Cisco Talospublished Feb 22, 19:32 UTC (Feb 22, 2019)ingested Sep 10, 06:19 UTC

Threat Roundup for Feb. 15 to Feb. 22

highRansomwareimportance 57

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article926 words · extracted from blog.talosintelligence.com · click to collapse

Friday, February 22, 2019 14:32

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 15 and Feb. 22. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

The most prevalent threats highlighted in this roundup are:

Doc.Downloader.Emotet-6861668-0
Downloader
Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a wide variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Packed.Nymaim-6860565-0
Packed
Nymaim is malware that can be used to deliver ransomware and other malicious payloads. It uses a domain generation algorithm to generate potential command and control (C2) domains to connect to additional payloads.
Win.Malware.Icloader-6860563-0
Malware
Icloader is a generic malware that largely behaves like adware. The samples are packed and have evasive checks to hinder the analysis and conceal the real activities. This family can inject code in the address space of other processes and upload files to a remote server.
Win.Malware.Bublik-6860562-0
Malware
Bublik is a downloader that targets Windows hosts. Although it's primarily used as malware to distribute various banking trojans, it's also capable of extracting and exfiltrating sensitive information from the host.
Win.Ransomware.Razy-6860532-0
Ransomware
Razy is oftentimes a generic detection name for a Windows trojan. They collect sensitive information from the infected host, format and encrypt the data, and send it to a C2 server. In this case, some of the samples in certain identified clusters can be attributed as Cerber samples, although the detection remains the same.
Win.Worm.Vobfus-6860533-0
Worm
Vobfus is a worm that copies itself to external drives and attempts to gain automatic code execution via autorun.inf files. It also modifies the registry so that it will launch when the system is booted. Once installed, it attempts to download follow-on malware from its command and control (C2) servers.

Threats

Doc.Downloader.Emotet-6861668-0

Indicators of Compromise
Registry Keys

N/A Mutexes
Global\PowerShell_CommandAnalysis_Lock_S-1-5-21-2580483871-590521980-3826313501-500 IP Addresses contacted by malware. Does not indicate maliciousness
189[.]236[.]235[.]73
70[.]184[.]86[.]103
76[.]113[.]130[.]72
117[.]52[.]20[.]53
66[.]216[.]234[.]131 Domain Names contacted by malware. Does not indicate maliciousness
bazee365[.]com
serhatevren[.]godohosting[.]com
mediarox[.]com Files and or directories created
%UserProfile%\405.exe
%WinDir%\SysWOW64\E7LYsu6obSo.exe
%LocalAppData%\Temp\kfcdv0jf.wos.psm1
%LocalAppData%\Temp\lu4nllxj.0of.ps1
%UserProfile%\Documents\20190218\PowerShell_transcript.PC.gVgu3PJN.20190218204843.txt File Hashes
0349453748c3c3fe4631e5c17665a702f7ca1ba8cc2c7508a91d686e17d41098
069185a0da074e0ece155c5cda364e5092b2573131fdc2c95002b18c44937a1d
0946a30abd52ef463b6a390efba6595d2a7917df95d3739df77e3ca57d1ecc8b
0966f1271c4cdd0f66bca3520ffe406d4ba14aaa06a7b14aa505c78958fead20
09fe30dd8b953d25af163fc4db119afd7387cc4b5109f331e1651927bf61cc63
0a091593757cd2d16b4ca2ed1806b73f1222f4367d6d78e0df8ee98c247ef1f6
0b6003563af9034d9a22f96adb0559f04b3753d0d4d9e6e76dd49504a427317e
0f25037f951fd8f0f1c2f4b94ec84d3aa8daa3f7d5774056136769ecb800dc6e
106b4d87576a07cc74f8ba9519d9730b50dc7309e69d0e7764822af981d98e61
1328ac0cb151437871e7f39f72b20c13fb9fc292adb78054f30a8f958404e4c6
1caa72377c62835653e1c1b062e418c62b689f8b6e600b739201a1300bae1bf5
265a6869c2a2f0b3f35b316eda5e78492ae2a574530c39a1673845245a342d67
27b0bd35f9ee7752e45d40707a3a777d20c8563e7067007101ec8de9d1c271da
2a1ca1f2eb72dd935b9ae4594eb332d9ee7363b70f1fa40e6b3a1a4dbdb44e1f
2cc2fbcac3c4262c49e3ad49903d4e9ebc5fbaaf9a2ad65ff53f808380b70a12
2dda30d522c1b72d38f8609a3bde18de25aa57ad7ba7d90cffdfc0db5cf6e977
327c64ca7348a0e2e4651a332776d10216cd77f77761766a12094cabe446ca4d
335b40ff58a6cf92f16ad95349e2cb9dc42d71654cebaff642fbbc168749bf26
380111d3408eed7a855ef759d4304570286eb4478d35b0ad1f35cb17b853b353
4392d56f6bda858b04d0a4cfe1112fba4a80c56bd916618b804e02b703465dea
4a5fe09fd3f776a86ecdbfdd0c6fe9abfd962a16444ec8bdd2dd03704fbdac6d
4bc0ebf4e04816770e0176a8f1ba04404a6d8b09150d21bcfaf3387ffed06606
4be4a46ef25e71de87371345da22d043385a72a479adf2ed56326cd69b2d500d
4db8c7a64afa55409a39042cd1ba8561230da23185f0b62a6e2243ad3efef4be
52a1a1863cc969cd93d48371e9d24e59cb691a8442477a4d8b1c25c51e71eb13

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Malware

Win.Packed.Nymaim-6860565-0

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses contacted by malware. Does not indicate maliciousness
N/A Domain Names contacted by malware. Does not indicate maliciousness
wmmjykpublbk[.]com
yvnnzvdcqs[.]com
yugejra[.]in
xriuhkmec[.]pw
zhvar[.]net Files and or directories created
%AllUsersProfile%\ph
%AllUsersProfile%\ph\eqdw.dbc
%AllUsersProfile%\ph\fktiipx.ftf
%LocalAppData%\Temp\gocf.ksv
%LocalAppData%\Temp\kpqlnn.iuy File Hashes
016fcb5281374301a886e62512c80bace5093baa28317392fa47b41c3fc9c209
04f643c92239dd1c24928a3da8a7ffc6974223fdce4c64f74ed16f77e606d1a9
06fa8ba73421f80a6b6a872832bc5fd37dd045280dfbab48d18af291c4f3a0b6
086685fc1ad9812ad986639b77db52cf570c63fef36b6220dfae184a4da20aa9
0e37a6e0bc2078eb99991da03dd81d85a169b0646637b8d16240887e8fb50f57
0fd6c83045db3b972b5329f11e6160251b53d1cbbf61f8b065421b8231982f2c
0ff32246d64c9529c01cd62b5ce2474ba77f11422d4aa14becf0b34ebc1d9b40
139572026f38ccfb8fb615a0a202d9b315cca46bb0ae31870e60aaa1b7db1d23
1655c03b41b2a5ac72829eb3b4867de87c3643f2e7cdaefb9e88392f8dff916d
175398f6a76bfb59c31c9c46c2d7c452be9f146451197042c5e0ef39a42f07b8
179c96674980e6ed485fe00d82141c3729274b5d6e13129801d445c981264e23
1a47d3a4951a6955fee9f29e0e6629b6e29dd4db58378e7ffa8aca948688175e
1b6d29d704243956e14ea5a259398b9e0b52544bc8ba3b6ca1c172273416517b
1cb1a09aec8926e8df8dd7edb1ccc63ea7192330ee36704ae3b2b706a6630cb8
1d99c9bfce431b2422370607430efd5b155b76ad58dc615d79076b8e0f2a7e6a
1e07e0277acf86c37ef6753ba1a2532e933044c7656ecc063c236c585b83c26f
1e5d95ea42bfc038d4513fa688336cd73622ed707ed188d66aed4cf6ac1086a1
1eec7c86d30be19611b16bd5e17fd747da9df96fa2907ca23acf1801b6c383c9
20d599362a7f80b9964569df6e07d2f18e434be47fc01dafa7e7d73831677a42
216a5552de53349bbaee2f121538c7b66783f1752a3d190f5b978fae27a77ed0
21c85e5768071487832d29e9661f68033e9f7baa30597535ded88439cb67796b
231d98cb92d4affea6db88d42b31f8b0d001a933c97ce2e670423fc1d185d6fe
2361248d5291c923b8763530dd5c551accda742d6e7d15660534ab56aff11ffe
23e28028a5392440dc99a040a0043cb3de50bdd678ed26777b72437819657d14
2472ef7f75de9881f4c6269de9093721147918a3ae94fed19e8078d9f42695ce

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Icloader-6860563-0

Indicators of Compromise
Registry Keys

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\localNETService Mutexes
N/A IP Addresses contacted by malware. Does not indicate maliciousness
N/A Domain Names contacted by malware. Does not indicate maliciousness
N/A Files and or directories created
%AllUsersProfile%\localNETService\localNETService.exe
%LocalAppData%\Temp\tsc131118.dat File Hashes
01d804f3bb30a0082396eaecdcdd0e9e329ea3ee585b8e0fa4f24210be9b644e
02f50ce46cb615461dbf0edf1b795f76a0cd8e9126ef8938a6a02266a98ecbbc
0827b4fed47eb0605a345f1e733b3b1937756c28254913fc8a36d4ba28b83541
0d572da25a4bc1db88843cc8610fe56e4a336dbe322c26248b594f7622113cf5
0e3a72fdb86ff31b61661a473db0863143c0f7c8e8aa659b7cf318ec6756e1ab
0ef73d5cc5afb4c6ad73cfd27724af99b562e0dab76485aa73414bd25fa0eac0
106b0659bddd2b26246fc00b929e8004dffe15fb9389fc7bae7cc1bec7f76a62
164966f0b65f4c0816a6b2af88f4846f15e92b0c2f4b76dee98baf875e4deede
20b1446c4d8190ecd749d995113c5bc6ce8375da14c73f7ee3c8f717e6d42e07
288a80d10c4d1a42eef45f92c1fd786009c10f8a54b1cebdf6790c6f1d0b06b8
29fb858feaf6614d5e5eccf68f7fe3446b11fcac0067b2bd1e24a53a23f2b9cc
2d7bda9823c838009d950022e78b9abf49246be6dd25c72c32eae10f43276c3b
2fa1d8b8719ea8528bde7c3ecd421d79a1e5ecf63612ec52b4c8cedfb5f6e1ed
2feec8571fb27548f20dc65efa838283c0f7be39dd8502bacd7472148f1f32b1
30361d76097bc679434e488157c98625d6961a936340947894f7f105c3d406b0
338d97248b5ff7489157822d0b0c413d550a46ce6da712e2fb838290bf7697a5
34099d3b62bb8baefde01a72f6921063d81dcd33c2512df3755aedd5524f19cf
349c06fedb963107c3dc825075c9517eb05df25091bcbb9d6407843b745409da
36064556c3b25426b42b43e8ebdd7b9ca3b6d02a54f0eb20ccbce62e4818a6da
39afaf2f57b8a1c6ed2ebe4072d0e81832d94d31e1c1f3a016cd65b500e14d62
3c603d3673c795fc13f7440c38908ea9cc4283a3d79e9f03bf2bb775162e0a8d
465fa07297f1aefff4acdc99cdc1e17583f57d29a0437f21e94c967ee2b6e838
4c4807efed90553e868ef794b9d7218ab7a635c1d95f6e56c45b8c0e6ecb1bee
4ca27d52b58f33e8a99d68509cb9487417844ea5501056177ebac910eb329c1f
4eb6179bff74cbc8625448c010aeabadf5bb7ee1fe1329e80f54f062f67af426

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Malware.Bublik-6860562-0

Indicators of Compromise
Registry Keys

<A>\{32DE27EC-AB30-11E8-A007-00501E3AE7B5}\DEFAULTOBJECTSTORE\IndexTable
<A>\{32DE27EC-AB30-11E8-A007-00501E3AE7B5}\DEFAULTOBJECTSTORE\LruList
<A>\{32DE27EC-AB30-11E8-A007-00501E3AE7B5}\DEFAULTOBJECTSTORE\LRULIST\00000000000029D3 Mutexes
Global\e02ef461-32f6-11e9-a007-00501e3ae7b5 IP Addressescontacted by malware. Does not indicate maliciousness
N/A Domain Names contacted by malware. Does not indicate maliciousness
N/A Files and or directories created
%LocalAppData%\CrashDumps
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7A9E.dmp
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7e9a_appcompat.txt File Hashes
0077f54220e81d1351a81a51f7089e1e0344b0e0c7e1db2baed69fc42d212eef
02f3a6dd7ec83508d644551b34f082a47597d91b70befc75662fa7afd2c1a4b8
0f155a227bf791b43ee66c51e5c3d6ff7edb46a70476239e7e3eac2af083b942
253c1e82213e8075144aaa722abe1786110d36c845f3ab62a67383ac53d33298
2565901fbf675dc8bf6bcff213ddde8f274a96f016dad4ed8d6bb04131fe2ae3
2623f7ef229170bed9265f02b4570b272b2913154800d42a493404d8fb412500
267298bf98507e02c999c1d38407d3f295d86f48f40e98fd33e8735861886011
3244e9cc8b1d9d3cc7d5073544bfa675876d423e57edadbcb033b949a8c811c0
327ffee4d88231c1b3efed3baed72a736fe7e1a3cacd02a83059774dca35e9e2
34e85051b9718edc52253faccd1a85e09ccdb118ae289a24c5b3eb660abd4b63
39854854e613965c6cf22e0380163f187867e6d1e25b8b85890c62fab1cf0224
3ab69a728aafea29c3a1de3a419efd93b889aafc7eacaeb3a3f9d7c632dfa8c1
3ee8339543fd72e79f03c5878520e9d0058e11ee49765e9ca73a7236e9c7b8ce
4342cc9cb045b6c87fb822345e7dee6d9e46bec385de4ae7be1ff6ce6061572f
444dd5b17528c2dbd05d8afb1bf633b4cde0855deb0338a52a17df67e7efcf06
4c56d62c2af1fda0af9be1f377ad7d737e7db306e7dc684df5a7c0163f10ebf2
4de35a78adab9e0f79a88a1452916719f42641155de80f6c90e5a152561cdaa3
4f011f91715575b91312eb8a29509d9c2aa4950127efc98e88d44d08ce143efc
52a6cbca15c3805effa45b474a732f9b74d38d35a78e3763380735cc6a685f63
5a73cda9b407ce518c1d5a9c4965d6287e2e2b4193e8fa702542c684c050c130
6fd9000a376b03dac177252a2e2879aa70c3f3365fff351d637f7b36aa2df385
7081050e0504735e2f48c098f5758a5a01c8972011478b6c5b2fcc5e33ea4932
8265acaed3a210ec5999474da742f447a23b407d5a0bc9ce1c42a48f609e6b61
852d1d4ee1c4a04fc7ea5b849d6c663725fa89ae6358e251325c636e81a47a5b
895e9a298dce50a19cd158de7f8a504d07948713a042e356d4207d6650815fd0

