ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Cisco Talospublished ()ingested

Threat Roundup for September 7 to September 14

highRansomwareimportance 57
Read the original
Tagsransomware

Indicators of compromiseAll →

TypeIndicatorContext
domainamniyatgostariranian.ir[.]220 185[.]106[.]208[.]180 5[.]61[.]29[.]155 Domain Names amniyatgostariranian[.]ir Files and or directories created %LocalAppData%\Temp\rmfw
domainawele.duckdns.orgain Names pafindo[.]me www[.]greenfleld[.]com safemann[.]tk awele[.]duckdns[.]org genpral[.]top dogged[.]cf siyaghasourccing[.]com www[.]
domaindogged.cfeld[.]com safemann[.]tk awele[.]duckdns[.]org genpral[.]top dogged[.]cf siyaghasourccing[.]com www[.]slompbit[.]xyz Files and or
domaingenpral.topwww[.]greenfleld[.]com safemann[.]tk awele[.]duckdns[.]org genpral[.]top dogged[.]cf siyaghasourccing[.]com www[.]slompbit[.]xyz F
domainpafindo.me[.]17 104[.]27[.]133[.]244 104[.]31[.]75[.]107 Domain Names pafindo[.]me www[.]greenfleld[.]com safemann[.]tk awele[.]duckdns[.]or
domainsafemann.tk.]75[.]107 Domain Names pafindo[.]me www[.]greenfleld[.]com safemann[.]tk awele[.]duckdns[.]org genpral[.]top dogged[.]cf siyaghaso
domainsiyaghasourccing.comfemann[.]tk awele[.]duckdns[.]org genpral[.]top dogged[.]cf siyaghasourccing[.]com www[.]slompbit[.]xyz Files and or directories created %Ap
domainwww.bvasetro.com[.]143 31[.]31[.]196[.]52 108[.]167[.]133[.]24 Domain Names www[.]bvasetro[.]com www[.]testci20170903033002[.]net www[.]com-logninsautho
domainwww.com-logninsauthorize.infoNames www[.]bvasetro[.]com www[.]testci20170903033002[.]net www[.]com-logninsauthorize[.]info www[.]healinggoodness[.]com www[.]losmejorescrm[.]com w
domainwww.greenfleld.com7[.]133[.]244 104[.]31[.]75[.]107 Domain Names pafindo[.]me www[.]greenfleld[.]com safemann[.]tk awele[.]duckdns[.]org genpral[.]top dogge
domainwww.grm-group.info[.]ptt-test[.]com www[.]thlg8[.]com www[.]mechakawaii[.]com www[.]grm-group[.]info Files and or directories created %AppData%\OQO3TQDA\OQO
domainwww.healinggoodness.comestci20170903033002[.]net www[.]com-logninsauthorize[.]info www[.]healinggoodness[.]com www[.]losmejorescrm[.]com www[.]mytechnik-beratung[.]co
domainwww.losmejorescrm.comw[.]com-logninsauthorize[.]info www[.]healinggoodness[.]com www[.]losmejorescrm[.]com www[.]mytechnik-beratung[.]com www[.]vintageontheline[.
domainwww.mechakawaii.comntageontheline[.]com www[.]ptt-test[.]com www[.]thlg8[.]com www[.]mechakawaii[.]com www[.]grm-group[.]info Files and or directories created
domainwww.mytechnik-beratung.com]info www[.]healinggoodness[.]com www[.]losmejorescrm[.]com www[.]mytechnik-beratung[.]com www[.]vintageontheline[.]com www[.]ptt-test[.]com www[.
domainwww.ptt-test.comwww[.]mytechnik-beratung[.]com www[.]vintageontheline[.]com www[.]ptt-test[.]com www[.]thlg8[.]com www[.]mechakawaii[.]com www[.]grm-gro
domainwww.slompbit.xyzkdns[.]org genpral[.]top dogged[.]cf siyaghasourccing[.]com www[.]slompbit[.]xyz Files and or directories created %AppData%\WindowsUpdat
domainwww.testci20170903033002.net.]52 108[.]167[.]133[.]24 Domain Names www[.]bvasetro[.]com www[.]testci20170903033002[.]net www[.]com-logninsauthorize[.]info www[.]healinggoodness
domainwww.thlg8.comung[.]com www[.]vintageontheline[.]com www[.]ptt-test[.]com www[.]thlg8[.]com www[.]mechakawaii[.]com www[.]grm-group[.]info Files an
domainwww.vintageontheline.comom www[.]losmejorescrm[.]com www[.]mytechnik-beratung[.]com www[.]vintageontheline[.]com www[.]ptt-test[.]com www[.]thlg8[.]com www[.]mechakawai
sha256028fd51a51027132ba29e92e35f1a5c90aad573bcb21c22a919401f53c2e1fe4C5.lck \Sys.exe %LocalAppData%\Temp\bhvDE00.tmp File Hashes 028fd51a51027132ba29e92e35f1a5c90aad573bcb21c22a919401f53c2e1fe4 2234c2a2e7c67e7056c3ffe96476d785917e24c41d4526be48a5aed7100
sha256029a61486c99ab399ea8d1d44f7fcec56160651af33261d6bc024e4179d328e4pData%\Temp\U97.exe %LocalAppData%\Temp\U97.exe File Hashes 029a61486c99ab399ea8d1d44f7fcec56160651af33261d6bc024e4179d328e4 03b77bb507d1625cba273a703d337218eca7acbf7432df38e9318715deb
sha25603b77bb507d1625cba273a703d337218eca7acbf7432df38e9318715deb0ae611486c99ab399ea8d1d44f7fcec56160651af33261d6bc024e4179d328e4 03b77bb507d1625cba273a703d337218eca7acbf7432df38e9318715deb0ae61 0947a945f7aec12d0861b138d80d8a7603167d1cbe775fd6b83d7d94f5c
sha25605c99bb1cd32c3e0483a8e6a862522918427ef78528c62e0f19bc66d79c61924ries created %WinDir%\SysWOW64\M2uHY39lfNiv.exe File Hashes 05c99bb1cd32c3e0483a8e6a862522918427ef78528c62e0f19bc66d79c61924 1685a821c96e8a5238012bdb27727d0ef77337b43a3f42336512e569492
sha2560947a945f7aec12d0861b138d80d8a7603167d1cbe775fd6b83d7d94f5ccd444bb507d1625cba273a703d337218eca7acbf7432df38e9318715deb0ae61 0947a945f7aec12d0861b138d80d8a7603167d1cbe775fd6b83d7d94f5ccd444 1316a3970c94e825d1d9369a02994c01c1d2f5f28495cb5d8938768c046
sha2561316a3970c94e825d1d9369a02994c01c1d2f5f28495cb5d8938768c046a2d41945f7aec12d0861b138d80d8a7603167d1cbe775fd6b83d7d94f5ccd444 1316a3970c94e825d1d9369a02994c01c1d2f5f28495cb5d8938768c046a2d41 1f1a8c28d686b8cea19181f2a54794a4d208c606f9fd0c2e5b5b29609d9
sha2561685a821c96e8a5238012bdb27727d0ef77337b43a3f42336512e569492385bdbb1cd32c3e0483a8e6a862522918427ef78528c62e0f19bc66d79c61924 1685a821c96e8a5238012bdb27727d0ef77337b43a3f42336512e569492385bd 196e36f7b92395cb1f1ae8e4abe16bb0d1331cf3964aac1d42e916ded5b
sha256196e36f7b92395cb1f1ae8e4abe16bb0d1331cf3964aac1d42e916ded5bd97ac821c96e8a5238012bdb27727d0ef77337b43a3f42336512e569492385bd 196e36f7b92395cb1f1ae8e4abe16bb0d1331cf3964aac1d42e916ded5bd97ac 1b6725f6483cf63ff5f553dd1130fbf20ef3dce66f2387e325a0d55ef63
sha2561b6725f6483cf63ff5f553dd1130fbf20ef3dce66f2387e325a0d55ef6357f146f7b92395cb1f1ae8e4abe16bb0d1331cf3964aac1d42e916ded5bd97ac 1b6725f6483cf63ff5f553dd1130fbf20ef3dce66f2387e325a0d55ef6357f14 27f57d7f6857d965623ca46a8da245449a7bef1f566612c57a5080fb33d
sha2561f1a8c28d686b8cea19181f2a54794a4d208c606f9fd0c2e5b5b29609d9d59483970c94e825d1d9369a02994c01c1d2f5f28495cb5d8938768c046a2d41 1f1a8c28d686b8cea19181f2a54794a4d208c606f9fd0c2e5b5b29609d9d5948 1f95c39e22609e5d6009de3caab9224f71efe03ffbbf8bdd1433c71546c
sha2561f95c39e22609e5d6009de3caab9224f71efe03ffbbf8bdd1433c71546cb4ba4c28d686b8cea19181f2a54794a4d208c606f9fd0c2e5b5b29609d9d5948 1f95c39e22609e5d6009de3caab9224f71efe03ffbbf8bdd1433c71546cb4ba4 277ad7f890bbfae3a0e8f24d8fbac51963f4bb161487c095b3f951dc1e0
sha2562234c2a2e7c67e7056c3ffe96476d785917e24c41d4526be48a5aed71008692f51a51027132ba29e92e35f1a5c90aad573bcb21c22a919401f53c2e1fe4 2234c2a2e7c67e7056c3ffe96476d785917e24c41d4526be48a5aed71008692f 2528df691ef2db7f155edf988ad14cf4a60bdd78725ef482731f798ee9b
sha2562528df691ef2db7f155edf988ad14cf4a60bdd78725ef482731f798ee9bbf22b2a2e7c67e7056c3ffe96476d785917e24c41d4526be48a5aed71008692f 2528df691ef2db7f155edf988ad14cf4a60bdd78725ef482731f798ee9bbf22b 2e8cf252b1308b94733b3bde811810bf6d4b6ad801cb25ddbe0864cfd2d
sha256277ad7f890bbfae3a0e8f24d8fbac51963f4bb161487c095b3f951dc1e0034af39e22609e5d6009de3caab9224f71efe03ffbbf8bdd1433c71546cb4ba4 277ad7f890bbfae3a0e8f24d8fbac51963f4bb161487c095b3f951dc1e0034af 2e70ea6467d4fef3c8ec276724fd95c6dd06e7ca5d8fdf4d79732bbcec9
sha25627f57d7f6857d965623ca46a8da245449a7bef1f566612c57a5080fb33de61ed5f6483cf63ff5f553dd1130fbf20ef3dce66f2387e325a0d55ef6357f14 27f57d7f6857d965623ca46a8da245449a7bef1f566612c57a5080fb33de61ed 2dbff5e59d76080e380afec2a128a2134f4beda7e3871fb82f131fa8dfe
sha2562dbff5e59d76080e380afec2a128a2134f4beda7e3871fb82f131fa8dfe23d60d7f6857d965623ca46a8da245449a7bef1f566612c57a5080fb33de61ed 2dbff5e59d76080e380afec2a128a2134f4beda7e3871fb82f131fa8dfe23d60 533904873f5b44acc5f93353877829ab41e839126d6d5e0b8a7316beac6
sha2562e70ea6467d4fef3c8ec276724fd95c6dd06e7ca5d8fdf4d79732bbcec9043267f890bbfae3a0e8f24d8fbac51963f4bb161487c095b3f951dc1e0034af 2e70ea6467d4fef3c8ec276724fd95c6dd06e7ca5d8fdf4d79732bbcec904326 32d89fbd94fe890b7cc07540cdb9c2f2546ec5ee863196a248b4567ae43
sha2562e8cf252b1308b94733b3bde811810bf6d4b6ad801cb25ddbe0864cfd2dec75ff691ef2db7f155edf988ad14cf4a60bdd78725ef482731f798ee9bbf22b 2e8cf252b1308b94733b3bde811810bf6d4b6ad801cb25ddbe0864cfd2dec75f 2e9a6106bf248abadc1d1cca31ea98f49b4b7c790d321ad728c12710ae3
sha2562e9a6106bf248abadc1d1cca31ea98f49b4b7c790d321ad728c12710ae3dfa16252b1308b94733b3bde811810bf6d4b6ad801cb25ddbe0864cfd2dec75f 2e9a6106bf248abadc1d1cca31ea98f49b4b7c790d321ad728c12710ae3dfa16 34da76e36056a82a77bb5c498fa7444d57ab471205176d1aff438c4c285
sha25632d89fbd94fe890b7cc07540cdb9c2f2546ec5ee863196a248b4567ae43a07f1a6467d4fef3c8ec276724fd95c6dd06e7ca5d8fdf4d79732bbcec904326 32d89fbd94fe890b7cc07540cdb9c2f2546ec5ee863196a248b4567ae43a07f1 32ed5c60cffc9e7b5fe7d740232fdacbd31129e5109fc9db7ff84bb4c07
sha25632ed5c60cffc9e7b5fe7d740232fdacbd31129e5109fc9db7ff84bb4c07d7898fbd94fe890b7cc07540cdb9c2f2546ec5ee863196a248b4567ae43a07f1 32ed5c60cffc9e7b5fe7d740232fdacbd31129e5109fc9db7ff84bb4c07d7898 35ac0533eced35b370857e4b2b447e7c24b3224140b60edb5150861c0aa
sha25634da76e36056a82a77bb5c498fa7444d57ab471205176d1aff438c4c285764ff106bf248abadc1d1cca31ea98f49b4b7c790d321ad728c12710ae3dfa16 34da76e36056a82a77bb5c498fa7444d57ab471205176d1aff438c4c285764ff 388a47dd46aa9d35c2875e687594bd053484d6380f8929d175cb6d4b6b2
sha25635ac0533eced35b370857e4b2b447e7c24b3224140b60edb5150861c0aa74026c60cffc9e7b5fe7d740232fdacbd31129e5109fc9db7ff84bb4c07d7898 35ac0533eced35b370857e4b2b447e7c24b3224140b60edb5150861c0aa74026 394196bc5702741978c1473d0ed835197341a2a30da48130764429fd717
sha256388a47dd46aa9d35c2875e687594bd053484d6380f8929d175cb6d4b6b293dcf6e36056a82a77bb5c498fa7444d57ab471205176d1aff438c4c285764ff 388a47dd46aa9d35c2875e687594bd053484d6380f8929d175cb6d4b6b293dcf 3a3a6db3d266830cd471cbb84d1707e915bf3ffbe54b84abff5ee703d91
sha256394196bc5702741978c1473d0ed835197341a2a30da48130764429fd717f1e74533eced35b370857e4b2b447e7c24b3224140b60edb5150861c0aa74026 394196bc5702741978c1473d0ed835197341a2a30da48130764429fd717f1e74 39eebb75f80b28445c50aaf25c1c0c757099bca5393fa4f4c7f5fbcf725
sha25639b1fb29a067a7129665f1289b608025f2495af0860e3ad903c50b97900556b8ta%\Temp\sex1tusl.bnb.ps1 %UserProfile%\802.exe File Hashes 39b1fb29a067a7129665f1289b608025f2495af0860e3ad903c50b97900556b8 42b6c861f47e1fcb5d8afca56545164e81371cc300d54cf8c62c3a68735
sha25639eebb75f80b28445c50aaf25c1c0c757099bca5393fa4f4c7f5fbcf725880756bc5702741978c1473d0ed835197341a2a30da48130764429fd717f1e74 39eebb75f80b28445c50aaf25c1c0c757099bca5393fa4f4c7f5fbcf72588075 3b5fe513e2178928fb5f4c07da4cd6e85572332353119c78f276b1aa020
sha2563a3a6db3d266830cd471cbb84d1707e915bf3ffbe54b84abff5ee703d91e64857dd46aa9d35c2875e687594bd053484d6380f8929d175cb6d4b6b293dcf 3a3a6db3d266830cd471cbb84d1707e915bf3ffbe54b84abff5ee703d91e6485 4160c38ae1dc75fd8ecadef940a522f123f55d2e7930be952438aa79ec9
sha2563b5fe513e2178928fb5f4c07da4cd6e85572332353119c78f276b1aa02008823b75f80b28445c50aaf25c1c0c757099bca5393fa4f4c7f5fbcf72588075 3b5fe513e2178928fb5f4c07da4cd6e85572332353119c78f276b1aa02008823 3bb8174f1cfd068311b93910f975f0422c775b39097fae2a4df0e394dbe
sha2563bb8174f1cfd068311b93910f975f0422c775b39097fae2a4df0e394dbec4e0a513e2178928fb5f4c07da4cd6e85572332353119c78f276b1aa02008823 3bb8174f1cfd068311b93910f975f0422c775b39097fae2a4df0e394dbec4e0a 3ef383fac7b7d0a7c41c92c23e56f5301b852c55f797f8642654a489ea8
sha2563ef383fac7b7d0a7c41c92c23e56f5301b852c55f797f8642654a489ea89154674f1cfd068311b93910f975f0422c775b39097fae2a4df0e394dbec4e0a 3ef383fac7b7d0a7c41c92c23e56f5301b852c55f797f8642654a489ea891546 52ccf4aea5e219eb6d7779f445ef381447eac605db64dc5ad3b28cb0b21
sha2564160c38ae1dc75fd8ecadef940a522f123f55d2e7930be952438aa79ec97cfd2db3d266830cd471cbb84d1707e915bf3ffbe54b84abff5ee703d91e6485 4160c38ae1dc75fd8ecadef940a522f123f55d2e7930be952438aa79ec97cfd2 4be4c1d3f17092537cbb850c669ec2ef939ca70888b5e8aa334f087833b
sha25642b6c861f47e1fcb5d8afca56545164e81371cc300d54cf8c62c3a6873599c3fb29a067a7129665f1289b608025f2495af0860e3ad903c50b97900556b8 42b6c861f47e1fcb5d8afca56545164e81371cc300d54cf8c62c3a6873599c3f 6d19edf4fb1031eb9f355b6a769a0a134f62bac5928f7553da1af0cf22e
sha2564be4c1d3f17092537cbb850c669ec2ef939ca70888b5e8aa334f087833b2e58e38ae1dc75fd8ecadef940a522f123f55d2e7930be952438aa79ec97cfd2 4be4c1d3f17092537cbb850c669ec2ef939ca70888b5e8aa334f087833b2e58e 62025cd8f7561c4bb148c158b34a7dfa4c167847e6ad1079cd923e9edc7
sha25652ccf4aea5e219eb6d7779f445ef381447eac605db64dc5ad3b28cb0b21f716e3fac7b7d0a7c41c92c23e56f5301b852c55f797f8642654a489ea891546 52ccf4aea5e219eb6d7779f445ef381447eac605db64dc5ad3b28cb0b21f716e 539e2b5fcac0cb124b8963df5eb05a9f4246963b7d4b5dd7d1beb10785f
sha256533904873f5b44acc5f93353877829ab41e839126d6d5e0b8a7316beac6fe2bf5e59d76080e380afec2a128a2134f4beda7e3871fb82f131fa8dfe23d60 533904873f5b44acc5f93353877829ab41e839126d6d5e0b8a7316beac6fe2bf 57b5249647e35c906de7c45c196e5768a9b85b0904e348e9ee673957df0
sha256539e2b5fcac0cb124b8963df5eb05a9f4246963b7d4b5dd7d1beb10785fffa994aea5e219eb6d7779f445ef381447eac605db64dc5ad3b28cb0b21f716e 539e2b5fcac0cb124b8963df5eb05a9f4246963b7d4b5dd7d1beb10785fffa99 56572619ff42dd8a9d58816134605ebf4d08ab4a90972ee5e33b082c9d0
sha25656572619ff42dd8a9d58816134605ebf4d08ab4a90972ee5e33b082c9d05e1c3b5fcac0cb124b8963df5eb05a9f4246963b7d4b5dd7d1beb10785fffa99 56572619ff42dd8a9d58816134605ebf4d08ab4a90972ee5e33b082c9d05e1c3 566404b1f32cdf120c82cff12ade5b6ec91056a5058fe76a91d2967973a
sha256566404b1f32cdf120c82cff12ade5b6ec91056a5058fe76a91d2967973aeb2fa619ff42dd8a9d58816134605ebf4d08ab4a90972ee5e33b082c9d05e1c3 566404b1f32cdf120c82cff12ade5b6ec91056a5058fe76a91d2967973aeb2fa 57cecd6a7451c556cb00ac2dcff02a071f29a83b5ec2ee47ef106ec39b9
sha25657b5249647e35c906de7c45c196e5768a9b85b0904e348e9ee673957df01bf034873f5b44acc5f93353877829ab41e839126d6d5e0b8a7316beac6fe2bf 57b5249647e35c906de7c45c196e5768a9b85b0904e348e9ee673957df01bf03 5a344865de5fffad1e8c19554146891220a3311580dac74fe6d97b27ef3
sha25657cecd6a7451c556cb00ac2dcff02a071f29a83b5ec2ee47ef106ec39b9024aa4b1f32cdf120c82cff12ade5b6ec91056a5058fe76a91d2967973aeb2fa 57cecd6a7451c556cb00ac2dcff02a071f29a83b5ec2ee47ef106ec39b9024aa 62ffb7c248775b8e6c7f64a093377de2d54c6050063c73486ed36218240
sha2565a344865de5fffad1e8c19554146891220a3311580dac74fe6d97b27ef31af0d49647e35c906de7c45c196e5768a9b85b0904e348e9ee673957df01bf03 5a344865de5fffad1e8c19554146891220a3311580dac74fe6d97b27ef31af0d 5dc5976380636bb8944b555547357401e9a6492219afa4b1bf5303910b5
sha2565dc5976380636bb8944b555547357401e9a6492219afa4b1bf5303910b5c751d865de5fffad1e8c19554146891220a3311580dac74fe6d97b27ef31af0d 5dc5976380636bb8944b555547357401e9a6492219afa4b1bf5303910b5c751d bd0fdb5024f3b812476319c9542863abad97d80eded9a12012274c76cb2
sha25662025cd8f7561c4bb148c158b34a7dfa4c167847e6ad1079cd923e9edc759b4a1d3f17092537cbb850c669ec2ef939ca70888b5e8aa334f087833b2e58e 62025cd8f7561c4bb148c158b34a7dfa4c167847e6ad1079cd923e9edc759b4a 667d6a7d6e36821428d87cab4b4b22acf80e69d4393d7353ef200b0aadd
sha25662ffb7c248775b8e6c7f64a093377de2d54c6050063c73486ed3621824068a97d6a7451c556cb00ac2dcff02a071f29a83b5ec2ee47ef106ec39b9024aa 62ffb7c248775b8e6c7f64a093377de2d54c6050063c73486ed3621824068a97 665e1b2319553e76b871c4b60cc18b4609334e45fc00309060a98f7b58a
sha256665e1b2319553e76b871c4b60cc18b4609334e45fc00309060a98f7b58a0cba27c248775b8e6c7f64a093377de2d54c6050063c73486ed3621824068a97 665e1b2319553e76b871c4b60cc18b4609334e45fc00309060a98f7b58a0cba2 69b312c7ac1509ee9789fb516d6b1d57d1634e5da9831b31f804a3685bf
sha256667d6a7d6e36821428d87cab4b4b22acf80e69d4393d7353ef200b0aadd40b39cd8f7561c4bb148c158b34a7dfa4c167847e6ad1079cd923e9edc759b4a 667d6a7d6e36821428d87cab4b4b22acf80e69d4393d7353ef200b0aadd40b39 7072e12ef4fedfdc2c015daba59b023b7fe4f9659331939568917178f73
sha25669b312c7ac1509ee9789fb516d6b1d57d1634e5da9831b31f804a3685bf40ed5b2319553e76b871c4b60cc18b4609334e45fc00309060a98f7b58a0cba2 69b312c7ac1509ee9789fb516d6b1d57d1634e5da9831b31f804a3685bf40ed5 69d061bace29d55f83505a2ab54ee4fce9cb5f56b8dd666b9dea53b7477
sha25669d061bace29d55f83505a2ab54ee4fce9cb5f56b8dd666b9dea53b7477adee52c7ac1509ee9789fb516d6b1d57d1634e5da9831b31f804a3685bf40ed5 69d061bace29d55f83505a2ab54ee4fce9cb5f56b8dd666b9dea53b7477adee5 COVERAGE SCREENSHOTS OF DETECTION ThreatGrid Umbrella Win.D
sha2566d19edf4fb1031eb9f355b6a769a0a134f62bac5928f7553da1af0cf22eeac2f861f47e1fcb5d8afca56545164e81371cc300d54cf8c62c3a6873599c3f 6d19edf4fb1031eb9f355b6a769a0a134f62bac5928f7553da1af0cf22eeac2f 81ea956fa6739a15975cd95abdb1a7986a7d664dfaa53cbe271a7b5fd10
sha2567072e12ef4fedfdc2c015daba59b023b7fe4f9659331939568917178f7354354a7d6e36821428d87cab4b4b22acf80e69d4393d7353ef200b0aadd40b39 7072e12ef4fedfdc2c015daba59b023b7fe4f9659331939568917178f7354354 92a3a24c0cb30f50b9a3e55ed25b913c2a3ebfcce31ed04f5f1c061d2d2
sha25681ea956fa6739a15975cd95abdb1a7986a7d664dfaa53cbe271a7b5fd1036edbdf4fb1031eb9f355b6a769a0a134f62bac5928f7553da1af0cf22eeac2f 81ea956fa6739a15975cd95abdb1a7986a7d664dfaa53cbe271a7b5fd1036edb a1b3e7b6b3330198ca2cbc5dd8f9a8fc6f7255680629f27c00f552b3982
sha25692a3a24c0cb30f50b9a3e55ed25b913c2a3ebfcce31ed04f5f1c061d2d2463bb12ef4fedfdc2c015daba59b023b7fe4f9659331939568917178f7354354 92a3a24c0cb30f50b9a3e55ed25b913c2a3ebfcce31ed04f5f1c061d2d2463bb 9d534c670a3ba061e7582766d5aa26590e7e29a59d71e5c7458141371f0
sha2569d534c670a3ba061e7582766d5aa26590e7e29a59d71e5c7458141371f04217d24c0cb30f50b9a3e55ed25b913c2a3ebfcce31ed04f5f1c061d2d2463bb 9d534c670a3ba061e7582766d5aa26590e7e29a59d71e5c7458141371f04217d bb54543651b5e69454f4ec905a7edcfb0c16d9ab6a145d8afd100056bfb
sha256a1b3e7b6b3330198ca2cbc5dd8f9a8fc6f7255680629f27c00f552b3982e877056fa6739a15975cd95abdb1a7986a7d664dfaa53cbe271a7b5fd1036edb a1b3e7b6b3330198ca2cbc5dd8f9a8fc6f7255680629f27c00f552b3982e8770 a84ead33b515b191683ace1f4fd762a9ab0a47e8a0bdbd141c99042debe
sha256a84ead33b515b191683ace1f4fd762a9ab0a47e8a0bdbd141c99042debe16ab57b6b3330198ca2cbc5dd8f9a8fc6f7255680629f27c00f552b3982e8770 a84ead33b515b191683ace1f4fd762a9ab0a47e8a0bdbd141c99042debe16ab5 ad5fd15f99eedfc43bf9e402569511388e7308bb548b36f2ff3180678c1
sha256ad5fd15f99eedfc43bf9e402569511388e7308bb548b36f2ff3180678c166991d33b515b191683ace1f4fd762a9ab0a47e8a0bdbd141c99042debe16ab5 ad5fd15f99eedfc43bf9e402569511388e7308bb548b36f2ff3180678c166991 b7c206428106b9b986e2e72129a94ed77c42cec020f3b2529accd5472de
sha256b7c206428106b9b986e2e72129a94ed77c42cec020f3b2529accd5472de230e115f99eedfc43bf9e402569511388e7308bb548b36f2ff3180678c166991 b7c206428106b9b986e2e72129a94ed77c42cec020f3b2529accd5472de230e1 bbb2a93d92cdef6cdfb04e8cfb0cb911b07190e3db8aa1a32c93326a8fd
sha256bb54543651b5e69454f4ec905a7edcfb0c16d9ab6a145d8afd100056bfbd84c9c670a3ba061e7582766d5aa26590e7e29a59d71e5c7458141371f04217d bb54543651b5e69454f4ec905a7edcfb0c16d9ab6a145d8afd100056bfbd84c9 c39f50e06a3d18483179c8cb4388b98ae0ba3b78879731c710cf74ed1e4
sha256bbb2a93d92cdef6cdfb04e8cfb0cb911b07190e3db8aa1a32c93326a8fdb90fc6428106b9b986e2e72129a94ed77c42cec020f3b2529accd5472de230e1 bbb2a93d92cdef6cdfb04e8cfb0cb911b07190e3db8aa1a32c93326a8fdb90fc c47244459faff7e557ac79b4277b4b8b4bfb550f3d9dbf845af4f352976
sha256bd0fdb5024f3b812476319c9542863abad97d80eded9a12012274c76cb24be3076380636bb8944b555547357401e9a6492219afa4b1bf5303910b5c751d bd0fdb5024f3b812476319c9542863abad97d80eded9a12012274c76cb24be30 cab0c315750aa444b838df04fc2506fad7d85cb4c44f823e3ae7e170c94
sha256c39f50e06a3d18483179c8cb4388b98ae0ba3b78879731c710cf74ed1e42326443651b5e69454f4ec905a7edcfb0c16d9ab6a145d8afd100056bfbd84c9 c39f50e06a3d18483179c8cb4388b98ae0ba3b78879731c710cf74ed1e423264 c5c98d6f4a5327dceae54918353096b17205320077347106d3fdcdf8394
sha256c47244459faff7e557ac79b4277b4b8b4bfb550f3d9dbf845af4f352976186c293d92cdef6cdfb04e8cfb0cb911b07190e3db8aa1a32c93326a8fdb90fc c47244459faff7e557ac79b4277b4b8b4bfb550f3d9dbf845af4f352976186c2 c5ba355f641c33f9197bc6b2fa35e6354ed55e98f476c1fe6dd7a68a07a
sha256c5ba355f641c33f9197bc6b2fa35e6354ed55e98f476c1fe6dd7a68a07a790164459faff7e557ac79b4277b4b8b4bfb550f3d9dbf845af4f352976186c2 c5ba355f641c33f9197bc6b2fa35e6354ed55e98f476c1fe6dd7a68a07a79016 e98698880ec4b02325a7b21119783a2841d7c288a2146c73ead369ea749
sha256c5c98d6f4a5327dceae54918353096b17205320077347106d3fdcdf8394c4dd80e06a3d18483179c8cb4388b98ae0ba3b78879731c710cf74ed1e423264 c5c98d6f4a5327dceae54918353096b17205320077347106d3fdcdf8394c4dd8 c9504878e0f9a6730f2f218b92c458d3e982a78883b601dfba704b724d5
sha256c9504878e0f9a6730f2f218b92c458d3e982a78883b601dfba704b724d539e73d6f4a5327dceae54918353096b17205320077347106d3fdcdf8394c4dd8 c9504878e0f9a6730f2f218b92c458d3e982a78883b601dfba704b724d539e73 ed3df212bea4cc4c44f7bd39429b15458df0bf7f70caeb4b1b4e1afda0e
sha256cab0c315750aa444b838df04fc2506fad7d85cb4c44f823e3ae7e170c940561ab5024f3b812476319c9542863abad97d80eded9a12012274c76cb24be30 cab0c315750aa444b838df04fc2506fad7d85cb4c44f823e3ae7e170c940561a d668cffa3e3ccf6b216efe3ab24b23d47fe0a5257819216b4a0f0e5ff1c
sha256d668cffa3e3ccf6b216efe3ab24b23d47fe0a5257819216b4a0f0e5ff1ca4aab315750aa444b838df04fc2506fad7d85cb4c44f823e3ae7e170c940561a d668cffa3e3ccf6b216efe3ab24b23d47fe0a5257819216b4a0f0e5ff1ca4aab f2c87fa787d18cd3a39d4652f4b567eed206619c62af34b0f3799107504
sha256e98698880ec4b02325a7b21119783a2841d7c288a2146c73ead369ea749f27bd55f641c33f9197bc6b2fa35e6354ed55e98f476c1fe6dd7a68a07a79016 e98698880ec4b02325a7b21119783a2841d7c288a2146c73ead369ea749f27bd COVERAGE SCREENSHOTS OF DETECTION AMP ThreatGrid Umbrella W
sha256ed3df212bea4cc4c44f7bd39429b15458df0bf7f70caeb4b1b4e1afda0ebbaec878e0f9a6730f2f218b92c458d3e982a78883b601dfba704b724d539e73 ed3df212bea4cc4c44f7bd39429b15458df0bf7f70caeb4b1b4e1afda0ebbaec COVERAGE SCREENSHOTS OF DETECTION AMP ThreatGrid Umbrella D
sha256f2c87fa787d18cd3a39d4652f4b567eed206619c62af34b0f37991075044f284ffa3e3ccf6b216efe3ab24b23d47fe0a5257819216b4a0f0e5ff1ca4aab f2c87fa787d18cd3a39d4652f4b567eed206619c62af34b0f37991075044f284 f560e84bcd29a9454a79a0a90cdd6def36b78d728bad9f2ac41bec75568
sha256f560e84bcd29a9454a79a0a90cdd6def36b78d728bad9f2ac41bec75568b1406fa787d18cd3a39d4652f4b567eed206619c62af34b0f37991075044f284 f560e84bcd29a9454a79a0a90cdd6def36b78d728bad9f2ac41bec75568b1406 COVERAGE SCREENSHOTS OF DETECTION AMP ThreatGrid Win.Droppe
Full article1,064 words · extracted from blog.talosintelligence.com · click to collapse

Friday, September 14, 2018 13:32

Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Sept. 7 and 14. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

  • Win.Dropper.Gamarue-6682684-0
    Dropper
    Gamarue, also known as Andromeda, is a botnet used to spread malware, steal information and perform other ilicit activities, such as click fraud.
  • Doc.Downloader.Powload-6681541-0
    Downloader
    Powload is a malicious document that uses PowerShell to download malware. This campaign is currently distributing the Emotet malware.
  • Win.Dropper.Hploki-6682476-0
    Dropper
    HpLoki is spread via malspam and is designed to steal passwords and user credentials for common programs such as Firefox and Outlook.
  • Win.Dropper.Emotet-6681708-0
    Dropper
    Emotet is a banking trojan with remote access capability that has remained relevant due to its continual evolution to bypass antivirus products.
  • Win.Dropper.Kovter-6681669-0
    Dropper
    Kovter is known for it's fileless persistence mechanism. This family of malware creates several malicious registry entries which store it's malicious code. Kovter is capable of reinfecting a system even if the file system has been cleaned of the infection. Kovter has been used in the past to spread ransomware and click-fraud malware.
  • Win.Dropper.Bredolab-6681668-0
    Dropper
    Bredolab is a trojan with remote access capability that downloads and distributes other malware such as botnets and Remote Access Trojans (RATs).
  • Win.Dropper.Johnnie-6681665-0
    Dropper
    Johnnie, also known as Mikey, is a malware family that focuses on persistence, and is known for its plugin architecture.
  • Win.Dropper.Zbot-6681657-0
    Dropper
    Zbot, also known as Zeus, is a trojan with remote access capability that steals information such as banking credentials using a variety of methods, including key-logging and form-grabbing.
  • Doc.Dropper.Valyria-6680534-0
    Dropper
    Valyria is a malicious Microsoft Word document family that is used to distribute other malware. This campaign is currently spreading Emotet.
  • Win.Dropper.Darkkomet-6680876-0
    Dropper
    DarkKomet is a freeware remote access tool that was released by an independent software developer. It provides the same functionality you would expect from a remote access tool: keylogging, webcam access, microphone access, remote desktop, URL download, program execution, etc.
  • Win.Dropper.Ponystealer-6680912-0
    Dropper
    Ponystealer is known to steal credentials from more than 100 different applications and may also install other malware such as a Remote Access Trojan (RAT).
  • Win.Dropper.Tspy-6680869-0
    Dropper
    The Tspy trojan is used to steal information, such as banking credentials, and installs a remote-access backdoor.
  • Win.Dropper.Fareit-6680873-0
    Dropper
    The Fareit trojan is primarily an information stealer that can download and install other malware.

THREATS

Win.Dropper.Gamarue-6682684-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
  • Value Name: Hidden
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: Windows Update

Mutexes

  • 3749282D282E1E80C56CAE5A

IP Addresses

  • 65[.]154[.]166[.]201
  • 45[.]122[.]138[.]6
  • 213[.]180[.]204[.]38
  • 46[.]249[.]38[.]155
  • 104[.]16[.]19[.]96
  • 104[.]16[.]18[.]96
  • 104[.]28[.]12[.]17
  • 104[.]27[.]133[.]244
  • 104[.]31[.]75[.]107

Domain Names

  • pafindo[.]me
  • www[.]greenfleld[.]com
  • safemann[.]tk
  • awele[.]duckdns[.]org
  • genpral[.]top
  • dogged[.]cf
  • siyaghasourccing[.]com
  • www[.]slompbit[.]xyz

Files and or directories created

  • %AppData%\WindowsUpdate.exe
  • %AppData%\pid.txt
  • %AppData%\pidloc.txt
  • %LocalAppData%\Temp\holdermail.txt
  • %LocalAppData%\Temp\holderwb.txt
  • %AppData%\D282E1\1E80C5.lck
  • \Sys.exe
  • %LocalAppData%\Temp\bhvDE00.tmp

File Hashes

  • 028fd51a51027132ba29e92e35f1a5c90aad573bcb21c22a919401f53c2e1fe4
  • 2234c2a2e7c67e7056c3ffe96476d785917e24c41d4526be48a5aed71008692f
  • 2528df691ef2db7f155edf988ad14cf4a60bdd78725ef482731f798ee9bbf22b
  • 2e8cf252b1308b94733b3bde811810bf6d4b6ad801cb25ddbe0864cfd2dec75f
  • 2e9a6106bf248abadc1d1cca31ea98f49b4b7c790d321ad728c12710ae3dfa16
  • 34da76e36056a82a77bb5c498fa7444d57ab471205176d1aff438c4c285764ff
  • 388a47dd46aa9d35c2875e687594bd053484d6380f8929d175cb6d4b6b293dcf
  • 3a3a6db3d266830cd471cbb84d1707e915bf3ffbe54b84abff5ee703d91e6485
  • 4160c38ae1dc75fd8ecadef940a522f123f55d2e7930be952438aa79ec97cfd2
  • 4be4c1d3f17092537cbb850c669ec2ef939ca70888b5e8aa334f087833b2e58e
  • 62025cd8f7561c4bb148c158b34a7dfa4c167847e6ad1079cd923e9edc759b4a
  • 667d6a7d6e36821428d87cab4b4b22acf80e69d4393d7353ef200b0aadd40b39
  • 7072e12ef4fedfdc2c015daba59b023b7fe4f9659331939568917178f7354354
  • 92a3a24c0cb30f50b9a3e55ed25b913c2a3ebfcce31ed04f5f1c061d2d2463bb
  • 9d534c670a3ba061e7582766d5aa26590e7e29a59d71e5c7458141371f04217d
  • bb54543651b5e69454f4ec905a7edcfb0c16d9ab6a145d8afd100056bfbd84c9
  • c39f50e06a3d18483179c8cb4388b98ae0ba3b78879731c710cf74ed1e423264
  • c5c98d6f4a5327dceae54918353096b17205320077347106d3fdcdf8394c4dd8
  • c9504878e0f9a6730f2f218b92c458d3e982a78883b601dfba704b724d539e73
  • ed3df212bea4cc4c44f7bd39429b15458df0bf7f70caeb4b1b4e1afda0ebbaec

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Umbrella

Doc.Downloader.Powload-6681541-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value Name: WpadDecisionReason
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value Name: WpadDecision
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value Name: WpadNetworkName
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value Name: WpadDetectedUrl
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: Type
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: Start
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: ErrorControl
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: ImagePath
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: DisplayName
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: WOW64
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: ObjectName
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: Description
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value Name: WpadDecisionTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\66-B3-8A-86-98-63
  • Value Name: WpadDecisionReason
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\66-B3-8A-86-98-63
  • Value Name: WpadDecisionTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\66-B3-8A-86-98-63
  • Value Name: WpadDecision
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\66-B3-8A-86-98-63
  • Value Name: WpadDetectedUrl

Mutexes

  • Global\I98B68E3C
  • Global\M98B68E3C

IP Addresses

  • 74[.]59[.]100[.]124
  • 101[.]6[.]34[.]139
  • 42[.]114[.]73[.]81
  • 186[.]10[.]33[.]220
  • 185[.]106[.]208[.]180
  • 5[.]61[.]29[.]155

Domain Names

  • amniyatgostariranian[.]ir

Files and or directories created

  • %LocalAppData%\Temp\rmfwlhcy.zma.psm1
  • %LocalAppData%\Temp\sex1tusl.bnb.ps1
  • %UserProfile%\802.exe

File Hashes

  • 39b1fb29a067a7129665f1289b608025f2495af0860e3ad903c50b97900556b8
  • 42b6c861f47e1fcb5d8afca56545164e81371cc300d54cf8c62c3a6873599c3f
  • 6d19edf4fb1031eb9f355b6a769a0a134f62bac5928f7553da1af0cf22eeac2f
  • 81ea956fa6739a15975cd95abdb1a7986a7d664dfaa53cbe271a7b5fd1036edb
  • a1b3e7b6b3330198ca2cbc5dd8f9a8fc6f7255680629f27c00f552b3982e8770
  • a84ead33b515b191683ace1f4fd762a9ab0a47e8a0bdbd141c99042debe16ab5
  • ad5fd15f99eedfc43bf9e402569511388e7308bb548b36f2ff3180678c166991
  • b7c206428106b9b986e2e72129a94ed77c42cec020f3b2529accd5472de230e1
  • bbb2a93d92cdef6cdfb04e8cfb0cb911b07190e3db8aa1a32c93326a8fdb90fc
  • c47244459faff7e557ac79b4277b4b8b4bfb550f3d9dbf845af4f352976186c2
  • c5ba355f641c33f9197bc6b2fa35e6354ed55e98f476c1fe6dd7a68a07a79016
  • e98698880ec4b02325a7b21119783a2841d7c288a2146c73ead369ea749f27bd

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Umbrella

Win.Dropper.Hploki-6682476-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
  • <HKCU>\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
  • <HKCU>\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\
  • <HKCU>\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook_2016\
  • <HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
  • <HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: LTXD9TT0THZ

Mutexes

  • 8-3503835SZBFHHZ
  • OQO3TQDA3CDEA0Az

IP Addresses

  • 216[.]146[.]38[.]70
  • 199[.]192[.]21[.]6
  • 52[.]7[.]6[.]73
  • 192[.]0[.]78[.]24
  • 107[.]163[.]140[.]178
  • 160[.]124[.]134[.]22
  • 64[.]98[.]145[.]30
  • 209[.]99[.]64[.]53
  • 207[.]148[.]248[.]143
  • 31[.]31[.]196[.]52
  • 108[.]167[.]133[.]24

Domain Names

  • www[.]bvasetro[.]com
  • www[.]testci20170903033002[.]net
  • www[.]com-logninsauthorize[.]info
  • www[.]healinggoodness[.]com
  • www[.]losmejorescrm[.]com
  • www[.]mytechnik-beratung[.]com
  • www[.]vintageontheline[.]com
  • www[.]ptt-test[.]com
  • www[.]thlg8[.]com
  • www[.]mechakawaii[.]com
  • www[.]grm-group[.]info

Files and or directories created

  • %AppData%\OQO3TQDA\OQOlog.ini
  • %AppData%\OQO3TQDA\OQOlogim.jpeg
  • %AppData%\OQO3TQDA\OQOlogrc.ini
  • %AppData%\OQO3TQDA\OQOlogri.ini
  • %AppData%\OQO3TQDA\OQOlogrv.ini
  • %AppData%\OQO3TQDA\OQOlogim.jpeg
  • %AppData%\OQO3TQDA\OQOlogrc.ini
  • %AppData%\OQO3TQDA\OQOlogri.ini
  • %AppData%\OQO3TQDA\OQOlogrv.ini
  • %LocalAppData%\Temp\PNj.exe
  • %LocalAppData%\Temp\PNj.exe
  • \TEMP\Documenti contrattuali.pdf.exe
  • %LocalAppData%\Temp\U97.exe
  • %LocalAppData%\Temp\U97.exe

File Hashes

  • 029a61486c99ab399ea8d1d44f7fcec56160651af33261d6bc024e4179d328e4
  • 03b77bb507d1625cba273a703d337218eca7acbf7432df38e9318715deb0ae61
  • 0947a945f7aec12d0861b138d80d8a7603167d1cbe775fd6b83d7d94f5ccd444
  • 1316a3970c94e825d1d9369a02994c01c1d2f5f28495cb5d8938768c046a2d41
  • 1f1a8c28d686b8cea19181f2a54794a4d208c606f9fd0c2e5b5b29609d9d5948
  • 1f95c39e22609e5d6009de3caab9224f71efe03ffbbf8bdd1433c71546cb4ba4
  • 277ad7f890bbfae3a0e8f24d8fbac51963f4bb161487c095b3f951dc1e0034af
  • 2e70ea6467d4fef3c8ec276724fd95c6dd06e7ca5d8fdf4d79732bbcec904326
  • 32d89fbd94fe890b7cc07540cdb9c2f2546ec5ee863196a248b4567ae43a07f1
  • 32ed5c60cffc9e7b5fe7d740232fdacbd31129e5109fc9db7ff84bb4c07d7898
  • 35ac0533eced35b370857e4b2b447e7c24b3224140b60edb5150861c0aa74026
  • 394196bc5702741978c1473d0ed835197341a2a30da48130764429fd717f1e74
  • 39eebb75f80b28445c50aaf25c1c0c757099bca5393fa4f4c7f5fbcf72588075
  • 3b5fe513e2178928fb5f4c07da4cd6e85572332353119c78f276b1aa02008823
  • 3bb8174f1cfd068311b93910f975f0422c775b39097fae2a4df0e394dbec4e0a
  • 3ef383fac7b7d0a7c41c92c23e56f5301b852c55f797f8642654a489ea891546
  • 52ccf4aea5e219eb6d7779f445ef381447eac605db64dc5ad3b28cb0b21f716e
  • 539e2b5fcac0cb124b8963df5eb05a9f4246963b7d4b5dd7d1beb10785fffa99
  • 56572619ff42dd8a9d58816134605ebf4d08ab4a90972ee5e33b082c9d05e1c3
  • 566404b1f32cdf120c82cff12ade5b6ec91056a5058fe76a91d2967973aeb2fa
  • 57cecd6a7451c556cb00ac2dcff02a071f29a83b5ec2ee47ef106ec39b9024aa
  • 62ffb7c248775b8e6c7f64a093377de2d54c6050063c73486ed3621824068a97
  • 665e1b2319553e76b871c4b60cc18b4609334e45fc00309060a98f7b58a0cba2
  • 69b312c7ac1509ee9789fb516d6b1d57d1634e5da9831b31f804a3685bf40ed5
  • 69d061bace29d55f83505a2ab54ee4fce9cb5f56b8dd666b9dea53b7477adee5

COVERAGE

SCREENSHOTS OF DETECTION

ThreatGrid

Umbrella

Win.Dropper.Emotet-6681708-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value Name: WpadDecisionReason
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value Name: WpadDecision
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value Name: WpadNetworkName
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value Name: WpadDetectedUrl
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: Type
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: Start
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: ErrorControl
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: ImagePath
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: DisplayName
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: WOW64
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: ObjectName
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIMCLOUD
  • Value Name: Description
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{CFFE6C1B-C698-4A68-B86B-DD768F696445}
  • Value Name: WpadDecisionTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\88-29-91-6E-18-27
  • Value Name: WpadDecisionReason
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\88-29-91-6E-18-27
  • Value Name: WpadDecisionTime
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\88-29-91-6E-18-27
  • Value Name: WpadDecision
  • <HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\88-29-91-6E-18-27
  • Value Name: WpadDetectedUrl

Mutexes

  • Global\I98B68E3C
  • Global\M98B68E3C

IP Addresses

  • 118[.]189[.]9[.]243
  • 207[.]107[.]101[.]210
  • 64[.]60[.]82[.]82
  • 189[.]222[.]75[.]8
  • 92[.]27[.]115[.]15
  • 74[.]59[.]100[.]124
  • 110[.]10[.]106[.]151
  • 172[.]223[.]235[.]13
  • 24[.]116[.]40[.]208
  • 101[.]6[.]34[.]139
  • 198[.]72[.]196[.]89

Domain Names

  • N/A

Files and or directories created

  • %WinDir%\SysWOW64\M2uHY39lfNiv.exe

File Hashes

  • 05c99bb1cd32c3e0483a8e6a862522918427ef78528c62e0f19bc66d79c61924
  • 1685a821c96e8a5238012bdb27727d0ef77337b43a3f42336512e569492385bd
  • 196e36f7b92395cb1f1ae8e4abe16bb0d1331cf3964aac1d42e916ded5bd97ac
  • 1b6725f6483cf63ff5f553dd1130fbf20ef3dce66f2387e325a0d55ef6357f14
  • 27f57d7f6857d965623ca46a8da245449a7bef1f566612c57a5080fb33de61ed
  • 2dbff5e59d76080e380afec2a128a2134f4beda7e3871fb82f131fa8dfe23d60
  • 533904873f5b44acc5f93353877829ab41e839126d6d5e0b8a7316beac6fe2bf
  • 57b5249647e35c906de7c45c196e5768a9b85b0904e348e9ee673957df01bf03
  • 5a344865de5fffad1e8c19554146891220a3311580dac74fe6d97b27ef31af0d
  • 5dc5976380636bb8944b555547357401e9a6492219afa4b1bf5303910b5c751d
  • bd0fdb5024f3b812476319c9542863abad97d80eded9a12012274c76cb24be30
  • cab0c315750aa444b838df04fc2506fad7d85cb4c44f823e3ae7e170c940561a
  • d668cffa3e3ccf6b216efe3ab24b23d47fe0a5257819216b4a0f0e5ff1ca4aab
  • f2c87fa787d18cd3a39d4652f4b567eed206619c62af34b0f37991075044f284
  • f560e84bcd29a9454a79a0a90cdd6def36b78d728bad9f2ac41bec75568b1406

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Win.Dropper.Kovter-6681669-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE
  • Value Name: DisableOSUpgrade
  • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\OSUPGRADE
  • Value Name: ReservationsAllowed
  • <HKLM>\SOFTWARE\WOW6432NODE\XVYG
  • Value Name: xedvpa
  • <HKCU>\SOFTWARE\XVYG
  • Value Name: xedvpa
  • <HKLM>\SOFTWARE\WOW6432NODE\XVYG
  • Value Name: tbqjcmuct
  • <HKCU>\SOFTWARE\XVYG
  • Value Name: tbqjcmuct
  • <HKCR>\.8CA9D79
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: vrxzdhbyv
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: ssishoff
  • <HKLM>\SOFTWARE\WOW6432NODE\XVYG
  • Value Name: lujyoqmfl
  • <HKCU>\SOFTWARE\XVYG
  • Value Name: lujyoqmfl
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.101
  • Value Name: CheckSetting
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.103
  • Value Name: CheckSetting
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.100
  • Value Name: CheckSetting
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.102
  • Value Name: CheckSetting
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.104
  • Value Name: CheckSetting
  • <HKLM>\SOFTWARE\WOW6432NODE\47A463C672DD6D6581
  • Value Name: 5CFEE7CEF48215E1
  • <HKLM>\SOFTWARE\WOW6432NODE\VDZEICWMAK
  • Value Name: X6VQZvnwo7
  • <HKLM>\SOFTWARE\WOW6432NODE\VDZEICWMAK
  • Value Name: ntPgALczv
  • <HKCU>\SOFTWARE\XVYG
  • Value Name: tnzok
  • <HKLM>\SOFTWARE\WOW6432NODE\XVYG
  • Value Name: tnzok
  • <HKCU>\SOFTWARE\XVYG
  • Value Name: usukxpt
  • <HKLM>\SOFTWARE\WOW6432NODE\XVYG
  • Value Name: usukxpt
  • <HKLM>\SOFTWARE\WOW6432NODE\VDZEICWMAK
  • Value Name: X6VQZvnwo7
  • <HKLM>\SOFTWARE\WOW6432NODE\VDZEICWMAK
  • Value Name: ntPgALczv
  • <HKLM>\SOFTWARE\WOW6432NODE\XVYG
  • Value Name: svdjlvs
  • <HKCU>\SOFTWARE\XVYG
  • Value Name: svdjlvs
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: fcbburq
  • <HKCR>\C3B616\SHELL\OPEN\COMMAND

Mutexes

  • B3E8F6F86CDD9D8B
  • A83BAA13F950654C
  • EA4EC370D1E573DA
  • A83BAA13F950654C
  • Global\7A7146875A8CDE1E
  • B3E8F6F86CDD9D8B

IP Addresses

  • 78[.]147[.]80[.]55
  • 186[.]92[.]100[.]186
  • 51[.]77[.]159[.]226
  • 54[.]60[.]252[.]133
  • 9[.]10[.]183[.]131
  • 25[.]171[.]204[.]203
  • 200[.]226[.]158[.]165
  • 56[.]64[.]211[.]104
  • 71[.]17[.]167[.]87
  • 71[.]76[.]12[.]139
  • 129[.]120[.]185[.]96
  • 73[.]221[.]63[.]241
  • 89[.]52[.]158[.]17
  • 161[.]76[.]36[.]98
  • 203[.]56[.]237[.]180
  • 110[.]140[.]93[.]114
  • 32[.]88[.]113[.]160
  • 6[.]206[.]4[.]223
  • 31[.]118[.]13[.]79
  • 9[.]82[.]17[.]148
  • 159[.]113[.]86[.]117
  • 220[.]54[.]131[.]35
  • 163[.]142[.]40[.]247
  • 214[.]212[.]60[.]57
  • 131[.]106[.]110[.]95
  • 123[.]2[.]250[.]245
  • 49[.]160[.]59[.]49
  • 114[.]209[.]113[.]187
  • 175[.]6[.]48[.]200
  • 144[.]14[.]99[.]157
  • 182[.]184[.]108[.]63
  • 142[.]136[.]194[.]68
  • 168[.]78[.]106[.]115
  • 143[.]200[.]106[.]175
  • 71[.]80[.]198[.]102
  • 71[.]20[.]130[.]109
  • 43[.]126[.]39[.]85
  • 54[.]101[.]217[.]191
  • 148[.]251[.]151[.]180
  • 153[.]122[.]15[.]46
  • 91[.]224[.]24[.]73
  • 101[.]47[.]103[.]67
  • 150[.]168[.]183[.]66
  • 162[.]48[.]140[.]135
  • 136[.]32[.]54[.]1
  • 14[.]73[.]200[.]171
  • 11[.]253[.]136[.]175
  • 14[.]64[.]130[.]197
  • 114[.]58[.]143[.]28
  • 104[.]8[.]80[.]169
  • 18[.]49[.]202[.]119
  • 44[.]120[.]17[.]31
  • 136[.]193[.]247[.]67
  • 25[.]68[.]69[.]58
  • 84[.]132[.]146[.]243
  • 90[.]94[.]24[.]214
  • 111[.]167[.]239[.]216
  • 205[.]107[.]63[.]68
  • 23[.]31[.]134[.]154
  • 102[.]95[.]176[.]232
  • 219[.]156[.]44[.]255
  • 81[.]9[.]242[.]40
  • 112[.]58[.]225[.]242
  • 1[.]250[.]189[.]144
  • 181[.]128[.]105[.]61
  • 41[.]132[.]73[.]111
  • 115[.]201[.]102[.]188
  • 166[.]242[.]22[.]223
  • 195[.]130[.]6[.]206
  • 16[.]119[.]179[.]29
  • 98[.]100[.]170[.]249
  • 219[.]215[.]144[.]147
  • 56[.]152[.]166[.]131
  • 185[.]113[.]241[.]82
  • 206[.]163[.]159[.]184
  • 21[.]203[.]91[.]206
  • 63[.]42[.]236[.]39
  • 161[.]234[.]178[.]123
  • 123[.]1[.]43[.]230
  • 145[.]163[.]125[.]117
  • 38[.]89[.]103[.]70
  • 121[.]76[.]27[.]206
  • 84[.]30[.]50[.]130
  • 212[.]67[.]45[.]128
  • 181[.]96[.]1[.]34
  • 57[.]40[.]56[.]93
  • 202[.]89[.]99[.]158
  • 18[.]33[.]230[.]2
  • 15[.]254[.]97[.]89
  • 87[.]134[.]145[.]91
  • 99[.]210[.]134[.]76
  • 150[.]117[.]58[.]69
  • 180[.]71[.]129[.]170
  • 45[.]136[.]108[.]51
  • 12[.]150[.]168[.]133
  • 23[.]253[.]50[.]154
  • 102[.]231[.]4[.]10
  • 46[.]172[.]214[.]81
  • 125[.]22[.]4[.]49
  • 124[.]215[.]186[.]198
  • 223[.]142[.]72[.]155
  • 212[.]205[.]119[.]69
  • 153[.]247[.]168[.]105
  • 149[.]174[.]138[.]37
  • 151[.]232[.]21[.]128
  • 21[.]11[.]121[.]107
  • 219[.]233[.]148[.]97
  • 128[.]198[.]138[.]53
  • 96[.]119[.]8[.]208
  • 148[.]58[.]214[.]10
  • 31[.]190[.]112[.]93
  • 60[.]97[.]44[.]10
  • 158[.]83[.]234[.]200
  • 137[.]40[.]230[.]10
  • 215[.]36[.]151[.]2
  • 125[.]29[.]217[.]151
  • 102[.]51[.]77[.]47
  • 110[.]159[.]253[.]93
  • 210[.]116[.]166[.]149
  • 147[.]240[.]74[.]32
  • 53[.]114[.]49[.]104
  • 201[.]11[.]100[.]75
  • 91[.]49[.]222[.]11
  • 5[.]54[.]132[.]49
  • 169[.]184[.]190[.]51
  • 39[.]189[.]235[.]205
  • 111[.]189[.]60[.]176
  • 170[.]122[.]170[.]244
  • 91[.]202[.]2[.]141
  • 70[.]179[.]112[.]71
  • 41[.]182[.]103[.]110
  • 142[.]14[.]55[.]144
  • 73[.]6[.]217[.]29
  • 59[.]78[.]136[.]88
  • 214[.]117[.]70[.]130
  • 154[.]161[.]82[.]126
  • 34[.]43[.]14[.]56
  • 209[.]160[.]109[.]177
  • 217[.]104[.]208[.]153
  • 98[.]11[.]81[.]33
  • 178[.]246[.]228[.]193
  • 150[.]77[.]136[.]244
  • 47[.]137[.]143[.]37
  • 77[.]196[.]34[.]150
  • 6[.]161[.]208[.]50
  • 110[.]66[.]55[.]157
  • 178[.]28[.]195[.]18
  • 91[.]235[.]196[.]78
  • 152[.]144[.]194[.]125
  • 154[.]238[.]129[.]158
  • 143[.]77[.]222[.]58
  • 10[.]212[.]55[.]75
  • 186[.]208[.]57[.]137
  • 191[.]179[.]65[.]236
  • 199[.]237[.]148[.]160
  • 121[.]225[.]109[.]43
  • 162[.]221[.]48[.]127
  • 201[.]27[.]166[.]227
  • 72[.]92[.]22[.]191
  • 218[.]226[.]16[.]9
  • 191[.]14[.]127[.]70
  • 194[.]149[.]87[.]120
  • 112[.]63[.]120[.]198
  • 73[.]164[.]233[.]13
  • 37[.]180[.]175[.]89
  • 133[.]206[.]166[.]246
  • 198[.]35[.]115[.]183
  • 47[.]167[.]218[.]46
  • 135[.]103[.]82[.]205
  • 7[.]200[.]105[.]154
  • 199[.]93[.]144[.]38
  • 59[.]192[.]15[.]15
  • 217[.]51[.]139[.]119
  • 123[.]127[.]82[.]29
  • 78[.]61[.]141[.]7
  • 186[.]185[.]52[.]3
  • 24[.]199[.]52[.]80
  • 5[.]234[.]59[.]44
  • 163[.]234[.]185[.]250
  • 1[.]252[.]56[.]226
  • 187[.]210[.]253[.]198
  • 43[.]135[.]189[.]243
  • 98[.]148[.]133[.]109
  • 88[.]32[.]65[.]1
  • 63[.]26[.]72[.]141
  • 198[.]69[.]36[.]64
  • 66[.]203[.]209[.]140
  • 40[.]80[.]9[.]141
  • 9[.]194[.]229[.]75
  • 103[.]64[.]98[.]245
  • 82[.]172[.]33[.]132
  • 116[.]245[.]114[.]219
  • 107[.]126[.]142[.]41
  • 115[.]28[.]249[.]223
  • 190[.]208[.]177[.]173
  • 135[.]230[.]171[.]152
  • 53[.]26[.]51[.]146
  • 20[.]229[.]84[.]137
  • 124[.]60[.]88[.]212
  • 177[.]156[.]53[.]62
  • 213[.]167[.]110[.]175
  • 88[.]1[.]186[.]185
  • 33[.]72[.]73[.]40
  • 26[.]57[.]39[.]220
  • 71[.]130[.]231[.]34
  • 212[.]3[.]115[.]68
  • 201[.]163[.]21[.]128
  • 33[.]65[.]249[.]104
  • 74[.]63[.]38[.]62
  • 163[.]14[.]66[.]71
  • 91[.]213[.]237[.]149
  • 28[.]10[.]105[.]191
  • 222[.]21[.]121[.]112
  • 78[.]228[.]61[.]65
  • 42[.]132[.]214[.]17
  • 136[.]80[.]39[.]220
  • 32[.]127[.]135[.]111
  • 132[.]241[.]123[.]26
  • 122[.]117[.]211[.]198
  • 165[.]184[.]216[.]139
  • 1[.]50[.]235[.]118
  • 76[.]221[.]33[.]248
  • 141[.]233[.]254[.]233
  • 197[.]27[.]162[.]130
  • 223[.]239[.]79[.]7
  • 15[.]253[.]169[.]20
  • 155[.]29[.]149[.]82
  • 142[.]12[.]122[.]234
  • 209[.]144[.]118[.]213
  • 58[.]213[.]179[.]16
  • 175[.]3[.]47[.]242
  • 39[.]40[.]132[.]64
  • 106[.]162[.]109[.]12
  • 195[.]142[.]187[.]29
  • 209[.]172[.]146[.]111
  • 173[.]228[.]9[.]90
  • 40[.]121[.]144[.]40
  • 211[.]67[.]42[.]241
  • 160[.]110[.]143[.]245
  • 120[.]31[.]29[.]140
  • 8[.]65[.]254[.]19
  • 86[.]205[.]253[.]167
  • 110[.]157[.]4[.]220
  • 75[.]59[.]231[.]248
  • 208[.]61[.]5[.]175
  • 144[.]31[.]70[.]99
  • 117[.]37[.]13[.]214
  • 51[.]217[.]73[.]162
  • 182[.]223[.]166[.]190
  • 207[.]57[.]189[.]34
  • 17[.]27[.]53[.]89
  • 136[.]219[.]235[.]153
  • 67[.]143[.]237[.]178
  • 165[.]188[.]89[.]101
  • 122[.]214[.]248[.]8
  • 158[.]237[.]30[.]116
  • 41[.]192[.]242[.]157

