Cisco Talospublished Sep 22, 14:23 UTC (Sep 22, 2018)ingested Sep 10, 06:19 UTC

Threat Roundup for September 14 to September 21

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article717 words · extracted from blog.talosintelligence.com · click to collapse

Saturday, September 22, 2018 10:23

Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Sept. 14 and 21. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

Win.Dropper.Genkryptik-6690044-0
Dropper
This threat attempts to spread via removable drives and spam email. It uses legitimate SMTP servers to send spam from its victims.
Win.Dropper.Dofoil-6689818-0
Dropper
Dofoil, aka SmokeLoader, is primarily used to download and execute additional malware. Read more about this threat on our blog here.
Doc.Malware.Nastjencro-6688356-0
Malware
Nastjencro uses PowerShell to download and execute additional malware.
Win.Dropper.Kovter-6689163-0
Dropper
Kovter uses mshta and PowerShell to minimize its presence on the victims harddrive. It uses the registry to execute a malicious script any time a file with a specific file extension is opened (e.g. *.clUQwv).
Win.Dropper.Coinminer-6688928-0
Dropper
This malware installs and executes cryptocurrency mining software. You can read more about this kind of threat on our blog.
Win.Dropper.Fareit-6688124-0
Dropper
The Fareit trojan is primarily an information stealer with the ability to download and install other malware.
Doc.Downloader.Pederr-6686124-0
Downloader
Pederr uses malicious PowerShell scripts to download and execute a malicious executable. It has been seen installing banking malware such as Emotet.

THREATS

Win.Dropper.Genkryptik-6690044-0

INDICATORS OF COMPROMISE

Registry Keys

Mutexes

IP Addresses

Domain Names

smtp[.]yandex[.]com

Files and or directories created

%AppData%\Windows Update.exe
\??\E:\Sys.exe
\??\E:\autorun.inf

File Hashes

0b6d3eb6dba7730fdfcaf892eb153c1cf9762419eaf0a29689ec929cc7e57aff
27b205b99c01b6ef21c8ee0df5dce9a970790d61b48da3d6a8be8c8845289db5
3069631a8410decb34e6210a8fc4b36de03d1635baac8655035365076a3613e4
3b6ec2629747f8ddb0b244a686f29f7001b030f0ba86ab7b76961bfff0f6c151
3ccba4f06849edeefe60f8a25f4752f89b9ccf8ca62378f7e6108980b244ac2c
3e2a97b7d366e255fcfd2f470da800e9e5aae08a3c1d75916870f8e42ad6160a
492064ef6226b2b174046c07987dfe09afcd9e2f3f69f80bb109dd8b151ea49d
4b50bda6c3fe41f6c930ec701d851781e1664b720e6fc65ab2fbb6c28916f24b
5325cf98bf3080c9846aba8bc76d5cb49de5ac4cf10e337e12a1945cc9a4763d
5a0a5181cf8be2be6fda2be77eca48030d64ad6f737f4c911eba52219537b746
5f7c12cefe681ce32304c1944da6a14e47de36d83ecb47101873d8702f041b76
656a97b7d3481ebf79887b691637f45ec54c494832f5b83774f35dc2c8d8bba2
714f0773cd6a55310527aa10eba1905284c42ace7a5cc063443fd8a00c9868fb
73efa5fd117d51ffd6d2f51e0a946ed3455ad29334f5899b39ff338d0b72edf8
825f8902a8a8ae4852ff5c2351efbc83140203473b2d90eb8526c9b8eb88faca
896e7407427fdb945e2f09b65095d80c79cae041db31a16bcd5979668bcd14ec
8a6fe46554f345d8e5001bff5b8147edb2570fab335bfef28d9f5cff661d6e2c
8eef0b06ac1bc9445e752d851dd2ed905494df8741ae22cc3acee2af1d2ef36f
9cbe3c887a94b6a4fb47f3ec3d1e329cb90b291c39f14179337c52eb3a6228a0
9fb4cd041ff2bb0cbbf2e62f3633aadcbf9513ff12a449a9db8c69aee048c387
a52367db8f3e58f122222d22b62072ad827389760e6cf179382b29e5d5478152
a80cb2444eaa865fc268874e90ab7af658335159e6c6d0ffd939662f9f7b82e6
af8e4c150fe96ee59d7a9ef0dc5d97624fa94bc4dd6a6bcb947b7c5820b9f47b
b906ab1e3606cd64670fa1ad6c308a63f10b6d71d1758f3f58cf72947ce4d836
c9a8eefdca421af7871d7dd3bccbb56a64fc1b7c0721260286a5c5e4d3c0ef67

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Umbrella