ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Cisco Talospublished ()ingested

Threat Roundup for August 3

highRansomwareimportance 57
Read the original
Tagsransomware

Indicators of compromiseAll →

TypeIndicatorContext
domainionesystemcare.info_2c8 IP Addresses N/A Domain Names www[.]wizzmonetize[.]com ionesystemcare[.]info www[.]rothsideadome[.]pw www[.]usatdkeyboardhelper[.]pw F
domainip-api.comQSR_MUTEX_HnRHWDxWQnveBdUtWT IP Addresses N/A Domain Names ip-api[.]com Files and or directories created N/A File Hashes 25430a35
domainlip.healthcakes.menLocal\MSCTF.Asm.MutexDefault1 IP Addresses N/A Domain Names lip[.]healthcakes[.]men Files and or directories created N/A File Hashes 00cc94
domainwww.rothsideadome.pwDomain Names www[.]wizzmonetize[.]com ionesystemcare[.]info www[.]rothsideadome[.]pw www[.]usatdkeyboardhelper[.]pw Files and or directories
domainwww.usatdkeyboardhelper.pwnetize[.]com ionesystemcare[.]info www[.]rothsideadome[.]pw www[.]usatdkeyboardhelper[.]pw Files and or directories created %ProgramFiles%\WJTLINY
domainwww.wizzmonetize.comRpl_Perf_Library_Lock_PID_2c8 IP Addresses N/A Domain Names www[.]wizzmonetize[.]com ionesystemcare[.]info www[.]rothsideadome[.]pw www[.]us
sha256002d9959f5e7417cc2cbc657243f2dab82fac3d2e94fa2d0c8e45eda10889b08cch.new %ProgramFiles%\WJTLINYZUI\GCOMQP0KN.exe File Hashes 002d9959f5e7417cc2cbc657243f2dab82fac3d2e94fa2d0c8e45eda10889b08 03c948623cf78efe90258d894ab0e793bca7009bd73d0be0f652575f81b
sha25600cc9438408d1b22b0afc57e3b233ff62774cbcb92e58b392403d8c794d988edakes[.]men Files and or directories created N/A File Hashes 00cc9438408d1b22b0afc57e3b233ff62774cbcb92e58b392403d8c794d988ed 118e08c379b0035cef2a155d59d97c6e8cae94b6f46c5e77f58d84c88c6
sha25603c948623cf78efe90258d894ab0e793bca7009bd73d0be0f652575f81bda621959f5e7417cc2cbc657243f2dab82fac3d2e94fa2d0c8e45eda10889b08 03c948623cf78efe90258d894ab0e793bca7009bd73d0be0f652575f81bda621 0f8d729821902252b7f7a1c0d51004d3770356969e7181548126f13f1e2
sha2560406ad0fe90d371b02742e6821486abbfbf2bbd72a7593e8ddb650f0b97673b3ories created %WinDir%\SysWOW64\TO5sH5uBMit.exe File Hashes 0406ad0fe90d371b02742e6821486abbfbf2bbd72a7593e8ddb650f0b97673b3 0604aa87706cb7890075b494f026c88b2f03b621367f1bb62a87f5c5deb
sha2560604aa87706cb7890075b494f026c88b2f03b621367f1bb62a87f5c5deb87870d0fe90d371b02742e6821486abbfbf2bbd72a7593e8ddb650f0b97673b3 0604aa87706cb7890075b494f026c88b2f03b621367f1bb62a87f5c5deb87870 086af92d83279f5792c15a762a70e158de54b67c1a96bfc14c4ad52a244
sha256086af92d83279f5792c15a762a70e158de54b67c1a96bfc14c4ad52a24468f32a87706cb7890075b494f026c88b2f03b621367f1bb62a87f5c5deb87870 086af92d83279f5792c15a762a70e158de54b67c1a96bfc14c4ad52a24468f32 10f13af2a3591efa3d58c47bb0635e3a653e14ec7726493bb4595b4dd8c
sha2560f8d729821902252b7f7a1c0d51004d3770356969e7181548126f13f1e2ebf2a8623cf78efe90258d894ab0e793bca7009bd73d0be0f652575f81bda621 0f8d729821902252b7f7a1c0d51004d3770356969e7181548126f13f1e2ebf2a 1e64134ff7358ea6e632fd2377532491235cf089f33095a72552e150088
sha25610f13af2a3591efa3d58c47bb0635e3a653e14ec7726493bb4595b4dd8cd51cb92d83279f5792c15a762a70e158de54b67c1a96bfc14c4ad52a24468f32 10f13af2a3591efa3d58c47bb0635e3a653e14ec7726493bb4595b4dd8cd51cb 127c316e7a10579e61369d6a8154e3e34726209b3cc075ddd6d9875c439
sha256118e08c379b0035cef2a155d59d97c6e8cae94b6f46c5e77f58d84c88c689d2c438408d1b22b0afc57e3b233ff62774cbcb92e58b392403d8c794d988ed 118e08c379b0035cef2a155d59d97c6e8cae94b6f46c5e77f58d84c88c689d2c 1f270dc860158d63bb400e08f12bce40a9a50494368ea6e44cfd89f7e0d
sha256127c316e7a10579e61369d6a8154e3e34726209b3cc075ddd6d9875c439c583eaf2a3591efa3d58c47bb0635e3a653e14ec7726493bb4595b4dd8cd51cb 127c316e7a10579e61369d6a8154e3e34726209b3cc075ddd6d9875c439c583e 1fc9fda1b0c868dc7cb0cf6d8867b7aefc202436fe9e41cba5b2b35bb1c
sha2561e64134ff7358ea6e632fd2377532491235cf089f33095a72552e150088b42f129821902252b7f7a1c0d51004d3770356969e7181548126f13f1e2ebf2a 1e64134ff7358ea6e632fd2377532491235cf089f33095a72552e150088b42f1 1eed9456e69a80cb4e8444ad0356d71e09a073715f92e51afa008e80d2a
sha2561eed9456e69a80cb4e8444ad0356d71e09a073715f92e51afa008e80d2a0352a34ff7358ea6e632fd2377532491235cf089f33095a72552e150088b42f1 1eed9456e69a80cb4e8444ad0356d71e09a073715f92e51afa008e80d2a0352a 26f928ef89fde0e3e3fa996073c7c0bba00c2cbfe280de338de15367f4c
sha2561f270dc860158d63bb400e08f12bce40a9a50494368ea6e44cfd89f7e0dc23f48c379b0035cef2a155d59d97c6e8cae94b6f46c5e77f58d84c88c689d2c 1f270dc860158d63bb400e08f12bce40a9a50494368ea6e44cfd89f7e0dc23f4 3e49b3e58eec40b735124509bafcf434904f5945c9d65a5a860b0950850
sha2561fc9fda1b0c868dc7cb0cf6d8867b7aefc202436fe9e41cba5b2b35bb1ce9e9f16e7a10579e61369d6a8154e3e34726209b3cc075ddd6d9875c439c583e 1fc9fda1b0c868dc7cb0cf6d8867b7aefc202436fe9e41cba5b2b35bb1ce9e9f 23ba67cf24c95f3bfd36b66f822feb3d2fd0f72617921550fee034a1b7b
sha25623ba67cf24c95f3bfd36b66f822feb3d2fd0f72617921550fee034a1b7b8cc74da1b0c868dc7cb0cf6d8867b7aefc202436fe9e41cba5b2b35bb1ce9e9f 23ba67cf24c95f3bfd36b66f822feb3d2fd0f72617921550fee034a1b7b8cc74 27e37ac7cc8b48573a8345223399ce6b0ab9432ee977acf02c09bcf64cf