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Ransomware.Razy-6860532-0

Indicators of Compromise
Registry Keys

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\Enroll\HcsGroups Mutexes
Global\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7
shell.{381828AA-8B28-3374-1B67-35680555C5EF} IP Addresses contacted by malware. Does not indicate maliciousness
178[.]33[.]163[.]80 Domain Names contacted by malware. Does not indicate maliciousness
hjhqmbxyinislkkt[.]1j9r76[.]top
hjhqmbxyinislkkt[.]1bxzyr[.]top Files and or directories created
%UserProfile%\documents\_R_E_A_D___T_H_I_S___9FWW7OX_.txt
%UserProfile%\documents\_R_E_A_D___T_H_I_S___MHSXUD0_.hta File Hashes
00cd7c1116f489b0cb66d67b3fde935928f891ae96656b6cba08563e3bc37e36
00d74b27e8660696a3e9f23585fd484e01c96c6ce6fed3a06082adffea90423c
01b9a1ab489f0499eeb7e8d67d75b42faad1c6fe6f4a1e4353f2e79c5d92f5cd
02b7190116a9bb98467f28d92495c1bee74c60af05fb58fff8199909260bacd9
04331cdca654e951f24f524d5d624f7137a197c99ab63aa9aafab67b56fec248
05863f8c9b9608169db2678d0cae1bce91a80819c091b9b762dd05cab2dac6ce
05c0678a044fab83eb77232a298f9114df78b1084b709a2dae59fded201919e4
071e548c39279c6ca7fed247213cd877ddf2fa106e5b8892a85cad4d2605ade0
07a40a71471037198a9e8c5c5a4e45e52115f772f598a2db0eb8bb187c914c40
07ce564ba06045026ce86faa30ff216f21398427e300131f202896441fbdf1fb
07d6477d260ce2bc3477902ece2c2bb6e290f1b36f04594c40292b049d42c6fb
08b07947fdf606f894e94678574056641da5db8f4db7f5774449fd21bebad29d
09fffb50fd033e16a63834d62e2ab5b3227abc57252e87509398cf6ad8b06458
0ae803d152f2cb6bb68e10c0c9244b4aac63a11a43153f2285c2b674fe9fc657
0b77399249b1ce25a8e408de81e3e46951a5eed52043069d1e48a407c0a05a47
0bd766bfedd04e188ee3885d523f6cd170d0c36bc159bb82d3772b51d8a36022
0c26799f75d7d16b8ebdf13ec6940cf3182af53e9cd451540901769380de6079
0d5d73215146991e0b32224281c6b8bc01248674f993d5d9fc90f5bed45d0d2e
0e23f0c0cab7a1e82a2909ee3abce4f88dbd7c54b7a748bd7966b9b1997ed09b
0f5d5c8840b06cf60283ad399e55b6bbe7f20edcfb26d332fa72c4103e155e68
1360e01b934cbc6ba2db60091ee38fd23efc5321a5aaf17563dc61a7824cad96
144506736eac91ec05d88315c8b74f2582a5238e48b41a716d55190b5942befc
16256930f1ee4e254193804f4741a81b427537e666aced7ff823ed582359ce2d
165010fd8c29e7947144e776dbe81a84816a322c29c72ac21dbf6d436648e382
17304b3bfb5ab40bc65b53ec39294bdbaa8e032dff44f2032a0b5a7c0b96879f

Coverage

Screenshots of DetectionAMP

ThreatGrid

Umbrella

Malware

Win.Worm.Vobfus-6860533-0

Indicators of Compromise
Registry Keys

N/A Mutexes
Local\ZonesLockedCacheCounterMutex IP Addresses contacted by malware. Does not indicate maliciousness
N/A Domain Names contacted by malware. Does not indicate maliciousness
49161[.]dnst2[.]net
49161[.]DNST2[.]NET
88818[.]dnst2[.]net Files and or directories created
N/A File Hashes
002c51db9009f2207dd0398defbc9a9f391f327f07105b19ea5c7c9c69ffd674
0096449116e4ebcd77a9e7c43723e793765974813475ed99aac513bc3d71b5b5
012ce7db1325159874f9b8925e524ce18b2c62dd230f1b2a674543bd74856137
0133c6d934996d6ea32ef17d0a6df96dc86a4b45d9e51e702230b167d87a9ed7
02b3e2b1723573274b6e91e53cd973ed8d5e242f3ddb44369deac8cfb2368778
06ef151d2aab329341ce68ce7a8b2e7c3b463ca940f47cdd6ce51a864af3266d
075e36642d1e37cc11c500a2cd2f3ad3fb2af73bce45a1b6e905078f00adac18
098cee9f87724372cad66c0d7797c8f3cc6832aded95235513799aa8f6061d2c
0b7af27bf47a48843e14aae81cd6f8c99e82da02c352f34d50d0fb2cca03b66f
11ef099b691e051efb1eca27aa5d8606157b0e7f0eb83216733e48f82c52ffc1
139c385377c85ac709c77857adfbed6ac46e0e5f57e4b947d730ab871cea6154
1b456b78b84fcc6137bc85f0203e29e558c3888c74d610a0ecce19c9008197d4
1da4ccd179876bcc378ebc4b1f3597e393e3b976cd0f0a7c24c51b9855d3fa91
21cc803b77f7413c781bcc21a7681470ad926289c28f6d126efb899aac482988
21ecefddb6898cc39ae277c119f47a84869afa5a798e70dcb58059dcb75c87bb
25fd3bf11d2ab30e74ccb67cc0ba7563ccbd0a1502b077da80d13239c9ea3b02
269f9b6e264729a3ff2c71abcb320e07d4ff4e76acf6be1b294c6a4b687beebd
27d60e838ac4e142d5799628e95138a959bdc9358af047937f1d42f45ab093ca
27e3fb1689f0fb0ab76d217909cd52a78dd290ce12a13ffe234542c675769eeb
283293ffdb4838e037561e8ac0df74cdd9181ef046ffb3e5ae0ae2d3614f4b27
2d2fab79f6d87e2994a60e3a982804fb8d05aa75dc13e9b4bdc9705a9db6247a
2d60ca16f74ffe613981c2c27d40992f3d309cbe7b4a693f1fb632590f06e278
2f3f0fabb06ce1a8d3c5bc6c120473a2f597f4050fd4b92747c766ac3af07881
30755cf5b6934d725fd87dc667fe82b3fd4964d6c55cfdcb327a29e95dd3435d
313fbcc0ce24e2c0d2c5c6870842feac4f1f2722101037f0c421ac0a9185ea16

Coverage

Screenshots of Detection AMP

ThreatGrid

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-for-feb-15-to-feb-22/

Type	Indicator	Context
sha256	0077f54220e81d1351a81a51f7089e1e0344b0e0c7e1db2baed69fc42d212eef	UME~1\ADMINI~1\LOCALS~1\Temp\7e9a_appcompat.txt File Hashes 0077f54220e81d1351a81a51f7089e1e0344b0e0c7e1db2baed69fc42d212eef 02f3a6dd7ec83508d644551b34f082a47597d91b70befc75662fa7afd2c
sha256	00cd7c1116f489b0cb66d67b3fde935928f891ae96656b6cba08563e3bc37e36	le%\documents\_R_E_A_D___T_H_I_S___MHSXUD0_.hta File Hashes 00cd7c1116f489b0cb66d67b3fde935928f891ae96656b6cba08563e3bc37e36 00d74b27e8660696a3e9f23585fd484e01c96c6ce6fed3a06082adffea9
sha256	00d74b27e8660696a3e9f23585fd484e01c96c6ce6fed3a06082adffea90423c	c1116f489b0cb66d67b3fde935928f891ae96656b6cba08563e3bc37e36 00d74b27e8660696a3e9f23585fd484e01c96c6ce6fed3a06082adffea90423c 01b9a1ab489f0499eeb7e8d67d75b42faad1c6fe6f4a1e4353f2e79c5d9
sha256	016fcb5281374301a886e62512c80bace5093baa28317392fa47b41c3fc9c209	a%\Temp\gocf.ksv %LocalAppData%\Temp\kpqlnn.iuy File Hashes 016fcb5281374301a886e62512c80bace5093baa28317392fa47b41c3fc9c209 04f643c92239dd1c24928a3da8a7ffc6974223fdce4c64f74ed16f77e60
sha256	01b9a1ab489f0499eeb7e8d67d75b42faad1c6fe6f4a1e4353f2e79c5d92f5cd	b27e8660696a3e9f23585fd484e01c96c6ce6fed3a06082adffea90423c 01b9a1ab489f0499eeb7e8d67d75b42faad1c6fe6f4a1e4353f2e79c5d92f5cd 02b7190116a9bb98467f28d92495c1bee74c60af05fb58fff8199909260
sha256	01d804f3bb30a0082396eaecdcdd0e9e329ea3ee585b8e0fa4f24210be9b644e	ETService.exe %LocalAppData%\Temp\tsc131118.dat File Hashes 01d804f3bb30a0082396eaecdcdd0e9e329ea3ee585b8e0fa4f24210be9b644e 02f50ce46cb615461dbf0edf1b795f76a0cd8e9126ef8938a6a02266a98
sha256	02b7190116a9bb98467f28d92495c1bee74c60af05fb58fff8199909260bacd9	1ab489f0499eeb7e8d67d75b42faad1c6fe6f4a1e4353f2e79c5d92f5cd 02b7190116a9bb98467f28d92495c1bee74c60af05fb58fff8199909260bacd9 04331cdca654e951f24f524d5d624f7137a197c99ab63aa9aafab67b56f
sha256	02f3a6dd7ec83508d644551b34f082a47597d91b70befc75662fa7afd2c1a4b8	54220e81d1351a81a51f7089e1e0344b0e0c7e1db2baed69fc42d212eef 02f3a6dd7ec83508d644551b34f082a47597d91b70befc75662fa7afd2c1a4b8 0f155a227bf791b43ee66c51e5c3d6ff7edb46a70476239e7e3eac2af08
sha256	02f50ce46cb615461dbf0edf1b795f76a0cd8e9126ef8938a6a02266a98ecbbc	4f3bb30a0082396eaecdcdd0e9e329ea3ee585b8e0fa4f24210be9b644e 02f50ce46cb615461dbf0edf1b795f76a0cd8e9126ef8938a6a02266a98ecbbc 0827b4fed47eb0605a345f1e733b3b1937756c28254913fc8a36d4ba28b
sha256	0349453748c3c3fe4631e5c17665a702f7ca1ba8cc2c7508a91d686e17d41098	Shell_transcript.PC.gVgu3PJN.20190218204843.txt File Hashes 0349453748c3c3fe4631e5c17665a702f7ca1ba8cc2c7508a91d686e17d41098 069185a0da074e0ece155c5cda364e5092b2573131fdc2c95002b18c449
sha256	04331cdca654e951f24f524d5d624f7137a197c99ab63aa9aafab67b56fec248	90116a9bb98467f28d92495c1bee74c60af05fb58fff8199909260bacd9 04331cdca654e951f24f524d5d624f7137a197c99ab63aa9aafab67b56fec248 05863f8c9b9608169db2678d0cae1bce91a80819c091b9b762dd05cab2d
sha256	04f643c92239dd1c24928a3da8a7ffc6974223fdce4c64f74ed16f77e606d1a9	b5281374301a886e62512c80bace5093baa28317392fa47b41c3fc9c209 04f643c92239dd1c24928a3da8a7ffc6974223fdce4c64f74ed16f77e606d1a9 06fa8ba73421f80a6b6a872832bc5fd37dd045280dfbab48d18af291c4f
sha256	05863f8c9b9608169db2678d0cae1bce91a80819c091b9b762dd05cab2dac6ce	cdca654e951f24f524d5d624f7137a197c99ab63aa9aafab67b56fec248 05863f8c9b9608169db2678d0cae1bce91a80819c091b9b762dd05cab2dac6ce 05c0678a044fab83eb77232a298f9114df78b1084b709a2dae59fded201
sha256	05c0678a044fab83eb77232a298f9114df78b1084b709a2dae59fded201919e4	f8c9b9608169db2678d0cae1bce91a80819c091b9b762dd05cab2dac6ce 05c0678a044fab83eb77232a298f9114df78b1084b709a2dae59fded201919e4 071e548c39279c6ca7fed247213cd877ddf2fa106e5b8892a85cad4d260
sha256	069185a0da074e0ece155c5cda364e5092b2573131fdc2c95002b18c44937a1d	53748c3c3fe4631e5c17665a702f7ca1ba8cc2c7508a91d686e17d41098 069185a0da074e0ece155c5cda364e5092b2573131fdc2c95002b18c44937a1d 0946a30abd52ef463b6a390efba6595d2a7917df95d3739df77e3ca57d1
sha256	06fa8ba73421f80a6b6a872832bc5fd37dd045280dfbab48d18af291c4f3a0b6	3c92239dd1c24928a3da8a7ffc6974223fdce4c64f74ed16f77e606d1a9 06fa8ba73421f80a6b6a872832bc5fd37dd045280dfbab48d18af291c4f3a0b6 086685fc1ad9812ad986639b77db52cf570c63fef36b6220dfae184a4da
sha256	071e548c39279c6ca7fed247213cd877ddf2fa106e5b8892a85cad4d2605ade0	78a044fab83eb77232a298f9114df78b1084b709a2dae59fded201919e4 071e548c39279c6ca7fed247213cd877ddf2fa106e5b8892a85cad4d2605ade0 07a40a71471037198a9e8c5c5a4e45e52115f772f598a2db0eb8bb187c9
sha256	07a40a71471037198a9e8c5c5a4e45e52115f772f598a2db0eb8bb187c914c40	48c39279c6ca7fed247213cd877ddf2fa106e5b8892a85cad4d2605ade0 07a40a71471037198a9e8c5c5a4e45e52115f772f598a2db0eb8bb187c914c40 07ce564ba06045026ce86faa30ff216f21398427e300131f202896441fb
sha256	07ce564ba06045026ce86faa30ff216f21398427e300131f202896441fbdf1fb	a71471037198a9e8c5c5a4e45e52115f772f598a2db0eb8bb187c914c40 07ce564ba06045026ce86faa30ff216f21398427e300131f202896441fbdf1fb 07d6477d260ce2bc3477902ece2c2bb6e290f1b36f04594c40292b049d4
sha256	07d6477d260ce2bc3477902ece2c2bb6e290f1b36f04594c40292b049d42c6fb	64ba06045026ce86faa30ff216f21398427e300131f202896441fbdf1fb 07d6477d260ce2bc3477902ece2c2bb6e290f1b36f04594c40292b049d42c6fb 08b07947fdf606f894e94678574056641da5db8f4db7f5774449fd21beb
sha256	0827b4fed47eb0605a345f1e733b3b1937756c28254913fc8a36d4ba28b83541	ce46cb615461dbf0edf1b795f76a0cd8e9126ef8938a6a02266a98ecbbc 0827b4fed47eb0605a345f1e733b3b1937756c28254913fc8a36d4ba28b83541 0d572da25a4bc1db88843cc8610fe56e4a336dbe322c26248b594f76221
sha256	086685fc1ad9812ad986639b77db52cf570c63fef36b6220dfae184a4da20aa9	ba73421f80a6b6a872832bc5fd37dd045280dfbab48d18af291c4f3a0b6 086685fc1ad9812ad986639b77db52cf570c63fef36b6220dfae184a4da20aa9 0e37a6e0bc2078eb99991da03dd81d85a169b0646637b8d16240887e8fb
sha256	08b07947fdf606f894e94678574056641da5db8f4db7f5774449fd21bebad29d	77d260ce2bc3477902ece2c2bb6e290f1b36f04594c40292b049d42c6fb 08b07947fdf606f894e94678574056641da5db8f4db7f5774449fd21bebad29d 09fffb50fd033e16a63834d62e2ab5b3227abc57252e87509398cf6ad8b
sha256	0946a30abd52ef463b6a390efba6595d2a7917df95d3739df77e3ca57d1ecc8b	5a0da074e0ece155c5cda364e5092b2573131fdc2c95002b18c44937a1d 0946a30abd52ef463b6a390efba6595d2a7917df95d3739df77e3ca57d1ecc8b 0966f1271c4cdd0f66bca3520ffe406d4ba14aaa06a7b14aa505c78958f
sha256	0966f1271c4cdd0f66bca3520ffe406d4ba14aaa06a7b14aa505c78958fead20	30abd52ef463b6a390efba6595d2a7917df95d3739df77e3ca57d1ecc8b 0966f1271c4cdd0f66bca3520ffe406d4ba14aaa06a7b14aa505c78958fead20 09fe30dd8b953d25af163fc4db119afd7387cc4b5109f331e1651927bf6
sha256	09fe30dd8b953d25af163fc4db119afd7387cc4b5109f331e1651927bf61cc63	1271c4cdd0f66bca3520ffe406d4ba14aaa06a7b14aa505c78958fead20 09fe30dd8b953d25af163fc4db119afd7387cc4b5109f331e1651927bf61cc63 0a091593757cd2d16b4ca2ed1806b73f1222f4367d6d78e0df8ee98c247
sha256	09fffb50fd033e16a63834d62e2ab5b3227abc57252e87509398cf6ad8b06458	947fdf606f894e94678574056641da5db8f4db7f5774449fd21bebad29d 09fffb50fd033e16a63834d62e2ab5b3227abc57252e87509398cf6ad8b06458 0ae803d152f2cb6bb68e10c0c9244b4aac63a11a43153f2285c2b674fe9
sha256	0a091593757cd2d16b4ca2ed1806b73f1222f4367d6d78e0df8ee98c247ef1f6	0dd8b953d25af163fc4db119afd7387cc4b5109f331e1651927bf61cc63 0a091593757cd2d16b4ca2ed1806b73f1222f4367d6d78e0df8ee98c247ef1f6 0b6003563af9034d9a22f96adb0559f04b3753d0d4d9e6e76dd49504a42
sha256	0ae803d152f2cb6bb68e10c0c9244b4aac63a11a43153f2285c2b674fe9fc657	b50fd033e16a63834d62e2ab5b3227abc57252e87509398cf6ad8b06458 0ae803d152f2cb6bb68e10c0c9244b4aac63a11a43153f2285c2b674fe9fc657 0b77399249b1ce25a8e408de81e3e46951a5eed52043069d1e48a407c0a
sha256	0b6003563af9034d9a22f96adb0559f04b3753d0d4d9e6e76dd49504a427317e	593757cd2d16b4ca2ed1806b73f1222f4367d6d78e0df8ee98c247ef1f6 0b6003563af9034d9a22f96adb0559f04b3753d0d4d9e6e76dd49504a427317e 0f25037f951fd8f0f1c2f4b94ec84d3aa8daa3f7d5774056136769ecb80
sha256	0b77399249b1ce25a8e408de81e3e46951a5eed52043069d1e48a407c0a05a47	3d152f2cb6bb68e10c0c9244b4aac63a11a43153f2285c2b674fe9fc657 0b77399249b1ce25a8e408de81e3e46951a5eed52043069d1e48a407c0a05a47 0bd766bfedd04e188ee3885d523f6cd170d0c36bc159bb82d3772b51d8a
sha256	0bd766bfedd04e188ee3885d523f6cd170d0c36bc159bb82d3772b51d8a36022	99249b1ce25a8e408de81e3e46951a5eed52043069d1e48a407c0a05a47 0bd766bfedd04e188ee3885d523f6cd170d0c36bc159bb82d3772b51d8a36022 0c26799f75d7d16b8ebdf13ec6940cf3182af53e9cd451540901769380d
sha256	0c26799f75d7d16b8ebdf13ec6940cf3182af53e9cd451540901769380de6079	6bfedd04e188ee3885d523f6cd170d0c36bc159bb82d3772b51d8a36022 0c26799f75d7d16b8ebdf13ec6940cf3182af53e9cd451540901769380de6079 0d5d73215146991e0b32224281c6b8bc01248674f993d5d9fc90f5bed45
sha256	0d572da25a4bc1db88843cc8610fe56e4a336dbe322c26248b594f7622113cf5	4fed47eb0605a345f1e733b3b1937756c28254913fc8a36d4ba28b83541 0d572da25a4bc1db88843cc8610fe56e4a336dbe322c26248b594f7622113cf5 0e3a72fdb86ff31b61661a473db0863143c0f7c8e8aa659b7cf318ec675
sha256	0d5d73215146991e0b32224281c6b8bc01248674f993d5d9fc90f5bed45d0d2e	99f75d7d16b8ebdf13ec6940cf3182af53e9cd451540901769380de6079 0d5d73215146991e0b32224281c6b8bc01248674f993d5d9fc90f5bed45d0d2e 0e23f0c0cab7a1e82a2909ee3abce4f88dbd7c54b7a748bd7966b9b1997
sha256	0e23f0c0cab7a1e82a2909ee3abce4f88dbd7c54b7a748bd7966b9b1997ed09b	3215146991e0b32224281c6b8bc01248674f993d5d9fc90f5bed45d0d2e 0e23f0c0cab7a1e82a2909ee3abce4f88dbd7c54b7a748bd7966b9b1997ed09b 0f5d5c8840b06cf60283ad399e55b6bbe7f20edcfb26d332fa72c4103e1
sha256	0e37a6e0bc2078eb99991da03dd81d85a169b0646637b8d16240887e8fb50f57	5fc1ad9812ad986639b77db52cf570c63fef36b6220dfae184a4da20aa9 0e37a6e0bc2078eb99991da03dd81d85a169b0646637b8d16240887e8fb50f57 0fd6c83045db3b972b5329f11e6160251b53d1cbbf61f8b065421b82319
sha256	0e3a72fdb86ff31b61661a473db0863143c0f7c8e8aa659b7cf318ec6756e1ab	da25a4bc1db88843cc8610fe56e4a336dbe322c26248b594f7622113cf5 0e3a72fdb86ff31b61661a473db0863143c0f7c8e8aa659b7cf318ec6756e1ab 0ef73d5cc5afb4c6ad73cfd27724af99b562e0dab76485aa73414bd25fa
sha256	0ef73d5cc5afb4c6ad73cfd27724af99b562e0dab76485aa73414bd25fa0eac0	2fdb86ff31b61661a473db0863143c0f7c8e8aa659b7cf318ec6756e1ab 0ef73d5cc5afb4c6ad73cfd27724af99b562e0dab76485aa73414bd25fa0eac0 106b0659bddd2b26246fc00b929e8004dffe15fb9389fc7bae7cc1bec7f
sha256	0f155a227bf791b43ee66c51e5c3d6ff7edb46a70476239e7e3eac2af083b942	6dd7ec83508d644551b34f082a47597d91b70befc75662fa7afd2c1a4b8 0f155a227bf791b43ee66c51e5c3d6ff7edb46a70476239e7e3eac2af083b942 253c1e82213e8075144aaa722abe1786110d36c845f3ab62a67383ac53d

Threat Roundup for Feb. 15 to Feb. 22

Indicators of compromiseauto-extracted · verify before use · export allAll →

Threats

Doc.Downloader.Emotet-6861668-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Packed.Nymaim-6860565-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Icloader-6860563-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Malware.Bublik-6860562-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Ransomware.Razy-6860532-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of DetectionAMP

Win.Worm.Vobfus-6860533-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys