb	1525d222eee566d9659723e31758615f38f11737f92e553bcbd1e38536b 1bd6c972c2e3d832da416d007c99a29c262eae2e8f33fe01a8a21e28351e35cb 23387c5a36e1238a0c7d0c2d5e085104633c5d241b640ce5c0c141298e6
sha256	1d8cda39dcf193f04d41ca364e038ddf7ae51ff5cabc56c687a38c41773b5d95	ae2501ccebf5e2e4e5f88d3323141aeca73e9016d69eacc11f79fd4e803 1d8cda39dcf193f04d41ca364e038ddf7ae51ff5cabc56c687a38c41773b5d95 2ec87871a0a83639fc814ab764d69147f2dccc13cdcd6dd6af4a9aaaebd
sha256	21d006b8f12a6b2e3126f3a6cef4f621c314a9dc21be6ffe51950f816f6a88c9	3fd18cad81c55ff4aa192803b748d8810900602c89c26114eb80c9db988 21d006b8f12a6b2e3126f3a6cef4f621c314a9dc21be6ffe51950f816f6a88c9 306d1f5e2b8292344d86d611dff2704920fa44ddd6fdc0b67a3e7e0f34d
sha256	23387c5a36e1238a0c7d0c2d5e085104633c5d241b640ce5c0c141298e690bb6	972c2e3d832da416d007c99a29c262eae2e8f33fe01a8a21e28351e35cb 23387c5a36e1238a0c7d0c2d5e085104633c5d241b640ce5c0c141298e690bb6 253a4ae4cbf315b3b22bb9c17dc10c56ebeb81a9b5b9f7914f6fa5fd427
sha256	253a4ae4cbf315b3b22bb9c17dc10c56ebeb81a9b5b9f7914f6fa5fd427b5f06	c5a36e1238a0c7d0c2d5e085104633c5d241b640ce5c0c141298e690bb6 253a4ae4cbf315b3b22bb9c17dc10c56ebeb81a9b5b9f7914f6fa5fd427b5f06 28ba614d48c8193e3281dd382b2e20572ec74dd1f3566aa587f8b4f3e24
sha256	28ba614d48c8193e3281dd382b2e20572ec74dd1f3566aa587f8b4f3e245a7a0	ae4cbf315b3b22bb9c17dc10c56ebeb81a9b5b9f7914f6fa5fd427b5f06 28ba614d48c8193e3281dd382b2e20572ec74dd1f3566aa587f8b4f3e245a7a0 2b2ef2273c974fb2645c6f89780f227f9361f3d70ea7c016ce04cb9723d
sha256	297ce1753eb30ecc82b016aac7ab694eb0bd4ded06fdecc5cd42a2464e4831db	69c82fd99a1b607100c42cae0c39f964ea2dbe6e0216479171d479275df 297ce1753eb30ecc82b016aac7ab694eb0bd4ded06fdecc5cd42a2464e4831db 2a0d2df8c466bbe5bf538e9745286f124f3ca426d3ece80fbb675863281

Threat Roundup for June 22

Indicators of compromiseauto-extracted · verify before use · export allAll →

Threats

Win.Trojan.Remcos-6591502-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Separ-6591487-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Tspy-6591475-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Jaik-6591471-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Delf-6591417-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Ursu-6591377-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys