Threat Roundup for December 13 to December 20

December 20, 2019, 10:07 am

≫ Next: Cisco ASA DoS bug attacked in wild

≪ Previous: Threat Source newsletter (Dec. 19, 2019)

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Dec. 13 and Dec. 20. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found herethat includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.
The most prevalent threats highlighted in this roundup are:

Threat Name	Type	Description
Doc.Downloader.Emotet-7451163-0	Downloader	Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a wide variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Dropper.TrickBot-7455405-0	Dropper	Trickbot is a banking trojan targeting sensitive information for certain financial institutions. This malware is frequently distributed through malicious spam campaigns. Many of these campaigns rely on downloaders for distribution, such as VB scripts.
Win.Packed.Dridex-7447905-1	Packed	Dridex is a well-known banking trojan that aims to steal credentials and other sensitive information from an infected machine.
Win.Packed.Razy-7450491-0	Packed	Razy is oftentimes a generic detection name for a Windows trojan. It collects sensitive information from the infected host and encrypt the data, and send it to a command and control (C2) server. Information collected might include screenshots. The samples modify auto-execute functionality by setting and creating a value in the registry for persistence.
Win.Dropper.NetWire-7454096-1	Dropper	NetWire is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam, remote desktop, and read data from connected USB devices. NetWire is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Trojan.Tofsee-7450732-0	Trojan	Tofsee is multi-purpose malware that features a number of modules used to carry out various activities such as sending spam messages, conducting click fraud, mining cryptocurrency and more. Infected systems become part of the Tofsee spam botnet and are used to send large volumes of spam messages in an effort to infect additional systems and increase the overall size of the botnet under the operator's control.
Doc.Downloader.Sagent-7454309-0	Downloader	Sagent downloads and executes a binary using PowerShell from a Microsoft Word document.
Win.Malware.Gandcrab-7454521-1	Malware	Gandcrab is ransomware that encrypts documents, photos, databases and other important files using the file extension ".GDCB," ".CRAB" or ".KRAB". Gandcrab is spread through both traditional spam campaigns, as well as multiple exploit kits, including Rig and Grandsoft.
Win.Trojan.HawkEye-7455512-1	Trojan	Hawkeye is an information stealing malware that specifically targets usernames and passwords stored by web browsers and mail clients on an infected machine. It is commonly spread via email and can also propagate through removable media.

Threat Breakdown

Doc.Downloader.Emotet-7451163-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{BEF6E003-A874-101A-8BBA-00AA00300CAB}`	10
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A}`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: ProxyEnable`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: ProxyServer`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: ProxyOverride`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: AutoConfigURL`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: AutoDetect`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A} Value Name: WpadDecisionReason`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A} Value Name: WpadDecision`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A} Value Name: WpadNetworkName`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A} Value Name: WpadDetectedUrl`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: Type`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: Start`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: ErrorControl`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: ImagePath`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: DisplayName`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: WOW64`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: ObjectName`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: Description`	2
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{E54C0DDD-6FAB-4796-8BBE-EE37AF7CD25A} Value Name: WpadDecisionTime`	2
`<HKCR>\TYPELIB\{C4EDCADC-BC75-481F-8A40-032075206B43}\2.0\FLAGS`	1
`<HKCR>\TYPELIB\{C4EDCADC-BC75-481F-8A40-032075206B43}\2.0\0`	1
`<HKCR>\TYPELIB\{C4EDCADC-BC75-481F-8A40-032075206B43}\2.0\0\WIN32`	1

Mutexes	Occurrences
`Global\I98B68E3C`	2
`Global\M98B68E3C`	2

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`100[.]108[.]65[.]228`	8
`100[.]116[.]148[.]111`	8
`100[.]112[.]136[.]191`	8
`100[.]89[.]177[.]62`	8
`100[.]93[.]135[.]190`	8
`168[.]235[.]82[.]183`	2
`96[.]234[.]38[.]186`	2
`120[.]51[.]83[.]89`	2
`204[.]197[.]244[.]176`	2
`149[.]202[.]153[.]251`	1
`103[.]47[.]185[.]215`	1
`107[.]180[.]41[.]254`	1
`69[.]16[.]254[.]127`	1
`82[.]145[.]43[.]153`	1
`139[.]255[.]47[.]211`	1
`37[.]228[.]137[.]204`	1
`157[.]7[.]231[.]227`	1
`202[.]238[.]198[.]32`	1
`202[.]238[.]198[.]30`	1
`60[.]36[.]166[.]212`	1
`192[.]1[.]4[.]230`	1
`50[.]31[.]174[.]165`	1
`113[.]43[.]208[.]199`	1
`202[.]130[.]62[.]24`	1
`103[.]253[.]113[.]131`	1

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`adichip[.]com`	10
`grafdesign[.]pl`	8
`dcjohnsonassociates[.]com`	8
`global-ark[.]co[.]jp`	8
`acadmi[.]co[.]uk`	8
`mail[.]1and1[.]com`	1
`587[.]hexabyte[.]tn`	1
`child-pro[.]com`	1
`imap[.]e-apamanshop[.]com`	1
`sg2plcpnl0259[.]prod[.]sin2[.]secureserver[.]net`	1
`mx1[.]retailconnection[.]co[.]za`	1
`smtp[.]consulmexrio[.]com[.]br`	1
`mail[.]ahg[.]com[.]mx`	1
`mail[.]cassado[.]com[.]pe`	1
`pop[.]aoishokai[.]co[.]jp`	1
`mail[.]thebasechurch[.]org`	1
`miyataseika[.]sakura[.]ne[.]jp`	1
`mail[.]uberved[.]com`	1
`mail[.]victoriasuitehotel[.]com[.]pe`	1
`pop3[.]jinrikiudon[.]co[.]jp`	1
`pop[.]e-apamanshop[.]com`	1
`bh-35[.]webhostbox[.]net`	1
`pop[.]orange[.]jo`	1
`mail[.]muzamilglass[.]com`	1
`mail[.]aceinterioruae[.]com`	1

*See JSON for more IOCs

Files and or directories created	Occurrences
`%HOMEPATH%\576.exe`	10
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat`	2

File Hashes

             24547a6e7ab9766fc85644033e27414deb2409367fae21fdb722174a605a34ad              27e0a7b8c18893b22583e19ef7634fd79fc9cb5daed862f794960ddaa19b58dc              363ecad264cfe3cdef52119a1b78c495d362efa7df5d38d182ce76dbf31facfd              3f0e86777e4a9b3285a9203907f5a7e6f804e7cfda3300b857e8712ac2030e57              5e31045309ab5ecbef3701c9023fc5a4631bf653347447484b652e434b086966              67c3eabb23b74c1a6ee4d384fa6f248c4a2492d998e7aaf0a1ce3f878a8ff715              6ba2589b00a95ff4ce9f7eee550bdffa6ef57dbf0212384ce38696b0c13778bd              7b0c9b63d9e8c6399e13354176e41bde009c94053b0566ef4506b17c14b46ab7              9100a8c4f2f6dd2bde134162d6b70f0d9ac99db4ff1f4551407a8a078ce2c35c              c0197a5e801dee8d80df024c32a616c04539a56108b2225b469c7eb5fede5447

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Malware

Win.Dropper.TrickBot-7455405-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Value Name: Blob`	3

Mutexes	Occurrences
`Global\316D1C7871E10`	20

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`167[.]86[.]123[.]83`	4
`5[.]34[.]177[.]50`	4
`193[.]37[.]213[.]110`	4
`170[.]84[.]78[.]224`	3
`216[.]239[.]36[.]21`	2
`216[.]239[.]38[.]21`	2
`117[.]196[.]233[.]79`	2
`85[.]143[.]220[.]41`	2
`5[.]2[.]72[.]84`	2
`146[.]185[.]219[.]94`	2
`185[.]62[.]189[.]132`	2
`107[.]172[.]29[.]108`	2
`3[.]224[.]145[.]145`	1
`200[.]21[.]51[.]38`	1
`31[.]214[.]138[.]207`	1
`181[.]129[.]104[.]139`	1
`190[.]142[.]200[.]108`	1
`181[.]113[.]28[.]146`	1
`177[.]105[.]242[.]229`	1
`185[.]66[.]13[.]65`	1
`212[.]124[.]117[.]25`	1
`64[.]44[.]133[.]151`	1
`107[.]172[.]208[.]51`	1
`146[.]185[.]253[.]132`	1
`172[.]82[.]152[.]130`	1

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`250[.]5[.]55[.]69[.]zen[.]spamhaus[.]org`	2
`myexternalip[.]com`	2
`ipecho[.]net`	1
`checkip[.]amazonaws[.]com`	1
`api[.]ipify[.]org`	1
`ipinfo[.]io`	1

Files and or directories created	Occurrences
`%System32%\Tasks\System Network Extensions`	20
`%APPDATA%\speedlink`	20
`%APPDATA%\speedlink\data`	20
`%APPDATA%\speedlink\settings.ini`	20
`%TEMP%\<random, matching '[a-f0-9]{3,5}'>_appcompat.txt`	20
`%TEMP%\<random, matching '[A-F0-9]{4,5}'>.dmp`	20
`%APPDATA%\SPEEDLINK\<original file name>.exe`	20

File Hashes

             14c4ecbdba8a97d3157dcbbe5be3ab9270ba9142e6ea6286634e8b9658db5f20              170f8b900b31d3bcdf5e97d870a4b791c7e28754b15b7c90c4e835c2f7d579b7              22c10541cffa8a6c504202fe909fdbaa87375427fb2918ac1ab78a0656a886f0              26c501cea49207f9482fa293ed361c2bb4c163ed6c0a8cf309aa21624570f0ba              2c5c0a1b1998c1686eb2cc6654681aa933eb123feb972110cb2ddd91ab188429              3247f44c8c5bd8707c2a78e71ae03cc4a98845e1af8f7e283ea0189bf2c578bf              7d97d4c51ba4ad8a562264a9a0f8a09165123eeab47b74370f116778e9507cdf              95ee0f3243a2202f706bd45aaa2d27614059773ecb978671324560dc87fa6c03              9b71918c0db320b9b7ae6501f7b898082678480825b24d6c863bc1c017291db5              9f8aeec6db5f0220c88f6b90777c17f52a0219a5581cd586931782a975d1e068              ae560bec5699185818aa31178b20782fdb5113c202ac29ac9e6e26a4a2ccc091              bbab2020a80bf96b5784d94a395f9239127389e114799d3de605e0a13f0a7f91              c93ab8787073bbbc9cd37a121fa63b1eb782f547ed3a2085c0b09ca3a7549dee              d635e095a8694027c0523c7b0ec13409daa295afb99eb40395a3794a948479a5              d7e9dd938f44a2be9163002868973d34bb445ffd008bc007493ee271661fc691              de4ff1ec4bdd8662185ab8776e9ca1a898a402d7c794b8b6f7d4b481a56e3a2b              e282e081f44f468e9f12421833b9db629f788b583cc050bf945cb3067be916ae              eaab484d0f2cfa0ba4e2ffe301f08e5a2f515195131f023bd8d69b8acafd5bb4              f1265e6373975143d1b68cc5ddde073a615531133a43cc789b425e3d318bd159              f979b407999143cd0d22e46cca3405a14dd0ddb6d022c79aa0f399c7a0b1db9f

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

Win.Packed.Dridex-7447905-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: trkcore`	16
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: DisableTaskMgr`	16
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.CHECK.0 Value Name: CheckSetting`	16

Mutexes	Occurrences
`2XzfQtwuWo`	2
`6K6du14uPy`	2
`Pl97gmRo4e`	2
`Rn0BgZV5LS`	2
`VdM3QqPmEf`	2
`dfSE5V35Cq`	2
`h7l6vKPM9o`	2
`qlxcdn1ONT`	2
`8Uxj8bcq52`	1
`YCQp73aCwI`	1
`A9GTS5Q4V7`	1
`hMRRcbdYM5`	1
`Oa0iwlf5sY`	1
`ogQ7oifBn6`	1
`jZKilZdPlc`	1
`qBGGGgXckD`	1
`l4ibeg830v`	1
`wOMqV2KpkO`	1
`7blYqMoYMu`	1
`3YLHr362i4`	1
`E2Z6XqeW5y`	1
`SUFSEHTYOK`	1
`Jm43Qhf6mW`	1
`SbwW51fbso`	1
`OM3OWBjT4C`	1

*See JSON for more IOCs

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`172[.]217[.]10[.]238`	16
`104[.]20[.]68[.]143`	12
`104[.]20[.]67[.]143`	4

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`pastebin[.]com`	16
`www[.]riirnqa3el[.]com`	2
`www[.]tcofbii6gc[.]com`	2
`www[.]xkwkb7vwyc[.]com`	2
`www[.]luzbvsguu7[.]com`	2
`www[.]e2vqnpqnxa[.]com`	2
`www[.]ddwnd8uazb[.]com`	2
`www[.]yg1ihyzjlx[.]com`	2
`www[.]k3okzy7fbv[.]com`	2
`www[.]5rmqghqote[.]com`	1
`www[.]sbbvxwzjds[.]com`	1
`www[.]lfrmipbwhf[.]com`	1
`www[.]5tmjtihjrd[.]com`	1
`www[.]99z7gq8bpa[.]com`	1
`www[.]fn8bcbak8g[.]com`	1
`www[.]j3hh3nvc1x[.]com`	1
`www[.]q6rbctmtup[.]com`	1
`www[.]6y1kayw2zo[.]com`	1
`www[.]cngy66afzf[.]com`	1
`www[.]xwra4vfpbm[.]com`	1
`www[.]xp9isgvq38[.]com`	1
`www[.]3upvufuqla[.]com`	1
`www[.]phtetocd0l[.]com`	1
`www[.]6komu134jz[.]com`	1
`www[.]cmckmtegzm[.]com`	1

*See JSON for more IOCs

Files and or directories created	Occurrences
`<malware cwd>\old_<malware exe name> (copy)`	13

File Hashes

             01568fc89054049b9f4c65271186513fa9406e5bcaddd2583fa55abea453f3aa              0a07af4ec8798650f1e578f7e48df97980cf18074d2cc8b17955bb129c44607e              2440f0be01bed503a0a4315e8f253d6559063c7dd3dfd7e28379b23cc9fe3929              25effe96a8c27444dac8ff4ff13f75bc56c351faa74ddd0b217bf6c5f8202cbc              282c63152fdf124cba6c392874c96e670ce019b8566c1cba18475701ce06fbac              4d7589c590b5b0e69c5f08c7664bf658fe340b47022299337e9ec0ccf604426e              6b0ab0fb5437d31cef43d3b0cb989832b3d42d4d1c115d2180ffa0e25d6e0be3              6fcbcc1c24bf20ea3dfff5bfad8d0c38e60e46d1c9cbf254d845c58d4cecd1c9              878fd0aa3f953d35e89d4cf6b52183aa3cc0a1ab244665a4262189c065ce04ce              87dabcb18d67440cf631479d6ae1bacb32d82704c3c54e0305c370cd3f122512              a51d3150053e1a9d2176e98f0000acb572ecbe7c33ae596ab9cdfd4a05470b8c              a71838cb33ea89f9e3f3201825b7129b8a61f112d946bf9b7671f2af901a07c1              ac29341c883ff743a3213050314bcfe0abffa366fec2abc09434d789bf836bcd              b82c549b351a01839d6e3cc9ca60f1aaed2478799f373bcae604b6ede0e0c4e6              bb819890507c80a1cf9e83808d451a00fdae2fb43b1881b3806093bba32c1a8a              f8b9bbc15f8697772d577944686a9b9c61547b992d156d0901293b438f359306

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

ThreatGrid

Win.Packed.Razy-7450491-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: None`	10

Mutexes	Occurrences
`frenchy_shellcode_006`	10
`Global\{259ce387-0d2a-4287-8147-d7e9dfdbdca4}`	10

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`79[.]134[.]225[.]121`	10

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`jogodo[.]duckdns[.]org`	10

Files and or directories created	Occurrences
`%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5`	10
`%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\Logs`	10
`%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\Logs\Administrator`	10
`%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\run.dat`	10
`%APPDATA%\None`	10
`%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\catalog.dat`	4
`%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\settings.bin`	4
`%APPDATA%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\storage.dat`	4

File Hashes

             06b47808b96d08f6ef2089ff0d8eed4a9d448d5e6ebc4fe86321cfaecb774bc0              0815f50eb9877530cdcc6a30e551772d0c4807e2105e7cc5ecd3b510d7d3a019              0950e389cce1b3be7140f1a9ba2ddd6a677fda7fb50020bfc15d80b9aac8ccec              7e0c1895e8a080c7db4faca83b354d5af326920ce4534658e0c947f61328b468              a3bcf7816ef93cacc688c6b7bebac3b46d6826c85cfd215d5da279af11e509ae              cf37f002c857a43c1d45189a68368ed643dc506c0260f4fe436d12e4e2b2d22d              d2cf31b477c11ba5cb39a341fc7bedddbf1a7ec9541b105bab8e0022849a88c9              dc0714b70cb172c05ccb08424163e8932add81a498b55a556feb706cb80ffc13              f2d9a6acc6b09b4027dc558a268036a1213deecefae9952670bff42a481daaba              f8a661f4823d529c13c7e2698f67aa3a00ed9a27f59e810b75cb4ead41dc3cf2

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

ThreatGrid

Win.Dropper.NetWire-7454096-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: task`	25
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: Registry Key Name`	25
`<HKLM>\SYSTEM\CONTROLSET001\ENUM\SW\\ASYNCMAC Value Name: CustomPropertyHwIdKey`	1

Mutexes	Occurrences
`-`	25
`KYIMEShareCachedData.MutexObject.Administrator`	8
`KYTransactionServer.MutexObject.Administrator`	8

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`85[.]206[.]175[.]225`	25

Files and or directories created	Occurrences
`%TEMP%\~$BOSCH.xlsx`	25
`%TEMP%\Install\Settings.ini`	25
`%TEMP%\BOSCH.xlsx`	25
`%TEMP%\Install`	25
`%TEMP%\Install\EXCEL.exe`	25
`%TEMP%\Install\EXCEL.vbs`	25

File Hashes

             04e12a8dcf9e8f041cf1b5b7f8f48a832df5fd607bf810fb28933fbc188a8c4b              0d9bedadc3e9edbc3b84c20a651d1e0a23609e4a7f039ec36c67276e90eed205              13047457fd3aca8c5d0ce5f165ea513cbdcd128a4e0de5b7322b895e1188f680              13a210e2e5527d08b6018f2463056f1d31011ed10e696b26e10482a4b09045f6              1e4e92c1d2b131e7710726282a014c014089a61bf93f7bd27b0689e4faef0d92              23804d31eb2d20e90df50559281008425b584a77fad856dce360400292bc6a80              291b26c6629d51d69e7856d22f80202b7a97f0a0f364adab27f16006e77d2df2              2e8e1ad0e72ecfc4cef418a8bc25095c4b0893a561c446a6aa1b8fe56c780d8c              36115f2ed9027f14643f000815ec615d44b97e3fb5c14cc0b67fcb9e784d3bda              3ad37750ccdb9ce0a82997c591d7842d9cee5722fc03219d0cf51f6cf7ddcc00              541e9bb6c2ff220ba15fd731000327f54ca8eae9e3df4d3e4193f50bf4f5f63b              5bf1aead7b5e89d92227d0e1daa019c0927de54faad212c35775d79f1c7b5d39              5f738f026c6f20f0d7ea5808ce96f14dbcb21f47b7b98d60e577a09d43d69071              6626bc4952d2a8cf839a47a4ada71ae877b7b89ac230821d9f5f17462eef4f4c              68252e2eb44e02032d53c42fe4b4c3ed6b8773f60aa78ebb7e6d34ee51ad32bc              68aaa21c0a7e40ba3bbc90abd3d9dd259d6c21d354d219b91ccd61e5c3b52089              68fe9505234da0d57d8a6c4898a1948574698fd5d5ddd9222efad0018d3adf3c              6fca62b51ce59dbf722f5f7d242f26c09b7b02cebde3d9b8db7feacc9d76da1a              7697945d1d3d95f66f3337329d8142f709fd153ead6ac8adfce7975b8572ad04              79a505ca4c4497351ee7cdd599212bf22979421f1055527bc11797d49b8ab907              7a291dffa29a8ca2f094af686ba0c8ceff4d432d10e601273f8b9a8779899e48              88edc5c751377aaf23028562d4a979ff2ca95b61d3d128fa42b64e68e42e20b2              895c0c05ba64cbf70bc8a9587194497b3c93f53cb9e17edcaf7d506a1f58b195              8bd10e751e7df59c1ba91a71bbeadbe5dfa12cb75d0fc7fdf65007703745e31c              8f7abac012c0016d87e3f40e14cdae185193aa8a6bfcb3810c010eab9ec495c6

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

ThreatGrid

Win.Trojan.Tofsee-7450732-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES`	16
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>`	16
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: Type`	16
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: Start`	16
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: ErrorControl`	16
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: DisplayName`	16
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: WOW64`	16
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: ObjectName`	16
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: Description`	16
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config1`	16
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config0`	16
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config2`	14
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config3`	14
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: ImagePath`	12
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config4`	8
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\exlrqyet`	2
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\athnmuap`	2
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\tmagfnti`	2
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\xqekjrxm`	2
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\gzntsagv`	1
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\ibpvucix`	1
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\jcqwvdjy`	1
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\piwcbjpe`	1
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\buionvbq`	1
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\slzfemsh`	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`69[.]55[.]5[.]250`	16
`43[.]231[.]4[.]7`	16
`85[.]114[.]134[.]88`	16
`239[.]255[.]255[.]250`	14
`46[.]4[.]52[.]109`	14
`192[.]0[.]47[.]59`	14
`64[.]233[.]186[.]26/31`	14
`173[.]194[.]66[.]26/31`	14
`46[.]28[.]66[.]2`	14
`78[.]31[.]67[.]23`	14
`188[.]165[.]238[.]150`	14
`93[.]179[.]69[.]109`	14
`176[.]9[.]114[.]177`	14
`67[.]195[.]228[.]110/31`	13
`98[.]136[.]96[.]76/31`	13
`67[.]195[.]204[.]72/30`	13
`104[.]44[.]194[.]232/30`	12
`98[.]136[.]96[.]74/31`	12
`172[.]217[.]197[.]26/31`	12
`98[.]136[.]96[.]92/31`	12
`172[.]217[.]10[.]67`	11
`209[.]85[.]202[.]26/31`	11
`188[.]125[.]72[.]74`	11
`213[.]205[.]33[.]61`	10
`65[.]55[.]37[.]104`	10

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`250[.]5[.]55[.]69[.]in-addr[.]arpa`	16
`microsoft-com[.]mail[.]protection[.]outlook[.]com`	16
`schema[.]org`	14
`250[.]5[.]55[.]69[.]zen[.]spamhaus[.]org`	14
`250[.]5[.]55[.]69[.]cbl[.]abuseat[.]org`	14
`mta5[.]am0[.]yahoodns[.]net`	14
`250[.]5[.]55[.]69[.]dnsbl[.]sorbs[.]net`	14
`whois[.]iana[.]org`	14
`250[.]5[.]55[.]69[.]bl[.]spamcop[.]net`	14
`whois[.]arin[.]net`	14
`250[.]5[.]55[.]69[.]sbl-xbl[.]spamhaus[.]org`	14
`hotmail-com[.]olc[.]protection[.]outlook[.]com`	14
`irina94[.]rusgirls[.]cn`	14
`anastasiasweety[.]rugirls[.]cn`	14
`mx-eu[.]mail[.]am0[.]yahoodns[.]net`	13
`mx-aol[.]mail[.]gm0[.]yahoodns[.]net`	13
`coolsex-finders6[.]com`	13
`ipinfo[.]io`	12
`aol[.]com`	12
`eur[.]olc[.]protection[.]outlook[.]com`	11
`www[.]google[.]co[.]uk`	11
`msn-com[.]olc[.]protection[.]outlook[.]com`	9
`web[.]de`	9
`mx[.]xtra[.]co[.]nz`	9
`xtra[.]co[.]nz`	9

*See JSON for more IOCs

Files and or directories created	Occurrences
`%SystemRoot%\SysWOW64\config\systemprofile`	16
`%SystemRoot%\SysWOW64\config\systemprofile:.repos`	16
`%SystemRoot%\SysWOW64\<random, matching '[a-z]{8}'>`	16
`%TEMP%\<random, matching '[a-z]{8}'>.exe`	16
`%HOMEPATH%`	11
`%System32%\<random, matching '[a-z]{8}\[a-z]{6,8}'>.exe (copy)`	11
`%TEMP%\gidjcpz.exe`	1

File Hashes

             0d55086e8221871f10f204087a165112434c8db294fbedfaa6de7d2a11b55943              2b069b741778d0e16246f7a2da8738b6b21e8004cb713efc8ce845b37fc94478              2d3fbb1b7d4da1af0e07fa6fd11f1e946815ce39b3b63fdf299e4acaa9d92ff1              2e02f61e0a99dceab6e026e2e9efb9dcd2466e41e56f3f659f0ee1a4670d502d              59dcd52b18a4badf7803940e05842a52b6af9fa95fdb2ddee26145d6a393c277              60d0cdba9b81f58e4f926e1bbe357d7415771f42819acb79fa4d02313fdac8b9              886ff6f03c5e0a77cf10cbd1461e1ee666901cfdfe26854610b9deef5450bf00              8d9142db7706f1be42d3d048cea675ca6caa5dffd562595124f4e5c95771480a              9403677dc99940afcced72ed29b04a0434417883d929164d279606e9df4fe1db              94568d7086b812c0017455b1d05968726ffd137d8831ddb607fbae5d454ed073              9af4c0927e3565f27e96a8b7fb26ff0ea2d22f6f2a0bd0c6de9f993378024791              a76e2be2b3730324299bd32c7da5a04f494f79a69aeab9649aa53984c852e49a              b926e4920a7b454553f73565ce89023af72ae4b6720da4110eb7fa85ff0310bf              cbd7701ebc908b3ab059a9d83a3be110e8f63b0e005a41d5e0788044a65f6a14              d9520acee8a753230b372d725a3d4ba4d3caf27fd1eee7d8a8c9779424f2c077              fd1d5902802ada2adc69f071535b1523e2e3580ec2ea960e03a875687913d5de

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Doc.Downloader.Sagent-7454309-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{BEF6E003-A874-101A-8BBA-00AA00300CAB}`	30
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: ProxyEnable`	12
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: ProxyServer`	12
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: ProxyOverride`	12
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: AutoConfigURL`	12
`<HKU>\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS Value Name: AutoDetect`	12
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA`	10
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: Type`	10
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: Start`	10
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: ErrorControl`	10
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: ImagePath`	10
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: DisplayName`	10
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: WOW64`	10
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\FUNCSITKA Value Name: ObjectName`	10
`<HKCR>\LOCAL SETTINGS\MUICACHE\23\52C64B7E Value Name: LanguageList`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TITLEHANT Value Name: DisplayName`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TITLEHANT Value Name: WOW64`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\TITLEHANT Value Name: ObjectName`	2
`<HKLM>\SOFTWARE\CLASSES\TYPELIB\{C4EDCADC-BC75-481F-8A5F-102075206B43}`	2
`<HKLM>\SOFTWARE\CLASSES\TYPELIB\{C4EDCADC-BC75-481F-8A5F-102075206B43}\2.0`	2
`<HKLM>\SOFTWARE\CLASSES\TYPELIB\{C4EDCADC-BC75-481F-8A5F-102075206B43}\2.0\FLAGS`	2
`<HKLM>\SOFTWARE\CLASSES\TYPELIB\{C4EDCADC-BC75-481F-8A5F-102075206B43}\2.0\0`	2
`<HKLM>\SOFTWARE\CLASSES\TYPELIB\{C4EDCADC-BC75-481F-8A5F-102075206B43}\2.0\0\WIN32`	2
`<HKLM>\SOFTWARE\CLASSES\TYPELIB\{C4EDCADC-BC75-481F-8A5F-102075206B43}\2.0\HELPDIR`	2
`<HKCR>\TYPELIB\{C4EDCADC-BC75-481F-8A5F-102075206B43}`	2

Mutexes	Occurrences
`Global\I98B68E3C`	10
`Global\M98B68E3C`	10
`Global\IC019706B`	2
`Global\MC019706B`	2
`Global\SyncRootManager`	2
`Local\C9E8AF12-FA27-4748-EC04-38CA71239739_RegisterDevice`	2
`Global\RecentDocumentsUpdate`	2

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`100[.]104[.]45[.]107`	18
`100[.]127[.]143[.]246`	18
`100[.]109[.]114[.]19`	18
`100[.]79[.]213[.]246`	18
`100[.]67[.]20[.]29`	18
`150[.]95[.]16[.]71`	12
`113[.]61[.]76[.]239`	12
`111[.]125[.]71[.]22`	12
`80[.]11[.]158[.]65`	10
`173[.]255[.]214[.]126`	6
`169[.]254[.]255[.]255`	2
`74[.]202[.]142[.]71`	2
`96[.]126[.]121[.]64`	2
`77[.]90[.]136[.]129`	2
`69[.]28[.]91[.]207`	1
`200[.]38[.]35[.]102`	1
`96[.]127[.]149[.]2`	1
`107[.]190[.]137[.]130`	1
`191[.]252[.]112[.]194/31`	1
`200[.]58[.]123[.]102`	1
`98[.]142[.]107[.]242`	1
`138[.]128[.]170[.]234`	1
`65[.]99[.]252[.]200`	1
`190[.]8[.]176[.]37`	1
`67[.]217[.]34[.]70`	1

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`hontam[.]net`	30
`powayhomevalues[.]com`	18
`gongxu[.]gfbags[.]com`	18
`sabrespringshomevalues[.]com`	18
`1localexpert[.]com`	18
`smtpout[.]secureserver[.]net`	2
`smtp[.]prodigy[.]net[.]mx`	2
`mxa[.]web-hostingmx[.]com`	1
`mail[.]prosyde[.]com`	1
`mail[.]ledneonchile[.]cl`	1
`mail[.]vieracruz[.]com`	1
`bestsol[.]pe`	1
`mailserver[.]dtctty[.]com`	1
`mail[.]alcorsa[.]com[.]gt`	1
`mail[.]imelsa[.]cl`	1
`mail[.]jacto[.]com[.]ar`	1
`lucanodotaciones[.]com`	1
`mail[.]adevpa[.]com`	1
`smtp[.]hidroil[.]com[.]ar`	1
`mail[.]mpcsa[.]com[.]mx`	1
`mail[.]amadisa[.]com`	1
`mail[.]confirmeza[.]com[.]co`	1
`mail[.]inmediprest[.]com[.]mx`	1
`mail[.]nueratelecom[.]net`	1
`mail[.]insurcol[.]com`	1

*See JSON for more IOCs

Files and or directories created	Occurrences
`%HOMEPATH%\223.exe`	30
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat`	10
`%System32%\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx`	2
`%System32%\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx`	2
`%System32%\winevt\Logs\Microsoft-Windows-NcdAutoSetup%4Operational.evtx`	2
`%System32%\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx`	2
`%System32%\winevt\Logs\Microsoft-Windows-TWinUI%4Operational.evtx`	2
`%System32%\winevt\Logs\Microsoft-Windows-TZSync%4Operational.evtx`	2
`%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms`	2
`%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\a4a5324453625195.automaticDestinations-ms`	2
`%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms`	2
`\TDLN-2060-41`	2
`%LOCALAPPDATA%\TileDataLayer\Database\EDB.log`	2
`\Device\NamedPipe\Sessions\1\AppContainerNamedObjects\S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742`	2
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows`	2
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History`	2
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5`	2
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache`	2
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5`	2
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE`	2
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters.dat`	2
`%SystemRoot%\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies`	2
`%APPDATA%\Microsoft\Windows\Recent\TEMP.lnk`	2
`\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8`	1
`%TEMP%\CVRB4F.tmp`	1

*See JSON for more IOCs

File Hashes

             08214f8f4d27bc90013b2403d515dadfe992e48b104fd2748ae28b4e37c2ddd6              1bf23d80114b94336235bc3b83960f4bcecd4478effa98b92536c1e907bb70b8              26485f44831ed89fabdf3773fd36709e78b560139836a17d784ee84493e6f021              3324b01c88474616fd9701d13708f6c9ff2d2125ed14e7983ae72ea1c5a5edf2              33b3b2a6c822fa356cc251c03b4e25f5a082a126a6d10717a312436250d6682e              3528140e6db34bde7280f4284122fb7190a4606ac61a4030f91504e4a962cb93              38589a48cab122fb15dc5efa82ae023b8b467a99e60c3c183772dc3d58bd43c5              4e1659700f1d599197f6bbe2330e7c91d87578fe23bfe082dce719f6e5372e0c              4f9954159f29d6292d48986cd0ab71952357c48738dda7f59798c66241514ae9              549fa8564e7e677601d557509c9f44336cc07a8c92949cd4928017ade6c072f4              660c09d1e5ae736de0b1fea0ee93040d0240567fe7254953cd8644bb0b2e49f6              664166554198691ddfb441ac33b12f12e5d14e36b0fb5c09d35ee04bd6d68ca2              6661a70c61b67a87302e04706ff07bcb12328d74bf1d8c7c0075d3edeb8064dc              765ba4ac4d0a2d99916dc9b0e844a669c4b5c5217068741c66216d9b291cea10              899e4dff369309ab4c7c5a466dbcf642bce9788307a75efe8371cc1087714eaf              9c1d3857fa6c1dfee066d46f1ce467429e26d020036019b57e9e87aa2f8fc2ab              a2717826ba6ed1d778ef8d7585ddae5c1e076da3d9cfaa9c5c8247c3c4f33ccb              aa33bd6b5ac85cb8d3a4d7e511b8c513ad22f7e6b130a456e23a2d07aa89304a              b35cf729a7cbf201c9b3682441e6edf65031fee775412e9887c751c1add6d3b3              b48575d226d564c2fb7235f4962d1b29e6152dcdab262157bed79c2a02f11157              c894fbda9027f90b827efebd981c2326d8761e843e5e633990bdc756240087e7              d03bed2bf79256ad1c94c6c66570e35ab54943ba921bdf295c2d0c5d12e7e982              d4b9a89ae01db11a9adf508ed1777327145eb205404a1df5020919c19068d4e0              e5c52d8f0bbb10dff3dcb0c7d055fdc5d856e8e9b2805a1560681f383c679b72              e80c5f3eeb9d4cea62abe90a95e27b1c04ee7b02bf021e11cf9da956485c0bea

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Malware

Win.Malware.Gandcrab-7454521-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Value Name: Blob`	22
`<HKCU>\SOFTWARE\KEYS_DATA`	22
`<HKCU>\SOFTWARE\KEYS_DATA\DATA`	22
`<HKCU>\SOFTWARE\KEYS_DATA\DATA Value Name: public`	22
`<HKCU>\SOFTWARE\KEYS_DATA\DATA Value Name: private`	22
`<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Value Name: Blob`	21
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST Value Name: C:\Windows\system32\rundll32.exe`	2
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST`	2
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY`	2
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\FROSTDM`	2
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\FROSTDM Value Name: Impersonate`	2
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\FROSTDM Value Name: Asynchronous`	2
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\FROSTDM Value Name: MaxWait`	2
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\FROSTDM Value Name: DllName`	2
`<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\FROSTDM Value Name: Startup`	2
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: frostdm`	2
`<HKCU>\Software\Microsoft\<random, matching '[A-Z][a-z]{3,11}'>`	2
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: webappsstore.exe`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: bookmarks-2017-10-03.exe`	1
`<HKCU>\SOFTWARE\MICROSOFT\IRIF Value Name: Pyursy`	1
`<HKCU>\SOFTWARE\MICROSOFT\KUWY Value Name: Naember`	1

Mutexes	Occurrences
`Global\8B5BAAB9E36E4507C5F5.lock`	22
`A16467FA-7343A2EC-6F235135-4B9A74AC-F1DC8406A`	10
`A9ZLO3DAFRVH1WAE`	2
`AhY93G7iia`	2
`B81XZCHO7OLPA`	2
`BSKLZ1RVAUON`	2
`F-DAH77-LLP`	2
`FURLENTG3a`	2
`FstCNMutex`	2
`GJLAAZGJI156R`	2
`I-103-139-900557`	2
`J8OSEXAZLIYSQ8J`	2
`LXCV0IMGIXS0RTA1`	2
`MKS8IUMZ13NOZ`	2
`OLZTR-AFHK11`	2
`OPLXSDF19WRQ`	2
`PLAX7FASCI8AMNA`	2
`RGT70AXCNUUD3`	2
`TEKL1AFHJ3`	2
`TXA19EQZP13A6JTR`	2
`VSHBZL6SWAG0C`	2
`chimvietnong`	2
`drofyunfdou`	2
`kliaduosix`	2
`limdouxdaz`	2

*See JSON for more IOCs

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`93[.]125[.]99[.]121`	22
`185[.]135[.]88[.]105`	22
`146[.]66[.]72[.]87`	22
`87[.]236[.]16[.]31`	22
`217[.]160[.]0[.]234`	22
`69[.]73[.]180[.]151`	22
`171[.]244[.]34[.]167`	22
`217[.]174[.]149[.]130`	22
`178[.]238[.]37[.]162`	22
`179[.]188[.]11[.]34`	22
`89[.]252[.]187[.]72`	22
`77[.]104[.]144[.]25`	22
`202[.]43[.]45[.]181`	22
`217[.]160[.]0[.]27`	22
`92[.]53[.]96[.]201`	22
`213[.]186[.]33[.]3`	22
`50[.]87[.]58[.]165`	22
`77[.]104[.]171[.]238`	22
`194[.]154[.]192[.]67`	22
`204[.]11[.]56[.]48`	22
`23[.]236[.]62[.]147`	22
`213[.]186[.]33[.]5`	22
`217[.]70[.]184[.]50`	22
`52[.]58[.]78[.]16`	22
`66[.]96[.]147[.]103`	22

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`big-game-fishing-croatia[.]hr`	22
`www[.]lagouttedelixir[.]com`	22
`www[.]himmerlandgolf[.]dk`	22
`zaeba[.]co[.]uk`	22
`bellytobabyphotographyseattle[.]com`	22
`www[.]wash-wear[.]com`	22
`www[.]poketeg[.]com`	22
`boatshowradio[.]com`	22
`www[.]perfectfunnelblueprint[.]com`	22
`perovaphoto[.]ru`	22
`www[.]cakav[.]hu`	22
`goodapd[.]website`	22
`www[.]ismcrossconnect[.]com`	22
`www[.]fabbfoundation[.]gm`	22
`alem[.]be`	22
`cevent[.]net`	22
`mauricionacif[.]com`	22
`cyclevegas[.]com`	22
`oceanlinen[.]com`	22
`6chen[.]cn`	22
`koloritplus[.]ru`	22
`asl-company[.]ru`	22
`www[.]krishnagrp[.]com`	22
`test[.]theveeview[.]com`	22
`picusglancus[.]pl`	22

*See JSON for more IOCs

Files and or directories created	Occurrences
`%HOMEPATH%\ntuser.ini`	22
`%APPDATA%\Microsoft\Media Player\KRAB-DECRYPT.txt`	22
`%HOMEPATH%\AppData\KRAB-DECRYPT.txt`	22
`%APPDATA%\KRAB-DECRYPT.txt`	22
`%APPDATA%\Media Center Programs\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Credentials\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Internet Explorer\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Internet Explorer\Quick Launch\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\Managed\Document Themes\1033\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\Managed\Document Themes\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\Managed\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\Managed\SmartArt Graphics\1033\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\Managed\SmartArt Graphics\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\User\Document Themes\1033\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\User\Document Themes\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\User\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\User\SmartArt Graphics\1033\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\User\SmartArt Graphics\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\User\Word Document Building Blocks\1033\KRAB-DECRYPT.txt`	22
`%APPDATA%\Microsoft\Templates\LiveContent\User\Word Document Building Blocks\KRAB-DECRYPT.txt`	22

*See JSON for more IOCs

File Hashes

             0682b36ae0be779eb1ad4d3e0d8958a08ad8e044609a6cee5af314ed4d94f237              0c7d85f6f2e1e16ca7bef272edffdb0d513ce0f050347578600cdac206e048bd              1483d05311d9c544e404bf3b35e1bc80a154dd9b5d9757a24b99569cc5ddf680              17133d42590782a30f8464c7446d6a202299daf3cf8391ea40883d17e9d367ed              17ef571b3e2bbbb215ebfb291a1a4c17169a7a5ff0720718720eadacd4500830              1d69bee79a17d872422f9aada2d4b4ee4c048a8932ef50885c9d327cf225af4c              20cf2009ca1e7155b428ae8c76ab0baf7196aaa4c0d2bb7b9aa452a595d4a3ac              2135b77151f05d56f91a8c652edaf6b7a28ae26300b1550b5d28672131aee95e              245efbc6f214ff0d5726c671b51ba0569edf83666c557152b54c494821bc0a7f              2481c8679ec7110d1811fd1578862b9f1b7439c1d818bd4102ebe31cb7e706c7              27b4c02d76cf9845056d456244cd093d86880101f4f6971323814a5eabc7e7b0              292ba930f72bbfa23dab563c3f35ec157a0374b8b3f34f122c6a5997a3daa81b              318cff626b73c4508e9860b2d9ad8a5b53f93637a9a4b9b21cec27c0dde10dcf              37bf027ea0235e19e6d72597c45721c99b9ec619982f7d948e8ddfa2742ef6ae              39eb43c190b49a55de56873a0947d32177bb183791d1f696ff102f75c9b1dca2              3debcef78d8f77548491144e69fde1d89f7b5392b09b1b51f4df061aa622c706              420fe4c2431f23d3a7c4044cdcb71d434daded7c127da6fd1a150c322dcde5e4              670cba74908e2755ace9382cbbd26016fa4c66d7794958fe2d51530100aaaa2a              6a6bc4b3e2c460141981ba83a3a933e35adddc4814a3ffca8e329a5c63a149b8              708bf234cb01321625bf94fd58ece8719ce405b0f0895c59b9a1634b532b6307              73aeb522487874825cbe13567a86280273f90b8a4ee2367f758f393fc24a406e              77b0e7632645006d4a456b314a1899c6c0aba73dcaf74cdbe91bf946c7c9ea98              7a8a1c55a55adfea28a36ef6b6c4836990d62dfb941dfe3ba68e6c32fe7d9874              7dd4779ce5a53500c292236d9b9b062c99cec62ef118aae15a752362fd4e0358              87182baddbc7e1915abd036980c7554a7ee4f7281055772fd851ce67284a6616

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Trojan.HawkEye-7455512-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED Value Name: Hidden`	8
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Windows Update`	6
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Registry Key Name`	1

Mutexes	Occurrences
`3749282D282E1E80C56CAE5A`	6

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`104[.]16[.]155[.]36`	5
`82[.]221[.]130[.]149`	3
`104[.]16[.]154[.]36`	3
`208[.]91[.]198[.]143`	2
`204[.]11[.]56[.]48`	1
`23[.]94[.]43[.]90`	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`whatismyipaddress[.]com`	8
`www[.]macniica[.]com`	4
`smtp[.]vivaldi[.]net`	3
`us2[.]smtp[.]mailhostbox[.]com`	2
`smtp[.]believelogs[.]com`	2
`www[.]swift-be[.]com`	1
`smtp[.]umcship-tw[.]com`	1

Files and or directories created	Occurrences
`%APPDATA%\pid.txt`	8
`%APPDATA%\pidloc.txt`	8
`%TEMP%\holdermail.txt`	8
`%TEMP%\holderwb.txt`	8
`%TEMP%\<random, matching '[a-z]{3}[A-F0-9]{3,4}'>.tmp`	8
`%APPDATA%\D282E1`	6
`%APPDATA%\D282E1\1E80C5.lck`	6
`%APPDATA%\WindowsUpdate.exe`	6
`%TEMP%\subfolder`	1
`%TEMP%\subfolder\filename.exe`	1
`%TEMP%\subfolder\filename.vbs`	1

File Hashes

             1cb99e6bb3f83d21bc06877531beb9bc652e311a5e49747062bbef5c5501cc70              2701a8daf4384bd6842ef6bb2bfc4c0418b204dfce07ef69b251a2c5de593e01              4688f2885e00eea958abbc479e875708c6e9f2347cb9ef5af4e8881c9b3b8439              525dae4004eed37854b1a6ce2046280a3c1d14f9d79c34447a6bf297d3313dca              6ac5e9684bd5bad7070d674da4786eee6827f5d88bd076aa0dc7f7d734d666e3              7036562647bece05ea15c2b3bea5ab4b40c3a965a5272d3a24dcb7af8930d8a5              75f3b9c29533c3b67b040a211d9acc2860ce3f224200d5985b69319210478fb4              7d494230588aedf9bb8700105b6c5cf2383efa5dda79daa3752f9f13b92dad2c              a306d0e9ba34a447d09b932a9ab125406872672212534e9aeb3a9d81338ff4d0              af7ff1a7242dbd0d142c03bfe23fd84f24b5dce494cca6545a6409548ae09c9e              c24a1e52447710a56f0e1de99401197fd2abebaa15c18de7aa0fa9548d7b15c5              c79783e0d3330fc51bcc92714e8663234c7443ad9245046a5072685c9fa6a86f              ceec143cb503f31efadadc2ca82cb74d52b08566ddde6bcba26da248d0fadb20              e52e3ffeb93c7794f2631ee2d9ac0dace29c1be8b4e0723db344879b23e9cfe4

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Exploit Prevention

Cisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits. These exploits use certain features to bypass typical anti-virus software, but were blocked by AMP thanks to its advanced scanning capabilities, even protecting against zero-day vulnerabilities.

CVE-2019-0708 detected - (24210)

An attempt to exploit CVE-2019-0708 has been detected. The vulnerability, dubbed BlueKeep, is a heap memory corruption which can be triggered by sending a specially crafted Remote Desktop Protocol (RDP) request. Since this vulnerability can be triggered without authentication and allows remote code execution, it can be used by worms to spread automatically without human interaction.

Process hollowing detected - (295)

Process hollowing is a technique used by some programs to avoid static analysis. In typical usage, a process is started and its obfuscated or encrypted contents are unpacked into memory. The parent then manually sets up the first stages of launching a child process, but before launching it, the memory is cleared and filled in with the memory from the parent instead.

Kovter injection detected - (161)

A process was injected into, most likely by an existing Kovter infection. Kovter is a click fraud Trojan that can also act as an information stealer. Kovter is also file-less malware meaning the malicious DLL is stored inside Windows registry and injected directly into memory using PowerShell. It can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2. It spreads through malicious advertising and spam campaigns.

Gamarue malware detected - (143)

Gamarue is a family of malware that can download files and steal information from an infected system. Worm variants of the Gamarue family may spread by infecting USB drives or portable hard disks that have been plugged into a compromised system.

Installcore adware detected - (112)

Install core is an installer which bundles legitimate applications with offers for additional third-party applications that may be unwanted. The unwanted applications are often adware that display advertising in the form of popups or by injecting into browsers and adding or altering advertisements on webpages. Adware is known to sometimes download and install malware.

Dealply adware detected - (98)

DealPly is adware, which claims to improve your online shopping experience. It is often bundled into other legitimate installers and is difficult to uninstall. It creates pop-up advertisements and injects advertisements on webpages. Adware has also been known to download and install malware.

Excessively long PowerShell command detected - (89)

A PowerShell command with a very long command line argument that may indicate an obfuscated script has been detected. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.

Special Search Offer adware - (45)

Special Search Offer adware displays unwanted advertising in the form of popups or by injecting into browsers and altering advertisements on webpages. Adware has also been known to download and install malware.

Reverse http payload detected - (26)

An exploit payload intended to connect back to an attacker controlled host using http has been detected.

Corebot malware detected - (25)

Corebot is a Trojan with many capabilities found in other prominent families. It features a plugin system to enable it to load a variety of features from the C&C server at any time. Known plugins include RAT capabilities such as taking desktop screenshots, as well as being able to intercept and modify browser communications and steal data, especially data related to banking.

↧

Cisco ASA DoS bug attacked in wild

December 20, 2019, 11:33 am

≫ Next: Vulnerability Spotlight: Two buffer overflow vulnerabilities in OpenCV

≪ Previous: Threat Roundup for December 13 to December 20

By Nick Biasini.

Cisco Talos has recently noticed a sudden spike in exploitation attempts against a specific vulnerability in our Cisco Adaptive Security Appliance (ASA) and Firepower Appliance. The vulnerability, CVE-2018-0296, is a denial-of-service and information disclosure directory traversal bug found in the web framework of the appliance. The attacker can use a specially crafted URL to cause the ASA appliance to reboot or disclose unauthenticated information.

This vulnerability was first noticed being exploited publicly back in June 2018, but it appeared to increase in frequency in the past several days and weeks. As such, we are advising all customers to ensure they are running a non-affected version of code. Additionally, we want to highlight that there is a Snort signature in place to detect this specific attack (46897). Concerned customers should ensure it is enabled in applicable policies that could detect this exploitation attempt.

Am I vulnerable?

Since this vulnerability lies in the web framework of the ASA/Firepower, not all appliances are affected. If an administrator wants to determine if they are vulnerable, there are a couple of commands that can be run to determine your risk. First, run the following command:

show asp table socket | include SSL|DTLS

If the command shows any listening sockets, then the potential for exploitation exists. The next step is to determine if the vulnerable process is running. That can be achieved by running the following command:

show processes | include Unicorn

If the process is shown as running, the likelihood of a vulnerability existing is elevated and the administrator should validate the running version of code on the appliance to determine if it is one of the affected versions listed in the advisory. If it is listed, then updating to a non-affected version is the most effective mitigation.

Conclusion

This isn't a new vulnerability, but as exploitation continues to increase, customers need to be aware of the risk of both a denial-of-service or unauthenticated information disclosure. Additionally, as we head into the holidays, people take time off, but adversaries do not. Customers should validate if they are vulnerable as soon as possible and plan the appropriate patching/mitigations strategies as necessary to minimize both risk and impact to the organization.

↧

Vulnerability Spotlight: Two buffer overflow vulnerabilities in OpenCV

January 2, 2020, 2:44 pm

≫ Next: Beers with Talos Ep. #69: 2019 Threat Recap - RATs, Turtles, and Worms, Oh My!

≪ Previous: Cisco ASA DoS bug attacked in wild

Dave McDaniel of Cisco Talos discovered these vulnerabilities.

Cisco Talos recently discovered two buffer overflow vulnerabilities in the OpenCV libraries. An attacker could potentially exploit these bugs to cause heap corruptions and potentially code execution. Intel Research originally developed OpenCV in 1999, but it is currently maintained by the non-profit organization OpenCV.org.

OpenCV is used for numerous applications, including facial recognition technology, robotics, motion tracking and various machine learning programs.

In accordance with our coordinated disclosure policy, Cisco Talos worked with OpenCV to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

OpenCV XML persistence parser buffer overflow vulnerability (TALOS-2019-0852/CVE-2019-5063)

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0. A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file to trigger this vulnerability.

Read the complete vulnerability advisory here for additional information.

OpenCV JSON persistence parser buffer overflow vulnerability (TALOS-2019-0853/CVE-2019-5064)

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, version 4.1.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that version OpenCV, version 4.1.0 is affected by these vulnerabilities.

Coverage

The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rules: 50774, 50775

↧

Beers with Talos Ep. #69: 2019 Threat Recap - RATs, Turtles, and Worms, Oh My!

January 6, 2020, 3:00 pm

≫ Next: Continued Escalation of Tensions in the Middle East

≪ Previous: Vulnerability Spotlight: Two buffer overflow vulnerabilities in OpenCV

By Mitch Neff.

Beers with Talos (BWT) Podcast episode No. 69 is now available. Download this episode and subscribe to Beers with Talos:

If iTunes and Google Play aren't your thing, click here.

Recorded Dec. 20, 2019

In a shorter year-end EP, we take both a look back and a look forward. It seems everyone else wants to break out the crystal ball this time of year and prognosticate the coming year’s threat landscape. We don’t have one of those, so we used a Magic 8-ball, but we’re pretty confident the results are as-good or better. Most of this EP is dedicated to going through the notable security events of the past year. We take a look at the lasting effects and lessons learned from 2019’s biggest threats.

The timeline:

00:50 — Roundtable - Security Fortune Telling. Break out the magic 8-ball!
05:50 — Old ASA bug resurfaces, apply the patch from 2018 please.
09:00 — 2019 notable security events: RATs, and sea turtles, and blue worms, oh my!
34:40 — Closing thoughts and parting shots

Some other links:

==========

Featuring: Craig Williams (@Security_Craig), Joel Esler (@JoelEsler), and Nigel Houghton (@EnglishLFC).
Hosted by Mitch Neff (@MitchNeff)

Subscribe via iTunes (and leave a review!)

Check out the Talos Threat Research Blog

Subscribe to the Threat Source newsletter

Follow Talos on Twitter

Give us your feedback and suggestions for topics: beerswithtalos@cisco.com

↧

Continued Escalation of Tensions in the Middle East

January 8, 2020, 2:50 pm

≫ Next: Vulnerability Spotlight: Remote code execution vulnerability in E2fsprogs

≪ Previous: Beers with Talos Ep. #69: 2019 Threat Recap - RATs, Turtles, and Worms, Oh My!

Cisco Talos works with many organizations around the world, monitoring and protecting against sophisticated threats every day. As such, we are watching the current state of events in the Middle East very closely for our customers and partners who may be impacted by the ongoing situation. We are continuing to evaluate potential threats and attack vectors, especially related to critical infrastructure and high-profile businesses and industries.

A challenge with protecting against state-sponsored campaigns is that the primary and ideal targets are potentially already compromised, either by a specific adversary or their allies who would be amenable to acting on their behalf. In previous research, Talos has observed footholds like this that can go undetected for extended periods, waiting to be modified remotely to exact a variety of potential malicious activities.

It may be difficult for primary target organizations to detect activity and defend themselves at the perimeter. Hopefully, they have employed a layered defense, which should include two-factor authentication, network segmentation and endpoint protection.

Of course, the potential also exists for the adversary to move away from a targeted maneuver to more broadly focused disruptions that could incorporate a much wider array of businesses and even consumers. This means that everyone should view this as a wake-up call — shore up defenses, update/patch your devices and focus on cyber hygiene. Employ authentication everywhere, beware of suspicious links, emails, etc. — phishing/credential theft continues to be popular among attackers. Every business should at least take a second look at every strange thing they see — don't ignore anomalous activities, take the time to see if there is something nefarious at the end of the tunnel.

While prior campaigns in the region have heavily relied on wiper malware, this is no guarantee that future campaigns will continue this trend. At times like this, vigilance is key.

Campaigns

According to US-Cert, Iran has been an active adversary since late 2011 and has been responsible for a series of attacks including some large-scale d istributed denial-of-service attacks against financial institutions, infiltration of a dam in New York state, and the destructive attacks against targets regionally and globally, including the large-scale Shamoon campaigns and the recent ZeroCleare wipers. They have also conducted a series of espionage campaigns against universities and companies to steal research, proprietary data, and intellectual property.

Additionally, Talos has found several large-scale campaigns based in the region that have included attacks against DNS infrastructure and those leveraging watering hole and social engineering techniques. Since the actors are active in the region DNSpionage, Muddywater, and Tortoiseshell will be included in the coverage list below.

The breadth and variety of both the attacks and the techniques shows the capabilities of the adversary. Apt33/34 Actors have not only attack traditional targets for espionage but have shown an interest in attacking critical infrastructure with the dam attack and have shown a willingness to be destructive in their activities. Actors in the region have also shown a willingness to attack some of the critical components of the internet, most notably DNS. These things combined make for a dangerous adversary that is operating during heightened tensions. As such we are providing a list of the ways that we cover these various attacks and a series of IOCs for organizations to be aware.

In-the-wild activities

We are continually assessing the threat landscape and the activities and actors currently operating. Based on the indicators we have been analyzing our telemetry sources to see if we have noticed any noticeable increases in activity that could be attributable to middle eastern actors. At this point, we do not have any indication that these activities have increased. However, this is an ongoing investigation and this could change at any moment.

Part of the process involved leveraging the mapping US-CERT had undertaken linking the APTs tactics, techniques, and procedures (TTPs) to the associated techniques on the MITRE ATT&CK™ matrix. Keep in mind these are generic techniques not associated with a single actor or nation state. Those organizations that have incorporated the ATT&CK framework should be able to map these techniques to the mitigation and detection strategies already in place. The techniques are listed below, for more details on the way that Cisco Talos maps related Mitre ATT&CK techniques to Cisco detection technologies, see this document.

Coverage

Additional ways our customers can detect and block this threat are listed below, please note that at the bottom of this document there is a more specific list of signatures and IOCs associated with campaigns and are labeled accordingly.

Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors. Exploit Prevention present within AMP is designed to protect customers from unknown attacks such as this automatically.

Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), and Meraki MX can detect malicious activity associated with this threat.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

ZeroCleare
Snort
52572-52581

ClamAV
Win.Malware.ZeroCleare*

SCAR Trojan
ClamAV
Win.Trojan.Scar-7509404-0
Win.Trojan.Scar-7509405-0

MagicHound malware
Snort
Sids: 36579, 36580, 41656 - 41659

ClamAV
Win.Trojan.MagicHound-5859368-0
Win.Trojan.MagicHound-5859367-0
Doc.Dropper.MagicHound-5859115-0
Doc.Dropper.MagicHound-5859369-0
Win.Trojan.MagicHound-5859366-0
Win.Trojan.MagicHound-5859365-0

Shamoon
Snort
23903, 23893, 23905 - 23933, 24127, 40906

ClamAV
Win.Dropper.DistTrack-*
Win.Trojan.DistTrack.*
Win.Malware.DistTrack.*

ThreatGrid
Shamoon Malware Detected

AMP Cloud IOCs
W32.Shamoon.ioc
W32.RawDiskDriverUse.ioc

CVE-2018-20250
Snort
49289 - 49292

ClamAV
Win.Exploit.CVE_2018_20250-6869547-0
Win.Exploit.CVE_2018_20250-6869546-1

Tortoiseshell
ClamAV
Win.Dropper.Tortoiseshell*
Win.Trojan.Tortoiseshell*

DNSpionage
Snort
48444, 48445, 50348 - 50355

ClamAV
Xls.Dropper.DNSpionage-6773417-0
Win.Malware.DNSpionage-6759811-1
Win.Trojan.DNSpionage-6975387-0

MuddyWater/Blackwater
Snort
48859, 48860

ClamAV
Doc.Dropper.Agent-6935014-0
Doc.Dropper.Agent-6899904-0
Doc.Dropper.Agent-6961195-0
Doc.Dropper.Agent-6918391-0
Doc.Dropper.Agent-6964920-0
Doc.Dropper.Agent-6932616-0

MacDownloader
Snort
41661 - 41663

ClamAV
Osx.Downloader.MacDownloader-5781857-0

Other (Indicators Not Linked to Specific Campaigns)

ClamAV
Win.Trojan.Turnedup-6598671-1
Win.Trojan.Hacktool-6478864-0
Win.Trojan.Lazagne-6779429-0
Rtf.Exploit.CVE_2017_11882-6584355-0

Indicators of Compromise (IOCs)

Hashes and Associated Campaigns:

WateringHole
afa563221aac89f96c383f9f9f4ef81d82c69419f124a80b7f4a8c437d83ce77
7651f0d886e1c1054eb716352468ec6aedab06ed61e1eebd02bca4efbb974fb6
9e5ab438deb327e26266c27891b3573c302113b8d239abc7f9aaa7eff9c4f7bb
8c8496390c3ad048f2a0a4031edfcdac819ee840d32951b9a1a9337a2dcbea25
5fe0e156a308b48fb2f9577ed3e3b09768976fdd99f6b2d2db5658b138676902
acf24620e544f79e55fd8ae6022e040257b60b33cf474c37f2877c39fbf2308a
7e3c9323be2898d92666df33eb6e73a46c28e8e34630a2bd1db96aeb39586aeb
165f8db9c6e2ca79260b159b4618a496e1ed6730d800798d51d38f07b3653952
55f513d0d8e1fd41b1417a0eb2afff3a039a9529571196dd7882d1251ab1f9bc
bff115d5fb4fd8a395d158fb18175d1d183c8869d54624c706ee48a1180b2361
2df6fe9812796605d4696773c91ad84c4c315df7df9cf78bee5864822b1074c9
8f6f7416cfdf8d500d6c3dcb33c4f4c9e1cd33998c957fea77fbd50471faec88
4442c48dd314a04ba4df046dfe43c9ea1d229ef8814e4d3195afa9624682d763
02f2c896287bc6a71275e8ebe311630557800081862a56a3c22c143f2f3142bd

Win.Dropper.Distrack/ZeroCleare
36a4e35abf2217887e97041e3e0b17483aa4d2c1aee6feadd48ef448bf1b9e6c
2a2a32a7e820e4a15abc96491cb3345161e189d6eaf02b62e2f86aac2c7d6c3d
cf3a7d4285d65bf8688215407bce1b51d7c6b22497f09021f0fce31cbeb78986
2fc39463b6db44873c9c07724ac28b63cdd72f5863a4a7064883e3afdd141f8d

W32.Disttrack/Shamoon

5a2f540018ca7c012a5d674bd929a0f38bf458043d4eeade1e2cdef94aab5eb8
b1c061138ba0cf34ba1dfb84e8ca89336d2a530808b42c363a69abfd6db8bf2a
052f0eb5986e92afc5460eafec293f805851cf2a98bdd2d2aed97eec6c7946a9
448ad1bc06ea26f4709159f72ed70ca199ff2176182619afa03435d38cd53237
735bf8c41e876a82815479f1e22155d0a2a47724b6f3d912c0bb995d10f8bcd9
7c7ff63898d59522bed1e4f0f7bd43a92a3167d66593628e040e36f90bfb2e5d
cd3d50629f0ed6b0ffeddd98b8cde57a6d00ec4b7f930f12ae7c0a980a9e9a00
f1710c802ce590bc737eda6d1845f390a7e7d2cf43313c3362768c5f9f94a807
4f02a9fcd2deb3936ede8ff009bd08662bdb1f365c0f4a78b3757a98c2f40400
61e8f2af61f15288f2364939a30231b8915cdc57717179441468690ac32ced54
7b589d45825c096d42bdf341193d3fd8fd9a0bd612a6ebd7466c26a753304df9
1982c011cdea5520a73ea610f46a243ccd768de87c8df4c428ead79840c38bf4
57fb0ec1eb292956a8d5031d6c2d1369acf5745b94a776aa6957e701003078d6
f9d94c5de86aa170384f1e2e71d95ec373536899cb7985633d3ecfdb67af0f72
ef35a54290d96871a860f80a789460ab10e91844a5184489c96a97b810768d29
cebdf768721473789ebe2fe79ffec7c6de0c52433b40fd02e57747f194fe0e80
7709da093dd9722e80c7c552a0935876b8d17ccf9ecc4784cffb1c1bc38dd9c0
c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a
66fdb7e7d868346e730113ccb9977ca840c4c337434b5fe517f7b1a858fd8317
7076c1d5c8a56820d87681754880013771fcd743a8e8bae8509e1dc682f82a5b
01e860972e621c1bd6c990d1817ebc0309dd9298f0e0819cc14d2ffcaa1820e7
a37b8d77fdbd740d7d214f88521adec17c0d30171ec0dee1372cb8908390c093
9979678be7b89a9f01c2481ea6f420417e67572f52aad66ae4ccce3c65a7b504
128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd
788aca28addbdf2588b160a9471f7421e402f4c6b74dd303a7997be83c9c8768
5902a246ea00defd6371126b352bc3e13432cee18fef427f2ee40a6e0ba995eb
25a3497d69604baf4be4d80b6824c06f1b7120144f98eeb0a13d57d6f72eb8e9
47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34
dbdea08e7b970d395236b8e0aada6fc07fb23e6181485d86f65da1e73ab2ba2e
394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b
04ffee9e574ae7aea7963d1f7e7dd9f9851487a743db8c86a866db7cb1b2f4d8
8cccb478de2c92b548f9976799f1b4da1bd8d6f1c821e7b0479b914939560310
d56dbe26887a4bef9b2c8f0d05f4502b80083e62ba3c7299c02e01b9eefeb2e4
4919436d87d224f083c77228b48dadfc153ee7ad48dd7d22f0ba0d5090b5cf9b
5475f35363e2f4b70d4367554f1691f3f849fb68570be1a580f33f98e7e4df4a
c7f937375e8b21dca10ea125e644133de3afc7766a8ca4fc8376470277832d95
c3ab58b3154e5f5101ba74fccfd27a9ab445e41262cdf47e8cc3be7416a5904f
bd2097055380b96c62f39e1160d260122551fa50d1eccdc70390958af56ac003
0694bdf9f08e4f4a09d13b7b5a68c0148ceb3fcc79442f4db2aa19dd23681afe
0975eb436fb4adb9077c8e99ea6d34746807bc83a228b17d321d14dfbbe80b03
391e7b90bf3f0bfeb2c2602cc65aa6be4dd1c01374b89c4a48425f2d22fe231c
ccb1209122085bed5bded3f923835a65d3cc1071f7e4ad52bc5cf42057dd2150
dab3308ab60d0d8acb3611bf364e81b63cfb6b4c1783864ebc515297e2297589
ee084f2c6fd2cc16f613fadd712641b5742489ca87851739dc868b976867858f
36414012564b88b5a2dcded39fc5ed22301ea2ef2f455bf697fa97a5925cb721
101e74ef7a18d3a790f1d30edc7bd9f4ebf0afb2cb85cffcd5710d0a53df77a6
4d4531f0372d4364e3d9b7e6ea13abf241bbc4a4b761f8a2aea67428d0de8d83

w32.Dropper/Filerase
35ceb84403efa728950d2cc8acb571c61d3a90decaf8b1f2979eaf13811c146b
5203628a89e0a7d9f27757b347118250f5aa6d0685d156e375b6945c8c05eb8a
d9e52663715902e9ec51a7dd2fea5241c9714976e9541c02df66d1a42a3a7d2a
2abc567b505d0678954603dcb13c438b8f44092cfe3f15713148ca459d41c63f

DNSpionage
9ea577a4b3faaf04a3bddbfcb934c9752bed0d0fc579f2152751c5f6923f7e14
15fe5dbcd31be15f98aa9ba18755ee6264a26f5ea0877730b00ca0646d0f25fa
2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec
82285b6743cc5e3545d8e67740a4d04c5aed138d9f31d7c16bd11188a2042969
45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff

Tortoiseshell
c121f97a43f4613d0a29f31ef2e307337fa0f6d4f4eee651ee4f41a3df24b6b5
2a9589538c563c006eaf4f9217a192e8a34a1b371a31c61330ce2b396b67fd10
55b0708fed0684ce8fd038d4701cc321fe7b81def7f1b523acc46b6f9774cb7b
ec71068481c29571122b2f6db1f8dc3b08d919a7f710f4829a07fb4195b52fac
51d186c16cc609ddb67bd4f3ecd09ef3566cb04894f0496f7b01f356ae260424
41db45b0c51b98713bc526452eef26074d034b2c9ec159b44528ad4735d14f4a
78e1f53730ae265a7eb00b65fbb1304bbe4328ee5b7f7ac51799f19584b8b9d4
46873290f58c25845b21ce7e560eae1b1d89000e887c2ff2976d931672390dd8
f31b5e14314388903a32eaa68357b8a5d07cbe6731b0bd97d2ee33ac67ea8817
f1c05ff306e941322a38fffb21dfdb5f81c42a00a118217b9d4e9807743d7275
1848f51d946fa8b348db8ef945a1ebff33ff76803ad26dfd175d9ea2aa56c7d0
ed150d9f6e12b6d669bcede3b7dc2026b7161f875edf26c93296e8c6e99152d5
2682328bde4c91637e88201eda5f5c400a3b3c0bdb87438d35660494feff55cf
e82a08f1514ccf38b3ae6b79e67d7605cb20b8377206fbdc44ddadfb06ae4d0d

Muddywater/Blackwater
0f3cabc7f1e69d4a09856cc0135f7945850c1eb6aeecd010f788b3b8b4d91cad
9d998502c3999c4715c880882efa409c39dd6f7e4d8725c2763a30fbb55414b7
0d3e0c26f7f53dff444a37758b414720286f92da55e33ca0e69edc3c7f040ce2
A3bb6b3872dd7f0812231a480881d4d818d2dea7d2c8baed858b20cb318da981
6f882cc0cddd03bc123c8544c4b1c8b9267f4143936964a128aa63762e582aad
Bef9051bb6e85d94c4cfc4e03359b31584be027e87758483e3b1e65d389483e6
4dd641df0f47cb7655032113343d53c0e7180d42e3549d08eb7cb83296b22f60
576d1d98d8669df624219d28abcbb2be0080272fa57bf7a637e2a9a669e37acf
062a8728e7fcf2ff453efc56da60631c738d9cd6853d8701818f18a4e77f8717

Domains:

Note that these domains were associated with previous, historical campaigns
hxxp[:]//intelchip[.]org
hxxp[:]//windowskernel[.]in
hxxp[:]//nameserver[.]win
hxxp[:]//cloudflare-analyse[.]xyz
hxxp[:]//nasr[.]xyz
hxxp[:]//winupdate64[.]com
hxxp[:]//githubapp[.]online
hxxp[:]//clalit[.]press
hxxp[:]//cloud-analyzer[.]com
hxxp[:]//labs-cloudfront[.]com
hxxp[:]//winupdate64[.]us
hxxp[:]//alkamaihd[.]net
hxxp[:]//fbcdn[.]bid
hxxp[:]//onlinewebcam[.]press
hxxp[:]//cachevideo[.]xyz
hxxp[:]//mswordupdate16[.]com
hxxp[:]//digicert[.]xyz
hxxp[:]//fbstatic-akamaihd[.]com
hxxp[:]//js[.]jguery[.]online
hxxp[:]//ssl-gstatic[.]online
hxxp[:]//trendmicro[.]tech
hxxp[:]//cloudflare[.]news
hxxp[:]//windowkernel[.]com
hxxp[:]//cloudflare-statics[.]com
hxxp[:]//mcafeemonitoring[.]com
hxxp[:]//cortana-search[.]com
hxxp[:]//jguery[.]online
hxxp[:]//sdlc-esd-oracle[.]online
hxxp[:]//cloudmicrosoft[.]net
hxxp[:]//outlook360[.]net
hxxp[:]//windowskernel[.]com
hxxp[:]//mswordupdate17[.]com
hxxp[:]//fb-statics[.]com
hxxp[:]//symcd[.]site
hxxp[:]//patchthiswindows[.]com
hxxp[:]//digicert[.]space
hxxp[:]//kernel4windows[.]in
hxxp[:]//updatedrivers[.]org
hxxp[:]//dnsserv[.]host
hxxp[:]//alkamaihd[.]com
hxxp[:]//un-webmail[.]com
hxxp[:]//intel-api[.]com
hxxp[:]//windowslayer[.]in
hxxp[:]//tehila[.]global
hxxp[:]//chromeupdates[.]online
hxxp[:]//officeapps-live[.]net
hxxp[:]//tehila[.]info
hxxp[:]//ipresolver[.]org
hxxp[:]//microsoft-security[.]host
hxxp[:]//patch7-windows[.]com
hxxp[:]//winupdate64[.]net
hxxp[:]//britishnews[.]press
hxxp[:]//gmailtagmanager[.]com
hxxp[:]//hamedia[.]xyz
hxxp[:]//tehila[.]co
hxxp[:]//1e100[.]tech
hxxp[:]//twiter-statics[.]info
hxxp[:]//githubapp[.]tech
hxxp[:]//windefender[.]org
hxxp[:]//cloudflare-analyse[.]com
hxxp[:]//officeapps-live[.]org
hxxp[:]//cloudflare[.]site
hxxp[:]//win-updates[.]com
hxxp[:]//nsserver[.]host
hxxp[:]//windowkernel14[.]com
hxxp[:]//static[.]news
hxxp[:]//cissco[.]net
hxxp[:]//windowskernel[.]net
hxxp[:]//patch8-windows[.]com
hxxp[:]//microsoft-tool[.]com
hxxp[:]//outlook360[.]org
hxxp[:]//owa-microsoft[.]online
hxxp[:]//google-api-update[.]com
hxxp[:]//broadcast-microsoft[.]tech
hxxp[:]//microsoft-ds[.]com
hxxp[:]//micro-windows[.]in
hxxp[:]//fbstatic-a[.]space
hxxp[:]//githubusecontent[.]tech
hxxp[:]//hotseller[.]info
hxxp[:]//digicert[.]online
hxxp[:]//cachevideo[.]online
hxxp[:]//fbstatic-a[.]xyz
hxxp[:]//officeapps-live[.]com
hxxp[:]//windows-10patch[.]in
hxxp[:]//winupdate64[.]org
hxxp[:]//akamai[.]press
hxxp[:]//azurewebsites[.]tech
hxxp[:]//windowssup[.]in
hxxp[:]//mswordupdate15[.]com
hxxp[:]//big-windowss[.]com
hxxp[:]//newsfeeds-microsoft[.]press
hxxp[:]//walla[.]press
hxxp[:]//cachevideo[.]com
hxxp[:]//windows24-kernel[.]in
hxxp[:]//ads-youtube[.]tech
hxxp[:]//windowskernel14[.]com
hxxp[:]//mssqlupdate[.]com
hxxp[:]//mcafee-analyzer[.]com
hxxp[:]//winfeedback[.]net
hxxp[:]//sphotos-b[.]bid
hxxp[:]//mpmicrosoft[.]com
hxxp[:]//1m100[.]tech
hxxp[:]//twiter-statics[.]com
hxxp[:]//chromium[.]online
hxxp[:]//mywindows24[.]in
hxxp[:]//sphotos-b[.]pw
hxxp[:]//fbexternal-a[.]pw
hxxp[:]//tehila[.]press
hxxp[:]//fdgdsg[.]xyz
hxxp[:]//elasticbeanstalk[.]tech
hxxp[:]//akamaitechnology[.]com
hxxp[:]//google-api-analyse[.]com
hxxp[:]//sharepoint-microsoft[.]co
hxxp[:]//windows-kernel[.]in
hxxp[:]//myservers[.]site
hxxp[:]//win-api[.]com
hxxp[:]//symcd[.]xyz
hxxp[:]//win-update[.]com
hxxp[:]//windows-api[.]com
hxxp[:]//ads-youtube[.]online
hxxp[:]//windows-drive20[.]com
hxxp[:]//jguery[.]net
hxxp[:]//fb-nameserver[.]com
hxxp[:]//f-tqn[.]com
hxxp[:]//qoldenlines[.]net
hxxp[:]//fb-statics[.]info
hxxp[:]//microsoftserver[.]org
hxxp[:]//mcafee-monitoring[.]com
hxxp[:]//akamaitechnology[.]tech
hxxp[:]//fbexternal-a[.]press
hxxp[:]//ssl-gstatic[.]net
hxxp[:]//ads-youtube[.]net
hxxp[:]//windowsupup[.]com
hxxp[:]//javaupdator[.]com
hxxp[:]//windows-india[.]in

IP Addresses:

Note that these IP Addresses were associated with previous, historical campaigns
206[.]221[.]181[.]253
66[.]55[.]152[.]164
68[.]232[.]180[.]122
173[.]244[.]173[.]11
173[.]244[.]173[.]12
173[.]244[.]173[.]13
209[.]190[.]20[.]149
209[.]190[.]20[.]59
209[.]190[.]20[.]62
209[.]51[.]199[.]116
38[.]130[.]75[.]20
185[.]92[.]73[.]194
144[.]168[.]45[.]126
198[.]55[.]107[.]164
104[.]200[.]128[.]126
104[.]200[.]128[.]161
104[.]200[.]128[.]173
104[.]200[.]128[.]183
104[.]200[.]128[.]184
104[.]200[.]128[.]185
104[.]200[.]128[.]187
104[.]200[.]128[.]195
104[.]200[.]128[.]196
104[.]200[.]128[.]198
104[.]200[.]128[.]205
104[.]200[.]128[.]206
104[.]200[.]128[.]208
104[.]200[.]128[.]209
104[.]200[.]128[.]48
104[.]200[.]128[.]58
104[.]200[.]128[.]64
104[.]200[.]128[.]71
107[.]181[.]160[.]138
107[.]181[.]160[.]178
107[.]181[.]160[.]194
107[.]181[.]160[.]195
107[.]181[.]161[.]141
107[.]181[.]174[.]21
107[.]181[.]174[.]228
107[.]181[.]174[.]232
107[.]181[.]174[.]241
188[.]120[.]224[.]198
188[.]120[.]228[.]172
188[.]120[.]242[.]93
188[.]120[.]243[.]11
188[.]120[.]247[.]151
62[.]109[.]2[.]52
188[.]120[.]232[.]157
185[.]118[.]65[.]230
185[.]118[.]66[.]114
141[.]105[.]67[.]58
141[.]105[.]68[.]25
141[.]105[.]68[.]26
141[.]105[.]68[.]29
141[.]105[.]69[.]69
141[.]105[.]69[.]70
141[.]105[.]69[.]77
31[.]192[.]105[.]16
31[.]192[.]105[.]17
31[.]192[.]105[.]28
146[.]0[.]73[.]109
146[.]0[.]73[.]110
146[.]0[.]73[.]111
146[.]0[.]73[.]112
146[.]0[.]73[.]114
217[.]12[.]201[.]240
217[.]12[.]218[.]242
5[.]34[.]180[.]252
5[.]34[.]181[.]13
86[.]105[.]18[.]5
93[.]190[.]138[.]137
212[.]199[.]61[.]51
80[.]179[.]42[.]37
80[.]179[.]42[.]44
176[.]31[.]18[.]29
188[.]165[.]69[.]39
51[.]254[.]76[.]54
158[.]69[.]150[.]163
192[.]99[.]242[.]212
198[.]50[.]214[.]62

↧

Vulnerability Spotlight: Remote code execution vulnerability in E2fsprogs

January 9, 2020, 9:58 am

≫ Next: Threat Source newsletter (Jan. 9, 2019)

≪ Previous: Continued Escalation of Tensions in the Middle East

Lilith [^_^] of Cisco Talos discovered this vulnerability.

E2fsprogs contains an exploitable remote code execution vulnerability in its directory rehashing functionality. This set of programs is often considered essential software for many Linux and Unix

machines and ships by default on most Linux systems. An attacker could exploit this vulnerability by causing an out-of-bounds write on the stack, which would then allow them to execute remote code on the victim machine.

In accordance with our coordinated disclosure policy, Cisco Talos worked with E2fsprogs to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

E2fsprogs e2fsck rehash.c mutate_name() code execution vulnerability (TALOS-2019-0973/CVE-2019-5188)

A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that versions 1.43.3 - 1.45.3 of E2fsprogs are affected by this vulnerability.

Coverage

Snort Rules: 52570, 52571

↧

Threat Source newsletter (Jan. 9, 2019)

January 9, 2020, 11:00 am

≫ Next: Threat Roundup for January 3 to January 10

≪ Previous: Vulnerability Spotlight: Remote code execution vulnerability in E2fsprogs

Newsletter compiled by Jon Munshaw.

Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.

We’re back after a long break for the holidays. And 2020 is already off to a fast start as tensions continue to rise in the Middle East.

We’ve gotten a lot of questions about whether customers and users should be concerned about cyber attacks from Iran after they’ve exchanged missile strikes with the U.S. But the reality of the situation is, if you haven’t already been preparing from attacks for state-sponsored actors, it’s already too late. We run down our thoughts on the situation here.

We also have our first Beers with Talos episode of the new year out, where the guys run down the top threats of 2019 and talk about what lessons we learned.

Upcoming public engagements

Event: Talos Insights: The State of Cyber Security at Cisco Live at Cisco Live Barcelona
Location: Fira Barcelona, Barcelona, Spain
Date: Jan. 27 - 31
Speakers: Warren Mercer
Synopsis: Cisco Talos specializes in early-warning intelligence and threat analysis necessary for maintaining a secure network. We are responsible for defending networks realize that the security threat landscape is constantly in flux as attackers evolve their skills. Talos advances the overall efficacy of all Cisco security platforms by aggregating data, cooperating with teams of security experts, and applying the cutting-edge big data technology to security. In this talk we will perform deep analysis of recent threats and see how Talos leverages large datasets to deliver product improvements and mitigation strategies.

Cyber Security Week in Review

The U.S. Department of Homeland Security issued a warning this week asking American organizations to prepare for potential cyber attacks from Iran. State-sponsored actors from the region were expected to respond after the U.S. killed a high-profile Iranian general in a drone strike.
Even though the U.S. and Iran seemed to walk back from their threats of physical retaliation against one another Wednesday, the threat of a cyber attack still lingers. Many researchers are using this discussion as an opportunity to remind defenders that a proxy cyber war has been raging for years between the two countries.
International currency exchange marketplace Travelex is still recovering from a ransomware attack earlier this month. The attackers, believed to be Sodinokibi, have requested a $6 million extortion payment.
The city of Las Vegas says it successfully thwarted a cyber attack that could have shut down many of its government operations. Officials said they first detected an intrusion on Jan. 7 and removed the malware before any damage could be done.
Mozilla released an emergency update for the Firefox web browser that fixes a bug attackers were exploiting in the wild. CVE-2019-17026 is a type confusion vulnerability that could allow an attacker to write data to or from memory locations that are normally closed off.
The popular social media app TikTok puts users at risk of having their accounts completely taken over with just an SMS message. A chain of vulnerabilities could allow an attacker to infect a user’s mobile device, then gain access to the user’s TikTok account and remove, add or edit videos.
California’s privacy law went into effect at the start of the new year, leaving many massive companies scrambling to clean up some of their privacy policies. Under the new law, a user may ask most major internet companies to disclose what personal information they store on the individual and how the company may profit off it.
A new update to Google Chrome is expected to cut down on notification spam. Chrome is changing its notifications API so the notifications are less intrusive, and to make it more difficult for cybercrime groups to exploit them.
The FBI is once again asking Apple to unlock iPhones for them. The agency is attempting to access the devices, which belonged to a man who committed a mass shooting at an American naval base.

Notable recent security issues

Title: Cisco patches dozen vulnerabilities in Data Center Network Manager
Description: Cisco released multiple security advisories last week announcing patches for 12 vulnerabilities in the Data Center Network Manager software. The software allows users to manage their Cisco switches and fabric extenders. Three of the vulnerabilities disclosed (CVE-2019-15975, CVE-2019-15976 and CVE-2019-15977) could allow an unauthenticated, remote attacker to bypass authentication and carry out a variety of malicious tasks with administrative privileges on an affected device.
Snort SIDs: 52530 - 52547

Title: Buffer overflow vulnerabilities in OpenCV
Description: Cisco Talos recently discovered two buffer overflow vulnerabilities in the OpenCV libraries. An attacker could potentially exploit these bugs to cause heap corruptions and potentially code execution. Intel Research originally developed OpenCV in 1999, but it is currently maintained by the non-profit organization OpenCV.org. OpenCV is used for numerous applications, including facial recognition technology, robotics, motion tracking and various machine learning programs.
Snort SIDs: 50774, 50775 (By Dave McDaniel)

Most prevalent malware files this week

SHA 256: d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81
MD5: 5142c721e7182065b299951a54d4fe80
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::1201

SHA 256:5fc600351bade74c2791fc526bca6bb606355cc65e5253f7f791254db58ee7fa
MD5: 121e1634bf18768802427f0a13f039a9
Typical Filename: AA_v3.exe
Claimed Product: Ammyy Admin
Detection Name: W32.SPR:Variant.22fn.1201

SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg

SHA 256: d8b594956ed54836817e38b365dafdc69aa7e07776f83dd0f706278def8ad2d1
MD5: 56f11ce9119632ba360e5b3dd0a89acd
Typical Filename: xme64-540.exe
Claimed Product: N/A
Detection Name: PUA.Win.Tool.Coinminer::100.sbx.tg

SHA 256:c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201

Keep up with all things Talos by following us on Twitter. Snort, ClamAV and Immunet also have their own accounts you can follow to keep up with their latest updates. You can also subscribe to the Beers with Talos podcast here (as well as on your favorite podcast app). And, if you’re not already, you can also subscribe to the weekly Threat Source newsletter here.

↧

Threat Roundup for January 3 to January 10

January 10, 2020, 1:41 pm

≫ Next: New Snort rules protect against recently discovered Citrix vulnerability

≪ Previous: Threat Source newsletter (Jan. 9, 2019)

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 3 and Jan. 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found herethat includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.
The most prevalent threats highlighted in this roundup are:

Threat Name	Type	Description
Win.Trojan.Razy-7505643-0	Trojan	Razy is oftentimes a generic detection name for a Windows trojan. It collects sensitive information from the infected host and encrypts the data, and sends it to a command and control (C2) server. Information collected might include screenshots. The samples modify auto-execute functionality by setting and creating a value in the registry for persistence.
Win.Dropper.Tofsee-7492214-1	Dropper	Tofsee is multi-purpose malware that features a number of modules used to carry out various activities such as sending spam messages, conducting click fraud, mining cryptocurrency, and more. Infected systems become part of the Tofsee spam botnet and are used to send large volumes of spam messages to infect additional systems and increase the overall size of the botnet.
Win.Packed.Ursnif-7489213-0	Packed	Ursnif is used to steal sensitive information from an infected host and can also act as a malware downloader. It is commonly spread through malicious emails or exploit kits.
Win.Packed.ZeroAccess-7489468-1	Packed	ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.
Win.Ransomware.TeslaCrypt-7501245-1	Ransomware	TeslaCrypt is a well-known ransomware family that encrypts a user's files with strong encryption and demands Bitcoin in exchange for a file decryption service. A flaw in the encryption algorithm was discovered that allowed files to be decrypted without paying the ransomware, and eventually, the malware developers released the master key allowing all encrypted files to be recovered easily.
Win.Dropper.Upatre-7491797-0	Dropper	Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.
Win.Dropper.TrickBot-7490964-0	Dropper	Trickbot is a banking trojan targeting sensitive information for certain financial institutions. This malware is frequently distributed through malicious spam campaigns. Many of these campaigns rely on downloaders for distribution, such as VB scripts.
Win.Packed.Formbook-7491272-1	Packed	Formbook is an information stealer that attempts to collect sensitive information from an infected machine by logging keystrokes, stealing saved web browser credentials, and monitoring information copied to the clipboard.

Threat Breakdown

Win.Trojan.Razy-7505643-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\75E0ABB6138512271C04F85FDDDE38E4B7242EFE Value Name: Blob`	11
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\SETTINGS\LEAKDIAGNOSISATTEMPTED`	7
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED Value Name: Hidden`	3
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\0748AF3992DE6E3AA7B386B7F6C08EF2.EXE`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\1C3DDA8020173A5B45A7C80CFC8B0298.EXE`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\0748AF3992DE6E3AA7B386B7F6C08EF2.EXE Value Name: LastDetectionTime`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\B4F3AEA9F95879ABBE9B311B5AB9FC30.EXE`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\2AA87EE2B7BAA7D413CC747537A867A2.EXE`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\1C3DDA8020173A5B45A7C80CFC8B0298.EXE Value Name: LastDetectionTime`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\EB9064AF85850CF7B3485B2A911798D7.EXE`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\B4F3AEA9F95879ABBE9B311B5AB9FC30.EXE Value Name: LastDetectionTime`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\2AA87EE2B7BAA7D413CC747537A867A2.EXE Value Name: LastDetectionTime`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\EB9064AF85850CF7B3485B2A911798D7.EXE Value Name: LastDetectionTime`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: goodsStartup key`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\6035E0F59A5169E7C59129A3CDBD076E.EXE`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\6035E0F59A5169E7C59129A3CDBD076E.EXE Value Name: LastDetectionTime`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: goods`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\0786B90DA12B29B5CC97621DCC78FA3E.EXE`	1
`<HKLM>\SOFTWARE\MICROSOFT\RADAR\HEAPLEAKDETECTION\DIAGNOSEDAPPLICATIONS\0786B90DA12B29B5CC97621DCC78FA3E.EXE Value Name: LastDetectionTime`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: mrke`	1

Mutexes	Occurrences
`Global\14c64321-2d62-11ea-a007-00501e3ae7b5`	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`172[.]217[.]12[.]206`	10
`172[.]217[.]9[.]225`	7
`172[.]217[.]5[.]238`	6
`104[.]16[.]155[.]36`	3
`77[.]88[.]21[.]158`	3
`172[.]217[.]10[.]46`	1
`172[.]217[.]10[.]33`	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`smtp[.]yandex[.]com`	3
`whatismyipaddress[.]com`	3
`doc-00-6c-docs[.]googleusercontent[.]com`	1
`doc-0s-9s-docs[.]googleusercontent[.]com`	1
`doc-14-60-docs[.]googleusercontent[.]com`	1
`doc-0k-c8-docs[.]googleusercontent[.]com`	1
`doc-00-5o-docs[.]googleusercontent[.]com`	1
`doc-10-6c-docs[.]googleusercontent[.]com`	1
`doc-04-bg-docs[.]googleusercontent[.]com`	1
`doc-04-6c-docs[.]googleusercontent[.]com`	1

Files and or directories created	Occurrences
`%APPDATA%\pid.txt`	3
`%APPDATA%\pidloc.txt`	3
`%TEMP%\holdermail.txt`	3
`%TEMP%\holderwb.txt`	3
`%HOMEPATH%\desktop\product.pif`	2
`%TEMP%\bhv61AB.tmp`	1
`%TEMP%\bhv8DF6.tmp`	1
`%HOMEPATH%\Orkende`	1
`%HOMEPATH%\Orkende\Recomm.pif`	1
`%TEMP%\bhv5953.tmp`	1

File Hashes

             3031363a67eca33c68892ed7529803bbaa926a6f371204eeaa8ca205501d8cac              34b978969d994134de71dd45996dc5d10516e534e23a2abb8537a1c548ac1c93              51e97032af43de44947d564ee43a9b43278312873caaa4bbd7d3e4f7ec00eb89              58962a9133651591f2d4df22589d1cdd4f7cee175f70c7d47c5a854a5264ec98              5be87b343f2d3af80883ed4deb795c0ae8f7e0ae4ba08a6bbac5b3e4659d0341              6bd1baae5ba600ff4ece4523e53bf9818bcc381a56664e3104c1c317d6f5a3bc              6dfdb201ddd46c8f2ded273f3c8ed6c5beca63196b5428fe388f59faaac79597              731aa2659852eb9b98d573b3f59436b49c15492d8df94e18da5a8f4c41f48fbe              79acdd5ea559b2e7e29fa6b47ca1053e11dbaadf540fc2b140aca89d1539d17e              8fa302841d886e0198c96d76d93399f5905844f424b255e6707a74ea610c55ce              cdaef1b003e82f8994dd616103781125fca98ec097ee79830c2262f41158237a

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

ThreatGrid

Win.Dropper.Tofsee-7492214-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES`	192
`<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config3`	175
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: Type`	158
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: Start`	158
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: ErrorControl`	158
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: DisplayName`	158
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: WOW64`	158
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: ObjectName`	158
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: Description`	158
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'>`	158
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> Value Name: ImagePath`	68
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\wpdjiqwl`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: Type`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: Start`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: ErrorControl`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: DisplayName`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: WOW64`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: ObjectName`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WPDJIQWL Value Name: Description`	11
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\lesyxfla`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LESYXFLA Value Name: Type`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LESYXFLA Value Name: Start`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LESYXFLA Value Name: ErrorControl`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LESYXFLA Value Name: DisplayName`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\LESYXFLA Value Name: WOW64`	11

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`69[.]55[.]5[.]250`	192
`43[.]231[.]4[.]6/31`	192
`85[.]114[.]134[.]88`	192
`239[.]255[.]255[.]250`	175
`46[.]4[.]52[.]109`	175
`46[.]28[.]66[.]2`	175
`78[.]31[.]67[.]23`	175
`188[.]165[.]238[.]150`	175
`93[.]179[.]69[.]109`	175
`176[.]9[.]114[.]177`	175
`192[.]0[.]47[.]59`	174
`172[.]217[.]12[.]164`	159
`74[.]125[.]192[.]26/31`	140
`67[.]195[.]204[.]72/30`	135
`168[.]95[.]5[.]116/31`	134
`172[.]217[.]197[.]26/31`	122
`172[.]217[.]10[.]67`	116
`216[.]146[.]35[.]35`	110
`212[.]227[.]15[.]40/31`	104
`104[.]47[.]54[.]36`	102
`208[.]76[.]51[.]51`	101
`168[.]95[.]6[.]60/30`	97
`98[.]136[.]96[.]92/31`	95
`31[.]13[.]66[.]174`	93
`98[.]136[.]96[.]74/31`	91

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`250[.]5[.]55[.]69[.]in-addr[.]arpa`	192
`microsoft-com[.]mail[.]protection[.]outlook[.]com`	192
`schema[.]org`	175
`250[.]5[.]55[.]69[.]zen[.]spamhaus[.]org`	175
`250[.]5[.]55[.]69[.]cbl[.]abuseat[.]org`	175
`mta5[.]am0[.]yahoodns[.]net`	175
`250[.]5[.]55[.]69[.]dnsbl[.]sorbs[.]net`	175
`250[.]5[.]55[.]69[.]bl[.]spamcop[.]net`	175
`250[.]5[.]55[.]69[.]sbl-xbl[.]spamhaus[.]org`	175
`whois[.]iana[.]org`	174
`whois[.]arin[.]net`	173
`coolsex-finders6[.]com`	173
`bestladies[.]cn`	173
`bestdates[.]cn`	173
`bestgirlsdates[.]cn`	173
`hotmail-com[.]olc[.]protection[.]outlook[.]com`	171
`eur[.]olc[.]protection[.]outlook[.]com`	127
`mx-eu[.]mail[.]am0[.]yahoodns[.]net`	125
`ipinfo[.]io`	118
`nam[.]olc[.]protection[.]outlook[.]com`	93
`mx6[.]earthlink[.]net`	91
`pkvw-mx[.]msg[.]pkvw[.]co[.]charter[.]net`	88
`charter[.]net`	87
`mx0[.]charter[.]net`	87
`msn-com[.]olc[.]protection[.]outlook[.]com`	72

*See JSON for more IOCs

Files and or directories created	Occurrences
`%SystemRoot%\SysWOW64\config\systemprofile`	192
`%SystemRoot%\SysWOW64\config\systemprofile:.repos`	192
`%TEMP%\<random, matching '[a-z]{8}'>.exe`	188
`%SystemRoot%\SysWOW64\<random, matching '[a-z]{8}'>`	158
`%HOMEPATH%`	59
`%System32%\<random, matching '[a-z]{8}\[a-z]{6,8}'>.exe (copy)`	59
`%SystemRoot%\SysWOW64\wpdjiqwl`	11
`%SystemRoot%\SysWOW64\lesyxfla`	11
`%SystemRoot%\SysWOW64\mftzygmb`	10
`%SystemRoot%\SysWOW64\piwcbjpe`	10
`%SystemRoot%\SysWOW64\zsgmltzo`	10
`%SystemRoot%\SysWOW64\yrflksyn`	10
`%TEMP%\<random, matching '[a-z]{4,9}'>.exe`	9

File Hashes

             03dfa2a7b5722d6fa2f2f85287c8bea67b2ae1c8be2d9de90b33c2b4dd3c0f42              07314be6c87366f215030d7a2af42440f8a2a187e782ad975a476a84aa389fe1              0862506904a93aba08781be3d9b5189c8cc01bc5fd86d9a4881bd114449502b7              088fe0b34e1db5b9010adb26a2380aa6faf53165f9e2d7d986fd0bc6be614f9e              0ad21f45614d3112c1201ff8a5b3fe702b4943e39ab9d8bc4f38362565c373d5              0b2c1eebcd3f136c556a8568541d589f691dbe6fb450fa708e9774f4ca72fb67              10d2a79f8c199a6ce16b0e3fd4a911524cc2ece755daf67c04f0d3118dfb3498              11e2d71f1dab632b58c9ab60a48c51854d59df47456a97ff9ef59c72b607229c              136e082449131aae0a3e28c21c99aaef24a9d1709cae71daee0e154bf2b45d9f              144d2f639c9dafd40f48b72980609cb018ca83a360b7e24fede6023e0e742397              16f778581e678fdd5e21442d3d55bcc4415271ac94ed0d31c2efd40c772f26ec              1733e36d0e55b369c97e387fa74da22462fbf1858b09befb5de125d9523e3d41              1756a1f4ce0593f80b857ed9a654c656dac96d3405a566dc38737e0a79bc194d              188389b2163b98dbb96edf4000496dacc062f2a6ae2dd021a3f49742d36a2e0b              189f32c3d78e9b129d62bb4e40b3693da216cc371018d5ce4ef2356a94ca4f6e              18f25a4e071f993b9ceac935a3814d7667e42c46d22ea9e8ccd7c4a3f0087f7b              1a747af4f485eb3c8c475c9dcd9cac9d7fe279f3f45777d793572c4927e07ffa              1af4c3359d224c2ad2006db3c9786afdeeb90404ab91ec7c63467092264e2183              1c1d1c939fd6d3e6a77c2fa342f2c39433eea8f9d3c749ecee42e287734bd330              1c69825459d03fb13956e1a0f40e485731fbe96e48efe1abc765db537fec77ba              1d3aecb8b67bd70634fbffcf15b5e21ef0ee95627d296e78caf3f07842820d9a              1d9d2d4000df6baadc93db56dbdc783c9db35a047be86bed8d4bfaacb33b6a9c              1f42ceba5e533e7aeb5395e1db11ef780b02e44c8cde237394b663b816da69b4              1ff0ce00b3cc5e3223e31501e16302b44ae24981b4b61f3500bdba2f671a057f              20f52e7aa1ee2e27dffcb75eb1e207681dbe2f72d44b0f4d2f66498102d8cf8e

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Packed.Ursnif-7489213-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Value Name: Blob`	18
`<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\75E0ABB6138512271C04F85FDDDE38E4B7242EFE Value Name: Blob`	18

Mutexes	Occurrences
`Local\https://vars.hotjar.com/`	18
`Local\https://www.avast.com/`	18

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`23[.]221[.]50[.]122`	18
`152[.]199[.]4[.]33`	18
`23[.]221[.]49[.]75`	18
`23[.]221[.]50[.]102`	18
`104[.]107[.]26[.]214`	18
`13[.]109[.]156[.]118`	18
`65[.]55[.]44[.]109`	17
`157[.]240[.]18[.]35`	15
`104[.]107[.]18[.]91`	15
`38[.]126[.]130[.]202`	15
`192[.]42[.]119[.]41`	14
`13[.]107[.]21[.]200`	13
`172[.]217[.]164[.]136`	13
`23[.]196[.]81[.]176`	13
`204[.]79[.]197[.]200`	12
`204[.]2[.]197[.]202`	12
`72[.]22[.]185[.]200/31`	12
`172[.]217[.]197[.]156/31`	12
`172[.]217[.]6[.]206`	11
`172[.]217[.]12[.]136`	11
`172[.]217[.]11[.]36`	11
`172[.]217[.]10[.]14`	11
`169[.]54[.]251[.]164`	11
`23[.]201[.]42[.]247`	11
`23[.]201[.]42[.]161`	11

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`googleads[.]g[.]doubleclick[.]net`	18
`www[.]googletagmanager[.]com`	18
`www[.]google-analytics[.]com`	18
`stats[.]g[.]doubleclick[.]net`	18
`connect[.]facebook[.]net`	18
`www[.]googleadservices[.]com`	18
`ib[.]adnxs[.]com`	18
`avast[.]com`	18
`static[.]avast[.]com`	18
`secure[.]adnxs[.]com`	18
`mc[.]yandex[.]ru`	18
`dev[.]visualwebsiteoptimizer[.]com`	18
`amplifypixel[.]outbrain[.]com`	18
`pixel[.]mathtag[.]com`	18
`tr[.]outbrain[.]com`	18
`amplify[.]outbrain[.]com`	18
`ajax[.]aspnetcdn[.]com`	18
`img-prod-cms-rt-microsoft-com[.]akamaized[.]net`	18
`az725175[.]vo[.]msecnd[.]net`	18
`script[.]hotjar[.]com`	18
`static[.]hotjar[.]com`	18
`c[.]s-microsoft[.]com`	18
`assets[.]onestore[.]ms`	18
`a[.]tribalfusion[.]com`	18
`www[.]avast[.]com`	18

*See JSON for more IOCs

Files and or directories created	Occurrences
`%TEMP%\www2.tmp`	13
`%TEMP%\www3.tmp`	13
`%TEMP%\www4.tmp`	13
`%HOMEPATH%\Favorites\Links\Suggested Sites.url`	13
`%HOMEPATH%\Local Settings\Application Data\Microsoft\Feeds\FeedsStore.feedsdb-ms`	13
`%HOMEPATH%\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms`	13
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}`	2
`\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B40C43F1-F039-44D2-AEB7-87F5AF8ABC3D}\ProxyStubClsid32`	2
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage`	2
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1FE6762-FC48-11D0-883A-3C8B00C10000}`	2
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A3CCEDF7-2DE2-11D0-86F4-00A0C913F750}`	1
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}`	1
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7EE7F34-3BD1-427f-9231-F941E9B7E1FE}`	1
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\14`	1
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2`	1
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6f237df9-9ddb-47ad-b218-400d54c286ad}`	1
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A4A1A128-768F-41E0-BF75-E4FDDD701CBA}\InProcServer32`	1
`\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{81397204-F51A-4571-8D7B-DC030521AABD}\InprocServer32`	1

File Hashes

             0ad051eb62410a3fe8d776a69f29a46fe609ea59c2adfe061811dc9ace3e40e9              17cfe796a3b8017bf83d2c302ec9507317abac0191cdf835d2d0d1a75d33b991              18b5f4e21612aadfed4e72cdef1356009fb1614535b62a4e39463f8cea9ace03              2013ff55ccdd16e36eccebe50b0587b6f2f37e333442be1552b50c41cbfe48d4              241ab82dccad5b9670c445509841c6aebf69de45815c3d9951f15be158b8ece5              270f970f0cfda8e8c61a73b2aab71fd51755ad911b8173f5aac4cdb5961ba8a5              3016c699d4c8c7affedc18f5cb4aadb30676a9c3081dee913b43b84737949708              31a02187883766f2eec0edc6479b8cd793c8e8eec658fe56b33581a76d9953f8              365acef54f3733520717314466c86aa978cbf08c37d1f9f0a90bbbea42b3f8f3              5ba3ea5868ddef74a57fff2c5ded68f17b08458876881161a7af9eb32438779d              5c486b96a5f273819baa9a010700f088ce3f707c87088a50e699ee6dedd0b117              611e95e1a1a352d6cb1a6106b0e69565b065de6d68dbe5c41d49c2ebfa637dd6              7a8b53746144a903954535791ef7c5038834af3cd1eec8c0dae8b28f609859bf              7fd6f59c5c23ea12adf5975e56730a52558799ae7a330ef40e552a4353a8d6e3              8220634b1969f5a06e3b5adff2dbae0356608a91e5162fccdd247f1571a2a4b2              9a20d2755608e7cf98a090f30b166779318f0a08747631fccc9393de15ed33cc              9b6503731468ce3922f5aec73e22a81489ddcf6124d86eeb2fc05cb7c2f4527f              b062f5f376af3972c8386343b27fb1e5947afb66c5c0741cced2d317f5261158              b2c7bc0dece9bed221c3fe88b9dce2313b036b9a3f5982b5bfa91961efb7bdaf              bb8d733fa6ca4ef01d8b44d098902e781359cdd36a4418538a504082b3b95fe6              cecc5dd05c51a6740730b775dc4af3d579b498880de7899b272d6225fb96cb44              e6bd801ae1e976ff76409d2b28d00d15f50e5819c3c5bbc54eb4ac9752f87435

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

Win.Packed.ZeroAccess-7489468-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\MICROSOFT\TRACING\KMDDSP Value Name: FileTracingMask`	55
`<HKLM>\SOFTWARE\MICROSOFT\TRACING\KMDDSP Value Name: ConsoleTracingMask`	55
`<HKLM>\SOFTWARE\MICROSOFT\TRACING\KMDDSP Value Name: MaxFileSize`	55
`<HKLM>\SOFTWARE\MICROSOFT\TRACING\KMDDSP Value Name: FileDirectory`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: Start`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: Start`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: DeleteFlag`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: DeleteFlag`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BROWSER Value Name: Start`	55
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Windows Defender`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: Type`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: ErrorControl`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: Type`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: ErrorControl`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: DeleteFlag`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: Type`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: ErrorControl`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: Type`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: ErrorControl`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010 Value Name: PackedCatalogItem`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009 Value Name: PackedCatalogItem`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008 Value Name: PackedCatalogItem`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007 Value Name: PackedCatalogItem`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006 Value Name: PackedCatalogItem`	55
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005 Value Name: PackedCatalogItem`	55

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`94[.]242[.]250[.]64`	116
`64[.]210[.]151[.]32`	55
`178[.]32[.]190[.]142`	55
`91[.]207[.]60[.]22`	15
`71[.]229[.]165[.]75`	15
`201[.]231[.]100[.]117`	15
`71[.]239[.]117[.]142`	9
`66[.]41[.]70[.]14`	8
`71[.]63[.]0[.]235`	7
`98[.]224[.]77[.]3`	7
`83[.]15[.]111[.]38`	7
`76[.]180[.]80[.]134`	7
`24[.]73[.]24[.]191`	7
`46[.]45[.]5[.]240`	7
`67[.]185[.]179[.]4`	6
`98[.]230[.]137[.]123`	6
`69[.]80[.]173[.]91`	6
`75[.]66[.]129[.]205`	6
`69[.]117[.]29[.]163`	6
`190[.]36[.]183[.]136`	6
`77[.]126[.]70[.]166`	6
`98[.]203[.]164[.]253`	6
`67[.]240[.]46[.]208`	5
`72[.]200[.]101[.]79`	5
`68[.]97[.]172[.]87`	5

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`promos[.]fling[.]com`	55

Files and or directories created	Occurrences
`\@`	116
`\L\eexoxfxs`	116
`\cfg.ini`	116
`\systemroot\assembly\GAC_32\Desktop.ini`	55
`\systemroot\assembly\GAC_64\Desktop.ini`	55
`%System32%\LogFiles\Scm\e22a8667-f75b-4ba9-ba46-067ed4429de8`	55
`%SystemRoot%\assembly\GAC_32\Desktop.ini`	55
`%SystemRoot%\assembly\GAC_64\Desktop.ini`	55
`\systemroot\assembly\temp\@`	55
`\systemroot\assembly\temp\U`	55
`\systemroot\assembly\temp\cfg.ini`	55
`\systemroot\system32\consrv.dll`	55
`%System32%\consrv.dll`	55
`%SystemRoot%\assembly\temp\@`	55
`%SystemRoot%\assembly\temp\cfg.ini`	55
`\systemroot\system64`	55

File Hashes

             024be6e3a83461f6084ade9ef26da705de0e7eeceebbd55ca5289a7396dcf280              02a6714aebbfef68f0528f10414a2fd8a8338243e05992d0c28d68383e1dc1a1              05597af5ff2dd97b20b7c57e4c3cd48cae1a4d2c7cd1c4ac920a6f1185a65900              0712314c985a7cc479d0cbcdcf06c886ba2d7fc79d89cf4efc56a137235eb379              0808ec44505b3130a5dde6e81c75f473f44a288d1134fff680394534283fce87              08b18f2eb8b1fb422adfb52d482f9d9bb3f4a24d18f89a186ed2865181f6b551              0b675bae551f40fe43934915324927652e35fa3089dcc911345478fc96338a3c              0d6aea5357e88970db6f5c226a2a888e1c7f1c5f20146087952612c06d064b4e              15d09a26dec6c151966a24bfebd38fb67c8397a06c3bf1702eb4702a871a9e2c              1744dd32bcf9cd45cfec1f4334de1df340129a555e12f73c740e02f7fe7b469c              1ac467786827d37bc69e30617fa2b14fa8903f68f73022e727caa634379490b2              1c9dc1eb7cb0191101faa393854592a440d6df736f07a767138df22c1f809c8d              1d34f5231571a20d3229e850bb786f6148dab477ca4a0169a0af3acf2d2ce71d              243ccb0ec0007367fc4e21dea982be68d6f32e6cdcafbd11e10768cb912a914b              2460096ab6403840c5de8a19dc1706cf2dc416cc9e3ab701275853d66eb7e142              24ec81e3c8a7247c0fa2292906afccc1d47b81412cfaf021dc22be067530e944              2b275de3b1d0f2786c58f17a0d2607a47dade5151046f255eea2f9da20a03c9c              311c8b6b2d2150fff040363e23fdca221be64cae3ad34d9b3dfacd396ed48fc6              330719fd8491c5abc9fd90c7e27310cb72d331222c5caaf4671525d48e4b1026              35ba7b85dd5146c275b74b7b09ef62985ba9db0d1e1f2771b6990d53ed965d52              37240db16c496c45552715904b84ce5cc2c1e01ebbcf519a7e0bee4cc73f08bd              39bf409ea1d861dfed811fa6c0aee2767aff44d96fffb4f3e552db1add1ed7fc              3b3d6c01a983c835152e169e092be6193bce78c22b41cda5e573e5330235aac6              3e6c74185843c930a9b5ea041a5a3eef7d9ae80a31e3a67e0c235b5090e64afb              3fcf02116eab251a35b6a9dba981edb13ba59701f0b52ca1521fd2dbff350477

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

Win.Ransomware.TeslaCrypt-7501245-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\XXXSYS`	15
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: addon_v57`	15
`<HKCU>\SOFTWARE\XXXSYS Value Name: ID`	15
`<HKCU>\Software\<random, matching '[A-Z0-9]{14,16}'>`	15
`<HKCU>\Software\<random, matching '[A-Z0-9]{14,16}'> Value Name: data`	15

Mutexes	Occurrences
`z_a_skh495ldfsgjl2935345`	15

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`23[.]20[.]239[.]12`	15
`64[.]140[.]157[.]157`	15
`157[.]119[.]94[.]202`	15
`104[.]27[.]31[.]89`	9
`104[.]27[.]30[.]89`	6
`3[.]225[.]189[.]10`	5
`3[.]229[.]167[.]115`	4
`54[.]83[.]91[.]42`	3
`34[.]195[.]145[.]145`	2
`3[.]93[.]124[.]54`	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`en[.]wikipedia[.]org`	15
`www[.]torproject[.]org`	15
`www[.]hugedomains[.]com`	15
`vostorgspa[.]kz`	15
`p4fhmjnsdfbm4w4fdsc[.]avowvoice[.]com`	15
`bledisloeenergy[.]com[.]au`	15
`polyhedrusgroup[.]com`	15
`todayinbermuda[.]co`	15
`nn54djhfnrnm4dnjnerfsd[.]replylaten[.]at`	15
`www[.]buildenergyefficienthomes[.]com`	15
`mosaudit[.]com`	15
`buildenergyefficienthomes[.]com`	15
`akdfrefdkm45tf33fsdfsdf[.]yamenswash[.]com`	15

Files and or directories created	Occurrences
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I0ZU5JT.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I478AKJ.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4FI238.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4FKVBH.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I4QK3KJ.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I5QX7W9.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I77RW1L.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I7J37KF.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I9NSD58.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IANXEE8.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IC5NB1M.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$ID60W3E.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IIUTK07.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IJE160U.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IKAVPAE.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IL2NS3P.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$INKC8CM.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IP8M1EE.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IPDP9E0.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$ISIYA4I.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IV54ALI.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IWK2JPN.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IWYYKMD.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IXC3P46.txt`	15
`\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$IZ7KADN.txt`	15

*See JSON for more IOCs

File Hashes

             00de6704e49ec7e8b570b95410704c0d3d81c727c688d06afe68e4f8f4e4b8e6              079ab9339f5b1ccf429dbf4426350c311adc6bdeeb3a003970d052088dcdaabf              4b7a8b7ffac89faa52034d12821a9e20bfd987adcdcbdba29d6daaca44ef9325              6352e2794884e3c090f6ec14ec8c870fdc6d4cde61f518c44ed5bae2916e67c8              69a0539a87e7a9fe382cf4c504c3d02bf6ee4cd6a5e20098ed619da8975480ee              70311b0da413a17ed6c5f300adcd7757301346300693823ba4e1e7845901c1b8              7f1a0f921a5132b1329dbdbfadc83eec6568ad151d1c33da89a4aaf0a5e5c0c2              a7ba5bb407c401764b9af3e22b005962431d5446f1c8ba468ab71a7ed1033299              b8dd6020265dc28fa74d1708e2238cc227791dace690699db22cbb3ba6c1d64c              bd9a8d8d2c8e1d426959e7022ecd26b7001998aba2617e13deac573d16208916              c7a8125f64e0c8d4133263f901855d1ef0ecea2e083c10782e4cfbbe8b334e79              dca1535c72840c4a47886ee0e23437fc560a4fea29c9c62f63a58726d21a565b              e010d87d8cb503b316a2dc3e064b99178b7040a213251ce49e58fd0d23c6cef5              eb6259dd5f1ed9540edc3e0e9944e08145b9514320cd65c26612b32b92fa6885              f347dc8de7cefff44e6127fcfd035c08d31439a6f4951dd92549bdd6400b60aa

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Dropper.Upatre-7491797-0

Indicators of Compromise

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`93[.]185[.]4[.]90`	25
`104[.]20[.]17[.]242`	10
`98[.]214[.]11[.]253`	6
`66[.]196[.]61[.]218`	6
`98[.]246[.]210[.]27`	6
`81[.]90[.]175[.]7`	5
`216[.]16[.]93[.]250`	5
`76[.]84[.]81[.]120`	4
`217[.]168[.]210[.]122`	4
`84[.]246[.]161[.]47`	4
`85[.]135[.]104[.]170`	3
`24[.]148[.]217[.]188`	3
`81[.]93[.]205[.]251`	3
`81[.]93[.]205[.]218`	3
`62[.]204[.]250[.]26`	3
`173[.]248[.]31[.]1`	3
`87[.]249[.]142[.]189`	2
`98[.]209[.]75[.]164`	2
`194[.]228[.]203[.]19`	2
`24[.]220[.]92[.]193`	2
`176[.]36[.]251[.]208`	2
`109[.]86[.]226[.]85`	2
`95[.]143[.]141[.]50`	2
`68[.]55[.]59[.]145`	2
`188[.]255[.]239[.]34`	2

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`icanhazip[.]com`	25

Files and or directories created	Occurrences
`%TEMP%\tywy22.txt`	24
`%TEMP%\tywyaven.exe`	24
`%TEMP%\t4930.tmp`	1
`%TEMP%\vimazet.exe`	1

File Hashes

             01152de6c7c348fa9716c3d760744689eb85386303593e6100f6532bd3fc2cb3              01cb3cbad05c3b0b186b604f32cb00a3ceced74ead26affe5b4fb1867d48be01              02f4933753d850d1774b56cbd35c994b6b7dd9b971fd45c34f5677f90b281b6a              062720c82d1bef7558b0a4675b9539a23afddf252ede24b5d54edfba2a758ca5              06f92e4b684161224f68388d8d4ca35d113682fadeb2e100072dfa8d43413101              09589d82d2f9460fe3d33b726794d41a93b672dbaed8e5f397350b7714649cd7              09f38837949bbee74dd5da5fce7a92d7f21168f7e43345bbd19f5cbfde8f6f69              0c45c58eab16df4d5bff14dad957f91d5785a09836560bc3bd681c27e012b1b8              0d774c5ac17521abec32a11e81317fed5f7c163d82ec7f9e1065c86834458cfe              0d90667089d17e2924b00e5207a357156e9076dfa3dab3f2e7dc5737135053a9              0e36b813e84b27ff1c1b770fffbf4175c7c39bbe499804c9c27565ed4a9518fa              0fa25c7c007f337ab5ba699a2611c47ff41a8ba74cb83fa1ffde097e7408f8ed              10c863059e4910501e1deea44279a5402e93796098230511c65be09f8f47eb82              1356d0345699b8766d5c8de5d61cb47fd63dc3f42fe2280a2c413a8d7f97c1c8              13f7895a32eb09a5016a408819dce9c95a4149888ad708c0232e0659e2ca06e3              14178c54d283e6579242e90df7c4dae8af71ff4594c834e3cc7a275588f561b7              14e727de9a56e79b9dcaf48cc9751d4cb447f16d839d705c628640857d0e6e13              1535d470effa0af601719b9ef64e615f321e4db52ee4b7bb05def6d501884fbc              16b232d226ca18447e1f1671538607fe5be412e935b930bcde73ff46e0b2890f              186a59f2954d3d213a26308386be80f2b503e08882324ab559490330700fc24a              1d2374db5ee92385e49fbaef9ef694361877cdffa4b51d8fd8d37e6272dfad57              1e1bdd6ddb3c256c79024eccdb2de6b0861a2a86e13f3f03cf1f378e2cdc9d36              1fcbef293371203729eca2c9491641a03b2330c9be11b438f84db0e996e5b78c              2119922518bc437c7d5fd7d7205929089a9ed9333cdff97bb214808f37e86dd7              211bdc6613fc3e691ac70d215a8a9edd5f0ebb85bb4f24d6e293fb21894a0b1b

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

Win.Dropper.TrickBot-7490964-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2580483871-590521980-3826313501-500 Value Name: RefCount`	1

Mutexes	Occurrences
`Global\316D1C7871E10`	22

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`181[.]113[.]28[.]146`	5
`188[.]120[.]254[.]68`	5
`195[.]123[.]220[.]178`	5
`198[.]23[.]209[.]201`	4
`104[.]20[.]17[.]242`	3
`119[.]252[.]165[.]75`	3
`78[.]24[.]223[.]88`	3
`188[.]165[.]62[.]34`	3
`164[.]68[.]120[.]60`	3
`69[.]195[.]159[.]158`	2
`190[.]214[.]13[.]2`	2
`5[.]2[.]70[.]145`	2
`185[.]213[.]20[.]246`	2
`185[.]141[.]27[.]190`	2
`185[.]177[.]59[.]163`	2
`216[.]239[.]38[.]21`	1
`200[.]21[.]51[.]38`	1
`200[.]127[.]121[.]99`	1
`181[.]129[.]104[.]139`	1
`18[.]213[.]79[.]189`	1
`45[.]125[.]1[.]34`	1
`23[.]20[.]220[.]174`	1
`45[.]137[.]151[.]198`	1
`5[.]182[.]210[.]109`	1
`51[.]89[.]115[.]124`	1

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`icanhazip[.]com`	3
`250[.]5[.]55[.]69[.]zen[.]spamhaus[.]org`	2
`checkip[.]amazonaws[.]com`	2
`wtfismyip[.]com`	2
`api[.]ip[.]sb`	1
`ipinfo[.]io`	1

