Cisco Talospublished Oct 12, 18:18 UTC (Oct 12, 2018)ingested Sep 10, 06:19 UTC

Threat Roundup for October 5 to October 12

Indicators of compromiseauto-extracted · verify before use · export allAll →

Full article872 words · extracted from blog.talosintelligence.com · click to collapse

Friday, October 12, 2018 14:18

Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Oct. 5 and 12. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this roundup are:

Win.Malware.Emotet-6710203-0
Malware
Emotet is a banking trojan that has remained relevant due to its continual evolution and its ability to bypass antivirus products.
Win.Malware.Fuerboos-6712723-0
Malware
Fuerboos is a backdoor trojan that monitors user activity and captures that information to eventually send it back to a server. It utilizes a double flux network where multiple hosts act as proxies to further prevent researchers from locating the actual malicious server.
Win.Dropper.Demp-6714293-0
Dropper
Demp drops DLL files that are later injected into the explorer process. It is also capable of accepting commands from a command and control (C2) server and exfiltrating system information.
Win.Malware.Dgbv-6714452-0
Malware
DGBV is malware written in Delphi and is packed with Inno Setup, a free software installation system. Once deployed, DGBV collects sensitive information from the infected host and sends it to a C2, including browser password databases.
Doc.Downloader.Valyria-6713303-0
Downloader
Valyria is a malicious Word document family that is used to distribute other malware. This campaign is currently spreading Emotet.
Win.Downloader.Dofoil-6714608-0
Downloader
Dofoil, AKA SmokeLoader, is primarily used to download and execute additional malware. Read more about this threat on our blog.
Win.Malware.Zbot-6714649-0
Malware
Zbot, also known as Zeus, is trojan that steals information such as banking credentials. It has numerous capabilities, including key-logging using methods such as key-logging and form grabbing.

THREATS

Win.Malware.Emotet-6710203-0

INDICATORS OF COMPROMISE

Registry Keys

<HKLM>\SYSTEM\CONTROLSET001\SERVICES\dimcloud

Mutexes

PEM6A4
PEM6B0

IP Addressescontacted by malware. Does not indicate maliciousness

96[.]114[.]157[.]81
24[.]203[.]4[.]40
216[.]137[.]249[.]154
98[.]191[.]228[.]168
41[.]204[.]202[.]41

Domain Namescontacted by malware. Does not indicate maliciousness

smtp[.]aavanira[.]com

Files and or directories created

File Hashes

0eba4bf670ebd4381150a0d9e1fd113561898849ac53fd22e0eee1afe05de77d
12faaf05baa1ead6dd6559f2eed72373d78eff2e462c59fc055ac098b8ad7d38
1affd33a6864d27ffb7b2398630c06610a3c9d81d0f84548b7a66c431d2b733a
1d75775d6b05c878611b678b1bceacc76c888fb086ad2c47111aa696dad4b59f
1fca28e3264af2703e3e221b9193e93351b3b9ef3474643fb27d589b8c10840e
20dec98c8003e986251cc8a765a931783203ec75eae436e9df2248a465321e53
213395fba51bb15feb10d201b78df2a8c4bfcd25498f672b02391a77647cb781
36bc6b1def213cb8f10670fa3d574f831fdd63a9a5f2a66f66c1d580dfb75955
3e9e1062c311605bb78e8df525eaa11268ad5b547ae9295669a0c751e16f5a13
49a9333f65eb8a84e74b14a928d7ad94737c95117eae62e87bf84617637f04a1
6c231427d0fc1cf9ad431c7c5a8973db04e5a5cd2ef3205d6f544ae3b20a57f8
74e5ce08015255e67a1e21dfd2e44afb613a329b4bc6a4a678d1fb18e0d45412
8e0652595b5c7661ce08ef8c986ad31cef38020f80f7afcd500a9acbdd6ae774
995cca730bcdeecd0e497999e7ff2a4a6659fae45130e05599f0d716125c00a3
a5a882b548a7b4faa705f9defef61566fdc778c983f58b71578896448f2721fb
aa9c066ef31f701399812d51bf46231d88911bf062098e4428e8768002d6274c
af253123e7bc9a5732d21ecca3d9d24db4c3a1d616fc8d8b14c3bdaa97bac3b9
b7fab8bd7cfc07cf11cbf012b9d926cc4953df301b4d5bf8df12106d9d748aca
c0fa19dd12030a9c24375a25dbfd413a6fd123b2b0451902af767167b313aad5
c1ea9d852216d51cffbed3da3ef2fc23156f523096f900a9127ca91cbda542fb
ed96c1d12554779cdef56ebd87ac4390815c006cb7771608297377cabc3a8023
fb05b1c6edb8961620fff003d4ea496d889e5e217f28e77a7d6c37a6c73e3f17

COVERAGE

SCREENSHOTS OF DETECTION

AMP

ThreatGrid

Umbrella