Cisco Talospublished Apr 13, 20:11 UTC (Apr 13, 2018)ingested Sep 10, 06:19 UTC

Threat Roundup for April 6

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article929 words · extracted from blog.talosintelligence.com · click to collapse

Friday, April 13, 2018 16:11

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 6 and 13. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and we will discuss how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this roundup are:

Win.Dropper.Fareit-6500687-1
Dropper
A credential and sensitive information harvester. Select information, such as banking credentials or web browser password databases, are queried for on the infected host. Any discovered data is propagated to a comm and control (C2).
Win.Dropper.Generickdz-6500702-1
Dropper
This cluster focuses on malware that creates a Run key for persistence and uses various Win32 API to perform malicious activities.
Win.Dropper.Generic-6502500-0
Dropper
This cluster focuses on malware that creates a Run key for persistence with embedded HTML to get the user to download additional files.
Win.Dropper.Mikey-6502276-0
Dropper
This cluster focuses on malware that creates a service for persistence, and is known for the plugin architecture.
Win.Dropper.Neutrinopos-6500704-1
Dropper
Neutrino has evolved over time. This variant targets point of sale (PoS) terminals. This family is known for using anti-sandbox techniques to hinder automatic analysis.
Win.Dropper.Shipup-6503419-0
Dropper
The typical behavior includes modifying the AutoRun feature for certain devices. It gains persistence by creating a scheduled task to conduct its activities.
Win.Dropper.Startsurf-6502245-0
Dropper
A trojan targeted at collecting personal information, and sometimes labeled as a potentially unwanted application (PUA) in other coverage signatures.
Win.Dropper.Upatre-6498441-1
Dropper
Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.
Win.Packed.Tofsee-6504793-0
Packed
A multi-purpose malware that can contain a number of modules to carry out various activities, including installing itself as a service to carry out its spam botnet functionality.

Threats

Win.Dropper.Fareit-6500687-1

Indicators of Compromise
Registry Keys

N/A Mutexes
\BaseNamedObjects\00291FDE1ED259137753E922 IP Addresses
101[.]99[.]75[.]151 Domain Names
makewebomb[.]xyz Files and or directories created
N/A File Hashes
b4abd9556f093b7d80bdc755d502917310a807d5ee9d9f9bac19bb0c8d596dbc
1ca88b2c00b625bf596b93abafae873a6aec5bf1afeee1e116dc402cae69f83a
3f2925b26b0f0b0f141346d8a654a74704d9326492537de17518bd6fb11671e8
ba0a2f6e001bc9c02ee8c5fbcd6cceaa74ced5ec058dfda71623146f06ff2490
f68b0c32da95c0fb06c4cefb992e1a0039afed32f6cfcef083db39a0702a06c7
61ff6f5d48f02c0a5b7a28936f8aa9ebad2344f3552608fae2ce3f14a9bf14d4
a7d667e9d67d4b7db00c52572ca1e945b1aba8139dce9c647b8b9bce89ba45e0
6a1a4a21545538c2dd34ba9beec07cbfe17c8ff65a10f1bcdf8598a8f1b58e42
85d0021f75a2d312a27bc1c17702d09520006aff590d439a90d8045d2325a04e
09574981553c2729c9779beee8e6007734f932a155de278eb46d9fc557c39400
e981fd64b4c1f1d50cdf3f21d3cd07dfb04dec58c518bee8697a187069997498
7c83266775aceac7e54b9d7db2620245520a52e854a5e61f5c5f2452a60432de
3ed671f4ea7e92ef0e0bf61e7bacc0b7a2a82ccea73a53e7cde66e3497a86520
97702356739358d428d1e7c7ddcc8aa08379562b290edb12348cae2bc0ddbb32
9c6def0cb6963372a10888e6f702d80381559a29db1da32ab149273b3d10ca34
df58773cc519e82a8beebeca8035018168cb3cb26aa491aae89c8d68cec835a7
5eb40ac46872c6d26cd7ebdb0938a9375d7cdf28017a5c625d890a7d2ba7852d
afcdd2fda5b3c9e78a977df31be307ea7323b746e07e35e4d3c39a3a3f4b4b79
a854a9702c14be3508d35873e80577ee9b1296c993ee2a4269c283884775564e
431e6a8252837a5e1c7c98aa9b72c1df4b21e34ae8c7e73882294097f140466e
1d7a1a4181706379a7f80ed926c47cb0ebc7beb953739c9b41cec20093c63914
7b24f0523af239668ee8946c433c53d0c233b0290bbaca405885d39dff86fa1f
444147472ba54f1f58776a84e98152ae28dfbca23602cb440a830fddd4a283cf
b33436701b6a54b78141a2812264f4b3ee93ac0a5ae0149e636e7db8c4f38a28
e5d34b53cb6e4e111e167cf13b608b87f7ab7d43d7f08f995ae9f2c1139e8f51

Coverage

Screenshots of Detection AMP

Win.Dropper.Generickdz-6500702-1

Indicators of Compromise
Registry Keys

<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value: kdivknmyqwz
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyServer
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: AutoDetect
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyOverride
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: ProxyEnable
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
Value: AutoConfigURL Mutexes
N/A IP Addresses
66[.]171[.]248[.]178 Domain Names
gandcrab[.]bit
dns1[.]soprodns[.]ru
nomoreransom[.]bit
nomoreransom[.]coin
ipv4bot[.]whatismyipaddress[.]com Files and or directories created
%LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.tmp
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\W7RSB4SE.htm
%AppData%\Microsoft\zkwnlf.exe File Hashes
599d9e37c39ec47a50b512e01449a37ff3c3354ed0b9b4de2ca7e8f2d3a33bfa
4d0f0b7c9a3b8694895275fcc45aa1df3e6f2ad0c58563a40ac80776c705f821
0aeb76bb929ea68275b904412054c3b15a73fd6479ee3daecd5ffd4c407eb721
c76394aaf293cbf4bf3b9d7a94c251feac11435204664d700bb4bd87da3c1898
66c2586add3eac9184972cfc7a6172532c16dc0d1e1f874e4cd3fa2276657c2a
02cb3c5568577ed9658fcf68b9f776d720e2f7355090b10875f0f9bb2b8ed161
5f7f8a6fd32cf4d91efe01c2f1b7c4fd5f509b504af134a08c6c688ba9597ea6
3c9c3423951655b97251bf5d3d12fe59fcf96d4274c4887b88744438371fe61b
4e496591b9c2c9722c07746edfc7892b178b8965bb4c452322caab68b2d5f262
2eed2f22d055d605a8387d35610e4e82815eb29b7212de12088202efa54d3c31
0073f6d57c2e4ca1871dc1a5e270160e734b2d79bd9b7b55b82a8ddc53aaac0f
c21fdd9a5d244aed75890c59094789c2f46815983084f4bc5966ae28630908a8
98f7b5afa98edbfcb4a6f502d9d29e6bb0912a6bcb7a14abe3a9a60e0487b201
c7e92cc3f88c7180e2774f2641c593ebebedee3424314fdd8fa8365f6cd0000a
1937b1e07be1737d79a3a4b1ea9c5ab0a56f1c3ce44d2e34d705a7b69b9346cd
310848da5dd6e75c8df5bc00223582a7b7e6fbef90ca45222948eaba546be3bd
40a0f808c1fd873c364850d95e2f0adb0ca24740945702de5c0552a5afc60612
b609c46124d069b2299de3896a5cc2f7540e4effcba462e7f5300573666efd4a
d7e95936470c9747f9c803d3839159e86112afbe49d68b578775f1c29141d502
036d8c2a089ea0870fa37060c96928789a8b373ca0795d1c06db443b53dc5882
2b7662b93abcd312eb2c4d66c246af9dc7c43a511fae5dddd11617bf2ced16c3
5795c26debe0c06d1f1968730a84efeed69f0493b23f8411b3ea60781e7a24a7
6856286bb8ac5961f58831e7e4fa6debe7a4a399e5ffa56d37e7ca78f1588871
6db67b808d476e3412034571798447aafbbe320a0884a417a7d7fae604440c6e
acaa87b92f1e2ee316033624e4760ca4f9c781e82b72949c46861c7652cf74c2

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Dropper.Generic-6502500-0

Indicators of Compromise
Registry Keys

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
Value: NZVHFTBPMBN Mutexes
N/A IP Addresses
198[.]54[.]117[.]217
68[.]65[.]121[.]51
104[.]200[.]23[.]95
104[.]250[.]149[.]195 Domain Names
www[.]atopgixn[.]info
www[.]gstringguitarco[.]com
www[.]mymugcity[.]com
WWW[.]SNHVWA[.]MEN
www[.]mankafei[.]net
www[.]9999zh[.]com
www[.]dltecgeradores[.]com
www[.]snhvwa[.]men
www[.]zswlu[.]info
www[.]bitstubs[.]com
www[.]allsystemstoupgrades[.]win Files and or directories created
%AppData%\K27P0CT0\K27logrv.ini
%TEMP%\Gsdf0d
%TEMP%\nsnD1EF.tmp
%TEMP%\zvu
%AppData%\K27P0CT0\K27logim.jpeg
%ProgramFiles(x86)%\Microsoft\Windows\WebCache\WebCacheV01.tmp
%TEMP%\nstD210.tmp\System.dll
%AppData%\K27P0CT0\K27logri.ini
%TEMP%\Gsdf0d\mshlg4q6x.exe
%ProgramFiles(x86)%\Gsdf0d
%TEMP%\nsc8B5E.tmp
%AppData%\K27P0CT0\K27log.ini
%TEMP%\nsi8B7F.tmp\System.dll
%ProgramFiles(x86)%\Gsdf0d\mshlg4q6x.exe
%AppData%\K27P0CT0\K27logrc.ini
%TEMP%\nsi8B7F.tmp
%AppData%\K27P0CT0
%TEMP%\nstD210.tmp File Hashes
44f6b3cea3a371a7cd6161739dcc6f9f96a40c8c732b1acd8042a2991a9bbf73
d62ee1186d8a8c7d84b2a03e0bee1c13c47d133a55238ba7c367f9539e6c9b17
df9f1a4e2cb4247132c7442aedfe873c5e801ab048e0236407066c3acd5ec79b
d8f1f59b81a985f538fc0a51c85c688794f94b28a06883ba9dadfb4b0c8bccd6
2ca04f3c65e3fd16b9c879c7db4cc8025279463dbb965e3954e35106fe952e86
3538c0a7785ab6d418112d10cd6844ded5745064840d18d74d9b978dea1fe1a9
09cc6c9e39425a71ccdc26ffd8a67179043b20f646286685eea24e6bb00b12d9
725752c4bda82acf554aad37fe97d08f4367c9a1e5d40b6fe17cdc94adf040fc
3d756dcf4397cb6b0d406b9f70eb18029965fce0110c0290af6ad73468aa2c1f
ef4d20220eaecedc0b3069192843bd5eddc196b25a9e083fd16d19ae100374df
70d50a77db7cb028163638a7e58c354e1fbab4757323ad9eccfb51e9b257f83c
35c996576eba666a33e26bc25122196de365465da8ebee70930b9c4ec6be7313
330a8b46f74f5d4af759b18db64dfd9af2ef3e429d597cd4522148fb78633000
ac6fbd8f18bb93cfac31af73eb9cf6a1aa925b95d44b42b3659ecfd49209ec76
711155de0073adc2f68fc4088253f92f43a696bbf5d8f892f902724be37668f3
c1e6324086192a47c60daee91f9f906c2ceb03cac0c67a8ed3f0a31c37e3a991
5301f9401c7d7ac485d0169085222c64ec2de6f14783cad6150b7c6f0f368c7c
96847279dd3564a5d689bf310483fe351fac55e54a440d15e55f0bb7d35baab6
aebb84da20c2c92da398b1e5fcc8adc6bfe893d5a8b56c5cd1beb42b3fa5f069
2a0904b6301b42ed0838633b161c947a781600fc884b0fc499f906a49ea38292
0e1c8a62bd632cd364d16dcf0839531c8dcb443269f4478f301e4adf758977a6
f34354749657c44beee0b1d7f5cdc4a31c858eab565fc2592f96c69eb9d501e1
8ecfcfc939e40cc943df83f548286c2f7f519a53e195b3ae595e0bef39baee29
21178d6e06ded3b1a43e98eb781220c37e729ef081bd160f168fc465313ea4ff
ef4b97346e1ee359feff43d136f3dd6031993fb47bdfd25520b4fc3279d3649b

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Dropper.Mikey-6502276-0

Indicators of Compromise
Registry Keys

<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\9B4DFF593EC4945503B76D97E83BADF6893F2597
Value: Blob
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV\INSTANCES
Value: DefaultInstance
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV\INSTANCES\MAGSV INSTANCE
Value: Altitude
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV\INSTANCES\MAGSV INSTANCE
Value: Flags
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK
Value: atimode
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK
Value: shield_count
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK
Value: set_pt
<HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK
Value: set_bl
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES
Value: 9B4DFF593EC4945503B76D97E83BADF6893F2597
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS
Value: DisabledComponents
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV
Value: ImagePath
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV
Value: DisplayName
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV
Value: St
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV
Value: Start
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV
Value: ErrorControl
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV
Value: WOW64
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV
Value: Group
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV
Value: Type
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS
Value: DisableTaskOffload
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\NETWORK\FILESERVICE
Value: igfxmtc_time
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\NETWORK\FILESERVICE
Value: Liveup
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\9B4DFF593EC4945503B76D97E83BADF6893F2597
<HKLM>\Software\Microsoft\WBEM\CIMOM
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV\Instances
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV\INSTANCES\magsv Instance
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\magsv Mutexes
N/A IP Addresses
45[.]77[.]68[.]17
45[.]32[.]78[.]78
45[.]63[.]57[.]87
173[.]192[.]16[.]184
174[.]37[.]56[.]249 Domain Names
gpt9[.]com
optcdn[.]com
www[.]userbest[.]com
optitm[.]com Files and or directories created
%System32%\drivers\spbiovxl.sys
%LocalAppData%\exhpugb\dowmload.tmp
%WinDir%\TEMP\UDD7B8B.tmp
%System32%\pwkmbru
%TEMP%\3ED5.tmp
%TEMP%\400F.tmp
%WinDir%\TEMP\msidntfs\SSL\cert.db
%TEMP%\nsy4211.tmp\ioSpecial.ini
%System32%\pwkmbru\dsieovx.exe
%WinDir%\TEMP\msidntfs\SSL
%WinDir%\TEMP\UDD73AE.tmp
%LocalAppData%\igfxmtc\igfxmtc.exe
%WinDir%\TEMP\msidntfs\SSL\SecureTrust Network Root CA 2.cer
%TEMP%\4119.tmp
%TEMP%\nsy4211.tmp\modern-wizard.bmp
%WinDir%\TEMP\UDD6BD1.tmp
%WinDir%\TEMP\msidntfs
%LocalAppData%\exhpugb
%TEMP%\3DCC.tmp.exe
%WinDir%\TEMP\UDD63F3.tmp
%WinDir%\TEMP\UDD8369.tmp
%TEMP%\3FFE.tmp
%TEMP%\nss41A2.tmp
%WinDir%\SysWOW64\pwkmbru
%TEMP%\nsy4211.tmp\GetVersion.dll
%System32%\pwkmbru\dsieovx.sys
%System32%\pwkmbru\dsieovxdrv.sys
%TEMP%\3E3A.tmp
%WinDir%\TEMP\UDD4441.tmp
%LocalAppData%\igfxmtc\dowmload.tmp
%LocalAppData%\igfxmtc
%TEMP%\nsy4211.tmp
%TEMP%\3DCC.tmp
%TEMP%\nsy4211.tmp\InstallOptions.dll File Hashes
4605f6041d93c6390c1ed856336c01a6cf3982bea1987c6de846752ca7006882
a10aefc70a3d3512cf54f74e39b3ee5cc5403c003179c57aeea7fb3895ed8ace
a0365a881396fa66719255cd617e5ef7e175343f28b7ee7ec347bf87811274c0
05be7b2de818dcb358a4f24d6050ae2b91d728c80a8af279894b5e701b060926
a32a315ae45f62d26cdd22281a69932c83f147fc4e820a9cc7bf05bcc4680777
6bd49db136718b3cef01348bc839e206d566a1e1c32e0537be61dfa2ee87de6b
a677a593cebda3734ab26828b65fd93b54bbc02199a080a26da61afcff29ae48
84c269a1661a987058f51dea4644ec2703b28170324fbeab6920e40ad1a05a54
ad7c7472d980025e3edbab89988fec2d5776b4f72b0757c2b1dac54d1c991c37
877d9c4195c38a9dc55c472f7c72ec3d6ad0d95a544458a2050edf22df3aac5c
0a6cabedfabfbab3fba2057d30b1faab2f1b2d2d47a6227aa3b677af45f92da2
683339b58c7cbc066f84c625efa0248eb89bfcd24de916f5fe600c33867084e7
7bc897c2c55ff708cbccff1461d2406aaef7953686817bd2d6a39ad58af393f9
e1e31a797b01f5f4ec694fb03d894e5ab331f41f3bc8c34bb407d390554bfe3a
fa8c301685d5ceb6a97b75f3bb665871e3ddf5b47410179dd7a55f4f3cebf4ab
9b4536855237fe80447950bf86d1177489dbc1b231122e4a5d2157ba93c1b504
19a5f6fc34e531409c787b00444671b44a5c11dec0dafab0e0ef699de29eea6d
b4e2b99c18bf61acedaff5b1908a212470eb902ddfe8e164e01ffcfbab19834b
db5b0bb4d05292e6649fa84f076195d7a0cfb15516ce386f214dc2dd96a5e467
11117fe96292e5d5702f2c82e4b21c3cbc4234f13417b22ad963a9f746978482
33ab8e652c16836caf3b22518485757f417fab73a92e916f0c6aaf27b57f3be4

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Dropper.Neutrinopos-6500704-1

Indicators of Compromise
Registry Keys

<HKU>\Software\Microsoft\Windows\CurrentVersion\Run
<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh
<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr
<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent
<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\host2lc
<HKLM>\SOFTWARE\Microsoft\Tracing\FWCFG
<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier Mutexes
\BaseNamedObjects\DRBCXMtx IP Addresses
216[.]58[.]217[.]174
62[.]75[.]222[.]235
216[.]58[.]206[.]78
84[.]16[.]241[.]77
66[.]199[.]229[.]251 Domain Names
google[.]com
u[.]drawfixmydesign[.]com
r[.]drawfixmydesign[.]com Files and or directories created
N/A File Hashes
2593e0c6d66d36c7d8b3061f3c242875113310a2939f89aea73eda1397e44e31
e9a7b16189e27dff9ff67e31d09fa05e7f32658dfa56bb51feff8ca0cfb4eb85
1a1144444adb05aee9ef8adfb3c892a97d32b870d1ee300975a5f3597f2ed638
ff5d541f260063a88b04a892cacfb3bcb13b8dd83c5f29ed5000737dbd6662c4
b1d0bfdd95f168cea0df0e138ee627cb7feb0a26ac7a736baa031547bb6fb08d
9af34cdb7f0b01c044fdeb64f0b733d78e8b9be854c4beeee679f8ee083530b1
24281907f8904bf6b9af4116f52ae2ba8b4b97ce586cd3b2b2777a8f3c76c8cc
61cb5cbccb6d1c329cb1a641c3a74fd4a4521dee0d2d03e810f3f12303e0f1f1
3431065d2208123137714d2d432427d33cff576d202e1fc7ea2990b21847cce1
ba975d346f8f543f348e1e42f03bf50167045740b321ae6dc8a8497e608e8766
2df889657dd28f91ea10c08d5a72cf890bf142a6fb4928520ecdefcf708cc2b5
174286f1a0bd66552237da989be39ef821b11fc6acccef5eabc00448991d1876
4632c1023c0baaa1e227defd4923098c4f3c49317964ff1cb088b40b9df7a605
530607f9b54be981e420a7bca1d33d0fa180e6c42877beddeb23836cc440f062
e9bcf85599744033e320f5031ecc8157e0498a42d699cb175d7242c95b9f4358
86746d7dfa923b5b1e0e5a0d27f19eb40979dcf342f2fba01ccbb09175b9363c
973c024f2af38334bfe80a5c1fc2f96b2215397124ff08110e3c96aa986e7440

Coverage

Screenshots of Detection AMP

Win.Dropper.Shipup-6503419-0

Indicators of Compromise
Registry Keys

<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{E5EC135A-79D5-4595-A051-FFFB0E1F7FB4}
Value: data
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
Value: aybbmte.job.fp
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATURES
Value: aybbmte.job
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\AYBBMTE
Value: Index
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\AYBBMTE
Value: Id
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{DAC4F53E-3658-4522-B6D9-1FB306F3D9D1}
Value: DynamicInfo
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{DAC4F53E-3658-4522-B6D9-1FB306F3D9D1}
Value: Path
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{DAC4F53E-3658-4522-B6D9-1FB306F3D9D1}
Value: Hash
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{DAC4F53E-3658-4522-B6D9-1FB306F3D9D1}
Value: Triggers
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{E5EC135A-79D5-4595-A051-FFFB0E1F7FB4} Mutexes
N/A IP Addresses
N/A Domain Names
N/A Files and or directories created
%ProgramFiles%\Mozilla\thfirxd.exe
%System32%\Tasks\aybbmte File Hashes
082f1ce18a378ec6eb67565fb7bd89cd29db886b44fe4312a863382af9e13df7
0e1d3984bd6c33ba0fc108329e3906bd074d70ed44a4c7fa6d8f857531bbc437
380545cfde4acaf2c29969d175db1cecd28c5691693e097e52da5c0e886a8301
13da7abee3f2ea4275c1434900db5ba9f620fde8743eb0ff2388b32897685e0b
9dc0c514ea1aaa91c1255857cb261bd6c94f8565ffef4420b75c5d5320717b09
30103085dd67ac6e9bdf14255fc5c8b697d68b810e732b4ae29798b62e5ad677
663ecdfa115605418b2826e4de7e289b0cd12849b719c7a171ee7524bf22fe99
cc203d955e3e33479423f7b2aea1f13c2ba5895da16159a779407e03e747d116
3784e5b40ff8687265efe5dacfd5b6c9d744fe294f425703ddafbf687192eb8e
0a52739b2a45b1002b78230df60dd42d2ffa0897197953639dd627bcc0454134
1824bb4ea96c6107c6660b104d60073be3a9f5c3bdbbc2c801771fc34a03e01c
a1175ff8f5544f4ec078e4d55db4b6aff7a7844e9df2057d3fe906cfa77d25f0
61dede4113d1eda504f7360ae535cd88ede9425722db4a43577185d0312acd5a
ac755dfabf99ea6fc8c334dcef526d1dce3680200deeaac5e80077a27042af9c
786c1b55e5e73fd3c2231d7e6fa0565aacb4fb239807f42c2f0cb83f57186271
4e27ccfd0c90aab501d16d45b1e9d13bde3e2d6c2ba6d230b7973dcc8567e556
c7dcf76652af54cf4cbbfdfc4fa5cc8d4a8e1807d478eceee32270260dbfecf7
228ffe97f34e097a0cb3b3288ee56a063da65d890b1f888d59d59f0ad2b3bb71
39c05a8b0d635eb221023154423dd3e26c93d16bb5a16a2512c68bde62996023
6bd38baca4b923c26628e9dcf9ee64d8bcc5c4ba9cb9f2298e32f8db7816de08
cb2155b65879f66eb449b60a90c632c701fbea7ac8d4011e3b24b238c3302de0
8fdabcedb02b4ae9364e53f38738710a1f6e9851077c29dbda34cf934229b47d
fdb559a29e0374fa7ce71d8661400fcc2d2db7d3486822a5cf1e0eba5c5634c8
4a6043017f598162263d52315c79bfcb5fbef86f19d51beb718fe8093dc1af16
2f9ca1b196aa915e3c87dabe20f353a4a69ee5998f8559ef8073194918dc7ea9

