Cisco Talospublished Oct 5, 16:23 UTC (Oct 5, 2018)ingested Sep 10, 06:19 UTC

Threat Roundup Sept 28

highRansomwareimportance 57

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article1,061 words · extracted from blog.talosintelligence.com · click to collapse

Friday, October 5, 2018 12:23

Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Sept. 28 and Oct. 5. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this roundup are:

Win.Malware.Gandcrab-6706045-0
Malware
Gandcrab is ransomware that encrypts documents, photos, databases and other important files using the file extension ".GDCB", ".CRAB" or ".KRAB". Gandcrab is spread through both traditional spam campaigns, as well as multiple exploit kits, including Rig and Grandsoft.
Xls.Downloader.Valyria-6704496-0
Downloader
These variants of Valyria are malicious Excel files that contain embedded VBA macros used to distribute other malware.
Win.Dropper.Fqdq-6705253-0
Dropper
This dropper attempts to access the Firefox Password Manager local database, uses a temporary batch file to perform additional malicious activities and uploads files to remote servers. Additionally, it might inject code, read INI files or use Visual Basic scripts.
Win.Malware.Genkryptik-6704925-0
Malware
Win.Malware.Genkryptik is oftentimes a generic detection name for a Windows trojan. Some of the malicious activities that could be performed by these samples, without the user's knowledge, include: collecting system information, downloading and uploading files and dropping additional samples.
Win.Malware.Zusy-6704537-0
Malware
Zusy is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" and "winver.exe". The malware attempts to trick the user into entering their login information whenever they visit a financial services website.
Win.Malware.Razy-6703914-0
Malware
Razy is oftentimes a generic detection name for a Windows trojan. They collect sensitive information from the infected host and encrypt the data, and send it to a command and control (C2) server. Information collected might include screenshots. The samples modify auto-execute functionality by setting/creating a value in the registry for persistence.
Doc.Malware.Emooodldr-6699885-0
Malware
These malicious Word documents contain embedded VBA macros, spawn new processes, drops files and remove Office resiliency keys.

Threats

Win.Malware.Gandcrab-6706045-0

Indicators of Compromise
Registry Keys

<HKCR>\LOCAL SETTINGS\MUICACHE\3E\52C64B7E
Value Name: LanguageList
<HKCU>\CONTROL PANEL\DESKTOP
Value Name: Wallpaper Mutexes
Global\8B5BAAB9E36E4507C5F5.lock
Global\XlAKFoxSKGOfSGOoSFOOFNOLPE IP Addresses contacted by malware. Does not indicate maliciousness.
50[.]63[.]202[.]89
93[.]125[.]99[.]121
137[.]74[.]238[.]33
94[.]231[.]109[.]239
185[.]135[.]88[.]105
146[.]66[.]72[.]87
87[.]236[.]16[.]31
217[.]160[.]0[.]234
69[.]73[.]180[.]151
104[.]31[.]77[.]95
171[.]244[.]34[.]167
217[.]174[.]149[.]130
70[.]40[.]197[.]96
223[.]26[.]62[.]72
80[.]77[.]123[.]23
178[.]238[.]37[.]162
51[.]68[.]50[.]168
104[.]28[.]30[.]160
67[.]227[.]236[.]96
66[.]96[.]147[.]67
179[.]188[.]11[.]34
89[.]252[.]187[.]72
194[.]58[.]56[.]95
104[.]28[.]28[.]142
104[.]27[.]163[.]241
213[.]186[.]33[.]186
107[.]178[.]113[.]162
87[.]236[.]16[.]29
188[.]165[.]53[.]185
173[.]247[.]242[.]133
77[.]104[.]144[.]25
191[.]252[.]51[.]37
202[.]43[.]45[.]181
192[.]163[.]234[.]40
217[.]160[.]0[.]27
209[.]182[.]208[.]245
94[.]73[.]148[.]18
45[.]33[.]91[.]79
87[.]236[.]19[.]135
52[.]29[.]192[.]136
178[.]33[.]233[.]202
92[.]53[.]96[.]201
186[.]202[.]153[.]158
104[.]24[.]104[.]13
213[.]186[.]33[.]3
188[.]64[.]184[.]90
95[.]213[.]173[.]173
103[.]107[.]17[.]102
103[.]27[.]238[.]31
50[.]87[.]58[.]165
104[.]27[.]186[.]113
104[.]24[.]102[.]153
77[.]104[.]171[.]238
194[.]154[.]192[.]67
87[.]236[.]16[.]41 Domain Names contacted by malware. Does not indicate maliciousness.
www[.]litespeedtech[.]com
big-game-fishing-croatia[.]hr
www[.]lagouttedelixir[.]com
dreamhost[.]com
www[.]himmerlandgolf[.]dk
hanaglobalholding[.]com
top-22[.]ru
zaeba[.]co[.]uk
ispsystem[.]com
unnatimotors[.]in
www[.]macartegrise[.]eu
blokefeed[.]club
bellytobabyphotographyseattle[.]com
diadelorgasmo[.]cl
www[.]bgfc[.]hr
www[.]wash-wear[.]com
yourmine[.]ru
www[.]reg[.]ru
www[.]poketeg[.]com
boatshowradio[.]com
www[.]perfectfunnelblueprint[.]com
perovaphoto[.]ru
www[.]cakav[.]hu
www[.]billerimpex[.]com
evotech[.]lu
www[.]ismcrossconnect[.]com
help[.]dreamhost[.]com
www[.]fabbfoundation[.]gm
alem[.]be
cevent[.]net
mauricionacif[.]com
smbardoli[.]org
www[.]aco[.]dk
cyclevegas[.]com
lucides[.]co[.]uk
krasnaypolyana123[.]ru
hoteltravel2018[.]com
oceanlinen[.]com
6chen[.]cn
koloritplus[.]ru
asl-company[.]ru
www[.]krishnagrp[.]com
test[.]theveeview[.]com
cdnjs[.]cloudflare[.]com
picusglancus[.]pl
bloghalm[.]eu
api[.]w[.]org
nesten[.]dk
simetribilisim[.]com
pp-panda74[.]ru
wpakademi[.]com
dna-cp[.]com
h5s[.]vn
bethel[.]com[.]ve
vjccons[.]com[.]vn
www[.]rment[.]in
marketisleri[.]com
www[.]byggekvalitet[.]dk
royal[.]by
gmpg[.]org
sherouk[.]com
tommarmores[.]com[.]br
graftedinn[.]us
www[.]mimid[.]cz
maxcdn[.]bootstrapcdn[.]com
panel[.]dreamhost[.]com
relectrica[.]com[.]mx
acbt[.]fr
damt7w3yoa0t2[.]cloudfront[.]net
topstockexpert[.]su
goodapd[.]website
www[.]n2plus[.]co[.]th
aurumwedding[.]ru
devdev[.]com[.]br
www[.]toflyaviacao[.]com[.]br
mimid[.]cz
nhs-foi[.]com
www[.]iyfipgun[.]com
wash-wear[.]com Files and or directories created
%AppData%\Microsoft\Internet Explorer\UserData\MA3SBLRS\spid[1].xml
%UserProfile%\Videos\98b689db98b68e303c.lock
%UserProfile%\Start Menu\98b689db98b68e303c.lock
%UserProfile%\Start Menu\SGMNP-DECRYPT.txt
%UserProfile%\Videos\Sample Videos\98b689db98b68e303c.lock
%UserProfile%\Videos\Sample Videos\SGMNP-DECRYPT.txt
\??\E:\$RECYCLE.BIN\S-1-5-21-2580483871-590521980-3826313501-500\98b689db98b68e303c.lock
\??\E:\$RECYCLE.BIN\S-1-5-21-2580483871-590521980-3826313501-500\SGMNP-DECRYPT.txt
\??\E:\$RECYCLE.BIN\SGMNP-DECRYPT.txt
\??\E:\98b689db98b68e303c.lock
\??\E:\SGMNP-DECRYPT.txt
\MSOCache\SGMNP-DECRYPT.txt
\PerfLogs\Admin\SGMNP-DECRYPT.txt
\PerfLogs\SGMNP-DECRYPT.txt
\Recovery\926583e2-ef64-11e4-beed-d6738078ad98\SGMNP-DECRYPT.txt
\Recovery\SGMNP-DECRYPT.txt
\SGMNP-DECRYPT.txt
\TEMP\SGMNP-DECRYPT.txt
%UserProfile%\Videos\SGMNP-DECRYPT.txt File Hashes
211484d0deda5cb97b16b27538b7d1d2c26af6ae3aac3c888085a0e8ddf2d8bd
46b702851cb5c1df0a97d1ae9e3202316d36ef2195395a9bcc3699dd1d247733
4e2ba4638d01c1473f0959fae6d31636456cde0ab995fa5f3fad1efc2cb7bf0e
69fd1808c32fe3209f384fba8f79df13bec479e9b081f7edcf8720f6257f7dfe
8b5c1735800d8ad69b535a863f4ae1941604b3e57261961e230a26b16b4b98ec
9ec54c9d6ec39c34c8e011fcb10fb2ae5334d1d0632e63a61d94b36b9f9c8a9b
c394e7fa3604f5ee26419a913dbfeb0988d59bbf8ed25d852ebf62a48cc1688a
c4a126172b27777413ee4efcd0ce8656fbef52e81c984993af3fa63d5264cc8e
d81aa5dbd9272f9be6e4a0def514a9284220d88f219ac6fd908ab2c942b92cdc
d9129786346cfa0aa07a1c82d4bcb79a977c7c8e1a052916a34b6cde4c09c006
e41697a99da83a32bf8a56f993123fbfaef378d5e6f61286a272536fe10b6d35
e50a28068fcae51a609946fad1637a5dbfbda8add88063ddb117cb8e0cfc4a74
e8502aa65a4da371c0e378b245374af7340b809140a5d2e3bc3bfa67a92a2bde
eb9347f0fbbb675ecc61beb1f2be8721871e203357b124ad9858037a641709f5
f77825b0388a6220521219030ad70bdb6fcd3216a590d092ec4aa22a506a17b6

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Xls.Downloader.Valyria-6704496-0

Indicators of Compromise
Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value Name: UNCAsIntranet
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
Value Name: AutoDetect
<HKCU>\SOFTWARE\MICROSOFT\WISP\MULTITOUCH
Value Name: MultiTouchEnabled
<HKCU>\SOFTWARE\MICROSOFT\WISP\PEN\PERSIST\0\1
Value Name: HidCursorName
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND
Value Name: DeleteFlag
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND
Value Name: Start Mutexes
Local\10MU_ACB10_S-1-5-5-0-57527
Local\10MU_ACBPIDS_S-1-5-5-0-57527
Global\316D1C7871E00
{773F1B9A-35B9-4E95-83A0-A210F2DE3B37}-Default IP Addresses contacted by malware. Does not indicate maliciousness.
78[.]47[.]139[.]102
107[.]180[.]25[.]0
103[.]110[.]91[.]118
89[.]163[.]224[.]250
199[.]249[.]223[.]62
185[.]220[.]101[.]12
89[.]27[.]96[.]42
208[.]113[.]131[.]196 Domain Names contacted by malware. Does not indicate maliciousness.
dallasmediationlawyer[.]com
myexternalip[.]com Files and or directories created
%LocalAppData%\Temp\character.exe
%AppData%\mssert\chasactes.exe
%LocalAppData%\Temp\const_cast.bat
%LocalAppData%\Temp\whzxixx5.jdj.ps1
%LocalAppData%\Temp\xgxfy2dc.eju.psm1
%LocalAppData%\Temp\21iyllij.ncz.psm1
%LocalAppData%\Temp\erifm5li.lo3.ps1
%LocalAppData%\Temp\wmez5d0g.r0g.ps1
%LocalAppData%\Temp\gs0jrz4i.yd2.psm1
%LocalAppData%\Temp\qgh0kqvv.ce5.ps1
%LocalAppData%\Temp\tkzdlipn.odo.psm1 File Hashes
0276895b76757b5b2726c1c2fbb50d98040dc2dc46aedff1e5b9709f168b4a8d
0f792637a859a3c2919e1e45a9500e1bdf2b5f4e07bfc4d8b5e24cf7c8003e5e
1114fd2ee387df04c4e7ed0bb6d088b220e893c8a1ee07386977c7369681e5d3
1c2f39f6a608c70b16a79ed4cfb228c412852caac8a8b8bafc4e0819d038aa2c
2ca6d57dcfacd0f59f8b390ccbf138b557b8e95a157a53de6fe864c5eafbcf80
4682a95f9ed32657ee61b7aec758ab6bbdc17a52e2812e1372b3b2a9776cadc1
655f60c338658334723310c79033b26daa207b61fd89ebaf4abbed93802c65be
672aac7a017a8417608dfe687fa4023fdd1e90a7d77f6e1d9b035a070c9d9c40
6ff12e83f44e19de6515c03108fccfd98abd3a70bbab1088171954a3c6113d3b
a407d2cfb849a1822895fb5770db7c24b707422da3a193e7d8f5d9e39bfb3896
ccbac43307cd046f896283deac0341351b5dc83e6be5cb2292a0c28cdfd34650
dafd70b7b82551b0feb905f8d466d2b02784ce6e5d5c2b8d6d00e82b27487ae0
dbf3533e970aacc291d0342289943605537407df18217182ca39d52a8c9f8970

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Dropper.Fqdq-6705253-0

Indicators of Compromise
Registry Keys

<HKCR>\LOCAL SETTINGS\MUICACHE\3E\52C64B7E
Value Name: LanguageList
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
Value Name: PnpInstanceID Mutexes
3749282D282E1E80C56CAE5A IP Addresses contacted by malware. Does not indicate maliciousness.
N/A Domain Names contacted by malware. Does not indicate maliciousness.
baxishop[.]ro Files and or directories created
%AppData%\D282E1\1E80C5.lck
%AllUsersProfile%\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol
\PC*\MAILSLOT\NET\NETLOGON
\lsass
%AppData%\D282E1
\samr File Hashes
030290f026a913226735bc017a37997180f130b9ce1fdc3b990e050aea4bc39e
07abd686b7cda16b61c65d82cb72f464e2ea31bb8bb165f01bbcfa693f1bd22a
1258790e008879340d7cd8e6b303e25183345a05d81b6583164f0a690323405b
12963b31f9719d9333f6cbdb46426c32179bba4a31976b094d192588eb4439ff
2627bd09fd4886f83a7ca589518523606b581ad026968f3d013e1cfb221f7811
2c18a46ea35314f065b21e151d37787cfa5b7696207226ca80f7732176659ee9
30a901d40309ac1e42e98ad59044e1e1f97f985ca397628e8f0deb8f67f39d1f
31ef4c98208464b43dd337b92cba0cfa05d0924ebc732e0b1ee88120495f503c
34f159a5b3ee64cbe520c18e9abd66be61b583dad385bbec9cadf054942827da
35c1410cfb084bb4f4ef5a7c3d92c7b78ddd33849864e41f22e09f5b1c3997b2
3a69eddc3ab09e947703dbfd7e279e9e6e867190c9f72f395833fe94a1b6903a
4688f04b2498695705ea718ba724e9f0c04d92d09d75505f7fa1b1ad19bfe795
4e79a2473921ee6132c3e73f9b4de0395ec350cb476981cf2cb19171034f9405
56979370107aeffca2fa5ad915f454e33ced1a5c6518dbc01ed15689b92e83dd
582f2175b65814e7558fca9ebc7e1a6f97402ce3079f43ece47fdc17c3f7324e
5f83ff3b7d094547fd00dacabe669e389bdd04af09dcbc7790f29a63f797a00f
6448bc9787a96f76cc6716294a204df6d1cbd6db9cc441abc78b31161529e00f
7a2868174590c11d2f95794260792700a1fd567b5315702decfd1cd6611ed0d5
8b7a4bc0f2ea0f3e54b0cea9fa2928ddd0a85aa80a64071985cf95301c0d5ac3
9030a6efd1e15d5e78b727700863ab45b667a7c532761b3a148aa222f7e17b87
946de8d2685ded47c74e4b7c9490e8961598462a87be7ca5bef22693745f7cfa
951860ee7f7283a3b238cbfdb6e161c09fcb6a2b7975bb142412c442fd2590fd
95b99dd7dd7814724287c89e2435aa65cc82e91c5aabd453be1a0532d50bd936
96397b26ba4ee4244704c2cadd71c3d3d4c12e988f6de1d695f3602432bd94b3
9c5acd9297928707ed7e472e9316b125b55b2cd98870aaa4b4630dcd0fece734

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Malware.Genkryptik-6704925-0

Indicators of Compromise
Registry Keys

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
Value Name: DhcpNameServer
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}
Value Name: DhcpNameServer Mutexes
!IECompat!Mutex
!PrivacIE!SharedMem!Mutex
Local\VERMGMTBlockListFileMutex
Local\!BrowserEmulation!SharedMemory!Mutex
Local\URLBLOCK_DOWNLOAD_MUTEX
Local\URLBLOCK_HASHFILESWITCH_MUTEX
{5312EE61-79E3-4A24-BFE1-132B85B23C3A}
{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}
IsoScope_1e0_ConnHashTable<480>_HashTable_Mutex
IsoScope_1e0_IESQMMUTEX_0_303
IsoScope_1e0_IESQMMUTEX_0_331
IsoScope_1e0_IESQMMUTEX_0_274
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_480
IsoScope_708_ConnHashTable<1800>_HashTable_Mutex
IsoScope_708_IESQMMUTEX_0_303
IsoScope_708_IESQMMUTEX_0_331
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1800
IsoScope_708_IESQMMUTEX_0_274
IsoScope_4b4_IESQMMUTEX_0_274
IsoScope_f8_IESQMMUTEX_0_274
IsoScope_20c_ConnHashTable<524>_HashTable_Mutex
IsoScope_20c_IESQMMUTEX_0_303
IsoScope_20c_IESQMMUTEX_0_331
IsoScope_4b4_ConnHashTable<1204>_HashTable_Mutex
IsoScope_4b4_IESQMMUTEX_0_303
IsoScope_4b4_IESQMMUTEX_0_331
IsoScope_20c_IESQMMUTEX_0_274
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_524
IsoScope_f8_ConnHashTable<248>_HashTable_Mutex
IsoScope_f8_IESQMMUTEX_0_303
IsoScope_f8_IESQMMUTEX_0_331
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_248
IsoScope_6e4_IESQMMUTEX_0_274
IsoScope_6e4_ConnHashTable<1764>_HashTable_Mutex
IsoScope_6e4_IESQMMUTEX_0_303
IsoScope_6e4_IESQMMUTEX_0_331
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1764
IsoScope_4e8_IESQMMUTEX_0_274
IsoScope_4e8_ConnHashTable<1256>_HashTable_Mutex
IsoScope_4e8_IESQMMUTEX_0_303
IsoScope_4e8_IESQMMUTEX_0_331
Local\URLBLOCK_FILEMAPSWITCH_MUTEX_1256 IP Addresses contacted by malware. Does not indicate maliciousness
13[.]107[.]21[.]200 Domain Names contacted by malware. Does not indicate maliciousness
ryiwuehwskosuqhs[.]com
goldenmemb[.]website
dolikulooospo[.]fun Files and or directories created
%LocalAppData%Low\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
%LocalAppData%\Microsoft\Windows\WebCache\V01tmp.log
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\dnserror[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\httpErrorPagesScripts[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\errorPageStrings[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\httpErrorPagesScripts[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\NewErrorPageTemplate[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\errorPageStrings[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\NewErrorPageTemplate[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\dnserror[1]
%LocalAppData%\Microsoft\Windows\WebCache\V010000F.log
%LocalAppData%\Temp\~DF4B1ABF6D6A9DC6E3.TMP
%LocalAppData%\Temp\~DF88BBAB8557CDD7E3.TMP
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\errorPageStrings[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\suggestions[2].en-US
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\NewErrorPageTemplate[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\dnserror[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\favicon[2].ico
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\favicon[1].png
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\favicon[2].png
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\views[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\favicon[1].ico
%LocalAppData%\Temp\~DFDEB0FC636A1346E9.TMP
%LocalAppData%\Temp\~DFEBFBFB87C6F7EC1B.TMP
%LocalAppData%\Temp\~DFFC172A87F8554CB4.TMP
%LocalAppData%\Temp\~DF81A97BC70E347BD0.TMP
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\httpErrorPagesScripts[1]
%LocalAppData%\Temp\~DF8AA772D245BBB59D.TMP
%LocalAppData%\Temp\~DF90B11BDCE6092786.TMP
%LocalAppData%\Temp\~DF9FFAF3D7E7318657.TMP
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\1NSKV6K6\NewErrorPageTemplate[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\7V3XNPL2\httpErrorPagesScripts[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\NewErrorPageTemplate[2]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\dnserror[2]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\errorPageStrings[1]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\errorPageStrings[2]
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\httpErrorPagesScripts[2]
%LocalAppData%\Temp\~DF5DDD3B43947F7CEA.TMP
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\6YL4T24G\dnserror[1]
%LocalAppData%\Temp\~DFB15BBE1A2AFF7D7E.TMP
%LocalAppData%\Temp\~DF1D30A03829232972.TMP
%LocalAppData%\Temp\~DF38E2C66D6383AD19.TMP
%LocalAppData%\Temp\~DFCE77235CFE7E5202.TMP File Hashes
060707050140235807d6e6ac6933fa26cf0c230d68f574b880e99a699bdf506a
088a6e8da14dbeab941702b1515b85486544dffc83885112b95997257f8d32d5
0dfc771e0fbdf05facc54643341dfce97b745efe13867b01049bc977624d14b2
0e21eb1c5f15689329bc6d46d78eb7d0f4eccc6fb8da4f41d17e6205ae7a847b
0f71ba5f0fbba5d9810a4f816c5ebe1d545c4c65b34c180c769c2cd3467b0737
130649d3f09197d1c2e895cc06fd9ecd6feb2e663562a6b99d95ae4ce66eddb8
139ac3f5d2e5351c0edcd0edb384d0a75e482e8007724f181c7a4204f5895ad9
13c3313b910f18431ea183b00632deacd266561a73bcf837f4b46f1f73b31bcd
24b6c693551ed33b55d7ce6baae96dcca9e3cb55e9b94637d5ba59edc109d402
27cec90ae8c84a79dd2ebb2928152bdea1b07cab3b2f1ad98ed8fb3f17cc339b
28b54e5cf1be89766c177bc7f4c8692abec0bb4bdf299a59709d10120f7bc205
29b845365404070e98840dcd74eb3c23919b0990b14bd0905b0921220f8b4bb9
2c3fad4307c0739c336e50ec670b61d00029d2a2be260676419f883835ce8818
337ad107eb3e1fc497af4b3f6006e12ae74a55d6535f28a67c9b231807e15f24
3394d5ec6ba4c548289008cbfea8238318af52d51e8e2110b5060635425db74c
378a4e27208c7fee9c7ac33d11d8872db902fe5242aceabba11343bf11a95155
3a136b2b6df645c3e6b3c0febb821a5dda5bcb4bd35f674fb33aa10684b58004
3c4e171d1f0b29b6f40f8bdf6af0c1161b092591c453c66734f4c6f54a0ac36f
3ec415b8f411c2004892c7dedcd25e4683d0f0fded754c8b9a0f784f087dddcf
420c05993a014331992918e89dda914851c0e31a2e196446309e3da07dc0c31a
43d9e51c98400b09bc499f0e2857e2b797254167c29c9d2234f6506d7cf7f98e
4ae9179659e2ba267b87478ea0f48c6c1caba252b4d2bcdfdc4b6ba873028d87
542b5b23123a0a71d79181adeda4edfff6b91cdaf0068aafc55ee03bdc928ab5
5bbc6d14ed5d408d0c7bb115853dff092c236517223c14b92c709a7ffa2c5742
5cc63a68be8b7ea9feca940e7b038ebca417f421a0b70c17d3e6ebfca4212e16