Files and or directories created	Occurrences
`%System32%\Tasks\System Network Extensions`	22
`%APPDATA%\adirecttools`	22
`%APPDATA%\adirecttools\data`	22
`%APPDATA%\adirecttools\settings.ini`	22
`%APPDATA%\ADIRECTTOOLS\<original file name>.exe`	22
`%TEMP%\<random, matching '[a-f0-9]{3,5}'>_appcompat.txt`	21
`%TEMP%\<random, matching '[A-F0-9]{4,5}'>.dmp`	21
`%APPDATA%\adirecttools\Data\pwgrab64`	1
`%APPDATA%\adirecttools\data\pwgrab64_configs\dpost`	1
`%APPDATA%\adirecttools\69ab1bb7084669cf84cc43537b700264.exe`	1
`%SystemRoot%\TEMP\~DF8EC46E2629511EB8.TMP`	1
`%APPDATA%\adirecttools\runme.exe`	1
`%SystemRoot%\TEMP\~DF5EC233074AA93A3C.TMP`	1
`%SystemRoot%\TEMP\~DF4BEDA5BB57A455AF.TMP`	1
`%SystemRoot%\TEMP\~DFCE2B4CA7595FDB1F.TMP`	1
`%SystemRoot%\TEMP\~DF771B5AE6CE965D7A.TMP`	1
`%SystemRoot%\TEMP\~DF21C4C13A90F8FECB.TMP`	1
`%SystemRoot%\TEMP\~DF2EDE8F31D379304B.TMP`	1
`%SystemRoot%\TEMP\~DF887620F0BF482816.TMP`	1
`%SystemRoot%\TEMP\~DF6B5F6A59497674CC.TMP`	1
`%SystemRoot%\TEMP\~DFA8D4CB1355CC2A5F.TMP`	1
`%SystemRoot%\TEMP\~DF326643DA3623EF2B.TMP`	1
`%SystemRoot%\TEMP\~DF2334856A166D2B71.TMP`	1
`%SystemRoot%\TEMP\~DF862A67F04082D9B3.TMP`	1
`%SystemRoot%\TEMP\~DFC53480C7F7651844.TMP`	1

*See JSON for more IOCs

File Hashes

             0245c1658f2c7d9989431954aeeae75907cd70d94d45137c6d03d1c77463779f              11a8ffc0df227cb681971a11904bf83d3a72a52aefd1335df4202115ccabe4a1              17db3888319bac8bdc2fa0c33c3125dca7f8b2f9ff39dfe8b16882c3babd5273              26e223b88abca88510d861698e8468675e7fc8fac1199a554d4fdd2cff91197d              4517232ad858b209e6a6fb873e2a8665a85c91506b1ded4c518e751fc7adacb2              65371d42ff1b2db3b211c5f180f411a2621679225dab602ed0d47a496287ff4c              691f1b9988bde02160172a8ed8d0e242cc25d8fd205839887140330ebff862f5              6b4f93bb3fc3aeb71591f7fd237367905898b62f3a08580d8ed691fa06f6734d              6e2ab21ca9e1bb545bee1a66190cd9786d9d2d376b47864715b121ed8ccb3d33              7055bef3d19a836529109b5037e4ce63e9f3c8d8f9e5b8daba57880b9ca5cb5e              7996ea4f4f2a2d9e2152eaefba2fc9077c33fc5a1848b2ec4e6a69e54ef7fba3              82aef9ea980b0fd2fb268be8fc8ebdf14b9150df5c167aa29ddcd464afc2014c              8d9c8ef971a707651456e085f7420e45463d77dbefeab733d381685500f4a027              9363001b83b189a7ebdefcebe844bbbe29e1db03e49fa642bc9530f345d65283              9971b48ee31acc1d33d3a28b3527f3039c5a633d0f0cb6b3422d3b1d219221f0              9e1d70348303b0480a64a03d82b2d011d1a51a5f106024e670f12acc64478b44              a6068b4a752629e61dff03d86cf8bf9141f52e22a8267c0de469fe5d2e5b65de              ae0e55999d7f5ae1be0a7132b2e972fc04c95c653f214f3f59ce30fc4e2f57af              b4c41107cda5716a098e22be19101e15e3e577e3d6cc8570a4e81e0f6cf24ae1              c693ddb405dcc6831f489f499ece83aae83d27226694bfc390b5059f0849bc2e              e0d95256f1587f75b9e0e632e92b88561d4441cb559d7b3944e3152669a28f92              ea15e0fd9d3c825cd2c2217ab150fb7cee86cf5b0a3e411c6c621084199bbb10

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

Win.Packed.Formbook-7491272-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\INTELLIFORMS\STORAGE2`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\0A0D020000000000C000000000000046`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\33FD244257221B4AA4A1D9E6CACF8474`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\3517490D76624C419A828607E2A54604`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\4C8F4917D8AB2943A2B2D4227B0585BF`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\5309EDC19DC6C14CBAD5BA06BDBDABD9`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\82FA2A40D311B5469A626349C16CE09B`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8503020000000000C000000000000046`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9207F3E0A3B11019908B08002B2A56C2`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9E71065376EE7F459F30EA2534981B83`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\A88F7DCF2E30234E8288283D75A65EFB`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\C02EBC5353D9CD11975200AA004AE40E`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\D33FC3B19A738142B2FC0C56BD56AD8C`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\DDB0922FC50B8D42BE5A821EDE840761`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\DF18513432D1694F96E6423201804111`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\ECD15244C3E90A4FBD0588A41AB27C55`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\F86ED2903A4A11CFB57E524153480001`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\{D9734F19-8CFB-411D-BC59-833E334FCB5E}`	27
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\{D9734F19-8CFB-411D-BC59-833E334FCB5E}\CALENDAR SUMMARY`	27

Mutexes	Occurrences
`8-3503835SZBFHHZ`	29
`Startup_shellcode_006`	29
`KN7MSAA2BUECxyHz`	29
`S-1-5-21-2580483-10603632762720`	21
`S-1-5-21-2580483-2008626601611`	2
`S-1-5-21-2580483-1148626601611`	1
`S-1-5-21-2580483-1464626601611`	1
`S-1-5-21-2580483-2116626601611`	1
`S-1-5-21-2580483-1392626601611`	1
`S-1-5-21-2580483-1992626601611`	1
`S-1-5-21-2580483-1380626601611`	1
`S-1-5-21-2580483-584626601611`	1
`S-1-5-21-2580483-1120626601611`	1
`S-1-5-21-2580483-2100626601611`	1
`S-1-5-21-2580483-1616626601611`	1
`S-1-5-21-2580483-1012626601611`	1
`S-1-5-21-2580483-972626601611`	1
`S-1-5-21-2580483-1440626601611`	1
`S-1-5-21-2580483-1460626601611`	1
`S-1-5-21-2580483-956626601611`	1
`S-1-5-21-2580483-1808626601611`	1
`S-1-5-21-2580483-888626601611`	1
`S-1-5-21-2580483-10203632762720`	1
`S-1-5-21-2580483-2036626601611`	1
`S-1-5-21-2580483-10843632762720`	1

*See JSON for more IOCs

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`162[.]213[.]250[.]169`	10
`173[.]0[.]50[.]210`	6
`217[.]160[.]0[.]55`	4
`192[.]155[.]190[.]84`	3
`172[.]247[.]92[.]19`	3
`199[.]59[.]136[.]230`	3
`184[.]168[.]221[.]32`	2
`198[.]54[.]117[.]216`	2
`198[.]54[.]117[.]211`	2
`23[.]20[.]239[.]12`	2
`184[.]168[.]131[.]241`	2
`217[.]160[.]0[.]154`	2
`74[.]208[.]236[.]114`	2
`199[.]59[.]138[.]230`	2
`74[.]117[.]219[.]198`	2
`198[.]54[.]117[.]218`	1
`198[.]54[.]117[.]212`	1
`198[.]54[.]117[.]215`	1
`184[.]168[.]221[.]36`	1
`185[.]230[.]60[.]195`	1
`85[.]159[.]66[.]62`	1
`97[.]74[.]42[.]79`	1
`172[.]217[.]5[.]243`	1
`208[.]100[.]26[.]245`	1
`3[.]234[.]181[.]234`	1

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`www[.]allixanes[.]com`	10
`www[.]travelcards[.]site`	6
`www[.]orlandohouston[.]com`	5
`www[.]xn--4qw729d[.]com`	5
`www[.]davekachman[.]com`	5
`www[.]iqama[.]info`	5
`www[.]reserveforcespolicy[.]com`	5
`www[.]enjoquotes[.]com`	4
`www[.]online-rfs-billing[.]info`	4
`www[.]imtrainee[.]net`	4
`www[.]ildolce[.]store`	4
`www[.]elgranretodeseve[.]com`	4
`www[.]arnaud4k[.]com`	4
`www[.]digital-spot[.]net`	4
`www[.]casalukre-co[.]com`	3
`www[.]jingrunxuan[.]com`	3
`www[.]hzwhedu[.]com`	3
`www[.]zxhckj[.]com`	3
`www[.]thehouseofthedrone[.]com`	3
`www[.]24hourautolocksmith[.]company`	3
`www[.]kingofthenorth[.]tech`	3
`www[.]aurora-health-ua[.]com`	3
`www[.]prokat[.]site`	3
`www[.]riicko[.]com`	3
`www[.]hugedomains[.]com`	2

*See JSON for more IOCs

Files and or directories created	Occurrences
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe`	29
`%APPDATA%\KN7MSAA2`	27
`%APPDATA%\KN7MSAA2\KN7log.ini`	27
`%APPDATA%\KN7MSAA2\KN7logrc.ini`	27
`%APPDATA%\KN7MSAA2\KN7logri.ini`	27
`%APPDATA%\KN7MSAA2\KN7logim.jpeg`	26
`%APPDATA%\KN7MSAA2\KN7logrv.ini`	26
`%ProgramFiles(x86)%\Ygl8drb`	1
`%ProgramFiles(x86)%\Ygl8drb\config9rs4ano.exe`	1
`%TEMP%\Ygl8drb`	1
`%TEMP%\Ygl8drb\config9rs4ano.exe`	1
`%ProgramFiles(x86)%\Ymnlhitch`	1
`%ProgramFiles(x86)%\Ymnlhitch\helpcfsd4ho.exe`	1
`%TEMP%\Ymnlhitch`	1
`%TEMP%\Ymnlhitch\helpcfsd4ho.exe`	1
`%ProgramFiles(x86)%\Kpfyl`	1
`%ProgramFiles(x86)%\Kpfyl\helpex9l_rep.exe`	1
`%TEMP%\Kpfyl`	1
`%TEMP%\Kpfyl\helpex9l_rep.exe`	1
`%ProgramFiles(x86)%\Gbbcdufw`	1
`%ProgramFiles(x86)%\Gbbcdufw\vgaxjwtjt.exe`	1
`%TEMP%\Gbbcdufw`	1
`%TEMP%\Gbbcdufw\vgaxjwtjt.exe`	1
`%ProgramFiles(x86)%\L1b6h`	1
`%ProgramFiles(x86)%\L1b6h\systrayybihc.exe`	1

*See JSON for more IOCs

File Hashes

             0146d4a89836ecc12759c33a85d60c3867a35b7ee468041fb26b0610ef76e54f              046bebb1052d11ee3db2b5c8cbf3e2f1dd509a2aa73e53f4ffb18d39985165cf              049fa135806899faa44ce50ba918331d0ea0aeb8aa6db5012117bfc794f57759              058392f97319e50bbd2172ab46255c892e12ee0b7948e6ce0420012eb85e7e35              07387a7c05fcaf63b03673bd92d634fcd13e1784fb6adcc6c2b8cf7154c07e55              07c11047e72c8f52c1f5c422fc5b7ed49225259012c813c2bc5a8827bcf5f752              0d49120f2ce8cc77ea769c79a1ab5c7669cb58c07de1a95f08549d2665529df1              0d8e415c487a6ced2680bcb31834fe282b914f09ac167dfb4f1685af0b529c35              0da9443c8aacb9e4757b81deeaeedc7b96766020522ed9992d7b9ce3e0eb5130              0de2930e0fd1d971aa98b219ce6dc3f36b07d8441b7abd0d663a63dd77cfbf37              163d07cf0a756800c6ce5be998331fdffa75081f5f669bbb6149eb0e89744043              1c64787e6ef766f7d9b8cc99deb128d45b89d02accacb3dac1e2ad076f5139eb              208a5ebc7af4b8d15e157e9115f4617a2b3e021a868367b3e7bb0bde69170911              2655a1ee89ed4101f552ce1b75b9d711ee5c6217e63cf6ce8e23086844c839e9              2a13033c3b6b7299bd795ce5c34bbba17a8de80d4d957e4d547ef1ae2ba728b4              2e98ffc7f5bab8e3f2085beba2ecc912f038c9a66a5f6b9ec7d8e0f2eca2fcbc              2fb1d73ee16fea837612ff0d9c89a934e5520310f9a06397f7e2c1a0c1604694              30545b09c38a284d95310d71822427e0bc0b69dcaeb3d316f2fe39decfb8c006              3064e41052d6dfa7c354a6e8c405ae2c1d09e48fa9e82dc4e8faee1f4bebdd4d              352c218b502f9db9eb8a56d8d6515c3fbe51298e29fe3878731a037885dc7f7b              356aa1a0e39cd24ed61ca8c1d6658a91c9dd8dbd2663ce90b5db2b793fe12e01              36fd577a0a6354cae84ff7a6bc3b21159f24cd0b8eff3482ba7c8278b4a89b27              3a14a285394c39842beaf312d02de42ab02c679e47cb6a40c3b900f196ba4e2d              3aa7710feab8dd35997e03ad650a5bae2f19de1d82e2a7fef032815d946e21ee              3d2f8ca93b256a27067969eda8d4fca7559e38b8af59a79c40c40c55f06b53d2

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Exploit Prevention

CVE-2019-0708 detected - (17518)

Process hollowing detected - (353)

Kovter injection detected - (269)

Gamarue malware detected - (158)

Installcore adware detected - (90)

Dealply adware detected - (88)

Excessively long PowerShell command detected - (87)

Corebot malware detected - (23)

Reverse http payload detected - (19)

An exploit payload intended to connect back to an attacker controlled host using http has been detected.

Fusion adware detected - (11)

Fusion (or FusionPlayer) is an adware family that displays unwanted advertising in the form of popups or by injecting into browsers and altering advertisements on webpages. Adware is known to sometimes download and install malware.

↧

New Snort rules protect against recently discovered Citrix vulnerability

January 13, 2020, 11:13 am

≫ Next: Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage

≪ Previous: Threat Roundup for January 3 to January 10

By Edmund Brumaghin, with contributions from Dalton Schaadt.

Executive Summary

Recently, the details of a critical vulnerability affecting Citrix Application Delivery Controller and Citrix Gateway servers were publicly disclosed. This vulnerability is currently being tracked using CVE-2019-19781. A public patch has not yet been released, however, Citrix has released recommendations for steps that affected organizations can take to help mitigate the risk associated with this vulnerability. Successful exploitation of CVE-2019-19781 could allow a remote attacker to execute arbitrary code on affected systems.

This vulnerability, which is a directory traversal vulnerability, affects multiple versions of these products. Since the public disclosure of this vulnerability, several proof-of-concept (PoC) tools have been publicly released that can be used by adversaries to scan for vulnerable systems and attempt to exploit the vulnerable condition to achieve remote code execution. There have been multiple public reports of mass-scanning and exploitation activity already being observed in the wild. As such, it is important that organizations are aware of this vulnerability and take steps to ensure that they mitigate the risk of attacks against their environment.

Talos coverage for CVE-2019-19781

Talos has developed and released coverage for this vulnerability in the form of Snort and Firepower signatures. These signatures have been available since Dec. 23, 2019 and can be leveraged by organizations to protect their affected systems from possible exploitation attempts until an official patch is publicly released.

Snort SIDs: 52512, 52513

↧

Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage

January 14, 2020, 11:17 am

≫ Next: Stolen emails reflect Emotet's organic growth

≪ Previous: New Snort rules protect against recently discovered Citrix vulnerability

By Jon Munshaw.

Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 49 vulnerabilities, eight of which are considered critical.

This month's security update is particularly important for its disclosure of two vulnerabilities related to a core cryptographic component in all versions of Windows. CVE-2020-0601 could allow an attacker to use cryptography to sign a malicious executable, making the file appear as if it was from a trusted source. The victim would have no way of knowing if the file was malicious. Cyber security reporter Brian Krebs says the vulnerability is so serious, Microsoft secretly deployed a patch to branches of the U.S. military prior to today.

January's update is also the last that will provide free updates to Windows 7 and Windows Server 2008/2008 R2.

Talos also released a new set of SNORTⓇ rules that provide coverage for some of these vulnerabilities. For more, check out the Snort blog post here.

Critical vulnerabilities

Microsoft disclosed eight critical vulnerabilities this month, all of which we will highlight below.

CVE-2020-0603, CVE-2020-0605, CVE-2020-0606 and CVE-2020-0646 are all remote code execution vulnerabilities in the .NET and ASP.NET core software. All four of these vulnerabilities can be triggered if a user opens a malicious, specially crafted file while using an affected version of .NET or ASP.NET Core. If successful, an attacker could then execute arbitrary code in the context of the current user. These bugs exist in how the software handles objects in memory.

CVE-2020-0609 and CVE-2020-0610 are remote code execution vulnerabilities in the Windows Remote Desktop Protocol Gateway Server. An attacker could exploit these bugs by sending a specially crafted request to the victim's system RDP Gateway via RDP. This vulnerability is pre-authentication and does not require any user interaction.

CVE-2020-0611 is a remote code execution vulnerability in the Windows Remote Desktop Protocol client. This vulnerability can be triggered if a user visits a malicious, specially crafted server. An attacker would need to trick the user into connecting to this server, either via a malicious file or a man-in-the-middle technique. The attacker could then execute arbitrary code on the victim's machine.

CVE-2020-0640 is a memory corruption vulnerability that exists in the way the Internet Explorer web browser handles objects in memory. An attacker could use this bug to corrupt the victim machine, and then gain the ability to execute arbitrary code. A user can trigger this vulnerability by visiting a malicious, attacker-controlled web page in Internet Explorer.

Important vulnerabilities

This release also contains 41 important vulnerabilities, three of which we will highlight below.

CVE-2020-0601 is a spoofing vulnerability in Windows CryptoAPI. The specific component, crypt32.dll, improperly validates Elliptic Curve Cryptography certificates. An attacker could exploit this bug to spoof a code-signing certificate and secretly sign a file, making that file appear as if it is from a trusted source. A malicious actor could also use this vulnerability to conduct man-in-the-middle attacks and decrypt confidential information.

CVE-2020-0616 is a denial-of-service vulnerability in Windows due to the way the operating system handles hard links. An attacker needs to log onto the victim machine to exploit this bug, and then run a specially crafted application that would allow them to overwrite system files.

CVE-2020-0654 is a vulnerability in the OneDrive app for Android devices that could allow an attacker to bypass certain security features. If the user access a link to a file on a OneDrive folder a certain way, they could bypass the passcode or fingerprint requirements for the app.

The other important vulnerabilities are:

CVE-2020-0602
CVE-2020-0607
CVE-2020-0608
CVE-2020-0612
CVE-2020-0613
CVE-2020-0614
CVE-2020-0615
CVE-2020-0617
CVE-2020-0620
CVE-2020-0621
CVE-2020-0622
CVE-2020-0623
CVE-2020-0624
CVE-2020-0625
CVE-2020-0626
CVE-2020-0627
CVE-2020-0628
CVE-2020-0629
CVE-2020-0630
CVE-2020-0631
CVE-2020-0632
CVE-2020-0633
CVE-2020-0634
CVE-2020-0635
CVE-2020-0636
CVE-2020-0637
CVE-2020-0638
CVE-2020-0639
CVE-2020-0641
CVE-2020-0642
CVE-2020-0643
CVE-2020-0644
CVE-2020-0647
CVE-2020-0650
CVE-2020-0651
CVE-2020-0652
CVE-2020-0653
CVE-2020-0656

Coverage

In response to these vulnerability disclosures, Talos is releasing a new SNORTⓇ rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up-to-date by downloading the latest rule pack available for purchase on Snort.org.

These rules are: 52593 - 51596, 52604, 52605

↧

Stolen emails reflect Emotet's organic growth

January 16, 2020, 7:06 am

≫ Next: Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Foxit PDF Reader

≪ Previous: Microsoft Patch Tuesday — Jan. 2020: Vulnerability disclosures and Snort coverage

By Jaeson Schultz

Introduction

Emotet has a penchant for stealing a victim's email, then impersonating that victim and sending copies of itself in reply. The malicious emails are delivered through a network of stolen outbound SMTP accounts. This relatively simple email-man-in-the-middle social engineering approach has made Emotet one of the most prolific vehicles for delivering malware that we have seen in modern times.

Cisco Talos continues to monitor Emotet, constantly detonating Emotet samples inside of the ThreatGrid malware sandbox and elsewhere. We witness in real-time as email that purports to be from Emotet's victims begins to emanate through Emotet's network of outbound mail servers. Vigilant monitoring of both stolen SMTP credentials and outbound email allows Talos to extract meta-information regarding Emotet's latest victims and provides insight into networks where Emotet is actively spreading.

One of the most cunning aspects of Emotet's propagation is the way they use social engineering of personal/professional relationships to facilitate further malware infection. When receiving a message from a trusted friend or colleague, it is quite natural for recipients to think, "I can safely open this email attachment because it is in reply to a message I sent, or from someone I know." Any person or organization who has sent an email to an Emotet victim could be targeted by Emotet's propagation messages. The more interaction with the victim you have, the more likely you are to receive malicious email from Emotet. Like a meandering watering hole attack, this is how Emotet crosses organizational boundaries with the potential to affect entire industries or even countries.

Increased targeting of U.S. military and government

Emotet continues to infect individuals and organizations all over the world, so to say that it is "targeted" would be a stretch. However, if a person has substantial email ties to a particular organization, when they become infected with Emotet the effects would manifest in the form of increased outbound Emotet email directed at that organization.

One of the most vivid illustrations of this effect can be seen in Emotet's relationship to the .mil (U.S. military) and .gov (U.S./state government) top-level domains (TLDs). When Emotet emerged from its summer vacation back in mid-September 2019, relatively few outbound emails were seen directed at the .mil and .gov TLDs.

But sometime in the past few months, Emotet was able to successfully compromise one or more persons working for or with the U.S. government. As a result of this, Talos saw a rapid increase in the number of infectious Emotet messages directed at the .mil and .gov TLDs in December 2019. Now that Emotet is back from their Orthodox Christmas vacation, that trend has continued into January 2020.

The emails are coming from inside the house!

Looking at the individual messages sometimes allows us to determine the identity of the Emotet victim and whether that victim is internal or external to the recipient organization. After all, Emotet wants recipients of its messages to recognize who the message came from as part of their social engineering efforts. Unfortunately, this doesn't work 100 percent of the time, because some of the messages sent by Emotet strips the original victim's personal data and drops the TLD in an attempt to impersonate only the organization. This results in the unintentionally comical reduction of domains like "us.af.mil" to simply "Us.af."

However, more often, Emotet will leave the contact information for the individual victim inside the propagation email. The message may also include the contents of a previous email exchange between the two recipients, just to add extra authenticity. For example, the following message was sent by Emotet to an individual working for U.S. Sen. Cory Booker. The From header and signature generated by Emotet both suggest that this message originated from an infected colleague at "booker.senate.gov."

Another issue that is often overlooked is the exfiltration problem presented by Emotet. Users who have their email stolen and sent to Emotet's command and control (C2) infrastructure may have lost control over sensitive data and communications. For now, Emotet is content using this data to enhance its social engineering approach, but they could just as easily be reading/parsing the contents of these messages and acting/trading on the information contained therein.

Conclusion

If an organization in close proximity to yours becomes infected with Emotet, you can expect to receive an increased volume of infectious email messages addressed to your users. If Emotet infects any of the users inside your domain, then the volume of Emotet email destined for your network will increase. Many of these email messages arrive via hijacked email threads, so there is no simple pattern that anti-spam systems can use to identify and eliminate these messages. More advanced anti-spam systems, such as IPAS, will still be able to successfully filter Emotet messages. However, all technical systems no matter how robust must always be supplemented by educational efforts and awareness training for your users.

Coverage

Additional ways our customers can detect and block this threat are listed below.

Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), and Meraki MX can detect malicious activity associated with this threat.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

↧

Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Foxit PDF Reader

January 16, 2020, 7:56 am

≫ Next: Beers with Talos Ep. #70: Semper Vigilantes - Strategic Defense in a Cyber Conflict

≪ Previous: Stolen emails reflect Emotet's organic growth

Aleksandar Nikolic of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.

Cisco Talos recently discovered four remote code execution vulnerabilities in Foxit PDF Reader. Foxit PDF Reader is a popular program for reading and editing PDFs. The software supports

JavaScript to allow for interactive elements in PDF files — all of these vulnerabilities exist in the JavaScript capabilities of the program. An attacker could exploit any of these bugs by tricking the user into opening a malicious PDF in Foxit PDF Reader.

In accordance with our coordinated disclosure policy, Cisco Talos worked with Foxit to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

Foxit PDF Reader JavaScript field action validate remote code execution vulnerability

(TALOS-2019-0915/CVE-2019-5126)

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Read the complete vulnerability advisory here for additional information.

Foxit PDF Reader JavaScript field action OnBlur remote code execution vulnerability (TALOS-2019-0920/CVE-2019-5131)

Read the complete vulnerability advisory here for additional information.

Foxit PDF Reader JavaScript createTemplate invalid page code execution vulnerability (TALOS-2019-0935/CVE-2019-5130)

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Read the complete vulnerability advisory here for additional information.

Foxit PDF Reader JavaScript field keystroke action remote code execution vulnerability (TALOS-2019-0934/CVE-2019-5145)

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused, resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled, visiting a malicious site can also trigger the vulnerability.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that these vulnerabilities affect version 9.7.0.29435 of Foxit PDF Reader.

Coverage

Snort Rules: 52046, 52047, 51949 - 51952, 51737, 51738

↧

Beers with Talos Ep. #70: Semper Vigilantes - Strategic Defense in a Cyber Conflict

January 16, 2020, 9:05 am

≫ Next: Threat Source newsletter (Jan. 26, 2019)

≪ Previous: Vulnerability Spotlight: Multiple remote code execution vulnerabilities in Foxit PDF Reader

By Mitch Neff.

Beers with Talos (BWT) Podcast episode No. 70 is now available. Download this episode and subscribe to Beers with Talos:

If iTunes and Google Play aren't your thing, click here.

Recorded Jan. 6, 2020

There is a looming cyber conflict on the horizon between the U.S. and Iran. We use all our time this week to discuss the situation at hand and take a hard look at what you should have already done foundationally. The crew offers insight and analysis of what nation-state cyber conflict looks like and what you can do to elevate your security strategy to the next level in an uncertain time of increased suspicion.

The timeline:

00:45 — Roundtable: CATS! and other weird things.
11:00 — Iran rundown: Framing the situation and how nation-state actors work
17:50 — A period of increased suspicion; taking alerts to the ground
22:30 — Offense is tactical, but defense is a strategic game
29:30 — Lessons learned from NotPetya
35:30 — Beyond just the basics and defense-in-depth
41:30 — Open-source and lower-cost defense options
44:10 — Closing thoughts and parting shots

Links and resources:

==========

Featuring: Craig Williams (@Security_Craig), Joel Esler (@JoelEsler), Matt Olney (@kpyke) and Nigel Houghton (@EnglishLFC).
Hosted by Mitch Neff (@MitchNeff)

Subscribe via iTunes (and leave a review!)

Check out the Talos Threat Research Blog

Subscribe to the Threat Source newsletter

Follow Talos on Twitter

Give us your feedback and suggestions for topics: beerswithtalos@cisco.com

↧

Threat Source newsletter (Jan. 26, 2019)

January 16, 2020, 11:00 am

≫ Next: JhoneRAT: Cloud based python RAT targeting Middle Eastern countries

≪ Previous: Beers with Talos Ep. #70: Semper Vigilantes - Strategic Defense in a Cyber Conflict

Newsletter compiled by Jon Munshaw.

Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.

This wasn’t your average Patch Tuesday. Microsoft’s monthly security update was notable for a few reasons. For starters, it’s really time to give up Windows 7, since this is the last free update Microsoft will issue for the operating system.

There was also a vulnerability that made headlines for leaving Windows open to cryptographic spoofing, which could allow an attacker to sign a malicious file as if it came from a trusted source. The bug was so severe that Microsoft even reached out to the U.S. military ahead of time to issue them an early patch. For more on Patch Tuesday, you can check out our roundup here and our Snort rule release here.

Elsewhere in the vulnerability department, we also released new Snort rules to protect users against some notable Citrix bugs that have been used in the wild.

And, as always, we have the latest Threat Roundup where we go through the top threats we saw — and blocked — over the past week.

Upcoming public engagements

Cyber Security Week in Review

Apple once again denied the FBI’s request for the company to unlock an iPhone belonging to someone involved in a criminal investigation. The agency is attempting to access a device belonging to a man who shot and killed multiple people at a naval base last year.
This caused U.S. President Donald Trump to enter the fold. Trump tweeted that he was unhappy with Apple denying law enforcement access to devices "used by killers, drug dealers and other violent criminal elements.”
More than two weeks after a ransomware attack, foreign currency exchange service Travelex is finally resuming normal operations. The company recently said it was making “good progress” on recovery and was expecting customer-facing systems to return soon.
The Travelex attack prompted the U.S. government to release a new warning that users need to update their VPN services as soon as possible. Vulnerabilities disclosed last year in Pulse Secure VPN leave users open to cyber attacks similar to the ransomware infection on Travelex, according to the U.S. Cybersecurity and Infrastructure Security Agency.
The Democratic party in Iowa says it will still use a mobile app to report primary election results, despite warnings that it is a security risk. Election judges will use the apps to count polling results during the presidential primaries and report those results on their mobile devices, though officials say there will be paper backups to verify the results.
The estimated cost of a recent cyber attack on the city of New Orleans is above $7 million, $3 million of which the city says it will recoup from its cyber insurance policy. Officials say it will still take months to rebuild their internal network, and departments are still digging out from having to manually carry out many functions for weeks.
The U.S. election security czar warned that attempts to interfere in the U.S.’ upcoming presidential election will be more sophisticated than ever. Shelby Pierson said at a recent presentation America is tracking several hacking groups, including a recent effort uncovered to breach a Ukrainian company at the center of President Donald Trump’s impeachment trial.
A critical vulnerability in a popular WordPress plugin leaves more than 300,000 sites open to attack. An attacker could exploit a bug in InfiniteWP to log in as an administrator on any affected site.
Android devices infected with the Faketoken malware began sending offensive SMS messages last week. It sends these messages to foreign numbers, potentially costing the victim money based on their carrier’s policies.
The U.S. may invest more than $1 billion into researching alternatives for 5G to avoid working with Chinese tech companies Huawei and ZTE. Legislation submitted in the Senate urged America to counter the Chinese government’s investment in the telecom space.

Notable recent security issues

Title: Microsoft patches 49 vulnerabilities as part of Patch Tuesday
Description: Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. Patch Tuesday covers 49 vulnerabilities, eight of which are considered critical. This month's security update is particularly important for its disclosure of two vulnerabilities related to a core cryptographic component in all versions of Windows. CVE-2020-0601 could allow an attacker to use cryptography to sign a malicious executable, making the file appear as if it was from a trusted source. The victim would have no way of knowing if the file was malicious. Cyber security reporter Brian Krebs says the vulnerability is so serious, Microsoft secretly deployed a patch to branches of the U.S. military prior to today.
Snort SIDs: 52593 - 51596, 52604, 52605

Title: ZeroCleare wiper malware deployed on oil refinery
Description: ZeroCleare, a wiper malware connected to an Iranian hacker group, was recently deployed against a national oil refinery in Bahrain. An upgraded version has been spotted in the wild, according to security researchers, which can delete files off infected machines. The latest attacks match previous attacks using this malware family, which have gone after other targets connected to Saudi Arabia. Concerns over Iranian cyber attacks have spiked since the U.S. killed a high-profile Iranian general in a drone strike.
Snort SIDs: 52572 – 52581

Most prevalent malware files this week

SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg

SHA 256: d73ea76f6f07f96b337335213418b58e3fbc7e4b519fec0ef3fbd19c1d335d81
MD5: 5142c721e7182065b299951a54d4fe80
Typical Filename: FlashHelperServices.exe
Claimed Product: Flash Helper Service
Detection Name: PUA.Win.Adware.Flashserv::1201

SHA 256: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
MD5: e2ea315d9a83e7577053f52c974f6a5a
Typical Filename: c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f.bin
Claimed Product: N/A
Detection Name: W32.AgentWDCR:Gen.21gn.1201

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201

SHA 256: da231330efd623bc7d116ed233828be88951b9df7cc889e747d31279bdf2c2a0
MD5: 4a4ee4ce27fa4525be327967b8969e13
Typical Filename: 4a4ee4ce27fa4525be327967b8969e13.exe
Claimed Product: N/A
Detection Name: PUA.Win.File.Coinminer::tpd

Keep up with all things Talos by following us on Twitter. Snort, ClamAV and Immunet also have their own accounts you can follow to keep up with their latest updates. You can also subscribe to the Beers with Talos podcast here (as well as on your favorite podcast app). And, if you’re not already, you can also subscribe to the weekly Threat Source newsletter here.

↧

JhoneRAT: Cloud based python RAT targeting Middle Eastern countries

January 17, 2020, 1:37 am

≫ Next: Threat Roundup for January 10 to January 17

≪ Previous: Threat Source newsletter (Jan. 26, 2019)

By Warren Mercer, Paul Rascagneres and Vitor Ventura with contributions from Eric Kuhla.

Updated January 17th: the documents do not exploit the CVE-2017-0199 vulnerability.

Executive Summary

Today, Cisco Talos is unveiling the details of a new RAT we have identified we're calling "JhoneRAT." This new RAT is dropped to the victims via malicious Microsoft Office documents. The dropper, along with the Python RAT, attempts to gather information on the victim's machine and then uses multiple cloud services: Google Drive, Twitter, ImgBB and Google Forms. The RAT attempts to download additional payloads and upload the information gathered during the reconnaissance phase. This particular RAT attempts to target a very specific set of Arabic-speaking countries. The filtering is performed by checking the keyboard layout of the infected systems. Based on the analysed sample, JhoneRAT targets Saudi Arabia, Iraq, Egypt, Libya, Algeria, Morocco, Tunisia, Oman, Yemen, Syria, UAE, Kuwait, Bahrain and Lebanon.

What's new? The campaign shows an actor that developed a homemade RAT that works in multiple layers hosted on cloud providers. JhoneRAT is developed in Python but not based on public source code, as it is often the case for this type of malware. The attackers put great effort to carefully select the targets located in specific countries based on the victim's keyboard layout.

How did it work? Everything starts with a malicious document using a well-known vulnerability to download a malicious document hosted on the internet. For this campaign, the attacker chose to use a cloud provider (Google) with a good reputation to avoid URL blacklisting. The malware is divided into a couple of layers — each layer downloads a new payload on a cloud provider to get the final RAT developed in Python and that uses additional providers such as Twitter and ImgBB.

So what? This RAT is a good example of how a highly focused attack that tries to blend its network traffic into the crowd can be highly effective. In this campaign, focusing detection of the network is not the best approach. Instead, the detection must be based on the behaviour on the operating system. Attackers can abuse well-known cloud providers and abuse their reputations in order to avoid detection.

Opsec and targeted countries

The fact that this attacker decided to leverage cloud services and four different services — and not their own infrastructure — is smart from an opsec point of view. It is hard for the targets to identify legitimate and malicious traffic to cloud provider infrastructure. Moreover, this kind of infrastructure uses HTTPS and the flow is encrypted that makes man-in-the-middle interception more complicated for the defender. It is not the first time an attacker used only cloud providers.

User-agent #1

User-agent #2

User-agent #3

Even while using these services, the authors of this JhoneRAT went further and used different user-agent strings depending on the request, and even on the downloaders the authors used other user-agent strings.

We already published a couple of articles about ROKRAT (here, here, here and here) where another unrelated actor, Group123, made the same choice but with different providers.

The attacker implemented filtering based on the keyboard's layout.

Keyboard layout check

The malware is executed only for the following layout, the country is based on the Microsoft website:

'0401' -> Saudi Arabia
'0801' -> Iraq
'0c01' -> Egypt
'1001' -> Libya
'1401' -> Algeria
'1801' -> Morocco
'1c01' -> Tunisia
'2001' -> Oman
'2401' -> Yemen
'2801' -> Syria
'3801' -> UAE
'3401' -> Kuwait
'3c01' -> Bahrain
'3001' -> Lebanon

Malicious documents

Decoy document

We identified three malicious Microsoft Office documents that download and load an additional Office document with a Macro. The oldest one from November 2019, named "Urgent.docx," is shown below:

Initial decoy document

The author of the document asks to enable editing in English and in Arabic.

The second document from the beginning of January is named "fb.docx" and contains usernames and passwords from an alleged "Facebook" leak:

Second decoy document

The more recent document is from mid-January and alleged to be from a United Arab Emirate organization. The author blurred the content and asks the user to enable editing to see the content:

Third decoy document

Macro loading

In the three documents, an additional Office document containing a Macro is downloaded and executed. The documents are located on Google Drive.

Malicious documents on Google Drive

Infection workflow

Stage No. 1: Malicious template on Google Drive

The template located on Google Drive contains a macro. The macro contains a virtual machine detection technique based on the serial number of the disks available in the victim environment. Indeed, some VMs do not have serial numbers and the macro is executed only if a serial number exists. A WMIC command is executed to get this information on the targeted system.

Macro WMI check

If a serial number exists, the rest of the code is executed. The purpose is to download an image from a new Google Drive link:

Image download

It is interesting to note that the filename of the downloaded image is randomly generated based on a dictionary: Array ("cartoon," "img," "photo"). The filename will be cartoon.jpg or img.jpg or photo.jpg and the image usually depicts a cartoon.

Stage No. 2: Image file on Google Drive

The image file is a real image with a base64-encoded binary appended at the end.

Image No. 1

The malware author has a curious sense of humor.

Image No. 2

The base64 data and image are separated by the "****" string:

Image and payload separation

The decoded binary filename is also randomly generated based on a dictionary: Array ("proc", "chrome", "winrar"). It can be proc.exe or chrome.exe or winrar.exe.

Stage No. 3: Autoit file

The decoded base64 data is an AutoIT binary. This binary downloads a new file on Google Drive.

AutoIT downloader

The filename is also randomly generated based on a dictionary $ARRAY[5]=["prc","winrar","chrome","sync","COM surr"].

Stage No. 4: Python RAT using cloud providers

The final payload is a remote access tool (RAT) written in Python. We named this RAT "JhoneRAT." The Python code is wrapped into an executable using pyinstaller. It uses minimal obfuscation applied only on variables and function naming.

RAT startup

The RAT starts by launching three threads. The first is responsible for checking if the system has the targeted keyboard layout — this is exclusively in Arabic-speaking countries. The second will create the persistence and, finally, the last one to be started is the main cycle for the RAT. As we explained before, the RAT targets specific countries by checking the keyboard's layout. In fact, this is one of the first checks it performs when it is executed. The persistence is achieved by adding an entry with the name "ChromeUpdater" to the 'Software\\Microsoft\\Windows\\CurrentVersion\\Run' .

Command and control communications

This RAT uses three different cloud services to perform all its command and control (C2) activities. It checks for new commands in the tweets from the handle @jhone87438316 (suspended by Twitter) every 10 seconds using the BeautifulSoup HTML parser to identify new tweets. These commands can be issued to a specific victim based on the UID generated on each target (by using the disk serial and contextual information such as the hostname, the antivirus and the OS) or to all of them:

Command fetching

Command parsing

The exfiltration, however, is done via other cloud providers. The screenshots are exfiltrated via the ImgBB website:

The remaining commands send feedback by posting data into Google Forms:

Finally, the RAT is able to download files encoded in base64 on Google Drive:

Feature-wise, the RAT has three commands:

Take a screenshot and upload it to ImgBB.
Download binary disguised has a picture from Google Drive and execute it.
Execute a command and send the output to Google Forms.

Anti-VM, anti-decompiler and no header

The attacker put a couple of tricks in place to avoid execution on virtual machines (sandbox). The first trick is the check of the serial number of the disk. The actor used the same technique in the macro and in the JhoneRAT. By default, most of the virtual machines do not have a serial number on the disk.

The attacker used a second trick to avoid analysis of the Python code. The actor used the same trick that FireEye in the Flare-On 6: Challenge 7: They removed the header of the Python bytecode. It can be perfectly executed without the header, but tools such as uncompyle6 need this header:

$ uncompyle6 final2

ImportError: Unknown magic number 227 in final2

Additionally, the generated code by uncompyle6 varies depending on the version and the impact is important.

Here is a condition generated with uncompyle6 version 3.3.5:

The same code generated with uncompyle6 version 3.6.2:

Based on our analysis and the behaviour of the executed malware, the correct interpretation is the first one based on the oldest version of uncompyle6.

For this specific condition, it is important because it's filtering on the keyboard layout to identify the targets.

Conclusion

This campaign shows a threat actor interested in specific Middle Eastern and Arabic-speaking countries. It also shows us an actor that puts effort in opsec by only using cloud providers. The malicious documents, the droppers and the RAT itself are developed around cloud providers. Additionally the attackers implemented anti-VM (and sandbox) and anti-analysis tricks to hide the malicious activities to the analyst. For example, the VM or the sandbox must have the keyboard layout of the targeted countries and a disk serial number. This campaign started in November 2019 and it is still ongoing. At this time, the API key is revoked and the Twitter account is suspended. However, the attacker can easily create new accounts and update the malicious files in order to still work. This campaign shows us that network-based detection is important but must be completed by system behaviour analysis.

IOCs

Docx:

273aa20c4857d98cfa51ae52a1c21bf871c0f9cd0bf55d5e58caba5d1829846f
29886dbbe81ead9e9999281e62ecf95d07acb24b9b0906b28beb65a84e894091
d5f10a0b5c103100a3e74aa9014032c47aa8973b564b3ab03ae817744e74d079

Template:

6cc0c11c754e1e82bca8572785c27a364a18b0822c07ad9aa2dc26b3817b8aa4

Image:

7e1121fca3ac7c2a447b61cda997f3a8202a36bf9bb08cca3402df95debafa69

PE Autoit:

b4a43b108989d1dde87e58f1fd6f81252ef6ae19d2a5e8cd76440135e0fd6366

PE Python:

4228a5719a75be2d6658758fc063bd07c1774b44c10b00b958434421616f1548

URL:

hxxps://drive[.]google[.]com/uc?export=download&id=1vED0wN0arm9yu7C7XrbCdspLjpoPKfrQ

hxxps://drive[.]google[.]com/uc?export=download&id=1LVdv4bjcQegPdKrc5WLb4W7ad6Zt80zl

hxxps://drive[.]google[.]com/uc?export=download&id=1OlQssMvjb7gI175qDx8SqTgRJIEp5Ypd

hxxps://drive[.]google[.]com/uc?export=download&id=1d-toE89QnN5ZhuNZIc2iF4-cbKWtk0FD

hxxps://drive[.]google[.]com/uc?export=download&id=1kbHVkvPIjX49qJ62TBz6drW2YPiiaX2a

hxxps://twitter[.]com/jhone87438316

↧

Threat Roundup for January 10 to January 17

January 17, 2020, 2:55 pm

≫ Next: Vulnerability Spotlight: Bitdefender BOX 2 bootstrap remote code execution vulnerabilities

≪ Previous: JhoneRAT: Cloud based python RAT targeting Middle Eastern countries

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 10 and Jan. 17. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found herethat includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.
The most prevalent threats highlighted in this roundup are:

Threat Name	Type	Description
Win.Trojan.Chthonic-7516291-1	Trojan	Chthonic is a banking trojan derived from the Zeus family of banking malware. It is typically spread via phishing emails and attempts to steal sensitive information from an infected machine. Chthonic has also been observed downloading follow-on malware such as Azorult, another information stealer.
Win.Dropper.Upatre-7524255-0	Dropper	Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.
Win.Malware.TrickBot-7524669-1	Malware	Trickbot is a banking trojan targeting sensitive information for certain financial institutions. This malware is frequently distributed through malicious spam campaigns. Many of these campaigns rely on downloaders for distribution, such as VB scripts.
Doc.Dropper.Emotet-7540598-0	Dropper	Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a wide variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails. Talos recently discovered an uptick in Emotet distribution. For more, click here.
Win.Packed.njRAT-7532636-1	Packed	njRAT, also known as Bladabindi, is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.
Win.Malware.Cerber-7533438-1	Malware	Cerber is ransomware that encrypts documents, photos, databases and other important files. Historically, this malware would replace files with encrypted versions and add the file extension ".cerber," although in more recent campaigns other file extensions are used.
Win.Packed.Barys-7532466-0	Packed	This is a trojan and downloader that allows malicious actors to upload files to a victim's computer.
Win.Packed.Razy-7532659-0	Packed	Razy is oftentimes a generic detection name for a Windows trojan. It collects sensitive information from the infected host and encrypt the data, and send it to a command and control (C2) server. Information collected might include screenshots. The samples modify auto-execute functionality by setting and creating a value in the registry for persistence.
Win.Packed.Dridex-7532883-1	Packed	Dridex is a well-known banking trojan that aims to steal credentials and other sensitive information from an infected machine.

Threat Breakdown

Win.Trojan.Chthonic-7516291-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED Value Name: Hidden`	11
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: EnableLUA`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: Start`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: Start`	11
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED Value Name: ShowSuperHidden`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS Value Name: Start`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: Start`	11
`<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WUAUSERV Value Name: Start`	11
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 2827271685`	11
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER Value Name: TaskbarNoNotification`	11
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER Value Name: TaskbarNoNotification`	11
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER Value Name: HideSCAHealth`	11
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER Value Name: HideSCAHealth`	11
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN`	11
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN Value Name: 2827271685`	11

Mutexes	Occurrences
`Frz_State`	11

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`40[.]91[.]124[.]111`	11
`208[.]100[.]26[.]245`	11
`40[.]67[.]189[.]14`	5
`20[.]45[.]1[.]107`	5
`40[.]90[.]247[.]210`	2

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`www[.]update[.]microsoft[.]com[.]nsatc[.]net`	11
`trokelnopartunofroner[.]com`	11
`mplusworldofficeupdates[.]com`	11
`imaginyourselfuafe[.]com`	11
`ltdcommprovvetverify[.]com`	11

File Hashes

             085b7d3df5bdf13484ad58dc9b34431a98117f0d267ac3aba91cfc0b384ea35f              11185553d3e040f23efc0b0d1a9f0dc813e76cdb84174efcc785193c6d525535              149e6ff5bb2d0d3abdc7fabd4e3f6be1c563e4b57e035ee30b71a7d04c02ef8f              6fb1c35d7c0cf7f33a162c4c4eb99d6c5866880318db7781a34d9e005264985e              72c636ace54abacf4eb3e6e3a4c695e6c2c160dc6097666b249df34f46489b97              7ccdcf694abe81e19e7afc091d2b614872695e6cd9d90abab21622689bf5555d              8549f3a0383c7d65c869c0eba84960011afe71eb501eb90921066992f0b03833              9116b4c639cedb801e6b9a4891cf5af8e61a7d2f1e54390858f0f5e63dff8f42              9b3ad135a115671e8c960f353dd1805a6bbcedb2f9bf866f366bd9410a601862              e03e7f3f2d272bb18bfd138006cadf905b0fd45028327a3ec556ef1cba7c96fc              e8da03e309d09fbe36a215769cf0f4b3f8b93cbf3137db0d4db77ce4bde4e534

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Win.Dropper.Upatre-7524255-0

Indicators of Compromise

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`91[.]211[.]17[.]201`	28
`173[.]216[.]240[.]56`	27
`38[.]124[.]169[.]187`	27
`188[.]231[.]34[.]130`	27
`176[.]108[.]102[.]76`	27
`104[.]20[.]17[.]242`	19
`104[.]20[.]16[.]242`	8
`174[.]96[.]234[.]86`	1
`69[.]77[.]155[.]3`	1
`38[.]124[.]169[.]178`	1
`38[.]123[.]202[.]3`	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`icanhazip[.]com`	28

Files and or directories created	Occurrences
`%TEMP%\PRTY8D97.txt`	27
`%TEMP%\prityviewer.exe`	27
`%TEMP%\scsiAFCF.log`	1
`%TEMP%\scsvii.exe`	1

File Hashes

             00592846d2880dfa06ea2bb489b90c1a626bc62664e6933cbcb163cea32e1b70              006c6f0e053a633347afb8e2dc1c5f9a3c732fe654844b32c8efa7fb1b6929f7              0105ed02beac29702244d7f1f2b727d3c53e49590626773e5eefb154d626e469              0120db2a1e9c321da2c654f924c48d44f8db9c32e5cecf62f782e5fd3750ed6d              01a44cd682b97252135d9afb72061db7e8ceb87530de59b081bc13481492dbe5              01d5a8081730c45cd3c16bed3572ac37f767422435975961e783eada059f9f57              0246b510696d6e82f4ef63bd567d00fde0b1a5d8c84b5461a53003c9dbf0a507              0293c190511688dd93a031763139557febc330bb1800334e37d14d0c63ecd466              0349359919a3db6665112c77b8687ad370dfb99bd592a8af0efd7fb32e94d9c4              03b212420fccffb3f96bdb68c7952c408ea8e36d0333d8e63048f8d086a88eec              0437d8df6d2cd8b97959b30c2bf8d875ca3832c055e7f26777459f6db0ccd451              04ab31cd4de8cb6313b676c2e511e3ac477c44dcfe9cfe4a62cf77ce81b1e1a3              04f9d97774c2545c681c1463aa5abcd09355e54345bb03e7cc4105ba1ed7303c              052e7d7d29ebb25c5ab42b7262ae657e20f727c48d63f1223503e3f03daa49ad              05f64082854e6332a3ca42f5b25b8c79569f0b03b84568f26bf997efdd334eec              0607df27c26a55485cfdd78c25ca4b02ff5ebdcde2f3bd5b9265eb366e94b6a5              064cb169eae962f176d84cf3ef074871410ca3bab11bf23ce64df46e036a5b7f              0669e65c645527ae11a544a4eea34fd7d4eb7e33a73b26b6dba3399e083b36c8              07ed2f34b113fb661022915db582d15f13c3734fe6ddda2ada51464f7213f192              09239e11b17a303b9e5f02bdd6b1fcf3fdd54de6ff94b3c49bec7b3230548673              092c3f850fa506c6439ac87a9107a0b5504c0025199d7fac8961c01f873adf82              094adba281d8f8a02207f46f90d4c284ce4f1ba47f1fce53d95a068017e9c159              0970d4111acc10bf407b0babfee1c184a604e6be22318f0474afdf50b26daa33              097bea67fb8fcc721538a887ac5a4c9214489cb7c61b278b2db997c17fc51442              0b291d9eebdd2055da99fd4bc56baad1ba06d87aae0e66e7ddfe9c23953c3a29

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

Win.Malware.TrickBot-7524669-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\V1-TZEVE4`	1
`<HKCU>\SOFTWARE\V1-TZEVE4 Value Name: exepath`	1
`<HKCU>\SOFTWARE\V1-TZEVE4 Value Name: licence`	1

Mutexes	Occurrences
`Global\316D1C7871E10`	41
`Remcos_Mutex_Inj`	1
`v1-TZEVE4`	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`188[.]120[.]254[.]68`	17
`78[.]24[.]223[.]88`	12
`198[.]23[.]209[.]201`	11
`185[.]177[.]59[.]163`	11
`5[.]182[.]210[.]109`	10
`181[.]113[.]28[.]146`	9
`164[.]68[.]120[.]60`	8
`185[.]213[.]20[.]246`	7
`195[.]123[.]220[.]178`	7
`181[.]112[.]157[.]42`	6
`146[.]185[.]253[.]191`	5
`5[.]2[.]70[.]145`	5
`188[.]165[.]62[.]34`	5
`185[.]141[.]27[.]190`	4
`69[.]195[.]159[.]158`	3
`181[.]129[.]104[.]139`	3
`45[.]137[.]151[.]198`	3
`51[.]89[.]115[.]124`	3
`172[.]82[.]152[.]11`	3
`172[.]217[.]9[.]243`	2
`52[.]55[.]255[.]113`	2
`190[.]214[.]13[.]2`	2
`181[.]140[.]173[.]186`	2
`45[.]125[.]1[.]34`	2
`79[.]174[.]12[.]245`	2

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`checkip[.]amazonaws[.]com`	4
`wtfismyip[.]com`	3
`www[.]myexternalip[.]com`	2
`api[.]ip[.]sb`	2
`api[.]ipify[.]org`	2
`250[.]5[.]55[.]69[.]zen[.]spamhaus[.]org`	1
`myexternalip[.]com`	1
`icanhazip[.]com`	1
`ipinfo[.]io`	1

Files and or directories created	Occurrences
`%TEMP%\<random, matching '[A-F0-9]{4,5}'>.dmp`	42
`%TEMP%\<random, matching '[a-f0-9]{3,5}'>_appcompat.txt`	42
`%APPDATA%\DirectTools\data`	31
`%System32%\Tasks\Direct Tools Update`	31
`%APPDATA%\DirectTools\settings.ini`	31
`%APPDATA%\DirectTools`	31
`%APPDATA%\DIRECTTOOLS\<original file name>.exe`	31
`%APPDATA%\gpuhealth`	10
`%System32%\Tasks\Task Gpu health`	10
`%APPDATA%\gpuhealth\data`	10
`%APPDATA%\gpuhealth\settings.ini`	10
`%APPDATA%\GPUHEALTH\<original file name>.exe`	10
`%APPDATA%\DirectTools\Data\pwgrab64`	2
`%System32%\Tasks\shadowdev`	1
`%APPDATA%\DirectTools\data\pwgrab64_configs`	1
`%APPDATA%\DirectTools\data\pwgrab64_configs\dpost`	1

File Hashes

             0267975d981105107f8003e7a84490d0871017449352a72ecf010ee3639d99b7              0eae61f5dde95c34cf6e6a225a55c8b34ad0149b4c92c96cac7e1dd67d7423d5              1100664b904de4aaeab06a193bb1f0d6e57f0ff0407a2a836e592751ebfac142              12707680fc20d5ed8f75ee6591f81c334a096c96d6866d1ac4caa719fc55ddbc              1c63d9a293d05e5f598a169969ffd39ba0739e17740ba5205323cfa9b2a692dd              209ee235c5ae5b120a8aca752b365519aa91531ef806ed32741f7058b4c4c4fa              2b952b15f735ae3852a5b1add3dfd56b51217b073064f3cccea83b145f3e2f09              2ea8f522a5a55daafca651634e4f269f4fe7e42f222bd92f732e8c3695667c69              2eb32d3912f7e2bff7827040a76cb5b4bee6e56cec7a09b751fbc04085cf87bd              324b9688d45acf12410b42e8ce2532f5a1d077361e905c9ef69bbc812d24a01f              43de46a37c7dc56a5919babc661e2fcfcd611f1d3ff92dbdcd5a61bfeea9b79f              4ab4a600b2c75dfda7438714bc6a2cc87123b95f21372bcdcf5aa33ff73dac74              4c2fdeacf1fccac0fcdc064a5ae38065950531b7f03c2c40b5068379a591394d              4ecc86000dcc587fdf491e6589961d9523b33aa85533f61638278f8f1fd537df              539e39809bcc3ace9256394c5ce3e7626c242d4580c3a15d0a1cc5eab75b4b9f              58b8be166449de4ea71a103e65d7c45e52cc8d6bd95ac0787eecfe8dd12f980f              5cbb5ace573160c815b2e56d85e8bf5092be22887f23e28af9c6fe3fef7039ab              6f1468021e0606d3021c19630e0bd05eb721111f00c2d203efae6bf23f617a1b              75d658a651fa2fdba6930d2a6b6d2ce7491a4b87d214eb830ea3f23cd329c011              76c73a2c8f85847cb72a1ddfe56a3e728598c3a47c94cce44bd9967237039ef5              7d45d177e653e36ae3fb598b0d17acc4895795712fa53c3deb5ba4137b30e73c              7ea58adcd3598f10aa2e81557b20e52db1ef0c89071c28cdc5143af8f9ec02be              87ad53b54453925c0ced0e0f71bbbec7ba9b08afb2f827642dc55e86c0dcb8e9              8b50aa0fc83663e01ddbd06ae779ea3fdf30eaa1a63d6ad385fdca3ec17fd6cc              8b8a7b9fdb397a75cd51d720e32aebc016b2b1947478311f39929a9a43de81b9

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

Doc.Dropper.Emotet-7540598-0

Indicators of Compromise

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`100[.]96[.]181[.]72`	18
`100[.]94[.]213[.]157`	18
`100[.]74[.]125[.]242`	18
`100[.]74[.]241[.]31`	18
`100[.]117[.]63[.]68`	18

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`www[.]dailygks[.]com`	18
`idnpoker[.]agenbolaterbaik[.]city`	18
`dobrovorot[.]su`	18
`casiroresources[.]com`	18
`isague[.]com`	18

Files and or directories created	Occurrences
`%HOMEPATH%\126.exe`	18
`%TEMP%\CVRE39.tmp`	1

File Hashes

             0e42ea2ebecf3779a9341c0375c8b71f60a88801b3a717d8fe5dec4a2bbee37c              2853b45864dd97b3be97f9acfcc6be83c6024d9b4e5b48d6b56a8c622e106b5e              2c2254c79ef6d0fc9a3c4bb9b865a2694ba00b791042f6f806dc8ae48ff07fa3              35a6c928ace899581d72bbb94aecb90fc54a9ef85b852a12cc77ec1a7fd4a239              3cec47fd33c8debe5e4cee8126ce9d3c977ae39d9baf454f86dd73ba82a87076              3e73a141bcf5c7a18d8fdc94f34102c1e765c5b0f37ff11c1d122463c4629d38              5a0ddb6c22ebb84af02651396e07204801bee4889965dc943cf6e16035771b87              617c999b2244b6e1a787a80a64f8818ae99a0bbd3c5603f95bdc6682c399a1c1              66974cd3270a8bf0aa4af9105ce84960ae7c7425b120b0045624f2615dbcf842              67812a5d87377778d7c2586585d30d7ab4ab6c2c9334844004c12badd5b72eba              71c8341327d3285f1f3c7ad62fdc102fd6a662c68a2f3a98eac7d0d9f5d6ea7b              92ad35b60997f88c37b57dc1fbb525217375289fab05ea7ba5d6c67ed1d00edf              947dd402232ac165d5c9286e67996e725bfe0c530f969aacea44e7979676fb45              aeed3ac02a448f72ef07047693ee9292d68a54049923a1ec4a53694d517cf048              b29038b3debfd28466ba4ea6e626143187bcd998bf442048a56f4737eb0d85fd              d1a0bf24f3c653cd6c7f75b8c51c92cec21fc74d04ce8749bf68a5ad7e40b151              d2be052e9a55cc6eada8d74f6b5c614584588797ee7107e17b2811fb47e3d724              eff598d5a0c0ecaa0d8243173520ef331e71fb60c33b94d24932219c9e27abb9

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Packed.njRAT-7532636-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKU>\S-1-5-21-2580483871-590521980-3826313501-500 Value Name: di`	22
`<HKCU>\ENVIRONMENT Value Name: SEE_MASK_NOZONECHECKS`	22
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: ParseAutoexec`	22
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 9b900e9e6a204ac0d795c328b297a541`	1
`<HKCU>\SOFTWARE\9B900E9E6A204AC0D795C328B297A541 Value Name: [kl]`	1
`<HKCU>\SOFTWARE\3E80006ED1A558F4A4E8C67B4482A653`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 3e80006ed1a558f4a4e8c67b4482a653`	1
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 3e80006ed1a558f4a4e8c67b4482a653`	1
`<HKCU>\SOFTWARE\3E80006ED1A558F4A4E8C67B4482A653 Value Name: [kl]`	1
`<HKCU>\SOFTWARE\BAC5BD34B5EC131B955ED0D6686691C0`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: bac5bd34b5ec131b955ed0d6686691c0`	1
`<HKCU>\SOFTWARE\8B9C85CEA1B5BC95470D5B663265ABBA`	1
`<HKCU>\SOFTWARE\EE265A490F50F82D7DA78B5AFC5D4BF1`	1
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: bac5bd34b5ec131b955ed0d6686691c0`	1
`<HKCU>\SOFTWARE\BAC5BD34B5EC131B955ED0D6686691C0 Value Name: [kl]`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 8b9c85cea1b5bc95470d5b663265abba`	1
`<HKCU>\SOFTWARE\EE265A490F50F82D7DA78B5AFC5D4BF1 Value Name: [kl]`	1
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 8b9c85cea1b5bc95470d5b663265abba`	1
`<HKCU>\SOFTWARE\8B9C85CEA1B5BC95470D5B663265ABBA Value Name: [kl]`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: driver`	1
`<HKCU>\SOFTWARE\1BB40C47BEAE292B8957771D185E2963`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 1bb40c47beae292b8957771d185e2963`	1
`<HKCU>\SOFTWARE\E44B3D2D77E82BFAA8FBE232C3FAC08B`	1
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 1bb40c47beae292b8957771d185e2963`	1
`<HKCU>\SOFTWARE\1BB40C47BEAE292B8957771D185E2963 Value Name: [kl]`	1

Mutexes	Occurrences
`<32 random hex characters>`	22
`Random`	3

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`46[.]246[.]13[.]73`	1
`41[.]97[.]3[.]243`	1
`41[.]102[.]190[.]225`	1
`91[.]109[.]176[.]6`	1
`84[.]236[.]13[.]94`	1
`41[.]226[.]95[.]248`	1
`197[.]167[.]16[.]253`	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`cadastroseguro2016[.]ddns[.]net`	3
`kounan-19[.]no-ip[.]org`	1
`sasbab[.]ddns[.]net`	1
`pubguk[.]linkpc[.]net`	1
`najor123[.]ddns[.]net`	1
`neonka99[.]ddns[.]net`	1
`no`	1
`skyfall2017[.]ddns[.]net`	1
`service-updater[.]hopto[.]org`	1
`eslam[.]no-ip[.]org`	1
`tigano0724[.]myq-see[.]com`	1
`ghostprocess[.]no-ip[.]info`	1
`taki[.]ddns[.]net`	1
`crazyevil3[.]ddns[.]net`	1
`systemo32[.]publicvm[.]com`	1
`rooowl1999[.]no-ip[.]biz`	1
`kamel23[.]noip[.]me`	1

Files and or directories created	Occurrences
`%APPDATA%\svchost.exe`	4
`%TEMP%\server.exe`	4
`%TEMP%\<random, matching '[a-z]{4,9}'>.exe`	4
`%APPDATA%\server.exe`	2
`%APPDATA%\svhost.exe`	1
`%HOMEPATH%\server.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\16d577f1045ea00e0472332fe1885e1f.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\2eed382eb0cd52422d5fda835a5d88b5.exe`	1
`%TEMP%\pc.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\df76fe148f41309232d46b5526143610.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\8d580f86972cdfde2bbd41845bc851f9.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\32814b0ea96b317a805dd9174ee7c5c4.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ee28203cdc477e7ad13344342ffe1e0b.exe`	1
`%TEMP%\Internet Explorer.exe`	1
`%APPDATA%\winziy.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\9b900e9e6a204ac0d795c328b297a541.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3e80006ed1a558f4a4e8c67b4482a653.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\8b9c85cea1b5bc95470d5b663265abba.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\driver.url`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\driver.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\1bb40c47beae292b8957771d185e2963.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\e44b3d2d77e82bfaa8fbe232c3fac08b.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\c4d9b868e64e2ec7e7f1e04c6e64ac91.exe`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\213668f5f21ad17f1b3d939134e17f24.exe`	1
`%APPDATA%\winx.exe`	1

*See JSON for more IOCs

File Hashes

             0462bc4b60370728471971b9326c2e1540370809292ffd6cb5791a61df705bf9              0b331c29e38da9fe5fe00f40e2af43a4ac960ce48539b34e6d506c3b54a49920              162616259b6591503807bda2b9228c88409f4a71c085bc4b39d5eef2b64213c9              1846cfe96f4733d9cc7620cff603abdf1c44fe2f84d34daa79c14b04a726357d              21f09de33d10673fb5f8c2f1cf5924f5b81019e037a44b7f151da61b84c85b0d              275e4d554f63db96a64bbca5f0b30ab96199c8595ea0c3c2d46a413f30387a2f              2b140d53ec1d99cc07662d85f14bae2a4e6cfea3b7d66da0b31be4ecd641bae1              2c55658cf368c0f4f16b9f142e6ee6adb91362c79eb5ecab77d93852b35b7599              3022c3729827f0f7ea739b18b073e6c488ce6481eedaae147cc33738401d131e              339e7b601f00ee4b80af2645e1e39a8b71901d328d1c56e4f42e7ba74f16b618              3d8b6537791fe4f05043a40cc0cff83fb5ae54396c40fded6daae018a7a03c0e              437d2adb9946aeb1e630619e4aa571149d2adedeea8f6d0c39c1bed21c4063cb              459304f70aa2e992bdaed0915ec96cda9c99c6edde30698197319f8fa40a4024              461ec9be4e72154e7faebde91b452dbf0c22281405f0966eeddf69330f91ad2d              51e865bd11fd5daff52c74c0072c6e713535d4a90d5b1398b78c806be1a59dc9              53b7c2eadbb2686d6bcfed439d656df597b396f0004b086a9aad6806e7810256              63779c53cc4ab5d02daadffdd2f7b93b3bfc1a137eb1e5a895d7e2b8393f42a5              6b1bbec6381d6c95ef40d1ddb1ffbc015777d30686d9ba4353857f35b5947e15              6e178460a0f54a86e71df31ac2e90ffbaaf00a41ce9722257613f33ed9acc892              79d129fd698fbf62084545a105e6bd3cc027435a42ae3eb48c3e62c6e2ec461e              80aab48e04978ab54b4a50bba68286d1f03af19b27e78e8263b360d10c7f5904              84bddfdc96745d0be34f31be3b7e4160db6e04fa7d7648ebf03b81807841bffb              86da48f0943d29d940c8ea86a26695026e0a3b5ff74c08cd1189d84e05a57d97              8789bba00344fcb155e891679121b770a4daabe0171a78fccbef5b92322f4105              8ac101bcbb0a30f23ff1f7fb341a3daaa7ff13f045c0e812ac9f6c5079ef82af

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

Win.Malware.Cerber-7533438-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED Value Name: Hidden`	25
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED Value Name: ShowSuperHidden`	25
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED Value Name: SuperHidden`	25
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER Value Name: Run`	25
`<HKCU>\SOFTWARE\MICROSOFT\COMMAND PROCESSOR Value Name: AutoRun`	25
`<HKCU>\CONTROL PANEL\DESKTOP Value Name: SCRNSAVE.EXE`	25
`<HKCU>\PRINTERS\DEFAULTS\{21A3D5EE-E123-244A-98A1-8E36C26EFF6D}`	25
`<HKCU>\PRINTERS\DEFAULTS`	25
`<HKLM>\BCD00000000\OBJECTS\{926583E4-EF64-11E4-BEED-D6738078AD98}\ELEMENTS\16000009 Value Name: Element`	24
`<HKLM>\BCD00000000\OBJECTS\{926583E4-EF64-11E4-BEED-D6738078AD98}\ELEMENTS\250000E0 Value Name: Element`	23
`<HKLM>\BCD00000000\OBJECTS\{926583E4-EF64-11E4-BEED-D6738078AD98}\ELEMENTS\250000E0`	23
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: fsutil`	2
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: fsutil`	2
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: logman`	2
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: logman`	2
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: rasautou`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: EhStorAuthn`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: EhStorAuthn`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: ntoskrnl`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: ntoskrnl`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: eventcreate`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: eventcreate`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: isoburn`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: isoburn`	1
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: hh`	1

Mutexes	Occurrences
`shell.{381828AA-8B28-3374-1B67-35680555C5EF}`	24

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`31[.]184[.]234[.]0/25`	25
`208[.]95[.]112[.]1`	25
`69[.]195[.]146[.]130`	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`ip-api[.]com`	25

Files and or directories created	Occurrences
`%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}`	25
`%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\Component_00`	25
`%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\Component_01`	25
`%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\Component_03`	25
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\fsutil.lnk`	2
`%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\fsutil.exe`	2
`%System32%\Tasks\fsutil`	2
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\logman.lnk`	2
`%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\logman.exe`	2
`%System32%\Tasks\logman`	2
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\odbcconf.lnk`	1
`%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\odbcconf.exe`	1
`%System32%\Tasks\javaws`	1
`%System32%\Tasks\logagent`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\ARP.lnk`	1
`%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\ARP.EXE`	1
`%System32%\Tasks\perfhost`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\perfhost.lnk`	1
`%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\perfhost.exe`	1
`%System32%\Tasks\EhStorAuthn`	1
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\StartUp\verclsid.lnk`	1
`%APPDATA%\{6F885251-E36F-0FE6-9629-63208157D7A2}\verclsid.exe`	1
`%System32%\Tasks\verclsid`	1
`%System32%\Tasks\rasautou`	1
`%System32%\Tasks\mfpmp`	1

*See JSON for more IOCs

File Hashes

             0c7e5bb1cee76e9863ce3b44c24eec38b1eb92892c5b60a833982516a54e9b76              28374ce7589aacac9039559d75f55b2fc82976fbb26e9fcbd4932ae9fba0ff59              358ef9b233660e1630b16cb46e59ca4e8e568aba5d18d2011d01531831656a4f              49b45cd004664bfa865adf65e6f0721c32e26855854ae36e1edbf807c70f6bda              52b992d21becd7be682c2922364a752c8175ef0061a7acd6f4edc077f80e82b1              5602333889bbd3667cb416a50968d930d482b2c85ceb1bea928378118f582d8a              622889cf94266b040d5fc4b648c5010da452d773d6af23eb6d92ef087e885de0              63920b6de768c6e2b2168c51b1e37ade32c2963c9ab270298a6a2c41d413b81f              674fabcda596680972f25c7a01401805f612211a6949231b6b0b51a7b4dc4bb6              75b7b2dbc574900f135e4b0e640ab9ba649309a8d6ad8dee502f24a777873bcf              79ad8ad6a72e5014dee5f21dc71d8dbb580aa2214f39680d990e5f9fae2c033a              80376654651c543804118148246ba881732d1c03312f3a5966bc750a5b9323d0              807a64e31851a9e6b31b848e8cf3f98aee708c3f9fb202083380dbb6c01e1ab6              90a475321d0b15ea933d816290542ba4eaf96b24275d5ad89f54f2e2986a1c6e              91c10c1d3338faa90223e12db01178109fee544d1cdd598c9e6eb2441df372df              a36b78449ee435b25af5f6af94ef15831ad257e5d311ebb21d5ed65fb13ac9d3              b54d186c102b61025a31209381847c9a92cbcc3de0180b85c1acd14eaf4543ac              c4a92d2271b389d943298c11e93283ea32565956a7d36497de0efdbc41c050c5              c51909551fe0e12ac55b976834ec5e529819b9865afa470bc39ca19ebc50855f              d85fd7e3a234d353f00bb58d8630e67de2e654ce33fbe13e1a11c74f3840ebdd              db39d08dd5b947bff9410e63a7a120aea4ea8c466af50ffc14c42e8d19df14c8              de64250a40802d3495fa2b0d6deac9ea159652e4e7b3c52d54abe55d986f0973              e6e307c6d4abeb1aa62f20c16cd0bf9cfc667ee945d4e6e7332e475d922c70af              e6fa6eca90b0231944129a2b9573ac03c019a788f91044cc50e743b0dd0fd9fa              f75b4f1eb4715ad1f6289df06ae3f1ef5e992fa36e4cdebd27ccdb6106945076

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

Win.Packed.Barys-7532466-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED Value Name: Hidden`	26
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: dbe70bc52631c4df155a4a1a865cf25d`	26
`<HKCU>\SOFTWARE\SHORTCUTINFECTION Value Name: NOiR`	14
`<HKCU>\SOFTWARE\SHORTCUTINFECTION`	14

Mutexes	Occurrences
`~[P6Er7#4$&WJr83!]~`	26

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`41[.]38[.]1[.]86`	1
`141[.]255[.]155[.]177`	1
`41[.]239[.]65[.]189`	1
`206[.]189[.]182[.]212`	1
`178[.]80[.]27[.]0`	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`b10j[.]ddns[.]net`	1
`uploadapk[.]ddns[.]net`	1
`anadnjwan[.]zapto[.]org`	1
`xmu51k[.]ddns[.]net`	1
`youssefassd1[.]hopto[.]org`	1
`clivou[.]ddns[.]net`	1
`hack-qi[.]no-ip[.]info`	1
`camifer93[.]ddns[.]net`	1
`ronaldo20[.]no-ip[.]org`	1
`zabanahacker[.]no-ip[.]org`	1
`magicfuny12[.]publicvm[.]com`	1
`badr123[.]ddns[.]net`	1
`level[.]publicvm[.]com`	1
`rostom071995[.]ddns[.]net`	1
`microsoftstores[.]sytes[.]net`	1

Files and or directories created	Occurrences
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe`	26
`%TEMP%\DarkData.dat`	26
`%HOMEPATH%\Start Menu\Programs\Startup\svchost.exe`	21
`%TEMP%\Microsoft`	18
`%TEMP%\Microsoft\svchost.exe`	18
`\autorun.inf`	13
`E:\<random, matching '[a-z]{4,7}'>.exe`	12
`%TEMP%\dw.log`	9
`%TEMP%\<random, matching '[A-F0-9]{4,5}'>.dmp`	9
`%LOCALAPPDATA%\WOrm.exe`	6
`%APPDATA%\Microsoft\Windows\Cookies\WOrm.exe`	6
`%APPDATA%\Microsoft\Windows\Network Shortcuts\WOrm.exe`	6
`%APPDATA%\Microsoft\Windows\Printer Shortcuts\WOrm.exe`	6
`%APPDATA%\Microsoft\Windows\Recent\WOrm.exe`	6
`%APPDATA%\Microsoft\Windows\SendTo\WOrm.exe`	6
`%APPDATA%\Microsoft\Windows\Start Menu\WOrm.exe`	6
`%APPDATA%\Microsoft\Windows\Templates\WOrm.exe`	6
`\<random, matching '[a-z]{4,7}'>.exe`	6
`%HOMEPATH%\AppData\WOrm.exe`	6
`%APPDATA%\WOrm.exe`	6
`%HOMEPATH%\Contacts\WOrm.exe`	6
`%HOMEPATH%\Cookies\WOrm.exe`	6
`%HOMEPATH%\Desktop\WOrm.exe`	6
`%HOMEPATH%\Documents\My Music\WOrm.exe`	6
`%HOMEPATH%\Documents\My Pictures\WOrm.exe`	6

*See JSON for more IOCs

File Hashes

             004e01f888cb6241fc7da95d1798830ed0c52ea179b1ed0b2f71598e7d83fdc4              006261e3d8b0d00ae9f6596dd914440a19b1b0ab333533c03fd75c3e63f07f0d              022d2461933a4aafe67d8ddb3c5fd7f14eea9035dec79bea200ff1d57776762d              02de146284642091fd6104b2a09a0a5ffc92d51c28e8c492acecbd39fb0c30e0              033645d3516e2f25ddb3566c1eed8a6be6d3c023f7f0e98c868efa12483dfac3              04ce16123c1db27009dfd8a2546810c881a22b6eeed4697d64cb44af2e69e75d              0780a44389bf1a4cde74cc26d87cf3ee10ab0f19ba75dc941abacb0939f6c0fd              085a78af5d0146251a13bc743866fe4292d84a6c0753c6e6fcbb91d2c7826dfe              0887bb1422d2b1a80b0912816d2e776afe9db36ae392887c30dffb6950b39190              08d8cf4bd5635a6930758f7736259f230ff559ede4880d044aa4eaed47f37115              0b0c9946d82dba06fceda4ce8a8f2a8ad828adba44e630f4652a5784d4305e5c              0c85f4b989930dd44f791828bad61061e8ff325142e1dd275fa30295a343c051              0d638e32faab7502716a78610e97a4c55974ff1c648784aa66294f1e594cbe1f              0de13ccba02abce52ee48511d094b474fbf8807aa54ea316f86a83befe85a1b6              1081f90d1fa09214611b5e0255d714db254f502e945069e93973eb0f63d00208              12bd605a3b68b17d0279e5fd34cb2c9dee540f4eb1b248447d101c9199ebfaf5              12f1c270b4df8c8baa2eb194f85267da965450cf35696644d71d3835a3905e1b              13c397c69dd1c2357af059f5760a551567834c836b6d124e4e1ffee085feda80              1493472fd451f1109f5c245245469e6882f92d34610a6c468e3af5dd9acdac89              17b64ea8a52fce27bcd439a2762f6a8dff4235c10ca99a60722e481509e42b0b              1888096d2e773f3e1377ee329bf649d0032e384badd451731cc1f6cf7eb924ce              18a5f4a28bd04a9e6b7283aa80bfe4649e48cac3592f72fed511e10935c80678              18f55fa2f805d9a0aa51b6c6e934b9ea14d4c63fb578811dad1d7816e5758b71              1962b11c5701a4b591c219a30164708e42bad73e72a58b5896cfa48c0ad20ed5              1a91bfeb723c4ad729eea5e22da6f8afeecbdb990a18c3272e1fc92d7c94bdae

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

Malware

Win.Packed.Razy-7532659-0

Indicators of Compromise

Registry Keys	Occurrences
`<HKCU>\SOFTWARE\7E3975E4EF230D7D9195`	4
`<HKCU>\SOFTWARE\7E3975E4EF230D7D9195 Value Name: 7E3975E4EF230D7D9195`	4
`<HKCU>\ENVIRONMENT Value Name: SEE_MASK_NOZONECHECKS`	2
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: ParseAutoexec`	2
`<HKCU>\SOFTWARE\FECBD0A484C99B705CF7099E6CE11887`	2
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: fecbd0a484c99b705cf7099e6ce11887`	2
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: fecbd0a484c99b705cf7099e6ce11887`	2
`<HKCU>\SOFTWARE\FECBD0A484C99B705CF7099E6CE11887 Value Name: [kl]`	2
`<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE Value Name: LastSyncTime`	1

Mutexes	Occurrences
`fca-1de3ff845109`	4
`jicaltapntot`	3
`gfgdgdfdgfggfdgfdgbfdbgdfbgdfbgfdbgdfbgdfbgdfbgdfbgdfgbdfgbdfgdfbdgfbgdfbgdfbgdbfgbdfdgbfgbfdvbvdgfdgfbvgdbfvdgfbvdgfvb`	2
`fecbd0a484c99b705cf7099e6ce11887`	2
`022-1b90e6b10b98`	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`51[.]15[.]40[.]85`	17
`177[.]75[.]44[.]41`	3
`177[.]75[.]44[.]147`	2
`169[.]254[.]255[.]255`	1
`72[.]21[.]81[.]240`	1
`104[.]20[.]68[.]143`	1
`104[.]20[.]67[.]143`	1
`109[.]202[.]107[.]15`	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`rentry[.]co`	17
`jhonjhon4842[.]ddns[.]net`	5
`pastebin[.]com`	2
`ctldl[.]windowsupdate[.]com`	1
`noregisterdomain[.]zapto[.]org`	1

Files and or directories created	Occurrences
`%APPDATA%\explorer.exe`	3
`%TEMP%\explorer.exe`	2
`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\fecbd0a484c99b705cf7099e6ce11887.exe`	2

File Hashes

             04c3f0070bc08bafddfeb011497eb893c37f63397b535dcedee9e5ac89e246c3              0e754a806b2813874c47332e98a8c118bd1e33508b44ff0081ac36a48814d769              120924a5852db8a4333cf74fc1f067f51a70a996de994bc4ce727ff1377f6023              16ca75f09433409d790695af612f4ee560c265f3f084b6dc04bcbebff2ebe964              3a1a6f80ea8aa66ce456ab0cd452ad38e12b3c904432fedb5a0242c987f84c81              4ca2e3f2272455e38269d69d20dbb16c1572befe8b81a92c4acdae93341549d2              5c4dee777eb540663373b08b31b5d69d52fe9108317b21b697ea2487a2b8621d              747b1a101bb3a43a6c0b58fb8a50d8ac9777ea704911e7df27edf8c81ead883e              7f85c722bf97008aafd593730ccf252318ffb8ad00645aa0e13eab7d76c96687              8953d845fe687b2a8c5e92a0a7b2aa9dcb5c61dd271983194ef300476faee3de              95384877ed6e9a9e726ff1d18bd0fd137160e4943e0bebe59c7f7a8bfd3b25d8              b58590a3a09129a3a1e55195b0f1a39bb278a4ee1c21257aa2d74b425f09e649              c679ac377cc06ef337c78bcd3882b4e0ad5023d9649c1e37296f98252573bd57              d2e84fc71ada0566834f9dcd871b927c3e52603b73cf2bc0d923fbba79fc205f              db7f08e2ae8fdb796d8420ef16ef539f2c8fe24ddabadf5a46cc7148b5c50e8a              ded370384b5abe048734193ae8281852d2f68cf93cdec658bb0047ed7314c9a6              efa4ffb921031f5c2cd960f2d24e56140dd2c0d549e2a7b2ea69e4ab0cb47dae              f24917e59deff96fe4107de88d80815c5aa45d3e7aa711ad772ea031bcfdcc1d              f5c8e5e5303aedd99923c610e3b0ecd34095fdff10ae120d1be6648c5bdc3e89

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Packed.Dridex-7532883-1

Indicators of Compromise

Registry Keys	Occurrences
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: trkcore`	12
`<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: DisableTaskMgr`	12
`<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.CHECK.0 Value Name: CheckSetting`	12

Mutexes	Occurrences
`bxHV8AirRi`	1
`nN6zSKd5De`	1
`1aGmpK2Fpc`	1
`7hIVwzEnv1`	1
`E6Q6j6YTV8`	1
`Irun61Xn7d`	1
`JLSADdwil0`	1
`NPXzzJejTH`	1
`WWN630213P`	1
`XPF1tOcJMb`	1
`2WpU6TmEPW`	1
`3ZJhaY3yr9`	1
`5he85143TO`	1
`KjY7CSFqPz`	1
`R9uXS0pi9F`	1
`TV4I4E35W8`	1
`eDiPKSpzC6`	1
`yebXkefg8w`	1
`CCbi4gfgIs`	1
`OuaMk6vUKi`	1
`RiFp6vyARh`	1
`W6ArquGVYc`	1
`cLgrRVqAOx`	1
`rw74rlool5`	1
`vxudb0VN9b`	1

*See JSON for more IOCs

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
`172[.]217[.]11[.]46`	12
`104[.]20[.]67[.]143`	7
`104[.]20[.]68[.]143`	5

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
`pastebin[.]com`	12
`www[.]4zjjwywndb[.]com`	1
`www[.]wyek9gljwv[.]com`	1
`www[.]dhpydj8zow[.]com`	1
`www[.]xy5xc1pa3f[.]com`	1
`www[.]dw4kr1pwbg[.]com`	1
`www[.]bz11msxwlf[.]com`	1
`www[.]65vxrzb8us[.]com`	1
`www[.]qiht7hodpf[.]com`	1
`www[.]gfuhlqwl2q[.]com`	1
`www[.]xdctdxp8w3[.]com`	1
`www[.]hfhfl9jloc[.]com`	1
`www[.]gvkkyn2d5c[.]com`	1
`www[.]womizyhbm9[.]com`	1
`www[.]zboz6h96hz[.]com`	1
`www[.]ssgj6cpx0k[.]com`	1
`www[.]rpy91utwrm[.]com`	1
`www[.]qeqvtkjksw[.]com`	1
`www[.]0ac8n2n5zb[.]com`	1
`www[.]eagzu4rlpm[.]com`	1
`www[.]0rfabtbv2r[.]com`	1
`www[.]abzze96jtg[.]com`	1
`www[.]wfajyuswse[.]com`	1
`www[.]d4ktsdbuhr[.]com`	1
`www[.]ep2iu65g3l[.]com`	1

*See JSON for more IOCs

File Hashes

             05afedd0b76f574373f858b854958c473482fcc6fa9736f0d447094605ad2102              0a3079b8c4963b26e74760337da6cb0b1a6c532cc524f4d0aae6dab1d52f7d75              0a4e162d4a11aa91ead63995af22c410b422b8b5af2038d4ef95d454c1d380e1              0f4f25d12a2729552a348fb33cd7374fbd5ce3bc53c8da873f3aa5026a7290ca              33991dbeb097cb0937ae9ea049418089b3437e7f4ef23cbcf26b906b1ab39d5b              79d11b3634c5a3dc51442b4e8cdf88d921f9d46273a55ac20cd1fa7d0d51c11d              919119268cb2b13ae638c6015822352d899cc39ea10959a86634c8bd2fc8912b              940eaff21163abfe8be6301e561e30a27f23800cb8bfe4a5df9a5ff7dbfb1d4f              a31fdd57bc317cd8f6c4df0c6f75bcd25999d36f7cc665da9018672dfe55061c              b5d15bb5d2a6bde41040d4b9d63e8cc1cfddf8669f5c1389c2aba584328dc27b              e45c5802e6091e4602519853d81ad08f45969d574cfa3d1e36a6af8bd0daaaf7              f3475d70597f4f77ab542f79c295c120094f9dc35bddb706bfb80b1e8787a061

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

ThreatGrid

Exploit Prevention

CVE-2019-0708 detected - (22771)

Process hollowing detected - (394)

Excessively long PowerShell command detected - (304)

Kovter injection detected - (181)

Dealply adware detected - (147)

Gamarue malware detected - (141)

Installcore adware detected - (125)

Corebot malware detected - (22)

Fusion adware detected - (13)

IcedID malware detected - (10)

IcedID is a banking Trojan. It uses both web browser injection and browser redirection to steal banking and/or other financial credentials and data. The features and sophistication of IcedID demonstrate the malware author's knowledge and technical skill for this kind of fraud, and suggest the authors have previous experience creating banking Trojans. IcedID has been observed being installed by Emotet or Ursnif. Systems infected with IcedID should also be scanned for additional malware infections.

↧

Vulnerability Spotlight: Bitdefender BOX 2 bootstrap remote code execution vulnerabilities

January 21, 2020, 9:29 am

≫ Next: Breaking down a two-year run of Vivin’s cryptominers

≪ Previous: Threat Roundup for January 10 to January 17

Claudio Bozzato, Lilith Wyatt and Dave McDaniel of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.

The Bitdefender BOX 2 contains two remote code execution vulnerabilities in its bootstrap stage. The BOX 2 is a device that protects users’ home networks from a variety of threats, such as malware,

phishing IOCs and other forms of cyber attacks. It also allows the user to monitor specific devices on the network and limit their internet access. These vulnerabilities could allow an attacker to gain the ability to arbitrarily execute system commands.

In accordance with our coordinated disclosure policy, Cisco Talos worked with Bitdefender to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

Bitdefender BOX 2 bootstrap download_image command injection vulnerability (TALOS-2019-0919/CVE-2019-CVE-2019-17095, CVE-2019-17096)

An exploitable command injection vulnerability exists in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method `/api/download_image` unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands. An unauthenticated attacker should impersonate a remote nimbus server to trigger this vulnerability.

Read the complete vulnerability advisory here for additional information.

Bitdefender BOX 2 bootstrap update_setup command execution vulnerability (TALOS-2019-0918)

An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of system commands. To trigger this vulnerability, an unauthenticated attacker can send a series of HTTP requests to the device while in the bootstrap stage.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that version 2.0.1.91 (in bootstrap mode), 2.1.47.42 and 2.1.53.45 (in production mode) of Bitdefender BOX 2 is affected by these vulnerabilities.

Coverage

↧

Breaking down a two-year run of Vivin’s cryptominers

January 21, 2020, 9:49 am

≫ Next: Vulnerability Spotlight: Multiple vulnerabilities in some AMD graphics cards

≪ Previous: Vulnerability Spotlight: Bitdefender BOX 2 bootstrap remote code execution vulnerabilities

News Summary

There is another large-scale cryptomining attack from an actor we are tracking as "Vivin" that has been active since at least November 2017.
"Vivin" has consistently evolved over the past few years, despite having poor operational security and exposing key details of their campaign.

By Andrew Windsor.

Talos has identified a new threat actor, internally tracked as "Vivin," conducting a long-term cryptomining campaign. We first began linking different samples of malware dropping illicit coin miners to the same actor in November of 2019. However, upon further investigation, Talos established a much longer timeline of activity. Observable evidence shows that Vivin has been active since at least November 2017 and is responsible for mining thousands of U.S. dollars in Monero cryptocurrency off of their infected hosts.

Vivin has shown to rotate the use of multiple cryptocurrency wallet addresses, in addition to altering the delivery chain of their payloads, over different time periods of activity. An interesting aspect of the actor's delivery method is their use of modified pirated software as their initial attack vector before the samples move on to common "living-off-the-land" methods at later stages of the attack. Vivin makes a minimal effort to hide their actions, making poor operational security decisions such as posting the same Monero wallet address found in our observable samples on online forms and social media. Nor do they discriminate in their targeting, attempting to capitalize on general user behavior, rather than targeting, to generate as large a victim pool as possible.

Despite the market downturn for cryptocurrency values in 2018, cryptomining remained a popular attack method for malicious actors throughout 2019 and heading into 2020. Over the course of last year, Talos Incident Response observed a number of cryptomining attacks, some of which potentially involved higher coordinated cybercrime groups and collaboration between multiple different threat actors. While more sophisticated actors certainly pose a significant threat, organizations should remain cognizant of the additional threat posed by less advanced actors employing wide or unrestricted targeting. Talos has previously documented one such actor, "Panda," illustrating their potential for long-term exploitation of their victims' resources and their resilience from being deterred from future action. These attributes make Vivin, and other actors like them, legitimate risks to organizational resource abuse and potential data theft.

The tactics, techniques, and procedures (TTPs) used by Vivin expose the actor's campaigns to multiple potential points of mitigation. Some of these include good systems hygiene such as preventing the use of pirated software on endpoints, proper event logging and monitoring, and systems resource monitoring. Other mitigation strategies involve a more active defense. For example, blocking the URIs used by the mining pools and the malware's intermediate stages. Detection signatures can also prevent the XMRig miner from being dropped and executed on targeted hosts.

What's new?

This is yet another reminder that malicious crypto mining still has a major spot on the threat landscape and, judging by this actor, are successful and long standing campaigns. This actors use of pirated software as a mechanism for malware delivery isn't often seen, but can be highly effective.

How did it work?

This actor used pirated software as an initial infection vector, masquerading their malware as popular software. Once the initial infection was completed "Vivin" quickly moved to common Windows tools. This actor has been successful pivoting their infrastructure and wallets as needed to maintain effectiveness.

So What?

Pirated software is dangerous and can be riddled with malware. Keeping it off your enterprise network will help mitigate the risks actors like "Vivin" present.
Adversaries are increasingly leveraging LoLBins and organizations need to ensure they are capable of detecting and preventing attacks that leverage them, without hindering productivity.
There is still significant money to be made from malicious crypto mining and actors are going to continue to deliver it, through any means necessary.
Operational Security (OpSec) is difficult and adversaries make mistakes, this is another example of how those mistakes can be leveraged in analysis.

Technical case overview

Vivin has been observed slightly altering their TTPs over time. Because of their propensity to use commodity malware tools, Vivin's moderate changes are most likely due to incremental changes in these tools, such as the use of an updated or new packer, tweaked methods of obfuscation, and structural changes in PowerShell code, among others. However, the same baseline execution flow is observable in all of our available samples. The following technical description is largely based on samples observed in the cycle of activity beginning in November 2019.

Initial infection occurs through the execution of malware made to resemble commonly used productivity software, tools, and games. These files were all likely obtained through pirated software forums and websites. Many of the samples are packed as self-extracting RAR files which extract and install what appears to be the actual software and covertly drop malicious files. The pirated software from our observed sample run contains a second stage payload that is written to \AppData\Local\Temp as "setup.exe." Upon successful execution, the observed samples dropped both a JavaScript ("setup.js") and VBScript ("dllm.vbs") file to the victim host's \AppData\Local\Temp and \Windows\Start Menu\Programs\Startup folders.

As part of this execution chain, the malware also reaches out to "csrss.publicvpn[.]com," a known malicious domain, to establish a TCP connection. During our analysis, the sample did not receive a response. The prevalence of this domain and others that are lexically similar within other sample runs associated with Vivin lead us to believe that these hosts act as a form of command and control, but we do not currently have enough information to glean its exact functionality and purpose. Nevertheless, the response failure does not hinder the rest of the sample's execution. Finally, in addition to immediately running the malicious script, the dropper also creates a job using Windows Task Scheduler. This job, called "anydesk"[1] in all of our samples, executes the dropped script every 30 minutes:

c:\windows\system32\schtasks.exe /create /sc minute /mo 30 /tn anydesk /tr c:\users\{username}\appdata\local\temp\setup.js

The malicious script contains an obfuscated PowerShell command that executes a number of cascading PowerShell calls and additional payload stage downloads. In the sample Talos originally discovered, the command reaches out to "pastebin[.]com/raw/gc5dfjh9," a page containing a URL of a supposed image file at "www[.]m9c[.]net/uploads/15758872491.jpg." This file is actually raw text containing additional PowerShell commands and the ASCII representations of further payloads.

These PowerShell commands reflectively load an included malicious .NET assembly. The sample then calls the "exe" method of the "Hackitup" class shown below, which performs more deobfuscation, in addition to some additional logic checks through more chained method calls, such as whether it's running on a 32- or 64-bit architecture. Finally, it constructs the configuration options to be loaded and executed with its final payload by invoking "cmd.exe."

The final payload is a packed variant of the XMRig cryptominer. Examination of the reconstructed PE file reveals that it is compressed with UPX. Additionally, the miner is launched with a common configuration that we were able to extract from the binary as shown in the figure below. XMRig is set up to use a maximum of 80 percent of the host's CPU resources with the "CryptoNight" algorithm in order to mine the Monero cryptocurrency. The extracted configuration string also contains Vivin's Monero payment address, which Talos used as a starting point to track this actor.

Vivin's malware employs a fair amount of obfuscation and evasion techniques throughout its execution. First, the initial droppers either install some form of the expected pirated software or they attempt to mimic a fake installation with paths that are named for associated programs. For example, our "PhantomPDF" sample installed to "F%3A/Software/Adobe/" which is neither Adobe softwares' or PhantomPDF's default install path. Furthermore, PhantomPDF is not developed by Adobe, but Adobe is arguably the most popular name associated with PDF software, thus the installation and execution paths may fool those not paying close attention. Second, the source code in the dropped JavaScript and VBScript files are heavily manipulated for obfuscation. Third, the .NET assemblies are reflectively loaded in order to keep additional files from being written to disk, in addition to their source code also being heavily obfuscated. Finally, all of the observable XMRIg payloads were packed using UPX.

The actor also used multiple methods of persistence to keep the XMRig mining software on the victimized hosts. Windows Scheduler was used to create the job "anydesk" to execute setup.js every 30 minutes. The sample copied various sources of execution: setup.exe, setup.js, and dllm.vbs to \AppData\Local\Temp in order to have them persist on disk. Additionally, the malware sample created startup items in two separate locations, thereby enabling re-execution of the malware following any system restarts. One startup item was created by writing dllm.vbs and setup.js to \Windows\Start Menu\Programs\Startup. The other was established by adding dllm.vbs to the "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" registry key. While none of these methods are particularly sophisticated, the amount of redundancies created could make it difficult to fully clean the XMRig miner off of the victimized system.

While all samples and execution chains Talos found associated with this actor dropped XMRig as their final payload, there were additional variations observed in some of them. For example, other samples dropped a VBScript file as their intermediary although it performed the same functional role as our original sample's JavaScript file. Some samples simply contained only one referenced PE file at the PowerShell stage and hid their XMRig payloads inside of the reflectively loaded .NET assembly as base-64 encoded strings. One of the more interesting samples first checked to see if it had access to "MSBuild.exe." However, the sample that contained this check still only attempts to run the XMRig launch command to cmd.exe, rather than attempting to compile the next stage on the host or use the inline task function execution as other malware has been observed doing when attempting to access MSBuild. Finally, some XMRig payloads used a dropped JSON configuration file rather than specifying them on the command-line or packing them into the final XMRig binary.

Tracking Vivin

Talos assesses with high confidence that Vivin's campaigns are indiscriminate, meant to infect as many hosts and extract as much money as possible. Upon too much exposure, Vivin rotates the wallet address used along with potentially updating their infrastructure used. The actor's activity exhibits a general lack of operational security (OpSec). They have been observed publicly posting the wallet IDs used in the malicious samples on social media sites such as Reddit. The actor also reuses the same or slight variations of the same username for a number of online accounts, including services used in the execution chains of the cryptomining malware. At the time of writing, Talos has observed three separate aliases directly linked to the actor, although they are all lexically similar.

We located the first username Talos linked to the actor through a Reddit post claiming the same Monero wallet address found hardcoded in our original sample's XMRig payload as their own. Further investigation into the user's posts revealed additional wallet addresses and an ongoing interest in various aspects of Monero coin mining, XMRig configurations, and the efficiency of different mining algorithms. The same user also posted about having issues with their account for the "minexmr[.]com" mining pool, the same pooling address used in the configurations of the XMRig payloads. A GitHub account also uses the same username as the Reddit account linked to Vivin that contains a forked repository of the XMRig coinminer source. Additionally, this user follows other accounts that house numerous repositories for file crypters, rootkits, process-hollowing, and other tools commonly used in malware packing and distribution. Finally, the two other aliases were found as users on Pastebin that had uploaded raw text links pointed at image and file hosting sites. These site links contain the PowerShell scripts used in the intermediary stages of Vivin's malware.

Talos originally began tracking Vivin by investigating a suspicious PowerShell command found in our AMP telemetry. However, this was not the original source of infection. By reconstructing a timeline of event execution surrounding the initial PowerShell command, we traced the original dropper back to what appeared to be a pirated installation of "Foxit PhantomPDF." After locating the initially executed file within this installation, dynamic and static analysis confirmed it as the infection source. After tracing the file write operations for the software installation, we believe the dropper had been downloaded onto the victim host through BitTorrent. The parent process for this in our original sample references the uTorrent BitTorrent client. Additional evidence supporting this includes a user going by one of Vivin's aliases uploading files to torrent forums and sites with the same or similar names of the malicious samples seen in the wild and that have been associated with the actor's malware infrastructure. Here's one example:

At the time of writing, Vivin remains active. After gathering pivot points and identifiers linked to to the actor, we broadened our investigation into additional ongoing activity and reconstruct patterns of historical activity through open source research and other data sources. We first saw this activity on Nov. 20, 2017. But because this date was a "last seen" value, Talos believes that Vivin's activity goes back further. The actor maintains multiple cryptocurrency wallet addresses, some of which have shown to go through cycles of dormancy and activity. Other associated wallet addresses have already been banned from mining pools under suspicion of botnet activity.

Talos observed two recently active cryptominer wallet addresses linked to Vivin. The first, "45VgqBWVhgu5LHSafj4q5sB3wuYXGvrSs5N9KLH5Tijze9NbsvUSaaSjVk1vuGBMwY2eXEHtQf95CULQHGQbghU21x4aWLY," we found hard-coded in our original sample's XMRig payload. As shown in the figure below, this wallet first showed minimal mining activity on Oct. 29, 2019. Around Nov. 10 the hashrate associated with this wallet constantly increased at an almost linear fashion until Nov. 30, 2019. After the 30th, the hashrate drastically reduces to about 20 percent of its peak and has continued to operate at about that level until Dec. 9. Interestingly, the drop in this wallet's activity occurred only a couple of days after Talos began blacklisting the discovered infrastructure and assigning malicious dispositions to known associated samples. A smaller second drop in activity occurs again on Dec. 9 and continues to steadily diminish.

The second wallet, "434PuVPN5tQ6xQA7pdB7NsNTJHWvUD5tL7rmsX7uzJgNdCAx7wo4yESiy51aqCcr13ZoYb3TFq3zw11BFQJiF1tnHibZ6EA," was found through an OSINT investigation into Vivin's online accounts and activity. The same Reddit user previously linked to Vivin also posted this wallet payment address in the MoneroMining subreddit in the later part of 2018. Further investigation revealed that this wallet has been in use at least as far back as Nov. 20, 2017, when it was active in the mining pool "dwarfpool." Activity associated with this wallet address once again resurfaced on Dec. 9, 2019. This time, the address is being observed on the "minexmr" mining pool, illustrated in the figure below, the same pool as our first active wallet address linked to Vivin.

There are two noteworthy observations here. First, the timing of its new activity. Remember that the first wallet address' second significant decline began on Dec. 9, the same day of this wallet address' resurgence. We believe that the convergence of this date likely signifies a point of infrastructure turnover, where no new effort is being made into actively proliferating malware using the first wallet address and active operations now using the second address. As previously discussed, Talos believes that Vivin operates their active campaigns in cycles, in addition to recycling wallet addresses after too much exposure. The timing and evidence observed between these two wallet addresses lends further credence to that assertion.

Secondly, the latter wallet address shows a total hashrate orders of magnitude above Vivin's other active wallet. This could indicate a much higher infection rate and proliferation of malware tied to that specific address. At the time of writing, Talos has not yet observed any specific samples in our telemetry directly tied to the second wallet address; however, data from VirusTotal does link it to a cryptominer submitted back in December 2017. Talos will continue to monitor our telemetry and data sources for malware samples and related infrastructure linked to Vivin's ongoing activity.

Mitigations

Fortunately, Vivin's lack of sophistication, and the nature of cryptominers in general, afford multiple avenues for detection and prevention. One area of mitigation deals with methods for systems and user behavior monitoring. Restricting the use of pirated software on organizational hosts and networks could mitigate against the initial attack vector observed in this investigation and other malware in general. Torrent sites and pirated software have long been easy distribution avenues of malware for illicit actors. Systems and network monitoring can be used to send alerts when associated behaviors are found. For example, monitoring for excessive or abnormal resource usage on endpoints could indicate cryptominer activity. Vivin set their miners to utilize up to 80 percent of a system's CPU resources.

Prevention of unnecessary and/or unauthorized system-level changes can help mitigate against intermediary stage behavior, such as PowerShell execution chains, in addition to persistence tactics used by Vivin, such as creating startup objects and scheduled tasks on victim hosts.

Another area of mitigation involves more active detection and prevention strategies. URIs used by Vivin's malware can be blacklisted and blocked at the network level, such as the image host links used to download and deploy the malware's intermediate stages, IP addresses associated with command and control infrastructure, and the domains used to connect to the mining pools themselves. Additionally, signatures and other detection content used by antivirus and other endpoint security services can detect and prevent miner applications like XMRig from being illicitly installed on systems. Further recommendations on mitigating this type of threat can also be found by reviewing the Cisco Talos whitepaper, "Blocking Cryptocurrency Mining Using Cisco Security Products."

Conclusion

The length of historical activity by Vivin, the multitude of wallets and malware execution infrastructure, and the actor's somewhat flippant attitude towards operational security suggests that the Vivin will attempt to continue their operations for the foreseeable future. Perhaps more telling is the actor's willingness to continuously roll over their infrastructure over a long period of time. As evidenced before, if enough of their infrastructure gets exposed, Vivin will likely abandon the iteration of malware, their execution chains, and potentially switch mining services.

It is easy to want to dismiss non targeted attacks and less sophisticated threat actors as inconsequential; however actors like Vivin remain viable threats to organizations. Among the wallet addresses Talos was able to link to Vivin, they have already mined thousands of dollars worth of cryptocurrency. The substantial growth in hash rates for the actor's Dec. 9 campaign also suggests that they could be significantly improving their delivery methods and infection rates. Aside from siphoning resources from organizations, the malware used to drop XMRig could also be modified for data theft, credential harvesting, and other malicious activity. Talos will continue to monitor activity by this actor and update or expand this post with any additional information.

Coverage

Ways our customers can detect and block this threat are listed below.

Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), Cisco ISR, and Meraki MX can detect malicious activity associated with this threat.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

IOCs

IPs

116[.]203[.]234[.]128
116[.]203[.]29[.]111

Domains/URLs

pastebin[.]com/raw/gc5dfjh9
pastebin[.]com/dr9bzymZ
mmc[.]publicvm[.]com:8002
csrss[.]publicvm[.]com
csrss[.]publicvm[.]com/Vre
csrss[.]publicvm[.]com:8094/Vre
csrss[.linkpc[.]net
csrss[.]linkpc[.]net/Vre
lsass[.]publicvm[.]com
mstsc[.]publicvm[.]com
spoolsv[.]linkpc[.]net
winlogon[.]publicvm[.]com
dwm[.]publicvm[.]com
www[.]m9c[.]net/uploads/15743593161.jpg
www[.]m9c[.]net/uploads/15723243711.png
www[.]m9c[.]net/uploads/15723168051.png
www[.]m9c[.]net/uploads/15572403801.jpg
www[.]m9c[.]net:80/uploads/15621655811.jpg
ddl3[.]data[.]hu/get/210358/11615096/Loader.jpg

SHA256s

aa6fa5b51a2e54a1aef50bc9ba3eb41b88b1834e867f09d2c8e29c0d41691ae6
2b48269eec1a294a52049cbd35ebd6f6097e1c486d60febe836378714657978a
da6908445649d30aff3f6ac9d9ec11c5f52c888c867ede766993c0fe731295fe
51f9a6d7574361bcf49962e2471a1d096db6c0d713ae07485b2791e74134513c
5dc7239df2e9fb497335cc846e09dfdd024e7345c44a96693022bedd240954de
4ac6131d639aa802302ab4cf32b959f9ab5ec76752cc297eb380d5c23d4a68f2
f476867d8152fcf0cb989b0e2c935db87c37162af33350874d671f99154752cf
8b7c197efab6f6c40b51df125d00e3de211ebb5123ee876f1992f03401559cda
31ac877d8c2c2a897eaff36b17d755466b8612ad2661510dd6b0d9484a2b1f6f
8aa5d523158838bf58a80744f031192314215a3d4c32c4f8644f93370828825b
ea647990182d7d3ac82ff9b6c99ed70a10473da16bc55eadb76131f78ed65fb9
79557c6d190d7daf34f10c7929facf56838ab27a5925f6f5197e1c0cbd660de3
524fbc5fff1e91adcd4c72ce83b7f33fa424acefafb198f1701484cedc17c590
9d7f2684a4efdb4738527d37b7995a40d819909d08e7443a6583231a1454b50b
705646f923a2412757bae71b60de0fef31284756768a59ef2057eaee7dfafe9f
a115451603cf9687c8c46945432033a942b4cd46a4209868e226e25a1a2e0ee1
d343e4b99b9cdaf2e7fc2283dda0e7e07cedf4bccf7f53869f2806b14113ab7d
4b71cc1af01417d8b17f1158bbfa53e0bb09a7dc16bbdf3edd8f2f99b8fc667d
f23ce16ad18907f0aa6957640dbe960daeaa33c714d0ca9f204a98800edc2df4
9d7066f441a5a3df894d018143ae2778175f18408c2fbab52442ed4ad178ae8f
25cc942e230b357a43297a8172a6700098b6ae152ef00acaa7e6a2c0fa07497d
5331924e1e5a634e55e7a3daaff3d5204eff50c4dc166d4d9d516510fb91fa4e
198a045c55710f8d32141c72e69b2cdd6c7a60b29ac9776046257897d612ceca
47928d09921466ddf1597e1ef7e8ac12397df7e616cd0c1710f4fa8a6384b439
d03054261a521440a7cfe281bd7d14f92610b54906df1dced8dbe6bc00e40029

Cryptocurrency Payment Addresses

Currently Active

45VgqBWVhgu5LHSafj4q5sB3wuYXGvrSs5N9KLH5Tijze9NbsvUSaaSjVk1vuGBMwY2eXEHtQf95CULQHGQbghU21x4aWLY

Currently Not Active

44WzjC6ERyR7CMDXpkgVeGH9Tj4fnBeAuCdcaH79NkMPhKr3bQRKMKtJhzfhrmXJJ42sdFvAvg4b3L7zaYTwigeqBt9jDrQ

4589o168fmkBrMVoR3qPQyXiDR3w9EFa3DajGUjY38MKLiaR4N5HbdFT7hw3iEh2mRZsABYvkgcFWaW5crPJQtVZ9ihwutP

4AbjKdQkedGZXvzm6VxMJb1zLB2CAmCmXdoCisRsQFAUPs4TWFePDUcZzk5ui4EdZXT3uaXXtssqPCoKQPTz7PeZNkKASkm

434PuVPN5tQ6xQA7pdB7NsNTJHWvUD5tL7rmsX7uzJgNdCAx7wo4yESiy51aqCcr13ZoYb3TFq3zw11BFQJiF1tnHibZ6EA

↧

Vulnerability Spotlight: Multiple vulnerabilities in some AMD graphics cards

January 22, 2020, 6:15 am

≫ Next: Threat Source newsletter (Jan. 23, 2020)

≪ Previous: Breaking down a two-year run of Vivin’s cryptominers

Piotr Bania of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.

Multiple vulnerabilities exist in a driver associated with the AMD Radeon line of graphics cards. An attacker can exploit these bugs by providing a specially crafted shader file to the user while using

VMware Workstation 15. These attacks can be triggered from VMware guest usermode to cause a variety of errors, potentially allowing an attacker to cause a denial-of-service condition or gain the ability to remotely execute code.

In accordance with our coordinated disclosure policy, Cisco Talos worked with AMD and VMware to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

AMD ATI Radeon ATIDXX64.DLL shader functionality constant buffer denial-of-service vulnerability (TALOS-2019-0913/CVE-2019-5124)

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.50005. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.

Read the complete vulnerability advisory here for additional information.

AMD ATI Radeon ATIDXX64.DLL MOVC shader functionality denial-of-service vulnerability (TALOS-2019-0936/CVE-2019-5147)

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13003.1007. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.

Read the complete vulnerability advisory here for additional information.

AMD ATI Radeon ATIDXX64.DLL MAD shader functionality denial-of-service vulnerability (TALOS-2019-0937/CVE-2019-5146)

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13025.10004. A specially crafted pixel shader can cause a denial of service. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.

Read the complete vulnerability advisory here for additional information.

AMD ATI Radeon ATIDXX64.DLL shader functionality VTABLE remote code execution vulnerability (TALOS-2019-0964/CVE-2019-5183)

An exploitable type confusion vulnerability exists in AMD ATIDXX64.DLL driver, versions 26.20.13031.10003, 26.20.13031.15006 and 26.20.13031.18002. A specially crafted pixel shader can cause a type confusion issue, leading to potential code execution. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that these vulnerabilities affect AMD ATIDXX64.DLL, version 26.20.13025.10004 running on the Radeon RX 550 series of graphics cards, while running on VMware Workstation 15, version 15.5.0, build-14665864 with Windows 10 x64 running as the guestVM.

Coverage

↧

Threat Source newsletter (Jan. 23, 2020)

January 23, 2020, 11:00 am

≫ Next: Threat Roundup for January 17 to January 24

≪ Previous: Vulnerability Spotlight: Multiple vulnerabilities in some AMD graphics cards

Newsletter compiled by Jon Munshaw.

Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.

Despite tensions starting to fizzle between the U.S. and Iran, people are still worried about cyber conflict. What would that even look like? Is it too late to start worrying now, anyway? That’s the main topic of the latest Beers with Talos podcast.

You should probably know this already, but you should actually never count out any type of cyber threat. Despite the declining popularity of virtual currencies, we are still seeing adversaries who want to hijack victims’ computing power to farm them. Take Vivin, for example. The latest cryptominer actor we discovered has been active since 2017, and is just getting started with its malicious activities in 2020.

Over at the Snort blog, you’ll want to keep an eye out for some changes we have coming to Snort.org. We’ll spare you the details for now, but please bear with us if the search function isn’t working correctly for you or you see anything else wonky on the site.

And, as always, we have the latest Threat Roundup where we go through the top threats we saw — and blocked — over the past week.

Upcoming public engagements

Event: Talos Insights: The State of Cyber Security at Cisco Live Barcelona
Location: Fira Barcelona, Barcelona, Spain
Date: Jan. 27 - 31
Speakers: Warren Mercer
Synopsis: Cisco Talos specializes in early-warning intelligence and threat analysis necessary for maintaining a secure network. We are responsible for defending networks realize that the security threat landscape is constantly in flux as attackers evolve their skills. Talos advances the overall efficacy of all Cisco security platforms by aggregating data, cooperating with teams of security experts, and applying the cutting-edge big data technology to security. In this talk, we will perform a deep analysis of recent threats and see how Talos leverages large datasets to deliver product improvements and mitigation strategies.

Event: A World of Threats: When DNS becomes the new weapon for governments at Swiss Cyber Security Days
Location: Forum Fribourg, Granges-Paccot, Switzerland
Date: Feb. 12 - 13
Speakers: Paul Rascagnères
Synopsis: In this presentation, Paul will present two threat actors Cisco Talos has been tracking who are manipulating the DNS system. On Jan. 22, 2019, the U.S. DHS published a directive concerning this attack vector. We will present the timeline for these events and their technical details. One of the actors is behind the campaign we named “Sea Turtle.” This actor is more advanced and more aggressive than others we’ve observed in the past. They do not hesitate to directly target registrars and one registry. The talk will break down these two actors and the methodology used to target the victims.

Cyber Security Week in Review

United Nations officials are investigating the hacking of Amazon CEO Jeff Bezos’ cellphone. Bezos reportedly watched a malicious video in 2018 that was infected with spyware, allowing a malicious actor to spy on his device for nine months until February 2019. Two security experts say in their findings that the hack is said to have originated from the Saudi Arabian government.

A new survey from NPR and PBS found that the spread of misinformation is Americans’ top concern heading into the 2020 presidential election. This ranked far above foreign interference (15 percent) and problems at the polling place (5 percent).

Technology company Citrix released another round of patches for a critical vulnerability in Application Delivery Controller and Citrix Gateway. Attackers have already exploited the bug to install malware on Citrix servers after proof-of-concept code was leaked in December prior to patches being ready.

U.S. President Donald Trump and Attorney General William Barr renewed a pressure campaign on Apple this week, calling again on the company to decrypt iPhones belonging to criminal suspects. The recent argument centers around a phone belonging to a man who killed multiple people on a naval base last year.

Meanwhile, a new report states that Apple dropped a previous plan to encrypt iCloud backups after the FBI complained. The decision came more than two years ago but is just being brought to light now.

Google also took a shot at Apple this week, preparing a research paper that states there are multiple vulnerabilities in the Safari web browser that puts users’ data at risk. Even if a user was to opt out of location tracking, the bugs could be exploited by third-party companies to obtain “sensitive private information about the user’s browsing habits.”

Foreign currency exchange service Travelex says its first customer-facing services are back online, weeks after a ransomware attack. The company still maintains that there is “no evidence that any data has left the organization.”

Intelligence Community Threats Executive Shelby Pierson says the U.S. government learned from its mistakes in 2016 and is prepared to more quickly disclose threats to U.S. elections. Former President Barack Obama’s administration came under fire for taking too long to disclose what it knew about Russia interfering in the 2016 presidential election.

Microsoft is warning of a critical vulnerability in Internet Explorer that’s being exploited in the wild, though no patch is available as of Thursday morning. An attacker could exploit this vulnerability to corrupt memory in such a way that they could execute arbitrary code in the context of the current user.

Notable recent security issues

Title: Microsoft cryptogrophy vulnerability lingers after Patch Tuesday
Description: The U.S. National Security Agency released a warning late last week, urging users to update their Microsoft products as soon as possible to fix a vulnerability in its cryptographic certificate-signing function. Attackers could use this bug to sign a program, and make it appear as if it is from a trusted source, without the user ever knowing about the adversary’s actions. A security researcher was even able to create a proof of concept “Rick Rolling” the NSA’s website to display a popular internet meme. The NSA’s statement says that it believes “the vulnerability to be severe and that sophisticated cyber actors will understand the underlying flaw very quickly and, if exploited, would render the previously mentioned platforms as fundamentally vulnerable.”
Snort SIDs: 52617 - 52619

Title: Emotet continues to grow, spike in spam to start off 2020
Description: Emotet continues to infect individuals and organizations all over the world, but Cisco Talos recently discovered a new relationship between Emotet and the .mil (U.S. military) and .gov (U.S./state government) top-level domains (TLDs). When Emotet emerged from its summer vacation back in mid-September 2019, relatively few outbound emails were seen directed at the .mil and .gov TLDs. But sometime in the past few months, Emotet was able to successfully compromise one or more persons working for or with the U.S. government. As a result of this, Talos saw a rapid increase in the number of infectious Emotet messages directed at the .mil and .gov TLDs in December 2019.
Snort SIDs: 51967-51971, 52029

Most prevalent malware files this week

SHA 256:85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
Typical Filename: eternalblue-2.2.0.exe
Claimed Product: N/A
Detection Name: W32.85B936960F.5A5226262.auto.Talos

SHA 256: 1c3ed460a7f78a43bab0ae575056d00c629f35cf7e72443b4e874ede0f305871
MD5: c2406fc0fce67ae79e625013325e2a68
Typical Filename: SegurazoIC.exe
Claimed Product: Digital Communications Inc.
Detection Name: PUA.Win.Adware.Ursu::95.sbx.tg

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
Typical Filename: qmreportupload.exe
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: c0cdd2a671195915d9ffb5c9533337db935e0cc2f4d7563864ea75c21ead3f94
MD5: 7c38a43d2ed9af80932749f6e80fea6f
Typical Filename: xme64-520.exe
Claimed Product: N/A
Detection Name: PUA.Win.File.Coinminer::1201

SHA 256: 15716598f456637a3be3d6c5ac91266142266a9910f6f3f85cfd193ec1d6ed8b
MD5: 799b30f47060ca05d80ece53866e01cc
Typical Filename: mf2016341595.exe
Claimed Product: N/A
Detection Name: W32.Generic:Gen.22fz.1201

Keep up with all things Talos by following us on Twitter. Snort, ClamAV and Immunet also have their own accounts you can follow to keep up with their latest updates. You can also subscribe to the Beers with Talos podcast here (as well as on your favorite podcast app). And, if you’re not already, you can also subscribe to the weekly Threat Source newsletter here.

↧