sha25625430a357d53aec77dd1f119b838ceae79a22bb3a60c7a002cb7328b098546a7-api[.]com Files and or directories created N/A File Hashes 25430a357d53aec77dd1f119b838ceae79a22bb3a60c7a002cb7328b098546a7 54279416f864d374f33fe9a2fe2998db3976c4ff43e8b0da006548489a5
sha25625f8455b83b98f38809af120e35c3eda189a05538f7aa2d527a265520bc3c75eE36F-0FE6-9629-63208157D7A2}\FlashPlayerApp.exe File Hashes 25f8455b83b98f38809af120e35c3eda189a05538f7aa2d527a265520bc3c75e 342a9470e5d3dd522c17cf0a5bc588d87a84689d90362c0b18c320385b2
sha25626f928ef89fde0e3e3fa996073c7c0bba00c2cbfe280de338de15367f4c8f76b456e69a80cb4e8444ad0356d71e09a073715f92e51afa008e80d2a0352a 26f928ef89fde0e3e3fa996073c7c0bba00c2cbfe280de338de15367f4c8f76b 2b0c6557b39ad8cca97ea6975aa3f4a8341774461b1bacab05d04ab20a9
sha25627e37ac7cc8b48573a8345223399ce6b0ab9432ee977acf02c09bcf64cf6622d7cf24c95f3bfd36b66f822feb3d2fd0f72617921550fee034a1b7b8cc74 27e37ac7cc8b48573a8345223399ce6b0ab9432ee977acf02c09bcf64cf6622d 2bf1192e5200b6f8d25586908b05912a5fa6e06e87540dbb914200446a3
sha2562b0c6557b39ad8cca97ea6975aa3f4a8341774461b1bacab05d04ab20a9463eb8ef89fde0e3e3fa996073c7c0bba00c2cbfe280de338de15367f4c8f76b 2b0c6557b39ad8cca97ea6975aa3f4a8341774461b1bacab05d04ab20a9463eb 3a5ac5c5ee7985367349d84d60be2c5f94f876c56cf73acbae6fc680ebb
sha2562bf1192e5200b6f8d25586908b05912a5fa6e06e87540dbb914200446a3deb10ac7cc8b48573a8345223399ce6b0ab9432ee977acf02c09bcf64cf6622d 2bf1192e5200b6f8d25586908b05912a5fa6e06e87540dbb914200446a3deb10 2ee83958eb1e8cb622ca833c38e51b53548d299b6574e5b7203741a2d27
sha2562ee83958eb1e8cb622ca833c38e51b53548d299b6574e5b7203741a2d27963f592e5200b6f8d25586908b05912a5fa6e06e87540dbb914200446a3deb10 2ee83958eb1e8cb622ca833c38e51b53548d299b6574e5b7203741a2d27963f5 2fca527cf8ebf4576e982118e22dfe3fd8e445749a5403dafed36089666
sha2562fca527cf8ebf4576e982118e22dfe3fd8e445749a5403dafed36089666f2357958eb1e8cb622ca833c38e51b53548d299b6574e5b7203741a2d27963f5 2fca527cf8ebf4576e982118e22dfe3fd8e445749a5403dafed36089666f2357 30bbfb79d26a172975e9482204f06423eff6948b1732384e7b6d23f9932
sha25630bbfb79d26a172975e9482204f06423eff6948b1732384e7b6d23f9932ec08d27cf8ebf4576e982118e22dfe3fd8e445749a5403dafed36089666f2357 30bbfb79d26a172975e9482204f06423eff6948b1732384e7b6d23f9932ec08d 30bf6e1a41dea6e4024853f9b7a6a878e4f5e4141dba4b0fe7686159925
sha25630bf6e1a41dea6e4024853f9b7a6a878e4f5e4141dba4b0fe7686159925fe6cfb79d26a172975e9482204f06423eff6948b1732384e7b6d23f9932ec08d 30bf6e1a41dea6e4024853f9b7a6a878e4f5e4141dba4b0fe7686159925fe6cf 42fca9d196c668747b74f80ca996aee9ae38bed96956b42436949a8d4d3
sha256342a9470e5d3dd522c17cf0a5bc588d87a84689d90362c0b18c320385b2e908d55b83b98f38809af120e35c3eda189a05538f7aa2d527a265520bc3c75e 342a9470e5d3dd522c17cf0a5bc588d87a84689d90362c0b18c320385b2e908d 41ebdf1d4a210f395d5ee32bf55c6b07ee1e0a0bdf939bd081f6d751323
sha2563a5ac5c5ee7985367349d84d60be2c5f94f876c56cf73acbae6fc680ebbdb3c6557b39ad8cca97ea6975aa3f4a8341774461b1bacab05d04ab20a9463eb 3a5ac5c5ee7985367349d84d60be2c5f94f876c56cf73acbae6fc680ebbdb3c6 47bcf1f1bca23a36e291a0ac4cb8d1cd59c0c80d6a8e3b2cc3d646284cc
sha2563e49b3e58eec40b735124509bafcf434904f5945c9d65a5a860b0950850a979ddc860158d63bb400e08f12bce40a9a50494368ea6e44cfd89f7e0dc23f4 3e49b3e58eec40b735124509bafcf434904f5945c9d65a5a860b0950850a979d 4348a4b50eba73d6eb5d0d254241d0e44fc63c975b589ac5276d6dc5cf8
sha25641ebdf1d4a210f395d5ee32bf55c6b07ee1e0a0bdf939bd081f6d751323c643c470e5d3dd522c17cf0a5bc588d87a84689d90362c0b18c320385b2e908d 41ebdf1d4a210f395d5ee32bf55c6b07ee1e0a0bdf939bd081f6d751323c643c 54be105a129d959359107d7dff6b379cd366e32bf7be9ac9a06bc2141d3
sha25642fca9d196c668747b74f80ca996aee9ae38bed96956b42436949a8d4d33ecf1e1a41dea6e4024853f9b7a6a878e4f5e4141dba4b0fe7686159925fe6cf 42fca9d196c668747b74f80ca996aee9ae38bed96956b42436949a8d4d33ecf1 45e6356ca3b373da3a80a72a1b64f1254f4426949598b8877abd6de99e3
sha2564348a4b50eba73d6eb5d0d254241d0e44fc63c975b589ac5276d6dc5cf8bab133e58eec40b735124509bafcf434904f5945c9d65a5a860b0950850a979d 4348a4b50eba73d6eb5d0d254241d0e44fc63c975b589ac5276d6dc5cf8bab13 4a1c1cf9c70b127cc514fa6cdbb0e286ee33bf19f6ff41ca02951c9947d
sha25645e6356ca3b373da3a80a72a1b64f1254f4426949598b8877abd6de99e3791669d196c668747b74f80ca996aee9ae38bed96956b42436949a8d4d33ecf1 45e6356ca3b373da3a80a72a1b64f1254f4426949598b8877abd6de99e379166 4ac5db87bc83dcbf1399f4fc0fede3c5ecee5b8ef2a2500fd79b1588ef0
sha25647bcf1f1bca23a36e291a0ac4cb8d1cd59c0c80d6a8e3b2cc3d646284cc531d55c5ee7985367349d84d60be2c5f94f876c56cf73acbae6fc680ebbdb3c6 47bcf1f1bca23a36e291a0ac4cb8d1cd59c0c80d6a8e3b2cc3d646284cc531d5 4ae3efb9a9cca68c098dcdba33d2aef39888cf229cd02be64cbf59a0b68
sha2564a1c1cf9c70b127cc514fa6cdbb0e286ee33bf19f6ff41ca02951c9947dac55e4b50eba73d6eb5d0d254241d0e44fc63c975b589ac5276d6dc5cf8bab13 4a1c1cf9c70b127cc514fa6cdbb0e286ee33bf19f6ff41ca02951c9947dac55e 4ae8cf675d6517b7989391fc653e8ddc96aa81cec4802e7e66de30adf0e
sha2564ac5db87bc83dcbf1399f4fc0fede3c5ecee5b8ef2a2500fd79b1588ef03342956ca3b373da3a80a72a1b64f1254f4426949598b8877abd6de99e379166 4ac5db87bc83dcbf1399f4fc0fede3c5ecee5b8ef2a2500fd79b1588ef033429 4b2f6d80bf78ad165c2f07d914cb4137ba31918f3f8f03f812b20715c34
sha2564ae3efb9a9cca68c098dcdba33d2aef39888cf229cd02be64cbf59a0b68dae301f1bca23a36e291a0ac4cb8d1cd59c0c80d6a8e3b2cc3d646284cc531d5 4ae3efb9a9cca68c098dcdba33d2aef39888cf229cd02be64cbf59a0b68dae30 5112edf0351d70ad31152f67e8996c9c4ad062f0023cfd43b4baecb8aa7
sha2564ae8cf675d6517b7989391fc653e8ddc96aa81cec4802e7e66de30adf0e96d2ecf9c70b127cc514fa6cdbb0e286ee33bf19f6ff41ca02951c9947dac55e 4ae8cf675d6517b7989391fc653e8ddc96aa81cec4802e7e66de30adf0e96d2e 527eac30113eb365330ec5c35591fe9ae69d4e1beca8b0ae24666e97d87
sha2564b2f6d80bf78ad165c2f07d914cb4137ba31918f3f8f03f812b20715c3451f56b87bc83dcbf1399f4fc0fede3c5ecee5b8ef2a2500fd79b1588ef033429 4b2f6d80bf78ad165c2f07d914cb4137ba31918f3f8f03f812b20715c3451f56 4d7d9d73dad989590860178530dd8848d9b79a23f1cb379bc1ca5545cb1
sha2564d7d9d73dad989590860178530dd8848d9b79a23f1cb379bc1ca5545cb196ecad80bf78ad165c2f07d914cb4137ba31918f3f8f03f812b20715c3451f56 4d7d9d73dad989590860178530dd8848d9b79a23f1cb379bc1ca5545cb196eca 4e81241256ab4adb5bb96b21633d95773cc34ee72e499659064db0d3204
sha2564e81241256ab4adb5bb96b21633d95773cc34ee72e499659064db0d32046dabfd73dad989590860178530dd8848d9b79a23f1cb379bc1ca5545cb196eca 4e81241256ab4adb5bb96b21633d95773cc34ee72e499659064db0d32046dabf 4ea92195bc159e268c7a348f2649010cb01a3e67c315d2f0b8115eaf2c8
sha2564ea92195bc159e268c7a348f2649010cb01a3e67c315d2f0b8115eaf2c87969241256ab4adb5bb96b21633d95773cc34ee72e499659064db0d32046dabf 4ea92195bc159e268c7a348f2649010cb01a3e67c315d2f0b8115eaf2c879692 5639d3af9cf530a057aebf3cbf92061b58539b2c311491a26d8f404a211
sha2565112edf0351d70ad31152f67e8996c9c4ad062f0023cfd43b4baecb8aa7b16b4fb9a9cca68c098dcdba33d2aef39888cf229cd02be64cbf59a0b68dae30 5112edf0351d70ad31152f67e8996c9c4ad062f0023cfd43b4baecb8aa7b16b4 52544303a89f2c4e3eedd64c000504a2ef4c920c20361961fc81cae3f52
sha25652544303a89f2c4e3eedd64c000504a2ef4c920c20361961fc81cae3f520244fdf0351d70ad31152f67e8996c9c4ad062f0023cfd43b4baecb8aa7b16b4 52544303a89f2c4e3eedd64c000504a2ef4c920c20361961fc81cae3f520244f 55e181f0e0e88efccf6534949ad8dd93a179e2b94b71e76a9e7db4d938e
sha256527eac30113eb365330ec5c35591fe9ae69d4e1beca8b0ae24666e97d8773e36f675d6517b7989391fc653e8ddc96aa81cec4802e7e66de30adf0e96d2e 527eac30113eb365330ec5c35591fe9ae69d4e1beca8b0ae24666e97d8773e36 53366f90f59348b8de81bdc04652200d2dcf8bad5cfc46a533c3b20cd0e
sha25653366f90f59348b8de81bdc04652200d2dcf8bad5cfc46a533c3b20cd0e200b2c30113eb365330ec5c35591fe9ae69d4e1beca8b0ae24666e97d8773e36 53366f90f59348b8de81bdc04652200d2dcf8bad5cfc46a533c3b20cd0e200b2 5f98685ee9098a31ced944840670772bb972db31ac5d1690974e59f566d
sha25654279416f864d374f33fe9a2fe2998db3976c4ff43e8b0da006548489a50bbdda357d53aec77dd1f119b838ceae79a22bb3a60c7a002cb7328b098546a7 54279416f864d374f33fe9a2fe2998db3976c4ff43e8b0da006548489a50bbdd 5ce812ebf77f6d63de37a1e3d261b9688d595aaeadaef3388f4214896bb
sha25654be105a129d959359107d7dff6b379cd366e32bf7be9ac9a06bc2141d3ca7faf1d4a210f395d5ee32bf55c6b07ee1e0a0bdf939bd081f6d751323c643c 54be105a129d959359107d7dff6b379cd366e32bf7be9ac9a06bc2141d3ca7fa 5dce0e7e0a1807d2804f28c5d5afd4ac282a022acd1945786bd118e1caf
sha25655e181f0e0e88efccf6534949ad8dd93a179e2b94b71e76a9e7db4d938ea2bd2303a89f2c4e3eedd64c000504a2ef4c920c20361961fc81cae3f520244f 55e181f0e0e88efccf6534949ad8dd93a179e2b94b71e76a9e7db4d938ea2bd2 56982cc1f4b4e92aea28a30684bdfc752122eb78fc545ccc3f4169a1597
sha2565639d3af9cf530a057aebf3cbf92061b58539b2c311491a26d8f404a211d66bb195bc159e268c7a348f2649010cb01a3e67c315d2f0b8115eaf2c879692 5639d3af9cf530a057aebf3cbf92061b58539b2c311491a26d8f404a211d66bb 59644dcd34cce275ff5d72c022fa76ac42a422b038d816909281e01e392
sha25656982cc1f4b4e92aea28a30684bdfc752122eb78fc545ccc3f4169a1597233cc1f0e0e88efccf6534949ad8dd93a179e2b94b71e76a9e7db4d938ea2bd2 56982cc1f4b4e92aea28a30684bdfc752122eb78fc545ccc3f4169a1597233cc 5c3982a206d40ec00b2029d4bdde1bb37192341583e803556872b97a609
sha25659644dcd34cce275ff5d72c022fa76ac42a422b038d816909281e01e392d3b403af9cf530a057aebf3cbf92061b58539b2c311491a26d8f404a211d66bb 59644dcd34cce275ff5d72c022fa76ac42a422b038d816909281e01e392d3b40 599e4e8130e4a1f3f3777c6f9f088cc03c2781f4e802e0e16e417a43ec5
sha256599e4e8130e4a1f3f3777c6f9f088cc03c2781f4e802e0e16e417a43ec58c518dcd34cce275ff5d72c022fa76ac42a422b038d816909281e01e392d3b40 599e4e8130e4a1f3f3777c6f9f088cc03c2781f4e802e0e16e417a43ec58c518 5eef8b5433ebc22e4c9ea3c1462d525192a4bda8d20be4e7b09fe7d03fb
sha2565c3982a206d40ec00b2029d4bdde1bb37192341583e803556872b97a609411aecc1f4b4e92aea28a30684bdfc752122eb78fc545ccc3f4169a1597233cc 5c3982a206d40ec00b2029d4bdde1bb37192341583e803556872b97a609411ae 61ee5c724a4c9408e9c8120eabac1babea8e91bf5719b02c78ce129f682
sha2565ce812ebf77f6d63de37a1e3d261b9688d595aaeadaef3388f4214896bb64892416f864d374f33fe9a2fe2998db3976c4ff43e8b0da006548489a50bbdd 5ce812ebf77f6d63de37a1e3d261b9688d595aaeadaef3388f4214896bb64892 810fb35557e051a7be3f03b37247c90796595a2d5afa1b2c3034187de2a