Coverage

Screenshots of DetectionAMP

ThreatGrid

Umbrella

Win.Malware.Zusy-6704537-0

Indicators of Compromise
Registry Keys

<HKCR>\LOCAL SETTINGS\MUICACHE\3E\52C64B7E
Value Name: LanguageList
<HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972-E325-11CE-BFC1-08002BE10318}\{9EB90D23-C5F9-4104-85A8-47DD7F6C4070}\CONNECTION
Value Name: PnpInstanceID
<HKCU>\Software\Microsoft\RAS AutoDial Mutexes
DBWinMutex
NtHack IP Addresses contacted by malware. Does not indicate maliciousness
139[.]196[.]204[.]190 Domain Names contacted by malware. Does not indicate maliciousness
www[.]bilibili[.]com
wpa[.]qq[.]com
bbs[.]nt47[.]com
www[.]nt47[.]com Files and or directories created
N/A File Hashes
00b657fa1270930f868fcd06c38af4b1514baa727c0db576e50340cc2f1c49dc
0f6f850198e9afb8ddfe5552dad5ae6151c3cdf41f5ed8964a1e46ce62ea0d2b
1bf8402a3da8797a130c528ff38fcca42403a5e878943d8dbaec420433c55edf
2c0996f013b00833a28d1612acc545a66264b613e7127738ccf3536ddb04501c
41cd6b708c56e1bad9b185ab09de02efd1f57d7c6691a9910d00b18489e59ec7
4733b5c290c00ca10bc72c248d6a014c6bf5fe21b92592b941cfdd8ac6870610
55099d0d5b7f5f677e431ebaf4c9a71877ab7b10887cb027ac78540ba1631779
680e98f78b16e05b2f55e1432f8553341cfd02ece47cedca652a04e1f4c901cf
6f496ef1284e79d93693374672e416d46b55c6590f8ab7737303b12f7316c2dd
9085e78cbbf63b30c42a4801cee1b67fa41f4c4308d0f163c3d39d7f76c00bf8
98e0df2e9cf8ba02d05cdc1bdea0cccc861855197f2a009f4a8fed152770b499
c19b9d8770e3619d832401aa7bc385bbf7e239d0397febbb441621efbb539f72
cca199364abfb50ec1dd467035fd2c637056abac9f8351393111dcdce8243e38
d346a3d9a4be88b2e6fe2b78b391efa47d4de3c9acb23aeb31c0b0e1868d9817
da9e5e6a5379284ca1b4e9be680bbecdcbca2378d8d8ae9e76e5601ba4fd9dcc
eba22d087a40a79daa58a95e6337f53cf98885400019ad9e8417bb4ce2f2c8ea

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Malware.Razy-6703914-0

Indicators of Compromise
Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: internat.exe
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: system
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{4LW407K6-M06A-64Y6-80K0-13CK6KK8U041}
Value Name: StubPath Mutexes
- IP Addresses contacted by malware. Does not indicate maliciousness
217[.]12[.]210[.]23
82[.]205[.]63[.]221 Domain Names contacted by malware. Does not indicate maliciousness
extreme33[.]dns1[.]us
mdformo[.]ddns[.]net
mdformo1[.]ddns[.]net Files and or directories created
N/A File Hashes
00e3f5ffeb38495cefce0f1c9522743764adf1ee6ce51b91c9c4726726562a12
01a7bdfdc6502db6bd237fcbc64596d8f76052e942c2c87e897f1ae786b7cac2
02c5fa1012b9cf0d46801cadcc4fe6814b4f75d50104e948031d00ff3ca7b93c
035f91568ca2bad43ce3fde98a2ae0418821e5f558c62b919c786c3b07bc0fe2
03970d185025e7e226c704b5bcd13de89730677345d3d57081d07895966567d4
052862be7afd84bbd167be8b83918d828608b35e1423600571747e67e66dbd16
055865fb005e3969e6d9e7feba2e81a8bedbe3048bf2a9cd3a9fbfe8ea6076e5
063e213ee0ecae95132a3cea557203b782de3c63b753fbd405ed670e83fbf573
07912d5cd0bf4ef89355a76c1fc36497e90333111b127dcf07d76cbc8ab76838
081fbe8f1c01676f9765ff7742b5d348433e2fd073136355100fe9f054140e6a
08627d7fbb6313bcdd42ac88152b71f4700dadf0446fb985b269c614bdd3f9af
08c257d2e5938dc6539b463ba0689982b79c112c8ad0aaf1be247726622ea487
092b86ef5f0e69ac5e1d554304189d289f27534fa4c7835ad4137f380a25979b
09c9b81d40f3c97876eaad0f29d7e9694c58c9a9cc4dc38b167611ecfbda3d75
0a032738a8ffc58b6cdce62ef209b247e008f597b6955d87da71e1654da970ef
0a77d603959b51f81cd2b3b27342be0fa4248586ba0121779f1a9959fd701d11
0aa93c8240a9c593d6a8d5c226d4f0b7ac033cef70b39524281c52d92a97fb0a
0afde5386ca8587bca67577727f02c3e71b883b7b5fc72e25a0d542f6c5819c8
0d794619980f35738bd57712d170542d6d8ff58248d21529754a0881c0b139a4
0f4fc18209bbb1d979cb504b807142e1a24aa8ee831e33ce8825a5bd350096fa
0ffca4c710e5af160e813f686181131c963123caaeeea9762f86296822b8c883
10427e9a0ee1b4e3d349d61839e1f09cb86b2a68d23e41933127dd5ce2da0134
1343648c8b4748294191cfdca4b4881a57cee96db4051530c514e7c56e1152e3
1495bb27a646d27162b28bce50ebf25abc5182e7417ced315f1b93060f7e99a0
17983b493cd46b604ef3846516da1cda1628ec855b896be8b54a9558ae83058c

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Doc.Malware.Emooodldr-6699885-0

Indicators of Compromise
Registry Keys

<HKCR>\LOCAL SETTINGS\MUICACHE\3E\52C64B7E
Value Name: LanguageList
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PRINT\PRINTERS\Canon PIXMA MG2520\PrinterDriverData Mutexes
Global\552FFA80-3393-423d-8671-7BA046BB5906
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
Global\PowerShell_CommandAnalysis_Lock_S-1-5-21-2580483871-590521980-3826313501-500
Global\MTX_MSO_AdHoc1_S-1-5-21-2580483871-590521980-3826313501-500
Global\MTX_MSO_Formal1_S-1-5-21-2580483871-590521980-3826313501-500
Local\10MU_ACB10_S-1-5-5-0-57527
Local\10MU_ACBPIDS_S-1-5-5-0-57527
Local\WinSpl64To32Mutex_e162_0_3000
Local\MSCTF.Asm.MutexDefault1 IP Addresses contacted by malware. Does not indicate maliciousness.
N/A Domain Names contacted by malware. Does not indicate maliciousness.
q0fpkblizxfe1l[.]com Files and or directories created
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B106E8EE-597B-49CA-A6A4-5BA8ABCC8F6A}.tmp
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{43E9ADDD-30D5-47E4-98B0-7E3A5536CACC}.tmp
%UserProfile%\Documents\20180928
%UserProfile%\924.exe
%SystemDrive%\TEMP\~$8241024f69edc258237f01170ea088fd5064c5908267e943f97bc9e2a6ea1d.doc
%LocalAppData%\Temp\CVR41E8.tmp
%LocalAppData%\Temp\~DFD053DCDB50AFFE51.TMP
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{0EF83731-611B-4C55-980D-4D5CFC5BF353}.tmp
%AppData%\Microsoft\Office\Recent\5f8241024f69edc258237f01170ea088fd5064c5908267e943f97bc9e2a6ea1d.LNK
\TEMP\~$8241024f69edc258237f01170ea088fd5064c5908267e943f97bc9e2a6ea1d.doc
%LocalAppData%\Temp\bdmwft0z.slp.ps1
%LocalAppData%\Temp\tjkn23yi.53a.psm1
%UserProfile%\Documents\20180928\PowerShell_transcript.PC.ceUgAgR5.20180928074741.txt File Hashes
06f0ec25e8b014b407402207afa8b6c0db494ad270d910534399c2137204e81b
0a8d4f2ac74485345284950b158da4be071633f33b0c7b9fa18d1f3e4d28732e
292b28d2f08fbd08ee8f1c2ed6f765b08c883031c0fae8dd84480ba0e1ca940d
3371fc7b0cf2d389571002c3ca26c9268edc373b79486e47bd6c349120f560c2
33d078881456e3b930c480803902fa28142b17c8550f3932e7cf4a1df0eb9213
567fe3794a9eec27697ae0634861d284279261880887f60a7374c6cbe63b7674
5f8241024f69edc258237f01170ea088fd5064c5908267e943f97bc9e2a6ea1d
91f0264ea76628c6b8825f358cd9cb8e1255604108fc059e0ac283d49c0dd852
933f5c822937fdec9325d1c99c5e0a5fda92296ef7c51ce7cd2dfc72bbe95b82
cf8f98b1adf802ed2b24345161a38c4cfa499b36f17b0466a1da74edce84ba4b
e469ba3bad870a5e7596035f69f2ba4cbb849cbdf9a8019890ccdea02c60e4d6
f368d4a10770c42316d9c1024a0894b85048020526be03b2e824165b5b66e978
f88ef62f2342f4d1105cfe85395b735efd3f0308b79551944983ce245d425510

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0928-1005/

Type	Indicator	Context
domain	6chen.cn	asnaypolyana123[.]ru hoteltravel2018[.]com oceanlinen[.]com 6chen[.]cn koloritplus[.]ru asl-company[.]ru www[.]krishnagrp[.]com
domain	alem.be	nect[.]com help[.]dreamhost[.]com www[.]fabbfoundation[.]gm alem[.]be cevent[.]net mauricionacif[.]com smbardoli[.]org www[.]ac
domain	asl-company.ru	avel2018[.]com oceanlinen[.]com 6chen[.]cn koloritplus[.]ru asl-company[.]ru www[.]krishnagrp[.]com test[.]theveeview[.]com cdnjs[.]cl
domain	bellytobabyphotographyseattle.com	unnatimotors[.]in www[.]macartegrise[.]eu blokefeed[.]club bellytobabyphotographyseattle[.]com diadelorgasmo[.]cl www[.]bgfc[.]hr www[.]wash-wear[.]com
domain	big-game-fishing-croatia.hr	Does not indicate maliciousness. www[.]litespeedtech[.]com big-game-fishing-croatia[.]hr www[.]lagouttedelixir[.]com dreamhost[.]com www[.]himmerl
domain	blokefeed.club	k ispsystem[.]com unnatimotors[.]in www[.]macartegrise[.]eu blokefeed[.]club bellytobabyphotographyseattle[.]com diadelorgasmo[.]cl ww
domain	boatshowradio.com	wear[.]com yourmine[.]ru www[.]reg[.]ru www[.]poketeg[.]com boatshowradio[.]com www[.]perfectfunnelblueprint[.]com perovaphoto[.]ru www[.
domain	cevent.net	help[.]dreamhost[.]com www[.]fabbfoundation[.]gm alem[.]be cevent[.]net mauricionacif[.]com smbardoli[.]org www[.]aco[.]dk cyclev
domain	cyclevegas.com	nt[.]net mauricionacif[.]com smbardoli[.]org www[.]aco[.]dk cyclevegas[.]com lucides[.]co[.]uk krasnaypolyana123[.]ru hoteltravel2018[
domain	diadelorgasmo.cl	e[.]eu blokefeed[.]club bellytobabyphotographyseattle[.]com diadelorgasmo[.]cl www[.]bgfc[.]hr www[.]wash-wear[.]com yourmine[.]ru www[.
domain	dreamhost.com	m big-game-fishing-croatia[.]hr www[.]lagouttedelixir[.]com dreamhost[.]com www[.]himmerlandgolf[.]dk hanaglobalholding[.]com top-22[
domain	evotech.lu	m perovaphoto[.]ru www[.]cakav[.]hu www[.]billerimpex[.]com evotech[.]lu www[.]ismcrossconnect[.]com help[.]dreamhost[.]com www[.]
domain	hanaglobalholding.com	uttedelixir[.]com dreamhost[.]com www[.]himmerlandgolf[.]dk hanaglobalholding[.]com top-22[.]ru zaeba[.]co[.]uk ispsystem[.]com unnatimotors[
domain	help.dreamhost.com	]billerimpex[.]com evotech[.]lu www[.]ismcrossconnect[.]com help[.]dreamhost[.]com www[.]fabbfoundation[.]gm alem[.]be cevent[.]net mauric
domain	hoteltravel2018.com	k cyclevegas[.]com lucides[.]co[.]uk krasnaypolyana123[.]ru hoteltravel2018[.]com oceanlinen[.]com 6chen[.]cn koloritplus[.]ru asl-company[
domain	ispsystem.com	lf[.]dk hanaglobalholding[.]com top-22[.]ru zaeba[.]co[.]uk ispsystem[.]com unnatimotors[.]in www[.]macartegrise[.]eu blokefeed[.]clu
domain	koloritplus.ru	a123[.]ru hoteltravel2018[.]com oceanlinen[.]com 6chen[.]cn koloritplus[.]ru asl-company[.]ru www[.]krishnagrp[.]com test[.]theveeview
domain	krasnaypolyana123.ru	oli[.]org www[.]aco[.]dk cyclevegas[.]com lucides[.]co[.]uk krasnaypolyana123[.]ru hoteltravel2018[.]com oceanlinen[.]com 6chen[.]cn kolorit
domain	lucides.co.uk	nacif[.]com smbardoli[.]org www[.]aco[.]dk cyclevegas[.]com lucides[.]co[.]uk krasnaypolyana123[.]ru hoteltravel2018[.]com oceanlinen
domain	mauricionacif.com	host[.]com www[.]fabbfoundation[.]gm alem[.]be cevent[.]net mauricionacif[.]com smbardoli[.]org www[.]aco[.]dk cyclevegas[.]com lucides[.
domain	oceanlinen.com	ides[.]co[.]uk krasnaypolyana123[.]ru hoteltravel2018[.]com oceanlinen[.]com 6chen[.]cn koloritplus[.]ru asl-company[.]ru www[.]krishn
domain	perovaphoto.ru	]com boatshowradio[.]com www[.]perfectfunnelblueprint[.]com perovaphoto[.]ru www[.]cakav[.]hu www[.]billerimpex[.]com evotech[.]lu www