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Dropper.Startsurf-6502245-0

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses
52[.]85[.]88[.]217 Domain Names
bush[.]basinafterthought[.]bid Files and or directories created
N/A File Hashes
9ad10ae09760aa994fdf2d6132a60276badb77b0ab773ee5d07d5b5e7a259207
2c31ec1ded95ec22f07a3bc29c03badd9158d8ddc19e1cdb98ccdab3482f2421
433403d0f920938654f1592148f99110a5dd35fed88260c44a022983e12bdaa1
a02c5f7013b02bbc66380276f4250ea42173971c60e8836bb676243b648dd3a0
f0bfcb581935377def575a18a89290427d335c95da6781b11d1ad91711cb4a81
41bf7b4e4d7a87395cc8867e026ed9d586830420a70325a672d07ea9c1a351e0
e616d1e7e2b6e1d4f1ac2fea3e2041b842d27f5de05ff941b5661997cfe8a856
4300dc69146725fe7476b6ee4a81ecbed78604e4575e299f52f6b6f3c65eaaa1
bc782f40d16fd6574c1e84edd0728470f426a31d2ff94e4bbb87a19cf3992048
04ead5ee82c762a26e1dc0e6a8b21c54669c771cca0291b5d41282d2e73a7fc0
739f27ac00dc449895f589ff28e86d78ea17ca298ffc0b40021136d7c77ed679
cc4c722e0d6e2bbff6119e1895f6dfbbb2ed75b3d786e4de507b48792a2660a2
28589697e00deb562a29f3cb335167b2880f3ef3065e418f57f1b626d9ea8c94
b622971e681f9e2fa5f84bfcb9e7144b6198d3fb554de8d4488117ca1e3f51c8
0fee9d67ef1967d2bee1f67b1dc5ae24dff5d6dba17b9247e33b87f5bf6e6856
6c8ca3ba14ee685739ea32a3ddc613d4544c69194a97c55365c570c053609938
f1dbfaf0378434cd1758feaabe050171df1c234ddc6215df494c6592a9e92547
e586da2bd9fd73223281176033b97e6e4e137249f9aff8430004099b31508e12
1d70d1eb3210984b8d2c3c62ca6ade7b018f44688d009cbde3c2c214224a3ffb
404746279f7d963489d1d7d2d9be4bd1b1dd82e81e21f6ebf09091ee7b059988
4696ddd4a7ed96a86a09413f14657c7e01053213f6f1f6008a3a3bbe4fe45229
66af9dc27feb2b69729b82e4076dd699cc504c3c8dce943d2023c7bdeca00f2a
4694e19504a1bbc0335c213bad487727ab75faab3bf29d92cb7e3d14a2d3a8d0
0863bf4a5476b5de02a15c3bdec1604c7d8ab7c8ca1c0546edf2f16a756e0d8f
39974f2161bc0151692ae2f380d38b626f2b47904f92ce5706e29b2fe05122d3

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Dropper.Upatre-6498441-1

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses
72[.]230[.]82[.]80
216[.]146[.]43[.]71
173[.]248[.]31[.]6
93[.]185[.]4[.]90
173[.]243[.]255[.]79 Domain Names
checkip[.]dyndns[.]org Files and or directories created
%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\W7RSB4SE.htm
%TEMP%\serizay.exe File Hashes
91122476660eff79e0de0f30752e1cf9b37985013cb2fd6ad51c6ea6f20dbdf5
fccaca287d58a30c33cc6a52e49fc16c9c5f08143624b82c8ea1df216ec42db0
6b93b7b97c1d5f3ad00378c8ff279c2f2ef8ba4ca16fdde45fe0557c37e8630a
e9574e34b580958e83aa060868edf408751f89f2844da98f2a8c4df24a175efd
2b0dbfbc6f7018646a9ec428424986969a8bcf3ca1c4e1b23d7aab3e7e7dda5f
d4be54137269f8b720abd45b5f900e513c8e9c6144169900c673a07b3181006a
45919cf6c7ca6e97bcbf5f3bcf670db27c29d81aaa50b3563c50ec4e80ec6f4c
388a22678ed13c5fc9a26d8d89a37805143b38d782677b49d9abbfa1dcd47105
d9b137bba139689b08b01f59dfc61b161f522c8618cd74321a7ae4531e093ebb
702c79933e6afba258861251597fc1eb6fada3273a1a3038f4332f09eac44237
ccbf0df625484ab8244a47737514ff698fa00fe2ed8da99e779134c4f96c2a3f
5c80cd096858030abfb8ec87a0aceb8b9d791dfdc67259e668ec2cabab3abef4
6b6eb4cc4aa8e3d71a97a8657ffcd27d2bd12466faf3b1f7fcbcd274a4b9561c
06c65a259d7c96000fcec97a7d8c5b6c4d0c8b8e52ed1d45c934a50d0369b3eb
f43312efa07fe063b6fd50de8f1bc3e7ccfe27b4d80d9082e8faaced210f6be0
84f1fd4c31d0c21517ffe56eea666d6c7954aec47e958c33238b91f6bc9ef0e0
07cb19e9013ac45d8e99618944ebd9d1a81499239d20800f8aaf5789b6fbb47e
e122d91eb62a33c8b4ef56b2299caf2f58fd4e48694c97e06c92f858497cf860
ea284de1551e367f736ce661b7342fc3a98297cfa8358972120375702dd14ccf
e4b38a225a2703c06bcf4d26acc22753a86b74fa461720bda700c1fa2c1b3db6
daeded4fb715741d4045fa7ff6e7d81920c3e7ce892c1c29676a51ee70d63712
bc417721acee0afa960d71a7c59acfb6d233384625620bd0856734521b028005
79a50327843a8ccf58147971d1c86945f9a40cd0d4ee35084b8af26c9f5ab210
53e260744b0f3d02c6d629cd466483b79c147d882e6749639631c4c7eeb46808
2e5bff8f11e5ed171ac94f1a5656014fbffd46b66493c90aaf47b640568faa1e

Coverage

Screenshots of Detection AMP

ThreatGrid

Win.Packed.Tofsee-6504793-0

Indicators of Compromise
Registry Keys

<HKLM>\SYSTEM\ControlSet001\Services\xkqrdots
<HKU>\Control Panel\Buses Mutexes
N/A IP Addresses
85[.]25[.]185[.]229
43[.]231[.]4[.]7
12[.]167[.]151[.]116 Domain Names
116[.]151[.]167[.]12[.]in-addr[.]arpa Files and or directories created
N/A File Hashes
c6eeffc5eb2ee7203e7abef9e60c5edffd5471aa02760e1b2ef0cce5c5a73aa3
cd159019d822551dd72c81fc954042275f65deaee88469c05682e7575a27e8e8
f0bd29ac4f11195c79f8b1812cbf93fcb2b8e67bd219c287e9e93c8136c44a32
40b0cde3e58f802d799ce9b3baa86d3b03582b8d52af828fcf33a7b71fa704de
842fd3e6342f2eab3bb49c69a6d963e3c7022221bdb074b4437310f8170b2c6f
e5633dfe5df0eadc14ee162af1c1f47c6350f514f6867cdeea8efeaf2cdd4f90
ea088b52681001876b19f1b4c22823d347b734e167cb634208a204d95f6c01f5
268b1d9cc88537d6ba2301845262a82bc6df00b07a74fa7ead0242e5cf0dc9ae
9b389a4e17438eeba6cba94c6359317175b36e38329ae8ccfef2e7bc5d3b5a61
e411592afee8c0a1d6baab011017672dea44c307ed4ea223999eb0152cd95db6
8ab34d8df0858423dd1f4f70f407ca929cf9300839c783ef40f64024e477b4f0
c8aeb4cf24afcabea69ac048a658fe031b033534a9cc77e249c03b1d0464a75c
10de8c9c16f71496e3c55f0d50640741449ea8f0e7b84dfabc80e13232dcee74
d2f102299b545cf1efc42b2e7d2de46dc6edf49b4da4ec4ee475539b21c7bad7
5a9b3c474315a6cc941b44e2e1563266497d7c3a8fc88653b12d3b6fa9283439
f5c742ff51664195be30bba05c56c909b07cf7a475c570a704435e99ec925c92
8d6c39242bb75f30437e3a3712cd54e5f4a1ccba7deef3ced7607c3894391297
5e7847c2c9edb9a8cd764e28cdb8f575fa157846ed1b0e4ccf0612f915a794a1
17595c6caf5362a043f81d32dc30dae30f27354fa9783de374301cbf42be2ff3
35dcd9cd70c1047b835736be487536a3f3d6f2c2d40752f40ab278149972c481
6812a316ac2f2fa0affd0977f61a97f7463f3dd77e18b217e8b97e2414d4ea18
81233480a520d005f90f203e99bc325fca56eff338e6761a11295315ac9010d1
8014614d9085f4ada71d6c403e8042ffdd715974ad826a19ec2fb8a4f713ca9f
1f26c8b1dada5dc707651958630211824886556eb23f77f04d7a4818f8c8e756
018ba4d9446e31d228b829f0f90f2f4519b87359d5d5750177152e0b986d8aad

Coverage

Screenshots of Detection AMP

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/threat-round-up-0406-0413/

Type	Indicator	Context
sha256	0073f6d57c2e4ca1871dc1a5e270160e734b2d79bd9b7b55b82a8ddc53aaac0f	f22d055d605a8387d35610e4e82815eb29b7212de12088202efa54d3c31 0073f6d57c2e4ca1871dc1a5e270160e734b2d79bd9b7b55b82a8ddc53aaac0f c21fdd9a5d244aed75890c59094789c2f46815983084f4bc5966ae28630
sha256	02cb3c5568577ed9658fcf68b9f776d720e2f7355090b10875f0f9bb2b8ed161	86add3eac9184972cfc7a6172532c16dc0d1e1f874e4cd3fa2276657c2a 02cb3c5568577ed9658fcf68b9f776d720e2f7355090b10875f0f9bb2b8ed161 5f7f8a6fd32cf4d91efe01c2f1b7c4fd5f509b504af134a08c6c688ba95
sha256	036d8c2a089ea0870fa37060c96928789a8b373ca0795d1c06db443b53dc5882	936470c9747f9c803d3839159e86112afbe49d68b578775f1c29141d502 036d8c2a089ea0870fa37060c96928789a8b373ca0795d1c06db443b53dc5882 2b7662b93abcd312eb2c4d66c246af9dc7c43a511fae5dddd11617bf2ce
sha256	05be7b2de818dcb358a4f24d6050ae2b91d728c80a8af279894b5e701b060926	a881396fa66719255cd617e5ef7e175343f28b7ee7ec347bf87811274c0 05be7b2de818dcb358a4f24d6050ae2b91d728c80a8af279894b5e701b060926 a32a315ae45f62d26cdd22281a69932c83f147fc4e820a9cc7bf05bcc46
sha256	082f1ce18a378ec6eb67565fb7bd89cd29db886b44fe4312a863382af9e13df7	s%\Mozilla\thfirxd.exe %System32%\Tasks\aybbmte File Hashes 082f1ce18a378ec6eb67565fb7bd89cd29db886b44fe4312a863382af9e13df7 0e1d3984bd6c33ba0fc108329e3906bd074d70ed44a4c7fa6d8f857531b
sha256	09574981553c2729c9779beee8e6007734f932a155de278eb46d9fc557c39400	21f75a2d312a27bc1c17702d09520006aff590d439a90d8045d2325a04e 09574981553c2729c9779beee8e6007734f932a155de278eb46d9fc557c39400 e981fd64b4c1f1d50cdf3f21d3cd07dfb04dec58c518bee8697a1870699
sha256	09cc6c9e39425a71ccdc26ffd8a67179043b20f646286685eea24e6bb00b12d9	0a7785ab6d418112d10cd6844ded5745064840d18d74d9b978dea1fe1a9 09cc6c9e39425a71ccdc26ffd8a67179043b20f646286685eea24e6bb00b12d9 725752c4bda82acf554aad37fe97d08f4367c9a1e5d40b6fe17cdc94adf
sha256	0a6cabedfabfbab3fba2057d30b1faab2f1b2d2d47a6227aa3b677af45f92da2	c4195c38a9dc55c472f7c72ec3d6ad0d95a544458a2050edf22df3aac5c 0a6cabedfabfbab3fba2057d30b1faab2f1b2d2d47a6227aa3b677af45f92da2 683339b58c7cbc066f84c625efa0248eb89bfcd24de916f5fe600c33867
sha256	0aeb76bb929ea68275b904412054c3b15a73fd6479ee3daecd5ffd4c407eb721	b7c9a3b8694895275fcc45aa1df3e6f2ad0c58563a40ac80776c705f821 0aeb76bb929ea68275b904412054c3b15a73fd6479ee3daecd5ffd4c407eb721 c76394aaf293cbf4bf3b9d7a94c251feac11435204664d700bb4bd87da3
sha256	0e1c8a62bd632cd364d16dcf0839531c8dcb443269f4478f301e4adf758977a6	4b6301b42ed0838633b161c947a781600fc884b0fc499f906a49ea38292 0e1c8a62bd632cd364d16dcf0839531c8dcb443269f4478f301e4adf758977a6 f34354749657c44beee0b1d7f5cdc4a31c858eab565fc2592f96c69eb9d
sha256	0e1d3984bd6c33ba0fc108329e3906bd074d70ed44a4c7fa6d8f857531bbc437	ce18a378ec6eb67565fb7bd89cd29db886b44fe4312a863382af9e13df7 0e1d3984bd6c33ba0fc108329e3906bd074d70ed44a4c7fa6d8f857531bbc437 380545cfde4acaf2c29969d175db1cecd28c5691693e097e52da5c0e886
sha256	11117fe96292e5d5702f2c82e4b21c3cbc4234f13417b22ad963a9f746978482	bb4d05292e6649fa84f076195d7a0cfb15516ce386f214dc2dd96a5e467 11117fe96292e5d5702f2c82e4b21c3cbc4234f13417b22ad963a9f746978482 33ab8e652c16836caf3b22518485757f417fab73a92e916f0c6aaf27b57
sha256	13da7abee3f2ea4275c1434900db5ba9f620fde8743eb0ff2388b32897685e0b	5cfde4acaf2c29969d175db1cecd28c5691693e097e52da5c0e886a8301 13da7abee3f2ea4275c1434900db5ba9f620fde8743eb0ff2388b32897685e0b 9dc0c514ea1aaa91c1255857cb261bd6c94f8565ffef4420b75c5d53207
sha256	174286f1a0bd66552237da989be39ef821b11fc6acccef5eabc00448991d1876	9657dd28f91ea10c08d5a72cf890bf142a6fb4928520ecdefcf708cc2b5 174286f1a0bd66552237da989be39ef821b11fc6acccef5eabc00448991d1876 4632c1023c0baaa1e227defd4923098c4f3c49317964ff1cb088b40b9df
sha256	1937b1e07be1737d79a3a4b1ea9c5ab0a56f1c3ce44d2e34d705a7b69b9346cd	cc3f88c7180e2774f2641c593ebebedee3424314fdd8fa8365f6cd0000a 1937b1e07be1737d79a3a4b1ea9c5ab0a56f1c3ce44d2e34d705a7b69b9346cd 310848da5dd6e75c8df5bc00223582a7b7e6fbef90ca45222948eaba546
sha256	19a5f6fc34e531409c787b00444671b44a5c11dec0dafab0e0ef699de29eea6d	6855237fe80447950bf86d1177489dbc1b231122e4a5d2157ba93c1b504 19a5f6fc34e531409c787b00444671b44a5c11dec0dafab0e0ef699de29eea6d b4e2b99c18bf61acedaff5b1908a212470eb902ddfe8e164e01ffcfbab1
sha256	1a1144444adb05aee9ef8adfb3c892a97d32b870d1ee300975a5f3597f2ed638	16189e27dff9ff67e31d09fa05e7f32658dfa56bb51feff8ca0cfb4eb85 1a1144444adb05aee9ef8adfb3c892a97d32b870d1ee300975a5f3597f2ed638 ff5d541f260063a88b04a892cacfb3bcb13b8dd83c5f29ed5000737dbd6
sha256	1ca88b2c00b625bf596b93abafae873a6aec5bf1afeee1e116dc402cae69f83a	9556f093b7d80bdc755d502917310a807d5ee9d9f9bac19bb0c8d596dbc 1ca88b2c00b625bf596b93abafae873a6aec5bf1afeee1e116dc402cae69f83a 3f2925b26b0f0b0f141346d8a654a74704d9326492537de17518bd6fb11
sha256	1d7a1a4181706379a7f80ed926c47cb0ebc7beb953739c9b41cec20093c63914	a8252837a5e1c7c98aa9b72c1df4b21e34ae8c7e73882294097f140466e 1d7a1a4181706379a7f80ed926c47cb0ebc7beb953739c9b41cec20093c63914 7b24f0523af239668ee8946c433c53d0c233b0290bbaca405885d39dff8
sha256	21178d6e06ded3b1a43e98eb781220c37e729ef081bd160f168fc465313ea4ff	fc939e40cc943df83f548286c2f7f519a53e195b3ae595e0bef39baee29 21178d6e06ded3b1a43e98eb781220c37e729ef081bd160f168fc465313ea4ff ef4b97346e1ee359feff43d136f3dd6031993fb47bdfd25520b4fc3279d
sha256	24281907f8904bf6b9af4116f52ae2ba8b4b97ce586cd3b2b2777a8f3c76c8cc	cdb7f0b01c044fdeb64f0b733d78e8b9be854c4beeee679f8ee083530b1 24281907f8904bf6b9af4116f52ae2ba8b4b97ce586cd3b2b2777a8f3c76c8cc 61cb5cbccb6d1c329cb1a641c3a74fd4a4521dee0d2d03e810f3f12303e
sha256	2593e0c6d66d36c7d8b3061f3c242875113310a2939f89aea73eda1397e44e31	sign[.]com Files and or directories created N/A File Hashes 2593e0c6d66d36c7d8b3061f3c242875113310a2939f89aea73eda1397e44e31 e9a7b16189e27dff9ff67e31d09fa05e7f32658dfa56bb51feff8ca0cfb
sha256	2a0904b6301b42ed0838633b161c947a781600fc884b0fc499f906a49ea38292	4da20c2c92da398b1e5fcc8adc6bfe893d5a8b56c5cd1beb42b3fa5f069 2a0904b6301b42ed0838633b161c947a781600fc884b0fc499f906a49ea38292 0e1c8a62bd632cd364d16dcf0839531c8dcb443269f4478f301e4adf758
sha256	2b7662b93abcd312eb2c4d66c246af9dc7c43a511fae5dddd11617bf2ced16c3	c2a089ea0870fa37060c96928789a8b373ca0795d1c06db443b53dc5882 2b7662b93abcd312eb2c4d66c246af9dc7c43a511fae5dddd11617bf2ced16c3 5795c26debe0c06d1f1968730a84efeed69f0493b23f8411b3ea60781e7
sha256	2ca04f3c65e3fd16b9c879c7db4cc8025279463dbb965e3954e35106fe952e86	59b81a985f538fc0a51c85c688794f94b28a06883ba9dadfb4b0c8bccd6 2ca04f3c65e3fd16b9c879c7db4cc8025279463dbb965e3954e35106fe952e86 3538c0a7785ab6d418112d10cd6844ded5745064840d18d74d9b978dea1
sha256	2df889657dd28f91ea10c08d5a72cf890bf142a6fb4928520ecdefcf708cc2b5	d346f8f543f348e1e42f03bf50167045740b321ae6dc8a8497e608e8766 2df889657dd28f91ea10c08d5a72cf890bf142a6fb4928520ecdefcf708cc2b5 174286f1a0bd66552237da989be39ef821b11fc6acccef5eabc00448991
sha256	2eed2f22d055d605a8387d35610e4e82815eb29b7212de12088202efa54d3c31	591b9c2c9722c07746edfc7892b178b8965bb4c452322caab68b2d5f262 2eed2f22d055d605a8387d35610e4e82815eb29b7212de12088202efa54d3c31 0073f6d57c2e4ca1871dc1a5e270160e734b2d79bd9b7b55b82a8ddc53a
sha256	30103085dd67ac6e9bdf14255fc5c8b697d68b810e732b4ae29798b62e5ad677	514ea1aaa91c1255857cb261bd6c94f8565ffef4420b75c5d5320717b09 30103085dd67ac6e9bdf14255fc5c8b697d68b810e732b4ae29798b62e5ad677 663ecdfa115605418b2826e4de7e289b0cd12849b719c7a171ee7524bf2
sha256	310848da5dd6e75c8df5bc00223582a7b7e6fbef90ca45222948eaba546be3bd	1e07be1737d79a3a4b1ea9c5ab0a56f1c3ce44d2e34d705a7b69b9346cd 310848da5dd6e75c8df5bc00223582a7b7e6fbef90ca45222948eaba546be3bd 40a0f808c1fd873c364850d95e2f0adb0ca24740945702de5c0552a5afc
sha256	330a8b46f74f5d4af759b18db64dfd9af2ef3e429d597cd4522148fb78633000	6576eba666a33e26bc25122196de365465da8ebee70930b9c4ec6be7313 330a8b46f74f5d4af759b18db64dfd9af2ef3e429d597cd4522148fb78633000 ac6fbd8f18bb93cfac31af73eb9cf6a1aa925b95d44b42b3659ecfd4920
sha256	33ab8e652c16836caf3b22518485757f417fab73a92e916f0c6aaf27b57f3be4	fe96292e5d5702f2c82e4b21c3cbc4234f13417b22ad963a9f746978482 33ab8e652c16836caf3b22518485757f417fab73a92e916f0c6aaf27b57f3be4 Coverage Screenshots of Detection AMP ThreatGrid Win.Droppe
sha256	3431065d2208123137714d2d432427d33cff576d202e1fc7ea2990b21847cce1	cbccb6d1c329cb1a641c3a74fd4a4521dee0d2d03e810f3f12303e0f1f1 3431065d2208123137714d2d432427d33cff576d202e1fc7ea2990b21847cce1 ba975d346f8f543f348e1e42f03bf50167045740b321ae6dc8a8497e608
sha256	3538c0a7785ab6d418112d10cd6844ded5745064840d18d74d9b978dea1fe1a9	f3c65e3fd16b9c879c7db4cc8025279463dbb965e3954e35106fe952e86 3538c0a7785ab6d418112d10cd6844ded5745064840d18d74d9b978dea1fe1a9 09cc6c9e39425a71ccdc26ffd8a67179043b20f646286685eea24e6bb00
sha256	35c996576eba666a33e26bc25122196de365465da8ebee70930b9c4ec6be7313	a77db7cb028163638a7e58c354e1fbab4757323ad9eccfb51e9b257f83c 35c996576eba666a33e26bc25122196de365465da8ebee70930b9c4ec6be7313 330a8b46f74f5d4af759b18db64dfd9af2ef3e429d597cd4522148fb786
sha256	380545cfde4acaf2c29969d175db1cecd28c5691693e097e52da5c0e886a8301	984bd6c33ba0fc108329e3906bd074d70ed44a4c7fa6d8f857531bbc437 380545cfde4acaf2c29969d175db1cecd28c5691693e097e52da5c0e886a8301 13da7abee3f2ea4275c1434900db5ba9f620fde8743eb0ff2388b328976
sha256	3c9c3423951655b97251bf5d3d12fe59fcf96d4274c4887b88744438371fe61b	a6fd32cf4d91efe01c2f1b7c4fd5f509b504af134a08c6c688ba9597ea6 3c9c3423951655b97251bf5d3d12fe59fcf96d4274c4887b88744438371fe61b 4e496591b9c2c9722c07746edfc7892b178b8965bb4c452322caab68b2d
sha256	3d756dcf4397cb6b0d406b9f70eb18029965fce0110c0290af6ad73468aa2c1f	2c4bda82acf554aad37fe97d08f4367c9a1e5d40b6fe17cdc94adf040fc 3d756dcf4397cb6b0d406b9f70eb18029965fce0110c0290af6ad73468aa2c1f ef4d20220eaecedc0b3069192843bd5eddc196b25a9e083fd16d19ae100
sha256	3ed671f4ea7e92ef0e0bf61e7bacc0b7a2a82ccea73a53e7cde66e3497a86520	66775aceac7e54b9d7db2620245520a52e854a5e61f5c5f2452a60432de 3ed671f4ea7e92ef0e0bf61e7bacc0b7a2a82ccea73a53e7cde66e3497a86520 97702356739358d428d1e7c7ddcc8aa08379562b290edb12348cae2bc0d
sha256	3f2925b26b0f0b0f141346d8a654a74704d9326492537de17518bd6fb11671e8	b2c00b625bf596b93abafae873a6aec5bf1afeee1e116dc402cae69f83a 3f2925b26b0f0b0f141346d8a654a74704d9326492537de17518bd6fb11671e8 ba0a2f6e001bc9c02ee8c5fbcd6cceaa74ced5ec058dfda71623146f06f
sha256	40a0f808c1fd873c364850d95e2f0adb0ca24740945702de5c0552a5afc60612	8da5dd6e75c8df5bc00223582a7b7e6fbef90ca45222948eaba546be3bd 40a0f808c1fd873c364850d95e2f0adb0ca24740945702de5c0552a5afc60612 b609c46124d069b2299de3896a5cc2f7540e4effcba462e7f5300573666

Threat Roundup for April 6

Indicators of compromiseauto-extracted · verify before use · export allAll →

Threats

Win.Dropper.Fareit-6500687-1

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Dropper.Generickdz-6500702-1

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Dropper.Generic-6502500-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Dropper.Mikey-6502276-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Dropper.Neutrinopos-6500704-1

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Dropper.Shipup-6503419-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Dropper.Startsurf-6502245-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Dropper.Upatre-6498441-1

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Win.Packed.Tofsee-6504793-0

Indicators of Compromise Registry Keys

Coverage

Screenshots of Detection AMP

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys

Indicators of Compromise
Registry Keys