sha2565dce0e7e0a1807d2804f28c5d5afd4ac282a022acd1945786bd118e1caf4050c05a129d959359107d7dff6b379cd366e32bf7be9ac9a06bc2141d3ca7fa 5dce0e7e0a1807d2804f28c5d5afd4ac282a022acd1945786bd118e1caf4050c 5fe244200c9367e1b132ccc13df6daaba5479d2491db8fe95658f439815
sha2565eef8b5433ebc22e4c9ea3c1462d525192a4bda8d20be4e7b09fe7d03fb9d119e8130e4a1f3f3777c6f9f088cc03c2781f4e802e0e16e417a43ec58c518 5eef8b5433ebc22e4c9ea3c1462d525192a4bda8d20be4e7b09fe7d03fb9d119 6238c7a704baa8771812e4f3452acb042c6475913db4cd57cfaf17a7454
sha2565f98685ee9098a31ced944840670772bb972db31ac5d1690974e59f566d1adaef90f59348b8de81bdc04652200d2dcf8bad5cfc46a533c3b20cd0e200b2 5f98685ee9098a31ced944840670772bb972db31ac5d1690974e59f566d1adae 61e7c5b6a7f1608cf0bf728d15f8cdfc0f9f5c7c3748ee28452cfa2a496
sha2565fe244200c9367e1b132ccc13df6daaba5479d2491db8fe95658f43981567c5ae7e0a1807d2804f28c5d5afd4ac282a022acd1945786bd118e1caf4050c 5fe244200c9367e1b132ccc13df6daaba5479d2491db8fe95658f43981567c5a 6292ddf51023ccca84211ed4f33944b4c3df1b694d102d90d3dd2a5a080
sha25661e7c5b6a7f1608cf0bf728d15f8cdfc0f9f5c7c3748ee28452cfa2a496e54cc85ee9098a31ced944840670772bb972db31ac5d1690974e59f566d1adae 61e7c5b6a7f1608cf0bf728d15f8cdfc0f9f5c7c3748ee28452cfa2a496e54cc 70ebc88b9a71c661b68325dd92d0945ea1927e4d115da217640a4efefcf
sha25661ee5c724a4c9408e9c8120eabac1babea8e91bf5719b02c78ce129f68239ff62a206d40ec00b2029d4bdde1bb37192341583e803556872b97a609411ae 61ee5c724a4c9408e9c8120eabac1babea8e91bf5719b02c78ce129f68239ff6 63cc723ad7e85798e9126f5cc933c48d0e3cdfa7504579ef0b0b3cced9c
sha2566238c7a704baa8771812e4f3452acb042c6475913db4cd57cfaf17a7454d4d22b5433ebc22e4c9ea3c1462d525192a4bda8d20be4e7b09fe7d03fb9d119 6238c7a704baa8771812e4f3452acb042c6475913db4cd57cfaf17a7454d4d22 Coverage Screenshots of Detection AMP ThreatGrid Win.Malwar
sha2566292ddf51023ccca84211ed4f33944b4c3df1b694d102d90d3dd2a5a080ed2b94200c9367e1b132ccc13df6daaba5479d2491db8fe95658f43981567c5a 6292ddf51023ccca84211ed4f33944b4c3df1b694d102d90d3dd2a5a080ed2b9 649c52d7b9a58837e6ccd308665d63971e424d29480c44448ddbef15e91
sha25663cc723ad7e85798e9126f5cc933c48d0e3cdfa7504579ef0b0b3cced9cb19c8c724a4c9408e9c8120eabac1babea8e91bf5719b02c78ce129f68239ff6 63cc723ad7e85798e9126f5cc933c48d0e3cdfa7504579ef0b0b3cced9cb19c8 65a0bb3fd94ec888696598703ed111471bd47962278a5f1006e7e0716bd
sha256649c52d7b9a58837e6ccd308665d63971e424d29480c44448ddbef15e91649a6df51023ccca84211ed4f33944b4c3df1b694d102d90d3dd2a5a080ed2b9 649c52d7b9a58837e6ccd308665d63971e424d29480c44448ddbef15e91649a6 6dd74f0816f8b24a6f93c2dae0c69d33689e4baba632605d138216d9c7a
sha25665a0bb3fd94ec888696598703ed111471bd47962278a5f1006e7e0716bd5b58e23ad7e85798e9126f5cc933c48d0e3cdfa7504579ef0b0b3cced9cb19c8 65a0bb3fd94ec888696598703ed111471bd47962278a5f1006e7e0716bd5b58e 71d6d1ed9a5bd71e8dbd03a91151a2965ac12198fa1825366bf19c4b141
sha2566dd74f0816f8b24a6f93c2dae0c69d33689e4baba632605d138216d9c7aab2ba2d7b9a58837e6ccd308665d63971e424d29480c44448ddbef15e91649a6 6dd74f0816f8b24a6f93c2dae0c69d33689e4baba632605d138216d9c7aab2ba 7322fb7767b733ef5a279720f581d54edae9ea4af69d39aaa3e79fc443e
sha25670ebc88b9a71c661b68325dd92d0945ea1927e4d115da217640a4efefcf0c7305b6a7f1608cf0bf728d15f8cdfc0f9f5c7c3748ee28452cfa2a496e54cc 70ebc88b9a71c661b68325dd92d0945ea1927e4d115da217640a4efefcf0c730 722e86b32635a1cace77ceee414761f28e386743fd2c513650e55814179
sha25671d6d1ed9a5bd71e8dbd03a91151a2965ac12198fa1825366bf19c4b14106cb7b3fd94ec888696598703ed111471bd47962278a5f1006e7e0716bd5b58e 71d6d1ed9a5bd71e8dbd03a91151a2965ac12198fa1825366bf19c4b14106cb7 71e3009284ae35a3087ef041162a2ada636b388738033ea62faefc2bbfc
sha25671e3009284ae35a3087ef041162a2ada636b388738033ea62faefc2bbfca9dfc1ed9a5bd71e8dbd03a91151a2965ac12198fa1825366bf19c4b14106cb7 71e3009284ae35a3087ef041162a2ada636b388738033ea62faefc2bbfca9dfc 7e17ee126754a9306b4ffcf536f384abe5c718672807de1e27e7c7f3846
sha256722e86b32635a1cace77ceee414761f28e386743fd2c513650e55814179bdac588b9a71c661b68325dd92d0945ea1927e4d115da217640a4efefcf0c730 722e86b32635a1cace77ceee414761f28e386743fd2c513650e55814179bdac5 91bb8eb10e0aa88ea1e33d1ec23893d5a45e01e8ab69081b96835b4aff3
sha2567322fb7767b733ef5a279720f581d54edae9ea4af69d39aaa3e79fc443e2bb33f0816f8b24a6f93c2dae0c69d33689e4baba632605d138216d9c7aab2ba 7322fb7767b733ef5a279720f581d54edae9ea4af69d39aaa3e79fc443e2bb33 76be26ac77aa81a5fb7d78135adb05b579cecc2173ffef5f5ab6b484e37
sha25676be26ac77aa81a5fb7d78135adb05b579cecc2173ffef5f5ab6b484e37f9e6eb7767b733ef5a279720f581d54edae9ea4af69d39aaa3e79fc443e2bb33 76be26ac77aa81a5fb7d78135adb05b579cecc2173ffef5f5ab6b484e37f9e6e 793b978af24469a77490ea609de0142ff817e557ad78a688dd5d65c2fe4
sha256793b978af24469a77490ea609de0142ff817e557ad78a688dd5d65c2fe49a8db6ac77aa81a5fb7d78135adb05b579cecc2173ffef5f5ab6b484e37f9e6e 793b978af24469a77490ea609de0142ff817e557ad78a688dd5d65c2fe49a8db 7c0e65092e8786d9052bbd74f4dc7b26567e150efb25d1503c4bfd9b389
sha2567c0e65092e8786d9052bbd74f4dc7b26567e150efb25d1503c4bfd9b3895b8ab78af24469a77490ea609de0142ff817e557ad78a688dd5d65c2fe49a8db 7c0e65092e8786d9052bbd74f4dc7b26567e150efb25d1503c4bfd9b3895b8ab 8815e1daad1f9cb4ff4243ff485218e3a0be93e2afef07048852ba79fdd
sha2567e17ee126754a9306b4ffcf536f384abe5c718672807de1e27e7c7f3846d9e7409284ae35a3087ef041162a2ada636b388738033ea62faefc2bbfca9dfc 7e17ee126754a9306b4ffcf536f384abe5c718672807de1e27e7c7f3846d9e74 85b36ab50aeb452822886815076c7c90c30273854496dde7fd3473e6211
sha256810fb35557e051a7be3f03b37247c90796595a2d5afa1b2c3034187de2a3f0bc2ebf77f6d63de37a1e3d261b9688d595aaeadaef3388f4214896bb64892 810fb35557e051a7be3f03b37247c90796595a2d5afa1b2c3034187de2a3f0bc 8f08bcadd3a44055a70dbae3308cf18c8d1824e424100eda03ddc71e941
sha25685b36ab50aeb452822886815076c7c90c30273854496dde7fd3473e62119f672e126754a9306b4ffcf536f384abe5c718672807de1e27e7c7f3846d9e74 85b36ab50aeb452822886815076c7c90c30273854496dde7fd3473e62119f672 877b9a03f0b8763c265ecbc4be76ffafc9eb26c4b618c2827ce1e200797
sha256877b9a03f0b8763c265ecbc4be76ffafc9eb26c4b618c2827ce1e200797ca876ab50aeb452822886815076c7c90c30273854496dde7fd3473e62119f672 877b9a03f0b8763c265ecbc4be76ffafc9eb26c4b618c2827ce1e200797ca876 885718a7bd95c44d14dec7f0efa101147b671e60a7ecac2622ac86061da
sha2568815e1daad1f9cb4ff4243ff485218e3a0be93e2afef07048852ba79fdd9294e5092e8786d9052bbd74f4dc7b26567e150efb25d1503c4bfd9b3895b8ab 8815e1daad1f9cb4ff4243ff485218e3a0be93e2afef07048852ba79fdd9294e 8e84fbc38403f1516447b73b73b5051777314089f0d1fefcfae004b1ef6
sha256885718a7bd95c44d14dec7f0efa101147b671e60a7ecac2622ac86061dab17f2a03f0b8763c265ecbc4be76ffafc9eb26c4b618c2827ce1e200797ca876 885718a7bd95c44d14dec7f0efa101147b671e60a7ecac2622ac86061dab17f2 9583c8f1f3c9982a45ed56fbc30f8be06708cfaa8557aa7f5b611784701
sha2568e84fbc38403f1516447b73b73b5051777314089f0d1fefcfae004b1ef6156411daad1f9cb4ff4243ff485218e3a0be93e2afef07048852ba79fdd9294e 8e84fbc38403f1516447b73b73b5051777314089f0d1fefcfae004b1ef615641 a0e3bd64d556ce80b85b7d328bb61beeaf2da297dc09058211150617d6a
sha2568f08bcadd3a44055a70dbae3308cf18c8d1824e424100eda03ddc71e9417fb5e35557e051a7be3f03b37247c90796595a2d5afa1b2c3034187de2a3f0bc 8f08bcadd3a44055a70dbae3308cf18c8d1824e424100eda03ddc71e9417fb5e 9435b87c7c91ac98f9f461aeaa6b1630e2270e2d2ccdf6a05d46fa02de9
sha25691bb8eb10e0aa88ea1e33d1ec23893d5a45e01e8ab69081b96835b4aff3b906a6b32635a1cace77ceee414761f28e386743fd2c513650e55814179bdac5 91bb8eb10e0aa88ea1e33d1ec23893d5a45e01e8ab69081b96835b4aff3b906a 97645bb27e056b282a0aa46dbbc79ed03bdc29c6f96e369d7537ee2bb1c
sha2569435b87c7c91ac98f9f461aeaa6b1630e2270e2d2ccdf6a05d46fa02de91d1ebcadd3a44055a70dbae3308cf18c8d1824e424100eda03ddc71e9417fb5e 9435b87c7c91ac98f9f461aeaa6b1630e2270e2d2ccdf6a05d46fa02de91d1eb 9634a2afb40139e39da8c8ef0da8f5104229d7bb4c3b95faee5a4396713
sha2569583c8f1f3c9982a45ed56fbc30f8be06708cfaa8557aa7f5b6117847018cd4f8a7bd95c44d14dec7f0efa101147b671e60a7ecac2622ac86061dab17f2 9583c8f1f3c9982a45ed56fbc30f8be06708cfaa8557aa7f5b6117847018cd4f Coverage Screenshots of Detection ThreatGrid Umbrella
sha2569634a2afb40139e39da8c8ef0da8f5104229d7bb4c3b95faee5a4396713f528e87c7c91ac98f9f461aeaa6b1630e2270e2d2ccdf6a05d46fa02de91d1eb 9634a2afb40139e39da8c8ef0da8f5104229d7bb4c3b95faee5a4396713f528e a137c89d2c6f0ae74217724e1cb56aea726e285d0e6e98adfda16617ad5
sha25697645bb27e056b282a0aa46dbbc79ed03bdc29c6f96e369d7537ee2bb1c8dd6eeb10e0aa88ea1e33d1ec23893d5a45e01e8ab69081b96835b4aff3b906a 97645bb27e056b282a0aa46dbbc79ed03bdc29c6f96e369d7537ee2bb1c8dd6e 9b36f0e70d5f7b4795b1278e052356484d4f2374f49563195f224ade6ce
sha2569b36f0e70d5f7b4795b1278e052356484d4f2374f49563195f224ade6ce08c71bb27e056b282a0aa46dbbc79ed03bdc29c6f96e369d7537ee2bb1c8dd6e 9b36f0e70d5f7b4795b1278e052356484d4f2374f49563195f224ade6ce08c71 ac86cafcc7062a389e25a4e26dd15df7ce2e64b7a6890bf5712189ab9ec
sha256a0e3bd64d556ce80b85b7d328bb61beeaf2da297dc09058211150617d6a83b8bbc38403f1516447b73b73b5051777314089f0d1fefcfae004b1ef615641 a0e3bd64d556ce80b85b7d328bb61beeaf2da297dc09058211150617d6a83b8b b6b3b53b1001b6de24797a89d61bd825760574ab4cb60f7a5971115acb5
sha256a137c89d2c6f0ae74217724e1cb56aea726e285d0e6e98adfda16617ad51d1762afb40139e39da8c8ef0da8f5104229d7bb4c3b95faee5a4396713f528e a137c89d2c6f0ae74217724e1cb56aea726e285d0e6e98adfda16617ad51d176 a2907c7011b20373fd47e03a0f4679fdd51b982b973bb37d1d45bfa4a61
sha256a2907c7011b20373fd47e03a0f4679fdd51b982b973bb37d1d45bfa4a618bc5a89d2c6f0ae74217724e1cb56aea726e285d0e6e98adfda16617ad51d176 a2907c7011b20373fd47e03a0f4679fdd51b982b973bb37d1d45bfa4a618bc5a b3c6a0883d9ed8bcf1bf162c0ade8b16f2cd4ae890e30ba9e9540f4bdf5
sha256ac86cafcc7062a389e25a4e26dd15df7ce2e64b7a6890bf5712189ab9ec81c8c0e70d5f7b4795b1278e052356484d4f2374f49563195f224ade6ce08c71 ac86cafcc7062a389e25a4e26dd15df7ce2e64b7a6890bf5712189ab9ec81c8c c3883ba74230604d38a638a1b8d0673cc3c91e01b482e6b83a6e6bbd4ed
sha256b3c6a0883d9ed8bcf1bf162c0ade8b16f2cd4ae890e30ba9e9540f4bdf5f5ba1c7011b20373fd47e03a0f4679fdd51b982b973bb37d1d45bfa4a618bc5a b3c6a0883d9ed8bcf1bf162c0ade8b16f2cd4ae890e30ba9e9540f4bdf5f5ba1 ba5afe1245d10f72637d34a96bf6e365c2f4326da69dcd440beacf421b6
sha256b6b3b53b1001b6de24797a89d61bd825760574ab4cb60f7a5971115acb53c8e4d64d556ce80b85b7d328bb61beeaf2da297dc09058211150617d6a83b8b b6b3b53b1001b6de24797a89d61bd825760574ab4cb60f7a5971115acb53c8e4 ef66d0161200d413bb8a577a517fe03f325f2fd2f0df778f6297a8658ca
sha256ba5afe1245d10f72637d34a96bf6e365c2f4326da69dcd440beacf421b6341330883d9ed8bcf1bf162c0ade8b16f2cd4ae890e30ba9e9540f4bdf5f5ba1 ba5afe1245d10f72637d34a96bf6e365c2f4326da69dcd440beacf421b634133 cd3a4783c2795a16c82518c56f955c9b56f415d59ef5bc77e143f612412
sha256c3883ba74230604d38a638a1b8d0673cc3c91e01b482e6b83a6e6bbd4edd3b10afcc7062a389e25a4e26dd15df7ce2e64b7a6890bf5712189ab9ec81c8c c3883ba74230604d38a638a1b8d0673cc3c91e01b482e6b83a6e6bbd4edd3b10 c56e3ca164803c5668cf0b8228c97626c486f5a7063d4b3109840137b67
sha256c56e3ca164803c5668cf0b8228c97626c486f5a7063d4b3109840137b67c8f98ba74230604d38a638a1b8d0673cc3c91e01b482e6b83a6e6bbd4edd3b10 c56e3ca164803c5668cf0b8228c97626c486f5a7063d4b3109840137b67c8f98 c82eaf2f1f156b95b43b2a984867e486911f6ceb329daea6ac9a6c53fae
sha256c82eaf2f1f156b95b43b2a984867e486911f6ceb329daea6ac9a6c53fae42685ca164803c5668cf0b8228c97626c486f5a7063d4b3109840137b67c8f98 c82eaf2f1f156b95b43b2a984867e486911f6ceb329daea6ac9a6c53fae42685 ca544eaedd654782fa6b7a130bdc58869c2124a59754ed1baf9a5c00faf
sha256ca544eaedd654782fa6b7a130bdc58869c2124a59754ed1baf9a5c00fafae12af2f1f156b95b43b2a984867e486911f6ceb329daea6ac9a6c53fae42685 ca544eaedd654782fa6b7a130bdc58869c2124a59754ed1baf9a5c00fafae12a d4ab2cc67c707cab8f7aab0fde94b50670f1b787b049f45564fe5368205
sha256cd3a4783c2795a16c82518c56f955c9b56f415d59ef5bc77e143f6124123364be1245d10f72637d34a96bf6e365c2f4326da69dcd440beacf421b634133 cd3a4783c2795a16c82518c56f955c9b56f415d59ef5bc77e143f6124123364b d0dbd75a4d8716ba7ca7d025ee1c772aa4ff554214a993b4b874a0a26dc
sha256d0dbd75a4d8716ba7ca7d025ee1c772aa4ff554214a993b4b874a0a26dcf5a6c783c2795a16c82518c56f955c9b56f415d59ef5bc77e143f6124123364b d0dbd75a4d8716ba7ca7d025ee1c772aa4ff554214a993b4b874a0a26dcf5a6c e2116a9a176ff765f1c5ec23003266bfe0f1592e46e41236482ad4c3520
sha256d4ab2cc67c707cab8f7aab0fde94b50670f1b787b049f45564fe5368205ed642eaedd654782fa6b7a130bdc58869c2124a59754ed1baf9a5c00fafae12a d4ab2cc67c707cab8f7aab0fde94b50670f1b787b049f45564fe5368205ed642 eac8c3c76e954d8e2be7a5d1570643b4ce6a856e8143faf6263ad50cf53
sha256e2116a9a176ff765f1c5ec23003266bfe0f1592e46e41236482ad4c3520ea53a75a4d8716ba7ca7d025ee1c772aa4ff554214a993b4b874a0a26dcf5a6c e2116a9a176ff765f1c5ec23003266bfe0f1592e46e41236482ad4c3520ea53a e2846881f6127d99222144e4ece509bd18522fdd7791bf84d7697b37ffa
sha256e2846881f6127d99222144e4ece509bd18522fdd7791bf84d7697b37ffa40919a9a176ff765f1c5ec23003266bfe0f1592e46e41236482ad4c3520ea53a e2846881f6127d99222144e4ece509bd18522fdd7791bf84d7697b37ffa40919 efc3e1b1d6c13c3624160edc36f678dd92f172339bfde598ad1a95b02b4
sha256eac8c3c76e954d8e2be7a5d1570643b4ce6a856e8143faf6263ad50cf53aceb2cc67c707cab8f7aab0fde94b50670f1b787b049f45564fe5368205ed642 eac8c3c76e954d8e2be7a5d1570643b4ce6a856e8143faf6263ad50cf53aceb2 f0a9c1c2fc19b4abd905e8a2f187f94e74dfe1e7de2d9a5328b13893b30
sha256ef66d0161200d413bb8a577a517fe03f325f2fd2f0df778f6297a8658ca0abc853b1001b6de24797a89d61bd825760574ab4cb60f7a5971115acb53c8e4 ef66d0161200d413bb8a577a517fe03f325f2fd2f0df778f6297a8658ca0abc8 f25d03efc63cba1a262034382f809aaa5918f218b965164897df0c989a0
sha256efc3e1b1d6c13c3624160edc36f678dd92f172339bfde598ad1a95b02b474981881f6127d99222144e4ece509bd18522fdd7791bf84d7697b37ffa40919 efc3e1b1d6c13c3624160edc36f678dd92f172339bfde598ad1a95b02b474981 f7df8c9e36cf3440709111a33721e7ac7268a2a80057df08843ba95a72c
sha256f0a9c1c2fc19b4abd905e8a2f187f94e74dfe1e7de2d9a5328b13893b301488d3c76e954d8e2be7a5d1570643b4ce6a856e8143faf6263ad50cf53aceb2 f0a9c1c2fc19b4abd905e8a2f187f94e74dfe1e7de2d9a5328b13893b301488d fb2aa3891cc9383631ddcca4076ae800d67d701a7ffb83d48240cc1d723
sha256f25d03efc63cba1a262034382f809aaa5918f218b965164897df0c989a08dd040161200d413bb8a577a517fe03f325f2fd2f0df778f6297a8658ca0abc8 f25d03efc63cba1a262034382f809aaa5918f218b965164897df0c989a08dd04 f8ee14337fe367aded0aee32c6c84ce404eaef53a6f75d86c6c08235f55
sha256f7df8c9e36cf3440709111a33721e7ac7268a2a80057df08843ba95a72c222eb1b1d6c13c3624160edc36f678dd92f172339bfde598ad1a95b02b474981 f7df8c9e36cf3440709111a33721e7ac7268a2a80057df08843ba95a72c222eb fdd4cce37fd524f99e096d0e45f95ac4dac696c8d7e8eb493bb485c6340
sha256f8ee14337fe367aded0aee32c6c84ce404eaef53a6f75d86c6c08235f55ec3033efc63cba1a262034382f809aaa5918f218b965164897df0c989a08dd04 f8ee14337fe367aded0aee32c6c84ce404eaef53a6f75d86c6c08235f55ec303 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha256fb2aa3891cc9383631ddcca4076ae800d67d701a7ffb83d48240cc1d723721751c2fc19b4abd905e8a2f187f94e74dfe1e7de2d9a5328b13893b301488d fb2aa3891cc9383631ddcca4076ae800d67d701a7ffb83d48240cc1d72372175 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
sha256fdd4cce37fd524f99e096d0e45f95ac4dac696c8d7e8eb493bb485c63409c7b3c9e36cf3440709111a33721e7ac7268a2a80057df08843ba95a72c222eb fdd4cce37fd524f99e096d0e45f95ac4dac696c8d7e8eb493bb485c63409c7b3 Coverage Screenshots of Detection AMP ThreatGrid Umbrella W
Full article611 words · extracted from blog.talosintelligence.com · click to collapse

Friday, August 10, 2018 15:05


Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Aug. 3 - 10. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

  • Win.Malware.Dbzx-6628757-0
    Malware
    This is a variant of the Tspy family. It is able to execute after every reboot, making it persistent. It contacts domains that are related to RATs and are generally command and control (C2) servers to upload data, and receives additional commands. The samples are often packed and contain anti-debug tricks to complicate the manual analysis.
  • Win.Malware.Emotet-6628754-0
    Malware
    This cluster provides generic detection for the Emotet trojan that's downloaded onto a targets machine. Emotet is a banking trojan that has remained relevant due to its continual evolution to bypass antivirus products.
  • Win.Malware.Zerber-6629234-0
    Malware
    This is a malware identification for a ransomware variant of Cerber.
  • Win.Malware.Startsurf-6628791-0
    Malware
    Strtsurf is a trojan targeted at collecting personal information, and sometimes labeled as a potentially unwanted application (PUA) in other coverage signatures.
  • Win.Packed.Eorezo-6629326-0
    Packed
    This malware is known to enable the display of advertisements in Internet Explorer. It's also downloads several pieces of software and installs them in the background.

Threats

Win.Malware.Dbzx-6628757-0

Indicators of Compromise
Registry Keys

  • <HKLM>\Software\Wow6432Node\Microsoft\Tracing  Mutexes
  • QSR_MUTEX_HnRHWDxWQnveBdUtWT  IP Addresses
  • N/A Domain Names
  • ip-api[.]com Files and or directories created
  • N/A File Hashes
  • 25430a357d53aec77dd1f119b838ceae79a22bb3a60c7a002cb7328b098546a7
  • 54279416f864d374f33fe9a2fe2998db3976c4ff43e8b0da006548489a50bbdd
  • 5ce812ebf77f6d63de37a1e3d261b9688d595aaeadaef3388f4214896bb64892
  • 810fb35557e051a7be3f03b37247c90796595a2d5afa1b2c3034187de2a3f0bc
  • 8f08bcadd3a44055a70dbae3308cf18c8d1824e424100eda03ddc71e9417fb5e
  • 9435b87c7c91ac98f9f461aeaa6b1630e2270e2d2ccdf6a05d46fa02de91d1eb
  • 9634a2afb40139e39da8c8ef0da8f5104229d7bb4c3b95faee5a4396713f528e
  • a137c89d2c6f0ae74217724e1cb56aea726e285d0e6e98adfda16617ad51d176
  • a2907c7011b20373fd47e03a0f4679fdd51b982b973bb37d1d45bfa4a618bc5a
  • b3c6a0883d9ed8bcf1bf162c0ade8b16f2cd4ae890e30ba9e9540f4bdf5f5ba1
  • ba5afe1245d10f72637d34a96bf6e365c2f4326da69dcd440beacf421b634133
  • cd3a4783c2795a16c82518c56f955c9b56f415d59ef5bc77e143f6124123364b
  • d0dbd75a4d8716ba7ca7d025ee1c772aa4ff554214a993b4b874a0a26dcf5a6c
  • e2116a9a176ff765f1c5ec23003266bfe0f1592e46e41236482ad4c3520ea53a
  • e2846881f6127d99222144e4ece509bd18522fdd7791bf84d7697b37ffa40919
  • efc3e1b1d6c13c3624160edc36f678dd92f172339bfde598ad1a95b02b474981
  • f7df8c9e36cf3440709111a33721e7ac7268a2a80057df08843ba95a72c222eb
  • fdd4cce37fd524f99e096d0e45f95ac4dac696c8d7e8eb493bb485c63409c7b3

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Malware.Emotet-6628754-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • PEMB2C
  • PEM944
  • PEM80C
  • PEMA10 IP Addresses
  • 67[.]68[.]235[.]25
  • 187[.]192[.]180[.]144 Domain Names
  • N/A Files and or directories created
  • %WinDir%\SysWOW64\TO5sH5uBMit.exe File Hashes
  • 0406ad0fe90d371b02742e6821486abbfbf2bbd72a7593e8ddb650f0b97673b3
  • 0604aa87706cb7890075b494f026c88b2f03b621367f1bb62a87f5c5deb87870
  • 086af92d83279f5792c15a762a70e158de54b67c1a96bfc14c4ad52a24468f32
  • 10f13af2a3591efa3d58c47bb0635e3a653e14ec7726493bb4595b4dd8cd51cb
  • 127c316e7a10579e61369d6a8154e3e34726209b3cc075ddd6d9875c439c583e
  • 1fc9fda1b0c868dc7cb0cf6d8867b7aefc202436fe9e41cba5b2b35bb1ce9e9f
  • 23ba67cf24c95f3bfd36b66f822feb3d2fd0f72617921550fee034a1b7b8cc74
  • 27e37ac7cc8b48573a8345223399ce6b0ab9432ee977acf02c09bcf64cf6622d
  • 2bf1192e5200b6f8d25586908b05912a5fa6e06e87540dbb914200446a3deb10
  • 2ee83958eb1e8cb622ca833c38e51b53548d299b6574e5b7203741a2d27963f5
  • 2fca527cf8ebf4576e982118e22dfe3fd8e445749a5403dafed36089666f2357
  • 30bbfb79d26a172975e9482204f06423eff6948b1732384e7b6d23f9932ec08d
  • 30bf6e1a41dea6e4024853f9b7a6a878e4f5e4141dba4b0fe7686159925fe6cf
  • 42fca9d196c668747b74f80ca996aee9ae38bed96956b42436949a8d4d33ecf1
  • 45e6356ca3b373da3a80a72a1b64f1254f4426949598b8877abd6de99e379166
  • 4ac5db87bc83dcbf1399f4fc0fede3c5ecee5b8ef2a2500fd79b1588ef033429
  • 4b2f6d80bf78ad165c2f07d914cb4137ba31918f3f8f03f812b20715c3451f56
  • 4d7d9d73dad989590860178530dd8848d9b79a23f1cb379bc1ca5545cb196eca
  • 4e81241256ab4adb5bb96b21633d95773cc34ee72e499659064db0d32046dabf
  • 4ea92195bc159e268c7a348f2649010cb01a3e67c315d2f0b8115eaf2c879692
  • 5639d3af9cf530a057aebf3cbf92061b58539b2c311491a26d8f404a211d66bb
  • 59644dcd34cce275ff5d72c022fa76ac42a422b038d816909281e01e392d3b40
  • 599e4e8130e4a1f3f3777c6f9f088cc03c2781f4e802e0e16e417a43ec58c518
  • 5eef8b5433ebc22e4c9ea3c1462d525192a4bda8d20be4e7b09fe7d03fb9d119
  • 6238c7a704baa8771812e4f3452acb042c6475913db4cd57cfaf17a7454d4d22

Coverage

Screenshots of Detection AMP


ThreatGrid

Win.Malware.Zerber-6629234-0

Indicators of Compromise
Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: FlashPlayerApp
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
  • Value Name: Run
  • <HKCU>\SOFTWARE\MICROSOFT\COMMAND PROCESSOR
  • Value Name: AutoRun
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value Name: DefaultConnectionSettings Mutexes
  • shell.{381828AA-8B28-3374-1B67-35680555C5EF} IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • %AppData%\Microsoft\Windows\Start Menu\Programs\StartUp\FlashPlayerApp.lnk
  • %AppData%\{6F885251-E36F-0FE6-9629-63208157D7A2}\FlashPlayerApp.exe File Hashes
  • 25f8455b83b98f38809af120e35c3eda189a05538f7aa2d527a265520bc3c75e
  • 342a9470e5d3dd522c17cf0a5bc588d87a84689d90362c0b18c320385b2e908d
  • 41ebdf1d4a210f395d5ee32bf55c6b07ee1e0a0bdf939bd081f6d751323c643c
  • 54be105a129d959359107d7dff6b379cd366e32bf7be9ac9a06bc2141d3ca7fa
  • 5dce0e7e0a1807d2804f28c5d5afd4ac282a022acd1945786bd118e1caf4050c
  • 5fe244200c9367e1b132ccc13df6daaba5479d2491db8fe95658f43981567c5a
  • 6292ddf51023ccca84211ed4f33944b4c3df1b694d102d90d3dd2a5a080ed2b9
  • 649c52d7b9a58837e6ccd308665d63971e424d29480c44448ddbef15e91649a6
  • 6dd74f0816f8b24a6f93c2dae0c69d33689e4baba632605d138216d9c7aab2ba
  • 7322fb7767b733ef5a279720f581d54edae9ea4af69d39aaa3e79fc443e2bb33
  • 76be26ac77aa81a5fb7d78135adb05b579cecc2173ffef5f5ab6b484e37f9e6e
  • 793b978af24469a77490ea609de0142ff817e557ad78a688dd5d65c2fe49a8db
  • 7c0e65092e8786d9052bbd74f4dc7b26567e150efb25d1503c4bfd9b3895b8ab
  • 8815e1daad1f9cb4ff4243ff485218e3a0be93e2afef07048852ba79fdd9294e
  • 8e84fbc38403f1516447b73b73b5051777314089f0d1fefcfae004b1ef615641
  • a0e3bd64d556ce80b85b7d328bb61beeaf2da297dc09058211150617d6a83b8b
  • b6b3b53b1001b6de24797a89d61bd825760574ab4cb60f7a5971115acb53c8e4
  • ef66d0161200d413bb8a577a517fe03f325f2fd2f0df778f6297a8658ca0abc8
  • f25d03efc63cba1a262034382f809aaa5918f218b965164897df0c989a08dd04
  • f8ee14337fe367aded0aee32c6c84ce404eaef53a6f75d86c6c08235f55ec303

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Malware.Startsurf-6628791-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • Local\MSCTF.Asm.MutexDefault1 IP Addresses
  • N/A Domain Names
  • lip[.]healthcakes[.]men Files and or directories created
  • N/A File Hashes
  • 00cc9438408d1b22b0afc57e3b233ff62774cbcb92e58b392403d8c794d988ed
  • 118e08c379b0035cef2a155d59d97c6e8cae94b6f46c5e77f58d84c88c689d2c
  • 1f270dc860158d63bb400e08f12bce40a9a50494368ea6e44cfd89f7e0dc23f4
  • 3e49b3e58eec40b735124509bafcf434904f5945c9d65a5a860b0950850a979d
  • 4348a4b50eba73d6eb5d0d254241d0e44fc63c975b589ac5276d6dc5cf8bab13
  • 4a1c1cf9c70b127cc514fa6cdbb0e286ee33bf19f6ff41ca02951c9947dac55e
  • 4ae8cf675d6517b7989391fc653e8ddc96aa81cec4802e7e66de30adf0e96d2e
  • 527eac30113eb365330ec5c35591fe9ae69d4e1beca8b0ae24666e97d8773e36
  • 53366f90f59348b8de81bdc04652200d2dcf8bad5cfc46a533c3b20cd0e200b2
  • 5f98685ee9098a31ced944840670772bb972db31ac5d1690974e59f566d1adae
  • 61e7c5b6a7f1608cf0bf728d15f8cdfc0f9f5c7c3748ee28452cfa2a496e54cc
  • 70ebc88b9a71c661b68325dd92d0945ea1927e4d115da217640a4efefcf0c730
  • 722e86b32635a1cace77ceee414761f28e386743fd2c513650e55814179bdac5
  • 91bb8eb10e0aa88ea1e33d1ec23893d5a45e01e8ab69081b96835b4aff3b906a
  • 97645bb27e056b282a0aa46dbbc79ed03bdc29c6f96e369d7537ee2bb1c8dd6e
  • 9b36f0e70d5f7b4795b1278e052356484d4f2374f49563195f224ade6ce08c71
  • ac86cafcc7062a389e25a4e26dd15df7ce2e64b7a6890bf5712189ab9ec81c8c
  • c3883ba74230604d38a638a1b8d0673cc3c91e01b482e6b83a6e6bbd4edd3b10
  • c56e3ca164803c5668cf0b8228c97626c486f5a7063d4b3109840137b67c8f98
  • c82eaf2f1f156b95b43b2a984867e486911f6ceb329daea6ac9a6c53fae42685
  • ca544eaedd654782fa6b7a130bdc58869c2124a59754ed1baf9a5c00fafae12a
  • d4ab2cc67c707cab8f7aab0fde94b50670f1b787b049f45564fe5368205ed642
  • eac8c3c76e954d8e2be7a5d1570643b4ce6a856e8143faf6263ad50cf53aceb2
  • f0a9c1c2fc19b4abd905e8a2f187f94e74dfe1e7de2d9a5328b13893b301488d
  • fb2aa3891cc9383631ddcca4076ae800d67d701a7ffb83d48240cc1d72372175

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Packed.Eorezo-6629326-0

Indicators of Compromise
Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: 6518673 Mutexes
  • Amazonassistant2018
  • Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_2c8
  • Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_2c8
  • WmiApRpl_Perf_Library_Lock_PID_2c8 IP Addresses
  • N/A Domain Names
  • www[.]wizzmonetize[.]com
  • ionesystemcare[.]info
  • www[.]rothsideadome[.]pw
  • www[.]usatdkeyboardhelper[.]pw Files and or directories created
  • %ProgramFiles%\WJTLINYZUI\cast.config
  • %LocalAppData%\Temp\DaGXhZc6w\Nursehealth.exe
  • %System32%\Tasks\One System Care Monitor
  • %ProgramFiles% (x86)\OneSystemCare
  • %SystemDrive%\TEMP\config.conf
  • %LocalAppData%\Temp\U8R09Z5FM2\OneTwo.exe
  • %LocalAppData%\Temp\U8R09Z5FM2\up.exe
  • %WinDir%\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new
  • %ProgramFiles%\WJTLINYZUI\GCOMQP0KN.exe File Hashes
  • 002d9959f5e7417cc2cbc657243f2dab82fac3d2e94fa2d0c8e45eda10889b08
  • 03c948623cf78efe90258d894ab0e793bca7009bd73d0be0f652575f81bda621
  • 0f8d729821902252b7f7a1c0d51004d3770356969e7181548126f13f1e2ebf2a
  • 1e64134ff7358ea6e632fd2377532491235cf089f33095a72552e150088b42f1
  • 1eed9456e69a80cb4e8444ad0356d71e09a073715f92e51afa008e80d2a0352a
  • 26f928ef89fde0e3e3fa996073c7c0bba00c2cbfe280de338de15367f4c8f76b
  • 2b0c6557b39ad8cca97ea6975aa3f4a8341774461b1bacab05d04ab20a9463eb
  • 3a5ac5c5ee7985367349d84d60be2c5f94f876c56cf73acbae6fc680ebbdb3c6
  • 47bcf1f1bca23a36e291a0ac4cb8d1cd59c0c80d6a8e3b2cc3d646284cc531d5
  • 4ae3efb9a9cca68c098dcdba33d2aef39888cf229cd02be64cbf59a0b68dae30
  • 5112edf0351d70ad31152f67e8996c9c4ad062f0023cfd43b4baecb8aa7b16b4
  • 52544303a89f2c4e3eedd64c000504a2ef4c920c20361961fc81cae3f520244f
  • 55e181f0e0e88efccf6534949ad8dd93a179e2b94b71e76a9e7db4d938ea2bd2
  • 56982cc1f4b4e92aea28a30684bdfc752122eb78fc545ccc3f4169a1597233cc
  • 5c3982a206d40ec00b2029d4bdde1bb37192341583e803556872b97a609411ae
  • 61ee5c724a4c9408e9c8120eabac1babea8e91bf5719b02c78ce129f68239ff6
  • 63cc723ad7e85798e9126f5cc933c48d0e3cdfa7504579ef0b0b3cced9cb19c8
  • 65a0bb3fd94ec888696598703ed111471bd47962278a5f1006e7e0716bd5b58e
  • 71d6d1ed9a5bd71e8dbd03a91151a2965ac12198fa1825366bf19c4b14106cb7
  • 71e3009284ae35a3087ef041162a2ada636b388738033ea62faefc2bbfca9dfc
  • 7e17ee126754a9306b4ffcf536f384abe5c718672807de1e27e7c7f3846d9e74
  • 85b36ab50aeb452822886815076c7c90c30273854496dde7fd3473e62119f672
  • 877b9a03f0b8763c265ecbc4be76ffafc9eb26c4b618c2827ce1e200797ca876
  • 885718a7bd95c44d14dec7f0efa101147b671e60a7ecac2622ac86061dab17f2
  • 9583c8f1f3c9982a45ed56fbc30f8be06708cfaa8557aa7f5b6117847018cd4f  

Coverage

Screenshots of Detection ThreatGrid


Umbrella

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-roundup-0803-0810/