domain	smbardoli.org	bfoundation[.]gm alem[.]be cevent[.]net mauricionacif[.]com smbardoli[.]org www[.]aco[.]dk cyclevegas[.]com lucides[.]co[.]uk krasnay
domain	top-22.ru	ost[.]com www[.]himmerlandgolf[.]dk hanaglobalholding[.]com top-22[.]ru zaeba[.]co[.]uk ispsystem[.]com unnatimotors[.]in www[.]m
domain	unnatimotors.in	alholding[.]com top-22[.]ru zaeba[.]co[.]uk ispsystem[.]com unnatimotors[.]in www[.]macartegrise[.]eu blokefeed[.]club bellytobabyphoto
domain	www.aco.dk	alem[.]be cevent[.]net mauricionacif[.]com smbardoli[.]org www[.]aco[.]dk cyclevegas[.]com lucides[.]co[.]uk krasnaypolyana123[.]
domain	www.bgfc.hr	club bellytobabyphotographyseattle[.]com diadelorgasmo[.]cl www[.]bgfc[.]hr www[.]wash-wear[.]com yourmine[.]ru www[.]reg[.]ru www[
domain	www.billerimpex.com	fectfunnelblueprint[.]com perovaphoto[.]ru www[.]cakav[.]hu www[.]billerimpex[.]com evotech[.]lu www[.]ismcrossconnect[.]com help[.]dreamho
domain	www.cakav.hu	o[.]com www[.]perfectfunnelblueprint[.]com perovaphoto[.]ru www[.]cakav[.]hu www[.]billerimpex[.]com evotech[.]lu www[.]ismcrossconn
domain	www.fabbfoundation.gm	ech[.]lu www[.]ismcrossconnect[.]com help[.]dreamhost[.]com www[.]fabbfoundation[.]gm alem[.]be cevent[.]net mauricionacif[.]com smbardoli[.]
domain	www.himmerlandgolf.dk	ng-croatia[.]hr www[.]lagouttedelixir[.]com dreamhost[.]com www[.]himmerlandgolf[.]dk hanaglobalholding[.]com top-22[.]ru zaeba[.]co[.]uk isp
domain	www.ismcrossconnect.com	[.]ru www[.]cakav[.]hu www[.]billerimpex[.]com evotech[.]lu www[.]ismcrossconnect[.]com help[.]dreamhost[.]com www[.]fabbfoundation[.]gm alem[.
domain	www.krishnagrp.com	eanlinen[.]com 6chen[.]cn koloritplus[.]ru asl-company[.]ru www[.]krishnagrp[.]com test[.]theveeview[.]com cdnjs[.]cloudflare[.]com picusg
domain	www.lagouttedelixir.com	ss. www[.]litespeedtech[.]com big-game-fishing-croatia[.]hr www[.]lagouttedelixir[.]com dreamhost[.]com www[.]himmerlandgolf[.]dk hanaglobalhol
domain	www.litespeedtech.com	ames contacted by malware. Does not indicate maliciousness. www[.]litespeedtech[.]com big-game-fishing-croatia[.]hr www[.]lagouttedelixir[.]c
domain	www.macartegrise.eu	p-22[.]ru zaeba[.]co[.]uk ispsystem[.]com unnatimotors[.]in www[.]macartegrise[.]eu blokefeed[.]club bellytobabyphotographyseattle[.]com di
domain	www.perfectfunnelblueprint.com	.]ru www[.]reg[.]ru www[.]poketeg[.]com boatshowradio[.]com www[.]perfectfunnelblueprint[.]com perovaphoto[.]ru www[.]cakav[.]hu www[.]billerimpex[.]c
domain	www.poketeg.com	gfc[.]hr www[.]wash-wear[.]com yourmine[.]ru www[.]reg[.]ru www[.]poketeg[.]com boatshowradio[.]com www[.]perfectfunnelblueprint[.]com
domain	www.reg.ru	mo[.]cl www[.]bgfc[.]hr www[.]wash-wear[.]com yourmine[.]ru www[.]reg[.]ru www[.]poketeg[.]com boatshowradio[.]com www[.]perfectfu
domain	www.wash-wear.com	photographyseattle[.]com diadelorgasmo[.]cl www[.]bgfc[.]hr www[.]wash-wear[.]com yourmine[.]ru www[.]reg[.]ru www[.]poketeg[.]com boatsh

Threat Roundup Sept 28

Indicators of compromiseauto-extracted · verify before use · export allAll →

Threats

Win.Malware.Gandcrab-6706045-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Xls.Downloader.Valyria-6704496-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Dropper.Fqdq-6705253-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Genkryptik-6704925-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of DetectionAMP

Win.Malware.Zusy-6704537-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Razy-6703914-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Doc.Malware.Emooodldr-6699885-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys