Threat Roundup for March 15 to March 22

March 22, 2019, 11:27 am

≫ Next: Cisco Talos adds new Content Category

≪ Previous: Cyber Security Week in Review (March 22)

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 15 and March 22. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

The most prevalent threats highlighted in this roundup are:

Win.Ransomware.Gandcrab-6900355-0
Ransomware
GandCrab is ransomware that encrypts documents, photos, databases and other important files using the file extension ".GDCB", ".CRAB" or ".KRAB". GandCrab is spread through both traditional spam campaigns, as well as multiple exploit kits, including Rig and GrandSoft.
Win.Trojan.Remcos-6898089-0
Trojan
Remcos is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam, and capture screenshots. Remcos is commonly delivered through Microsoft Office Documents with macros, sent as attachments on malicious emails.
Win.Malware.Autoit-6897734-0
Malware
Autoit is a malware family leveraging the well-known AutoIT automation tool, widely used by system administrators. AutoIT exposes a rich scripting language that allows to write fully functional malicious software. This family will install itself on the system and contact a C2 server to receive additional instructions.
Win.Ransomware.Cerber-6896901-0
Ransomware
Cerber is ransomware that encrypts documents, photos, databases and other important files using the file extension ".cerber."
Win.Malware.Zbot-6896522-0
Malware
Zbot, also known as Zeus, is trojan that steals information such as banking credentials using a variety of methods, including key-logging and form-grabbing.
Win.Malware.Ursnif-6896385-0
Malware
Ursnif is used to steal sensitive information from an infected host and can also act as a malware downloader. It is commonly spread through malicious emails or exploit kits.
Win.Packed.Kovter-6895460-0
Packed
Kovter is known for its fileless persistence mechanism. This family of malware creates several malicious registry entries that store its malicious code. Kovter is capable of reinfecting a system even if the file system has been cleaned of the infection. Kovter has been used in the past to spread ransomware and click-fraud malware.
Win.Malware.Upatre-6894504-0
Malware
Upatre is a trojan that is often delivered through spam emails with malicious attachments or links. It is known to be a downloader and installer for other malware.
Doc.Downloader.Emotet-6894115-0
Downloader
Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a wide variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Trojan.NetWire-6893426-1
Trojan
NetWire is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam, remote desktop, and read data from connected USB devices. NetWire is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.

Threats

Win.Ransomware.Gandcrab-6900355-0

Indicators of Compromise

Registry Keys

<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
- Value Name: xbnykvblxlz

Mutexes

IP Addresses contacted by malware. Does not indicate maliciousness

66[.]171[.]248[.]178

Domain Names contacted by malware. Does not indicate maliciousness

carder[.]bit
ransomware[.]bit
ns2[.]wowservers[.]ru

Files and or directories created

%AppData%\Microsoft\jfwwxp.exe

File Hashes

19b5f589a31dd4b6fd6fcda9e529f04adee6628740cfb4354b7fde94ca4c8fe8
2870e29273fac8161c571505e2081afe0aa8c9e198150923f9efcb15a0379e66
31bbc9f6a7d5b5c248c6379afcf7c7026fb0f3b521016d918edba1fad085a9cc
3e9ae9bb1061f2335cbca35ddfe71f7b93d8ff14a79c362b7a5e22a3c19f5af0
3f18aeab0f40e3f957807fdb6142cafcfd4faeac39b0f31df9e869cca981cb70
5a6f4af9f4c0230111b39ff7cf127db182738ed735fa72183f935f272491b53d
635cd9d2065acf51745629ff92e41c8b331d25376868cfde5ec3dfab91cd0026
961b6caacf88d67139309a5dbec806301a1e7fc8eec7db166d9d0d0120346cad
a8d145d01780227cecb322d69d173248c122c5c5b5ffe74c28e1ef89958b4dd7
c4e78e775a53a51eefc2b5dd4ce161bd1794119a02481e03b9917aba5279d9c0
cfb324eb0b95048aa3248b4475902e575da996b63ff86cf78211424ec8c1c561
e43d30708069f2ec0b0237144b23e2d337521174530caefd04728fcc0cbbfd6e
fcefe7d20db180411dd0f1ae2749e622738d9b8e6cca09a01b870551823ccbd3

Coverage

Screenshots of Detection

AMP

ThreatGrid

Umbrella