Domain Names

  • bscw[.]paritaet[.]net
  • www[.]dso[.]pl

Files and or directories created

  • %LocalAppData%\4dd3cc\519d0f.bat
  • %LocalAppData%\4dd3cc\8e9866.8ca9d79
  • %LocalAppData%\4dd3cc\d95adb.lnk
  • %AppData%\b08d66\0b3c0b.8ca9d79
  • %LocalAppData%\Temp\~DF5BCE8BF7EE69B404.TMP
  • %LocalAppData%\Temp\g1b14dab.rdk.ps1
  • %LocalAppData%\Temp\pey0h1im.c1n.psm1

File Hashes

  • 044be48174fa81edefd3b35843d76998c4a72defd3fb0b7e0b5ecaa7d205c71d
  • 20998f4c46d0da1403bf6d894fd0396432cefa7b544fab1929be314f5c710e94
  • 26ad68daec330f0af6a5455a2293a1cdba9b9e9ca025b3d733e59d1c2cd6a3f6
  • 27b93d841df9dfe56d07a1430d1ab1bb88e8dea3e413b1ad8d27276a14cb298d
  • 29bb23883b4cc5f4789114445bb397d19ded701c6e0dc80b5d946d5a2b54a027
  • 30ebdae089ff27b5a6ef838ca17597f4d0728b25dcc34c59aafc997fce3c84a4
  • 3bbfbf7b816f5afb26a04d040b911a0efa58bde3770f45735b991d69af23eba2
  • 3be48068d2d627fafa15cdd22e1199206884b943622c98c4f8071d5e610a5498
  • 458ba8a48200ae6c90c3789427dec37078531978a91730f153f2399aad5cd6b3
  • 47f74240978d492d091790fab667d39b2c6e42e86d29a983e6e6dac0b62875c5
  • 4aa3b9a23dd6f18c6257c1baca710b0eaa51d5eb9e4b66fbc0731d755cce67dd
  • 4f1aa4b14e4c59ff2d9f1e4905e5e246b751246f164a1d7d1edd54ce4007cc81
  • 5d8a4cdc70c0dd0b373f1a50c140622772f6590a31c697e0cf1dd9b89b7e6cc6
  • 654e000b1c469894355614e418f9d47246fbb9a0184627cd71270f3091c8a9e8
  • 6ec77a1190da50078315a9e4f9370f2ebee86eedf4e405ab11d29ac7ca196c64
  • 86a095ae381129b0f0b1fc48f9e9cb8f264bbdb9538aa2db50c82555f36f5943
  • 89985343060c86a350986e14a31cdbfcd88b7858dd098fb50668717bf5479b76
  • 940b8b2d4c5e160f7072e05957f08446d889027a80e671400441edf0751f6285
  • 9c3213ffa67c205a8f0d172dcf9dafb0f57f4f81ad3f3a134955f184237c0ad8
  • 9fd19c951d381be78083e0dbcbe19b2f8aa342697b4daeeabd477d92beaea7e3
  • a34ef5a0bb557ec591b1f75ad280bd4fd3cd34ff9a443e6f1f5fc72810852e86
  • abb2228d2d252c4722b978492c029930fb0e4882b349a3b82506554666476b25
  • cd4ca0a0e849e7210825f6ae9363b672787aa750078f4ec319b8dd00790ab25d
  • d0ee281046421afc2dc25081d14b2643914f12c4ad753fa382b1c16f8fca13ae
  • d29e129b708074f8f7dc8965119c9ea4ea314f49568b99ccf77bb1014bdacb41

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Win.Dropper.Bredolab-6681668-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: HKLM
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: HKCU
  • <HKCU>\SOFTWARE\CYBER
  • Value Name: FirstExecution
  • <HKCU>\SOFTWARE\CYBER
  • Value Name: NewIdentification
  • <HKCU>\SOFTWARE\CYBER
  • Value Name: NewGroup

Mutexes

  • Administrator1
  • Administrator4
  • Administrator5

IP Addresses

  • 212[.]52[.]43[.]195
  • 52[.]8[.]126[.]80

Domain Names

  • tanne0214[.]zapto[.]org
  • remotes[.]no-ip[.]biz
  • 7896[.]sytes[.]net
  • imacdrake[.]no-ip[.]org
  • creditoshabbo[.]hopto[.]org
  • humberto1992[.]zapto[.]org
  • ereticus1[.]no-ip[.]org

Files and or directories created

  • %LocalAppData%\Temp\Administrator2.txt
  • %LocalAppData%\Temp\Administrator2.txt
  • %LocalAppData%\Temp\Administrator7
  • %LocalAppData%\Temp\Administrator8
  • %LocalAppData%\Temp\Administrator7
  • %LocalAppData%\Temp\Administrator8
  • %LocalAppData%\Temp\Administrator2.txt
  • %LocalAppData%\Temp\Administrator7
  • %LocalAppData%\Temp\Administrator8
  • %AppData%\Administratorlog.dat
  • %WinDir%\SysWOW64\WinDir\Svchost.exe
  • %WinDir%\SysWOW64\WinDir\Svchost.exe

File Hashes

  • 48180ade1a05ee5c2110ee4c71754da73383cd4819289c6c091d519855f1627f
  • 56cc8bd6718775c3b9de1bf381824d1bdc9a15b6b9c9e056e2ed3d93c6e731ec
  • 5db46724856b56cd131601c4e5c39e006c47408b9a5be64fd8d7a8126e402607
  • 87e20d484f20fe2e21152d74f8a8cbd145c2bfbd501932c23d7be394cf1801e5
  • 94986d91cb3d0f3de612a63b4d7e9ad005dab44a05e895499a9cd5e8baa544c8
  • 987b509f8ac3f8cf96c5ea2060b1d6026e3ead908168728bd602f00f4a4b73ff
  • bcc49772a1699a5f2858f85f098fabc1adcd8ebb8834d806ddb23509c83c5e4a
  • cb397ef75dbf1a3cd2269e209dfb70d1a1910ca2a437d010b2c0a11a3a9dd740
  • e1feb2a427d5f5e40e3b9840f4f1795bb775e1bfbcf0f4d4f7df8a09a4ab0cff
  • e5fce427ec167c53e5b34873596a72ce348a02d578d0951fa22d59b590dd0ebb
  • f095a1ae871884b632eb885dd80c9c3d27079abae8c8daa8237b48df41708f5d
  • f80624e00b65c0560fd5da5834e4539740d7ac19872c10389dfbee7b1d46cefa

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Win.Dropper.Johnnie-6681665-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKLM>\Software\Wow6432Node\Microsoft\MediaPlayer\Preferences\
  • <HKCU>\Software\Microsoft\MediaPlayer\Preferences\ProxySettings\HTTP
  • <HKCU>\Software\Microsoft\MediaPlayer\Preferences\ProxySettings\RTSP
  • <HKCU>\Software\Microsoft\MediaPlayer\Player\Tasks\NowPlaying\
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: Video Display Driver
  • <HKCU>\SOFTWARE\DN-AKFCC
  • Value Name: ServerStarted
  • <HKCU>\SOFTWARE\DN-AKFCC
  • Value Name: InstalledServer
  • <HKCU>\SOFTWARE\CROSSFIRE
  • Value Name: NewIdentification
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
  • Value Name: Isass
  • <HKCU>\SOFTWARE\LAMMER
  • Value Name: FirstExecution
  • <HKCU>\SOFTWARE\LAMMER
  • Value Name: NewIdentification
  • <HKCU>\SOFTWARE\CROSSFIRE
  • Value Name: FirstExecution

Mutexes

  • _SHuassist.mtx
  • _x_X_BLOCKMOUSE_X_x_
  • _x_X_PASSWORDLIST_X_x_
  • _x_X_UPDATE_X_x_
  • sr54g65dg45ds5s8798ae
  • sr54g65dg45ds5s8798ae_PERSIST
  • XTREMEUPDATE
  • dN-AKfcC
  • dN-AKfcCPERSIST
  • sr54g65dg45ds5s8798ae_SAIR
  • dN-AKfcCEXIT
  • Isass
  • Isass_PERSIST
  • Global\2fbe6fe1-b6df-11e8-8419-00501e3ae7b5
  • Isass_SAIR

IP Addresses

  • 187[.]59[.]175[.]44
  • 186[.]237[.]232[.]135
  • 177[.]17[.]90[.]164
  • 177[.]206[.]100[.]238
  • 186[.]237[.]232[.]88
  • 177[.]125[.]230[.]242
  • 141[.]255[.]144[.]44

Domain Names

  • codelux2017[.]ddns[.]net
  • skypeprocesshost[.]ddns[.]com[.]br
  • homersides[.]duckdns[.]org
  • ducklife[.]ddns[.]net
  • wandersongay[.]ddns[.]net

Files and or directories created

  • %LocalAppData%\Temp\XX--XX--XX.txt
  • %WinDir%\Root\Video Display Driver.exe
  • %LocalAppData%\Temp\XX--XX--XX.txt
  • %WinDir%\Root\Video Display Driver.exe
  • %WinDir%\SysWOW64\hi-IM\csrss.exe
  • %WinDir%\SysWOW64\hi-IM\csrss.exe
  • %LocalAppData%\Temp\UuU.uUu
  • %LocalAppData%\Temp\XxX.xXx
  • %LocalAppData%\Temp\UuU.uUu
  • %LocalAppData%\Temp\XxX.xXx
  • %LocalAppData%\Temp\UuU.uUu
  • %LocalAppData%\Temp\XX--XX--XX.txt
  • %LocalAppData%\Temp\XxX.xXx
  • %WinDir%\SysWOW64\Isass.exe
  • %WinDir%\SysWOW64\Isass.exe
  • %LocalAppData%\Temp\XX--XX--XX.txt
  • %WinDir%\Root\Video Display Driver.exe

File Hashes

  • 04c42d576ba4b5ca2cc45462c75352276aed4a6a678f2b75c0157a20e7421d86
  • 0c7c3f4f67e67df34376b41b8bd98973c874d034cb2ae85184b03b9211dc56be
  • 182311866d129d6203d9bd8f139b92ce7b55cdd691c6694f43553edcd59f9ddd
  • 226a1ad2b6aca583e340057cfc9c8e638fecb935ef34ef262ee067eb0aa54c16
  • 322fac0e1a6069a7b98f6fd5a30734cf73072084cf6529bc746f238a88907418
  • 44364855cb08ace848e4911bfe857787b48e7c8ef004f39c983962d10b162477
  • 5af2fbf37c77c3ff9228059325f203f7252363862480b65242e6952fc61f0c73
  • 87aecc8838b2d8f6e169950ad621932ba2d10106fae3681140e04c7ae43661c4
  • a6086ddbbeaa39e13d4cb807642ee1080b768314a67015941547af7361a80e97
  • b3f9905c476ecf22dacd1d15e6ff5425933662dd297685dc475128907c96e705
  • b67f0572957a4f71ec4afe43a7647d43044a23554a099735a3b99d910bc24867
  • c84c2e49fc9b57e1e53c91ee35bf0a85106582211dd544326d1e10cdc3a29218
  • d4d77eae0d0481baa2313aa84775a1906687c8e948d1e1b52b2d8ea74430e169
  • e524f71e112623370be56536226766338a308f77e6a042937d471d5244047f3b
  • ed684ccd44e82e65b2563ce6c7d8e5d48560fb98e7cc42bf483707b18c52efba

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Win.Dropper.Zbot-6681657-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\PRIVACY
  • Value Name: CleanCookies
  • <HKCU>\SOFTWARE\MICROSOFT\AHPYE
  • Value Name: Toitqa
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: {913237A3-A7F1-4D42-F774-A9CF00C8A7BB}
  • <HKLM>\System\CurrentControlSet\Services\NapAgent\Shas
  • <HKLM>\System\CurrentControlSet\Services\NapAgent\Qecs
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.101
  • Value Name: CheckSetting
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.103
  • Value Name: CheckSetting
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.100
  • Value Name: CheckSetting
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.102
  • Value Name: CheckSetting
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.104
  • Value Name: CheckSetting

Mutexes

  • Global\{FA015A2D-CA7F-2671-F774-A9CF00C8A7BB}
  • Local\{93231DB1-8DE3-4F53-F774-A9CF00C8A7BB}

IP Addresses

  • N/A

Domain Names

  • grandesupport[.]biz

Files and or directories created

  • N/A

File Hashes

  • 39784419d8565a3ced22083127a61835770f3bc638f87b3ea9318ffcbfdaf848
  • 4017493d29c4951897f50c9e237c6eeb194fb7899f9203975a93a7c11c2368c7
  • 51617fde592532fac1020fc924adc6d15be9bab516ec3d36e8910f7406123476
  • 683d10e142f3a87561e1fd84881079c716792add73d26bb647c2bad37efb7492
  • 786c00b22f4337b0745fa9614a2810258e214bf4f61f36a8cf9a6a08647d15c6
  • 796e89fe89692a2d27fd8645fc215df4bab2ee992f6f1660b1790fbdf11b31a6
  • 7b1aa81187bb675440e409c2a0572804abad624c1a7c446831ffc619c14c447a
  • 88e7defd3c756d2d34e43c2988c1d650f55167c4c8649010c6b21d0537f968c5
  • 8b3b86c5fd43a44f09424eb36f0a849c0617d11dc1f8b3d60c9c4734fcd8a7ff
  • afb294c4d70a0cc8364963c3671ee65e176c26d367201bf6063ef3e2ae200b0a
  • d2a4c371dd2aad5d29909117c858e22996f0da89b5bbac232be3b36ff881ce97
  • dac1c6f00041fc055ef9a091156116a62633d8e986fdc7fc56e9bd5f88ef3ea1
  • fa0bede1310a0cf7f146bc659c89cf815725c5984de50748ff77d9f0d693b1dc

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Umbrella

Doc.Dropper.Valyria-6680534-0

INDICATORS OF COMPROMISE


Registry Keys

  • N/A

Mutexes

  • Global\552FFA80-3393-423d-8671-7BA046BB5906

IP Addresses

  • 173[.]201[.]185[.]6
  • 103[.]27[.]232[.]26
  • 104[.]236[.]33[.]143
  • 184[.]168[.]188[.]1
  • 91[.]216[.]107[.]152

Domain Names

  • fithealthyliving[.]net
  • staging-geblog[.]b2ldigitalprojects[.]com
  • arcbko[.]com
  • wcspl[.]org
  • bechner[.]com

Files and or directories created

  • %LocalAppData%\Temp\538.exe
  • %LocalAppData%\Temp\kg4a5d2p.1ae.ps1
  • %LocalAppData%\Temp\vknsrz3n.wpf.psm1

File Hashes

  • 0238239e3cf2075650f629cb689f505107bda604df0aa2574db2a53600022f38
  • 069ff6dca25b828171a73beb093055320d309bc9143a1ae5b540465c655192c4
  • 242aae6952657369293d30dc1d3764b6966ac1a6e6d62e969f00d19a9fb7b193
  • 301a228cf13e759f90b0a3feed41dff781c7f85e8b605790912ccb44d473d572
  • 45dea266a99e322ccedab4a3896b2861f494690db67f6e02132a7b8b4b5a89e7
  • 54f695dc4f5498b1b04287dbe71674273a3252e0f18e924b8acd8909f33c7caa
  • 5941d8a04f73dbe37dda523049e58c5973f0c4ae41662697f11d7e345798b9dc
  • 5f7de3a70448c1e1285bd53c5109cbd07f2c06b95acedd9b983917ff033f209b
  • 7af1f7a16f09716615b2d6de7da9f741a69dd9d9709284b83ca177972ab7a7e7
  • 7b86ed501d87008bdce4d834b7785fe819abf0aa1a57e8d8c3375bbd5305f6c8
  • 7fcf47adafd831ba002e265e38de3b65b0323f9c25c79f976112fb057029d450
  • 874ec93d6dfd58dc22c195e10b7da0a105accbcd3c89ce88455c17b1f277145d
  • 91e151742255613156ff2f026af1fb0c1c1414fcac566994c52c4d3072d42e64
  • a8c0129de81bf9bd7ea0a8f27fab96b798a60a98655c9137a0425f6dd3e9b295
  • afd149d4cccd6600794a46652cea139c70f3d4961e5b501d66854b9f9ea91b75
  • b6f2936958c9133e87ae4c0acb73265514e460959438b175648e17ba7818fbbc
  • b8f79a3b73aeb5c6e075a4ae6bc921397eccc9a99589b37e2c0a6d98ef3c5ea2
  • bf1c5f995535d59a70d970f9892a57d2f309b9076787199a1af221e9f8284527
  • c176225326d983a4698f5b12e8c17f4efff2f1d025148570725abee3cbef5af0
  • cfe5248f7c852dc86994b44fabb8415e864a8b27805acf844af8533c40c17896
  • efa9962b68e9090b2fa71ee3b22726715a9d2c65d223f2fdcbcc24b621806a12
  • f520f9cc0e7e736664ac1409931351a3b37331b84f9a1d845f7a279963db906a
  • f604290550ccfa8be31f5c14078b4b1b95e93778b0d75e5284a3515ca160b49d

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Umbrella

Win.Dropper.Darkkomet-6680876-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKCU>\SOFTWARE\DC3_FEXEC
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: turnon

Mutexes

  • YG75FBKJ76

IP Addresses

  • 91[.]200[.]124[.]201

Domain Names

  • val[.]myftp[.]org

Files and or directories created

  • %AppData%\dclogs
  • %AppData%\ace.exe
  • %LocalAppData%\Temp\OSXEF.txt
  • %LocalAppData%\Temp\OSXEF.bat

File Hashes

  • 03c483310dd297d66e6d5a6638267688b056a5d5b21b667bba8b7a9ab664889c
  • 07e3f9989a69d60372e72b8f25bb82c3a40eb5b10b7d33d0a296b392ba9c5135
  • 0a00f60a8af2d9f32a08376c10f7f624438494aa9213f81f395b3d8f3a1eb65a
  • 0c03079c94b8d104f8056011b896e388166697bae717de5a4fa31f4638e9381f
  • 0d9d0c68de0c21b6c1a800ec3985a2986d88869eb334ab1c6dc0c5dc40119483
  • 0e0b5874acbca1fba6f98c9a30ae1505a1a87e6368a8906a6a6fd8e28bb31427
  • 0e2827de18a187c5ed31e9dcf44ca4f3f407f16a4e6f6a7b01304494514592da
  • 0f06f2ab0ce310049915962b7961b58b46bca4beba857633ac95b2a13cfa5d05
  • 0f99f662e7bab77cc78547802cdf85d810ce971682f7b50bdb8c77fcbc85aaaa
  • 1119d8e1bdd4bdf582a4d8047835bdd5f1fa2bc0f5f39f7e9ddc6421ffd9feb4
  • 12883e0f1911daadb66fbbb66b7be9feb6e02a1c3447445ce1947dd6fc600410
  • 14c7eaa26712518b9d8c811cc160a127aa3ef2f19d0f7da38549aadbcbc6b38e
  • 169fe2cad2ab1c592d1e573f4d8d108d1cb842219a1078cfd0bb82cb4419f66d
  • 1744294b2eea0b04f59090a13d0a03796498bc303cae65b04129652b8a5b8cd6
  • 179f922f65f7437dc74ab133bd47f4d463cb703cf63dafc59ed4611eef7eb3ac
  • 1992cad7397af3479dfd7945ff7d12c0abcee4311f043b026eb41172898b1a7d
  • 1a05832ebb6c608346f01306db48b0afd4e571b06d9a7c5c2845d7aed1f7d207
  • 1ca18752e5cb2d58ee1de63b9402993558560eff0592930b281a083d1a635f17
  • 1e14c8f6b9c81c69aebdd5253527534d819474c41fa0be9c7edfe17e543baa17
  • 1e2bffa2672a47cdbfd0dfd9f4a531ef5e1c654ee3c262fd21b4fb22630c032e
  • 1e4a660328cf9d5332b4aab97933ed451af7c8925ad8550b7678c9c3c522c71a
  • 236d1f514cf2f46d4833377df1b854830990f723d0599659c0c938cdafb1e754
  • 2401a683279fd61dffdb81d4f0a946fc129bc72d5c5e8061303323f74d3e19a5
  • 276e71bebd8336e347e3ed2cbe2787a1de99cefa706af48feeccf3395e3219a3
  • 28252e1df5f42535c404992c9e65c6c165c938d0c7d9e7062ce06ee4ba42cbb5

COVERAGE

SCREENSHOTS OF DETECTION

ThreatGrid

Win.Dropper.Ponystealer-6680912-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
  • Value Name: Registry Key Name
  • <HKCU>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
  • <HKCU>\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
  • <HKCU>\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\
  • <HKCU>\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook_2016\
  • <HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
  • <HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
  • Value Name: MPX0O4RP3X
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
  • Value Name: LTWTXJJ0
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: K62XHZYXTH
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
  • Value Name: XTWXCZIXDHF

Mutexes

  • 8-3503835SZBFHHZ
  • 299N2C3FD0EVCX9z

IP Addresses

  • 47[.]91[.]170[.]222
  • 185[.]230[.]61[.]161
  • 52[.]5[.]251[.]20
  • 198[.]54[.]117[.]200
  • 209[.]99[.]40[.]222
  • 104[.]27[.]140[.]60
  • 185[.]207[.]8[.]246
  • 146[.]196[.]82[.]3
  • 172[.]217[.]10[.]115
  • 221[.]246[.]80[.]218
  • 47[.]254[.]67[.]48
  • 180[.]76[.]97[.]209
  • 209[.]99[.]40[.]223
  • 158[.]85[.]87[.]76
  • 182[.]237[.]0[.]67
  • 35[.]194[.]164[.]137
  • 104[.]149[.]211[.]146
  • 104[.]28[.]8[.]192
  • 107[.]173[.]131[.]73
  • 103[.]224[.]182[.]243
  • 52[.]78[.]124[.]149
  • 199[.]192[.]25[.]192
  • 208[.]91[.]197[.]132
  • 209[.]200[.]154[.]54
  • 198[.]185[.]159[.]144
  • 203[.]170[.]80[.]250
  • 176[.]9[.]3[.]251
  • 50[.]63[.]202[.]69
  • 208[.]91[.]197[.]46
  • 183[.]90[.]253[.]13
  • 52[.]7[.]6[.]73
  • 192[.]0[.]78[.]24
  • 182[.]61[.]117[.]253
  • 198[.]54[.]117[.]218
  • 34[.]240[.]216[.]169
  • 198[.]57[.]247[.]216
  • 216[.]239[.]32[.]21
  • 91[.]184[.]0[.]14
  • 216[.]239[.]34[.]21
  • 104[.]28[.]9[.]192
  • 23[.]238[.]221[.]30
  • 67[.]222[.]38[.]88
  • 50[.]63[.]202[.]89
  • 104[.]217[.]9[.]112
  • 208[.]91[.]197[.]91
  • 185[.]53[.]179[.]29

Domain Names

  • www[.]841bifa[.]com
  • www[.]n*****boutique[.]com (Editor's note: This URL has been censored to remove offensive language.)
  • www[.]goedutravel[.]com
  • www[.]xctljc[.]com
  • www[.]redkoe-porno[.]info
  • www[.]femalesdress[.]com
  • www[.]planeggerstrasse[.]info
  • www[.]qfs[.]ink
  • www[.]funnysworld[.]com
  • www[.]xn--vuqu93jrjhqkc[.]net
  • www[.]suatusta[.]com
  • www[.]casineuros[.]com
  • www[.]rabe-networks[.]com
  • www[.]reducetarian[.]biz
  • www[.]selviproperty[.]com
  • www[.]giftedaroundtheworld[.]com
  • www[.]aditsachde[.]com
  • www[.]oane4[.]win
  • www[.]ayursanskar[.]biz
  • www[.]benthanh-toyota[.]com
  • www[.]puptowngirl[.]net
  • www[.]cyn[.]ink
  • www[.]theniftyfiftiesband[.]com
  • www[.]webbyen[.]com
  • www[.]globaltimbereurope[.]com
  • www[.]3zci3b[.]info
  • www[.]xn--fjqu42jgii[.]com
  • www[.]mizukusahonpomeibi[.]com
  • www[.]zjjdmd[.]com
  • www[.]donghairc[.]com
  • www[.]theadvancedcoach[.]com
  • www[.]telegraphresidences[.]com
  • www[.]sjckt888[.]com
  • www[.]schmidtatlanguage[.]com
  • www[.]vdemg[.]info
  • www[.]happyslider[.]com
  • www[.]chfnik[.]com
  • www[.]crstudents[.]net
  • www[.]fiveroot[.]com
  • www[.]luxuryconversion[.]com
  • www[.]studio51[.]style
  • www[.]custombusinessapps[.]net
  • www[.]verzuimverzekering[.]info
  • www[.]float2fit[.]com
  • www[.]ketones[.]info
  • www[.]dk-drugs[.]com
  • www[.]reviewhqs[.]com
  • www[.]revivemyappliance[.]com
  • www[.]scgcgg[.]com
  • www[.]mjkrol[.]com
  • www[.]bigmovephilly[.]com
  • www[.]chinaxzl[.]com
  • www[.]thienduonghoaviet[.]com
  • www[.]rsstatic[.]com
  • www[.]fattoupdates[.]date

Files and or directories created

  • %LocalAppData%\Temp\subfolder\filename.vbs
  • %LocalAppData%\Temp\subfolder\filename.bat
  • %AppData%\299N2C3F\299log.ini
  • %AppData%\299N2C3F\299logim.jpeg
  • %AppData%\299N2C3F\299logrc.ini
  • %AppData%\299N2C3F\299logri.ini
  • %AppData%\299N2C3F\299logrv.ini
  • %LocalAppData%\Temp\Bfz8hctw\msltqlrvah.exe
  • %WinDir%\SysWOW64\shdocvw.dll
  • %ProgramFiles% (x86)\Ktbchzlcx\winnnhlg.exe
  • %ProgramFiles% (x86)\Copx0\services9rdh.exe
  • %ProgramFiles% (x86)\Copx0\services9rdh.exe

File Hashes

  • 0e5a451852c815706a150befb73bdc405dc598a78b2e7dc63b35f520004feca6
  • 1f422318d70cdf15e6d1063be1bd7b169b664f6f1be0ca16aa9056d8c8f66ab1
  • 2e8f73a03161b25c97679b7355216ba238dbac83606f0167d0e37555c45c8805
  • 714dae6f00f1111c8b1df7028b2a42f1ba1de8c04c1daf312705ca681e4cb50c
  • 7ee3c73197123364b96ae7049659349cc23814205c5694ffa4d4bd5e549100b7
  • 8e501cd8772aa05320f248a288288803399c0a066ac0b72f4964b535bdbce9a5
  • ad73ee11fd4721805d0f59f6946d66a9cd3168a5653fbb3af1169f5085af2c43
  • c69593cb3f3af2548ad6acdc58771ff9106b9159ca335f33dfac742e6c5645d4
  • d4cfe9a0b6a7b4c18a29432b0af83ced8e25598be1b40f28ff653663c9e03c49
  • e499b206363260d823bcb8132ba6557facc614ad579cbfce2a198d6b1e1a7643
  • eafe32cbdf7df2612b5d72e2ffbff2efd98908d8356d81ee4cc55899b3252dd1

COVERAGE

SCREENSHOTS OF DETECTION

ThreatGrid

Umbrella

Win.Dropper.Tspy-6680869-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKCU>\SOFTWARE\REMCOS-4TJ61G
  • Value Name: exepath
  • <HKCU>\SOFTWARE\REMCOS-4TJ61G
  • Value Name: lic

Mutexes

  • 3749282D282E1E80C56CAE5A
  • Remcos-4TJ61G
  • Remcos_Mutex_Inj

IP Addresses

  • 89[.]38[.]241[.]133
  • 173[.]46[.]85[.]220

Domain Names

  • novachim[.]ro
  • doublelogs[.]ddns[.]me

Files and or directories created

  • %AppData%\D282E1\1E80C5.lck
  • %AppData%\jeje\mula.exe
  • %AppData%\jeje\mula.exe:ZoneIdentifier
  • %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\jeje.vbs
  • %AppData%\oir\jjd.dat

File Hashes

  • 2f416035e7d2527d7ab1bae1a5a03cfeaa87f1bbe5e580e903510c9fe61be0a9
  • 45f3dd601882ceb313fc33e19353e0bac78736c4817e9bde21a5b2635d3967e1
  • 4fdde7b1b995d53e924f9afb20235ef20fdfeb6c725bbc8a471f2ed3fb7e2767
  • 5e6b55f97481c9bb254d22af75fdeca2b9279e3128fde5c3db5fe784b6fc00d4
  • 5fc44bc2badb67648153759de5082a92f8ce9da9308dffc07f035dee0bece920
  • 7bc281874a32bf4a364cf800826b62650d8c67efb15a088dd9d0295558043a71
  • 7c5ad554bf6d496c57e4767efeb33dba75adc35771f0472f0cd32675f30b9abf
  • 811e38165cb164768a901a92dae30f0e5570f90e9055a50a4b67a14f028bdb2c
  • 821590fc905bf786438afa1e83eaf3c32d6411031d2c66e79fbd997ab9a7f37e
  • 892657166b1192c61cfd9c84ff8e59e445f0a998f43bace122190d877a9aeb49
  • 94b6da36c0fa409de9e8bb11fe7f0534b41da22798cbbfaad0814f463268fd5c
  • b10073140d45a3488190b8600b67c651c6e3a8ca636ae7e52153bfd1649fb961
  • dcdfca045b4aad4c0219463548cdba9619c221ee776e515446c775bf958e7362
  • e435e8d490a36ac8f56cbfd931eca5504a6c6ba2c09fbd61a833b5ccbca4d14a
  • fbf1961c71e5f892a8abd9d2dbc6c72e9b618bd96e05d64557f9acddcb1500bf
  • fd0a8f8031ce65b74380e994d9a4c615fff62c1c889053896c6635842a089dc5
  • fd4381d2d6a8140f1cd2bc19b661a4073e2540436ae287211955e439192f5e24

COVERAGE

SCREENSHOTS OF DETECTION

ThreatGrid

Umbrella

Win.Dropper.Fareit-6680873-0

INDICATORS OF COMPROMISE


Registry Keys

  • <HKCU>\SOFTWARE\WINRAR
  • Value Name: HWID
  • <HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003E9
  • Value Name: F
  • <HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000001F5
  • Value Name: F
  • <HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003EC
  • Value Name: F

Mutexes

  • 3749282D282E1E80C56CAE5A
  • Stertorous8
  • Decent5
  • A4gds89g46dfgs
  • Reserveful
  • Sabbagh0
  • Elfic

IP Addresses

  • 185[.]36[.]191[.]6
  • 104[.]24[.]126[.]133

Domain Names

  • www[.]bellyrocksh[.]com
  • etete[.]eu
  • larrydaves[.]cf
  • vivsinomain1[.]cf
  • sunnynaturelstone[.]com

Files and or directories created

  • %AppData%\D282E1\1E80C5.lck
  • %System32%\config\SAM
  • %LocalAppData%\Temp\1153725803.bat

File Hashes

  • 0d221abd5eaf60a723ae0e93866fe0cb6aaf2c23046c567427ba1bff0665c02e
  • 18096cf4c75fc51a36b58e484848d2bdc39c426944a4f40b7b99592745bb5944
  • 1b38f6fa030cea6692b79f688cbdf7cc0b09105cee0706a7f04a52d44ee36704
  • 21458efd813e4c45d2bae2d8c6acca70ae748590b820387c3c7d68f98b8278ae
  • 2f8cad659288c512b79db69fcac1628f52bfd3f7b60fe37835701186e67eac57
  • 46bbaf619bdc28747cc62945e9caccc27d8848c0ab07c52918cad4290cc067c5
  • 49f4e7e79ad9e6a2009286e0ab738f0e41abf82fd495ced8aca3387455f442c7
  • 6076060229b2536037d85ca3050441b2a713a26b316d60a03347c8b380dce96c
  • 753a70cf5cac5dbadd649cd30a25665267b174c2917c98ec0bb70919f610cc15
  • 7a9bcdf5fd9edf0cd59e1d60cf3c31d7b0365f6b894170a9c56cea8f7f07d4bd
  • 8408b21f4e141a7e94f3604f422e78baabeb30b7d1ea98a7f25bd4b4d75e7a1d
  • 8ac3a9a28f34bcaeb7bae278b1f843c58dd9e8ab5c248c339a2deb779955d494
  • 8dbf7b8ddffaafe6781321100351b769190a8e1dd4273a1d6b7660159857540e
  • 9394988bb9d819321fb1febe7522e57a995eeb10b45716120eef7b7588bd51ac
  • 998447cb9f7d5377be0cafd30b03a6b2f2f40e2860234abb6af08ef551d491f0
  • ae2c150a838a6694c64ae712a964cbd086413b80ef427507b54957531c2aa6b4
  • b34d4f5fe5e5b10cbc519634a0184d818d9ab20cf8107dfd4206793226b86319
  • bb9010216f0dbe202446ea44d191a9e5a09f3bd23b453e13685063aa23ae1671
  • c3cfeb64a23fca1da202e6e4837ef4a7eeabb6711d97a8e2c87130e3d47d7d66
  • c56acb67efeb900524883c2268f05f27fa5fc549a3c15bb10639ca0634e8e037
  • ecf51b788b7cd3bcb0d44802666ac24f8b9f6629159bb6fe1a9e70b68381c7a8
  • ed43e191adf1a6f2af897f4d7a1eccd88aa11636dca56507d367c40f2732da76

COVERAGE

SCREENSHOTS OF DETECTION

ThreatGrid

Umbrella

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0907-0914/