Threat Roundup for July 5 to July 12

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between July 5 and July 12. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found herethat includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.
The most prevalent threats highlighted in this roundup are:

Threat Name	Type	Description
Win.Virus.Expiro-7011826-0	Virus	Expiro is a known file infector and information-stealer that hinders analysis with anti-debugging and anti-analysis tricks.
Win.Dropper.Nymaim-7011878-0	Dropper	Nymaim is malware that can be used to deliver ransomware and other malicious payloads. It uses a domain generation algorithm to generate potential command and control (C2) domains to connect to additional payloads.
Win.Dropper.TrickBot-7011945-0	Dropper	Trickbot is a banking trojan targeting sensitive information for select financial institutions. This malware is frequently distributed through malicious spam campaigns. Many of these campaigns rely on downloaders for distribution, such as VB Scripts.
Win.Malware.njRAT-7011967-1	Malware	njRAT, also known as Bladabindi, is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.
Win.Malware.Tofsee-7012060-0	Malware	Tofsee is multi-purpose malware that features a number of modules used to carry out various activities, such as sending spam messages, conducting click fraud, mining cryptocurrency, and more. Infected systems become part of the Tofsee spam botnet and are used to send large volumes of spam messages in an effort to infect additional systems and increase the overall size of the botnet under the operator’s control.
Win.Ransomware.Gandcrab-7012204-0	Ransomware	GandCrab is ransomware that encrypts documents, photos, databases and other important files typically using the file extension ".GDCB", ".CRAB" or ".KRAB." GandCrab is spread through both traditional spam campaigns, as well as multiple exploit kits, including Rig and GrandSoft.
Win.Packed.Xcnfe-7012508-0	Packed	This cluster provides generic detection for the Dridex banking trojan that's downloaded onto a target's machine.
Win.Packed.Kuluoz-7051229-0	Packed	Kuluoz, sometimes known as "Asprox," is a modular remote access trojan that is also known to download and execute follow-on malware, such as fake antivirus software. Kuluoz is often delivered via spam emails pretending to be shipment delivery notifications or flight booking confirmations.
Win.Ransomware.Cerber-7052005-0	Ransomware	Cerber is ransomware that encrypts documents, photos, databases and other important files using the file extension ".cerber."

---

Threat Breakdown

Win.Virus.Expiro-7011826-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V2.0.50727_32 Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V2.0.50727_32 Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V2.0.50727_64 Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V2.0.50727_64 Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V4.0.30319_32 Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V4.0.30319_32 Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V4.0.30319_64 Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CLR_OPTIMIZATION_V4.0.30319_64 Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\COMSYSAPP Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\COMSYSAPP Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IEETWCOLLECTORSERVICE Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IEETWCOLLECTORSERVICE Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MOZILLAMAINTENANCE Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MOZILLAMAINTENANCE Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MSISERVER Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MSISERVER Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\OSE Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\OSE Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\UI0DETECT Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\UI0DETECT Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\VDS Value Name: Type	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\VDS Value Name: Start	27
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\VSS Value Name: Type	27

Mutexes	Occurrences
kkq-vx_mtx1	27
gazavat-svc	27
kkq-vx_mtx64	27
kkq-vx_mtx65	27
kkq-vx_mtx66	27
kkq-vx_mtx67	27
kkq-vx_mtx68	27
kkq-vx_mtx69	27
kkq-vx_mtx70	27
kkq-vx_mtx71	27
kkq-vx_mtx72	27
kkq-vx_mtx73	27
kkq-vx_mtx74	27
kkq-vx_mtx75	27
kkq-vx_mtx76	27
kkq-vx_mtx77	27
kkq-vx_mtx78	27
kkq-vx_mtx79	27
kkq-vx_mtx80	27
kkq-vx_mtx81	27
kkq-vx_mtx82	27
kkq-vx_mtx83	27
kkq-vx_mtx84	27
kkq-vx_mtx85	27
kkq-vx_mtx86	27

Files and or directories created	Occurrences
\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.vir	27
\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\ose.vir	27
\MSOCache\All Users\{91140000-0011-0000-0000-0000000FF1CE}-C\setup.vir	27
%CommonProgramFiles%\Microsoft Shared\VSTO\10.0\VSTOInstaller.vir	27
%CommonProgramFiles%\Microsoft Shared\ink\ConvertInkStore.vir	27
%CommonProgramFiles%\Microsoft Shared\ink\InputPersonalization.vir	27
%CommonProgramFiles%\Microsoft Shared\ink\ShapeCollector.vir	27
%CommonProgramFiles%\Microsoft Shared\ink\TabTip.vir	27
%CommonProgramFiles%\Microsoft Shared\ink\mip.vir	27
%ProgramFiles%\DVD Maker\DVDMaker.vir	27
%ProgramFiles%\Internet Explorer\ieinstal.vir	27
%ProgramFiles%\Internet Explorer\ielowutil.vir	27
%ProgramFiles%\Internet Explorer\iexplore.vir	27
%ProgramFiles%\Java\jre6\bin\java.vir	27
%ProgramFiles%\Java\jre6\bin\javaw.vir	27
%ProgramFiles%\Java\jre6\bin\javaws.vir	27
%ProgramFiles%\Java\jre6\bin\unpack200.vir	27
%ProgramFiles%\Java\jre7\bin\jabswitch.vir	27
%ProgramFiles%\Java\jre7\bin\java.vir	27
%ProgramFiles%\Java\jre7\bin\javacpl.vir	27
%ProgramFiles%\Java\jre7\bin\javaw.vir	27
%ProgramFiles%\Java\jre7\bin\javaws.vir	27
%ProgramFiles%\Java\jre7\bin\jp2launcher.vir	27
%ProgramFiles%\Java\jre7\bin\ssvagent.vir	27
%ProgramFiles%\Java\jre7\bin\unpack200.vir	27

File Hashes

Coverage

Product	Protection
Amp
Cloudlock	N/A
Cws
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
Wsa	N/A

Screenshots of Detection

AMP

ThreatGrid

---

Win.Dropper.Nymaim-7011878-0

Indicators of Compromise

Registry Keys	Occurrences
<HKCU>\Software\Microsoft\GOCFK	23
<HKCU>\SOFTWARE\MICROSOFT\GOCFK Value Name: mbijg	23

Mutexes	Occurrences
Local\{369514D7-C789-5986-2D19-AB81D1DD3BA1}	23
Local\{D0BDC0D1-57A4-C2CF-6C93-0085B58FFA2A}	23
Local\{F04311D2-A565-19AE-AB73-281BA7FE97B5}	23
Local\{F6F578C7-92FE-B7B1-40CF-049F3710A368}	23
Local\{306BA354-8414-ABA3-77E9-7A7F347C71F4}	23
Local\{F58B5142-BC49-9662-B172-EA3D10CAA47A}	23
Local\{C170B740-57D9-9B0B-7A4E-7D6ABFCDE15D}	23
Local\{B888AC68-15DA-9362-2153-60CCDE3753D5}	23
Local\{2DB629D3-9CAA-6933-9C2E-D40B0ACCAC9E}	23

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
xunveu[.]in	22
rerbitzfyff[.]in	22
uwsmf[.]net	22
utgwcrp[.]com	22
xyiubkksjo[.]pw	22
octvwlg[.]net	22
mzutglz[.]com	22
bjgouvf[.]net	22
ulgug[.]in	22
bybxug[.]pw	22
ilqmz[.]com	22
wnckjojra[.]net	22
vncya[.]in	22
mzpgaccm[.]in	22
cspflbgtpwxg[.]com	22
pcarbnracpll[.]in	20
hnmkptaybcf[.]pw	20
ypgfnvixxaw[.]in	20
emuakrgqzg[.]pw	20
ucwwhvxji[.]com	20
rinzevlc[.]net	20
zdlvqrnmf[.]net	20
chavpayztnex[.]net	20
fwceecdhnnph[.]net	20
xlwzoffpooo[.]com	20

Files and or directories created	Occurrences
%ProgramData%\ph	23
%ProgramData%\ph\fktiipx.ftf	23
%TEMP%\gocf.ksv	23
%ProgramData%\l4szb	23
%LOCALAPPDATA%\15rdg	23
%APPDATA%\4fo	23
%TEMP%\fro.dfx	20
\Documents and Settings\All Users\pxs\pil.ohu	20
%TEMP%\bpnb.skg	10
%TEMP%\wghpl.bqj	1
\Documents and Settings\All Users\akt\aaq.hcr	1
%TEMP%\mfw.cac	1
\Documents and Settings\All Users\yvn\uwawv.hnd	1

File Hashes

Coverage

Product	Protection
Amp
Cloudlock	N/A
Cws
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
Wsa

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Win.Dropper.TrickBot-7011945-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Value Name: Blob	10
<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender	2
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Users\Administrator\AppData\Roaming\services\	2
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Users\Administrator\AppData\Roaming\services\	2
<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	2
<HKLM>\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths	2

Mutexes	Occurrences
316D1C7871E00	16
\BaseNamedObjects\785161C887200	9

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
216[.]239[.]34[.]21	4
37[.]230[.]115[.]129	4
78[.]155[.]207[.]143	4
193[.]233[.]62[.]131	4
195[.]133[.]196[.]219	3
200[.]111[.]97[.]235	3
186[.]68[.]120[.]16	3
37[.]230[.]115[.]171	3
37[.]230[.]115[.]133	3
62[.]69[.]241[.]103	3
216[.]239[.]36[.]21	2
23[.]21[.]121[.]219	2
50[.]16[.]229[.]140	2
94[.]103[.]80[.]16	2
216[.]239[.]32[.]21	1
34[.]233[.]102[.]38	1
198[.]27[.]74[.]146	1
104[.]20[.]17[.]242	1
216[.]239[.]38[.]21	1
54[.]235[.]124[.]112	1
52[.]206[.]161[.]133	1
104[.]20[.]16[.]242	1
94[.]127[.]111[.]14	1
184[.]73[.]220[.]206	1
46[.]30[.]45[.]208	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
ipecho[.]net	5
elb097307-934924932[.]us-east-1[.]elb[.]amazonaws[.]com	5
myexternalip[.]com	2
checkip[.]amazonaws[.]com	2
api[.]ipify[.]org	2
wtfismyip[.]com	1
ipinfo[.]io	1
icanhazip[.]com	1

Files and or directories created	Occurrences
Modules	16
client_id	16
group_tag	16
%System32%\Tasks\services update	16
%APPDATA%\localservice\client_id	14
%APPDATA%\localservice\group_tag	14
%APPDATA%\localservice	14
%SystemRoot%\Tasks\services update.job	9
%SystemRoot%\TEMP\~DFDA4328936B46A2E2.TMP	1
%SystemRoot%\TEMP\~DFBEE2068C496B9A0B.TMP	1
%SystemRoot%\TEMP\~DFE4F856122203E5A6.TMP	1
%SystemRoot%\TEMP\~DF95BC682C0250D9D0.TMP	1
%SystemRoot%\TEMP\~DF664B3409FD7DCCB3.TMP	1
%SystemRoot%\TEMP\~DF8B34B44DCAF0FAB3.TMP	1
%SystemRoot%\TEMP\~DFDFC8A9E27AB554F4.TMP	1
%SystemRoot%\TEMP\~DFE798A25A56E126CC.TMP	1
%SystemRoot%\TEMP\~DFCCEBCD519293AB68.TMP	1
%SystemRoot%\TEMP\~DF5DE8F500481F14C0.TMP	1
%SystemRoot%\TEMP\~DFB36F6F7DB9D671D4.TMP	1
%SystemRoot%\TEMP\~DF7A2364BFEF750112.TMP	1
%SystemRoot%\TEMP\~DF604668AE25DEDE76.TMP	1
%APPDATA%\localservice\82b686b66ad703470800edb64763f2b64e1cffaa6830accbe7ff8178e6b48724.exe	1
%SystemRoot%\TEMP\~DF7802BEE615801D53.TMP	1
%SystemRoot%\TEMP\~DF50F658542C3B5672.TMP	1
%SystemRoot%\TEMP\~DF5E22B8EF8D659CE2.TMP	1

File Hashes

Coverage

Product	Protection
Amp
Cloudlock	N/A
Cws
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
Wsa

Screenshots of Detection

AMP

ThreatGrid

---

Win.Malware.njRAT-7011967-1

Indicators of Compromise

Registry Keys	Occurrences
<HKU>\S-1-5-21-2580483871-590521980-3826313501-500 Value Name: di	26
<HKCU>\ENVIRONMENT Value Name: SEE_MASK_NOZONECHECKS	26
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: ParseAutoexec	26
<HKLM>\System\CurrentControlSet\Services\NapAgent\Shas	24
<HKLM>\System\CurrentControlSet\Services\NapAgent\Qecs	24
<HKLM>\System\CurrentControlSet\Services\NapAgent\LocalConfig	24
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\Enroll\HcsGroups	24
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\UI	24
<HKCU>\Software\3d115699981cee571b7b4f66ac05e68c	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 3d115699981cee571b7b4f66ac05e68c	7
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 3d115699981cee571b7b4f66ac05e68c	7
<HKCU>\SOFTWARE\3D115699981CEE571B7B4F66AC05E68C Value Name: [kl]	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: d357c7c29de6f023d943a6a5749259b6	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: d357c7c29de6f023d943a6a5749259b6	1
<HKCU>\SOFTWARE\D357C7C29DE6F023D943A6A5749259B6 Value Name: [kl]	1
<HKCU>\Software\eecedbc08899b6053b2f68175c2ade9d	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: eecedbc08899b6053b2f68175c2ade9d	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: eecedbc08899b6053b2f68175c2ade9d	1
<HKCU>\SOFTWARE\EECEDBC08899B6053B2F68175C2ADE9D Value Name: [kl]	1
<HKCU>\Software\cee69a9c58a2f342efc10ce9b61baf18	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: cee69a9c58a2f342efc10ce9b61baf18	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: cee69a9c58a2f342efc10ce9b61baf18	1
<HKCU>\SOFTWARE\CEE69A9C58A2F342EFC10CE9B61BAF18 Value Name: [kl]	1
<HKCU>\Software\c89d6f2f51b03aeeb600705006913620	1
<HKCU>\SOFTWARE\C89D6F2F51B03AEEB600705006913620 Value Name: [kl]	1

Mutexes	Occurrences
Unknown	26
Global\783b85a0-9df2-11e9-a007-00501e3ae7b5	26
3d115699981cee571b7b4f66ac05e68c	7
767e342b9464203399b874be2f756a33	1
88f1bb19962eeb60cb416d731fb26aea	1
e4147808b03abe9f0c3c590c783b5f67	1
cd37f8fb04904790aec64ec6b0296433	1
b2d5379932f9d6eda0b4b4e483e6f706	1
d1c945c77014d102f98a39383a30a06f	1
54652225b66d96cf87694edf842a80cd	1
43ea784f064f564187850c70cfe36c6e	1
d357c7c29de6f023d943a6a5749259b6	1
eecedbc08899b6053b2f68175c2ade9d	1
cee69a9c58a2f342efc10ce9b61baf18	1
c89d6f2f51b03aeeb600705006913620	1
b92cfeca418c2dea22378d2a69b20e0d	1
2fec419046b765ea0c3b4e01c9db47a7	1
853654d9e10653518ce2df77e9edb5a0	1
f6a16052a275bda28850cb9c07e032e6	1
2c19e5532f94fc5804396a44a7b11075	1
bd038787fbc588893c8c348e22ae3557	1
f1d09ec17b6425dd6e0a316aeae5b67e	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
156[.]196[.]135[.]14	4
67[.]214[.]175[.]69	3
159[.]89[.]214[.]31	1
66[.]199[.]229[.]251	1
85[.]17[.]30[.]167	1
154[.]121[.]37[.]5	1
62[.]117[.]61[.]130	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
magichako[.]publicvm[.]com	7
shadowhakar41[.]ddns[.]net	2
AAAA5[.]HOPTO[.]ORG	1
kounan19[.]myq-see[.]com	1
salehboot[.]ddns[.]net	1
updated[.]ddns[.]net	1
blackstrretboy[.]ddns[.]net	1
z12z12[.]hopto[.]org	1
bobaramos[.]ddns[.]net	1
hackerdzarit[.]ddns[.]net	1
hassan1212[.]ddns[.]net	1
rezallta[.]ddns[.]net	1
serveo[.]net	1
android-update[.]servehttp[.]com	1

Files and or directories created	Occurrences
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Mirosoft.js	26
%APPDATA%\Microsoft\Windows\Templates\Windows.Exe	26
%TEMP%\dw.log	24
%TEMP%\73E7.dmp	24
%HOMEPATH%\Start Menu\Programs\Startup\Mirosoft.js	24
%HOMEPATH%\Templates\Windows.Exe	24
%TEMP%\server.exe	13
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\3d115699981cee571b7b4f66ac05e68c.exe	7
%TEMP%\ddn.exe	2
%APPDATA%\explorer.exe	1
%APPDATA%\server.exe	1
%TEMP%\system32.exe	1
%APPDATA%\wininit.exe	1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\767e342b9464203399b874be2f756a33.exe	1
%TEMP%\syswine.exe	1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\cd37f8fb04904790aec64ec6b0296433.exe	1
%TEMP%\updated.exe	1
%TEMP%\svchos.exe	1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\d1c945c77014d102f98a39383a30a06f.exe	1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\cee69a9c58a2f342efc10ce9b61baf18.exe	1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\b92cfeca418c2dea22378d2a69b20e0d.exe	1
%TEMP%\windows updates.exe	1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\f6a16052a275bda28850cb9c07e032e6.exe	1

File Hashes

Coverage

Product	Protection
Amp
Cloudlock	N/A
Cws
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
Wsa

Screenshots of Detection

AMP

ThreatGrid

---

Win.Malware.Tofsee-7012060-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\System\CurrentControlSet\Services\NapAgent\Shas	13
<HKLM>\System\CurrentControlSet\Services\NapAgent\Qecs	13
<HKLM>\System\CurrentControlSet\Services\NapAgent\LocalConfig	13
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\Enroll\HcsGroups	13
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NAPAGENT\LOCALCONFIG\UI	13
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\athnmuap	13
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\ATHNMUAP Value Name: Type	13
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\ATHNMUAP Value Name: Start	13
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\ATHNMUAP Value Name: ErrorControl	13
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\ATHNMUAP Value Name: DisplayName	13
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\ATHNMUAP Value Name: WOW64	13
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\ATHNMUAP Value Name: ObjectName	13
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\ATHNMUAP Value Name: Description	13
<HKU>\.DEFAULT\Control Panel\Buses	12
<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config0	12
<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config1	12
<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config4	10
<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config2	10
<HKU>\.DEFAULT\CONTROL PANEL\BUSES Value Name: Config3	10
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\gzntsagv	2
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\athnmuap	2
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHS Value Name: C:\Windows\SysWOW64\mftzygmb	2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MFTZYGMB Value Name: ImagePath	2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\GZNTSAGV Value Name: ImagePath	2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\ATHNMUAP Value Name: ImagePath	2

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
43[.]231[.]4[.]7	13
69[.]55[.]5[.]250	12
239[.]255[.]255[.]250	10
46[.]4[.]52[.]109	10
176[.]111[.]49[.]43	10
85[.]25[.]119[.]25	10
144[.]76[.]199[.]2	10
144[.]76[.]199[.]43	10
98[.]137[.]159[.]27	10
192[.]0[.]47[.]59	10
209[.]85[.]202[.]27	10
168[.]95[.]5[.]114	10
104[.]44[.]194[.]232	9
104[.]44[.]194[.]236	9
94[.]23[.]27[.]38	9
188[.]125[.]73[.]87	8
74[.]6[.]137[.]65	8
65[.]55[.]92[.]184	8
65[.]55[.]33[.]135	8
65[.]55[.]92[.]168	8
65[.]55[.]92[.]152	8
65[.]55[.]37[.]72	8
65[.]54[.]188[.]72	8
104[.]44[.]194[.]231	8
65[.]55[.]37[.]120	8

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
microsoft-com[.]mail[.]protection[.]outlook[.]com	13
250[.]5[.]55[.]69[.]in-addr[.]arpa	12
250[.]5[.]55[.]69[.]zen[.]spamhaus[.]org	10
250[.]5[.]55[.]69[.]cbl[.]abuseat[.]org	10
mta7[.]am0[.]yahoodns[.]net	10
mta5[.]am0[.]yahoodns[.]net	10
mx-eu[.]mail[.]am0[.]yahoodns[.]net	10
250[.]5[.]55[.]69[.]dnsbl[.]sorbs[.]net	10
whois[.]iana[.]org	10
250[.]5[.]55[.]69[.]bl[.]spamcop[.]net	10
whois[.]arin[.]net	10
250[.]5[.]55[.]69[.]sbl-xbl[.]spamhaus[.]org	10
hotmail-com[.]olc[.]protection[.]outlook[.]com	10
mta6[.]am0[.]yahoodns[.]net	10
honeypus[.]rusladies[.]cn	10
marina99[.]ruladies[.]cn	10
coolsex-finders4[.]com	10
sexual-pattern3[.]com	10
msx-smtp-mx1[.]hinet[.]net	9
ipinfo[.]io	8
yahoo[.]fr	6
charter[.]net	6
mx0[.]charter[.]net	6
smtp[.]secureserver[.]net	6
msa[.]hinet[.]net	6

Files and or directories created	Occurrences
%SystemRoot%\SysWOW64\athnmuap	13
%TEMP%\wmslmukt.exe	13
%SystemRoot%\SysWOW64\config\systemprofile:.repos	12
%SystemRoot%\SysWOW64\config\systemprofile	12
%System32%\antugrwv\nuhhkvni.exe (copy)	10
%HOMEPATH%	9

File Hashes

Coverage

Product	Protection
Amp
Cloudlock	N/A
Cws
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
Wsa

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Win.Ransomware.Gandcrab-7012204-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Value Name: Blob	15
<HKCU>\SOFTWARE\keys_data\data	10
<HKCU>\SOFTWARE\keys_data	10
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\TASKBAND Value Name: FavoritesChanges	9
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\TASKBAND Value Name: FavoritesVersion	9
<HKCU>\Software\EncryptKeys	9
<HKCU>\SOFTWARE\ENCRYPTKEYS Value Name: local_enc_private_key_len	9
<HKCU>\SOFTWARE\ENCRYPTKEYS Value Name: local_public_key_len	9
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\TASKBAND Value Name: FavoritesResolve	9
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\TASKBAND Value Name: Favorites	9
<HKLM>\SOFTWARE\Wow6432Node\ex_data\data	5
<HKLM>\SOFTWARE\Wow6432Node\keys_data\data	5

Mutexes	Occurrences
Global\8B5BAAB9E36E4507C5F5.lock	15
BleepingComputer_no_more_ransom	9
Global\XlAKFoxSKGOfSGOoSFOOFNOLPE	5
Global\syncronize_9WATTOA	1
Global\syncronize_9WATTOU	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
213[.]186[.]33[.]5	15
185[.]135[.]88[.]105	13
23[.]236[.]62[.]147	13
217[.]70[.]184[.]50	13
66[.]96[.]147[.]103	13
149[.]56[.]154[.]141	13
199[.]188[.]201[.]218	13
47[.]75[.]206[.]148	13
45[.]118[.]145[.]96	13
69[.]163[.]193[.]127	13
23[.]100[.]15[.]180	13
142[.]93[.]6[.]249	13
62[.]210[.]24[.]116	13
104[.]31[.]75[.]227	10
104[.]27[.]162[.]241	9
104[.]28[.]31[.]160	8
104[.]24[.]103[.]153	7
45[.]33[.]91[.]79	6
104[.]24[.]102[.]153	6
194[.]154[.]192[.]67	6
186[.]202[.]153[.]95	6
217[.]160[.]0[.]27	5
209[.]182[.]208[.]245	5
94[.]73[.]148[.]18	5
213[.]186[.]33[.]3	5

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
www[.]cyclevegas[.]com	13
img[.]maokeyang[.]cn	13
himmerlandgolfogsparesort[.]dk	13
www[.]casegranmoun[.]com	13
acbt[.]fr	5
www[.]billerimpex[.]com	5
asl-company[.]ru	5
www[.]macartegrise[.]eu	5
oceanlinen[.]com	5
nesten[.]dk	5
perovaphoto[.]ru	5
koloritplus[.]ru	5
pp-panda74[.]ru	5
dna-cp[.]com	5
boatshowradio[.]com	5
www[.]mimid[.]cz	5
tommarmores[.]com[.]br	5
cevent[.]net	5
poketeg[.]com	5
alem[.]be	5
h5s[.]vn	5
wpakademi[.]com	5
www[.]fabbfoundation[.]gm	5
6chen[.]cn	5
zaeba[.]co[.]uk	5

Files and or directories created	Occurrences
%APPDATA%\Microsoft\Templates\LiveContent\Managed\SmartArt Graphics\1033\TM02660319[[fn=Tab List]].glox	23
%HOMEPATH%	20
%HOMEPATH%\ntuser.ini	15
%HOMEPATH%\98b689da98b68e3d7f.lock	14
%HOMEPATH%\AppData\98b689da98b68e3d7f.lock	14
%APPDATA%\98b689da98b68e3d7f.lock	14
%APPDATA%\Media Center Programs\98b689da98b68e3d7f.lock	14
%APPDATA%\Microsoft\98b689da98b68e3d7f.lock	14
%APPDATA%\Microsoft\Internet Explorer\98b689da98b68e3d7f.lock	14
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Cookies\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Desktop\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Documents\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Documents\My Music\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Documents\My Pictures\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Documents\My Videos\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Downloads\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Favorites\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Links\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Music\98b689da98b68e3d7f.lock	14
%HOMEPATH%\My Documents\98b689da98b68e3d7f.lock	14
%HOMEPATH%\NetHood\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Pictures\98b689da98b68e3d7f.lock	14
%HOMEPATH%\PrintHood\98b689da98b68e3d7f.lock	14
%HOMEPATH%\Recent\98b689da98b68e3d7f.lock	14

File Hashes

Coverage

Product	Protection
Amp
Cloudlock	N/A
Cws
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
Wsa

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Win.Packed.Xcnfe-7012508-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: trkcore	25
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: DisableTaskMgr	25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.CHECK.0 Value Name: CheckSetting	25

Mutexes	Occurrences
47DjnezoRe	2
IXK1mBzkeB	2
RkTC1Yz5Uz	2
TmvHGtjMMV	2
gTBa3BMJg6	2
mssh1fu7QG	2
pyG6EAoW3D	2
rPy4lSuqRA	2
ii60Bmwus7	1
vKukwxgBam	1
CUDKUvauMV	1
KCeMGJgXYT	1
SFxcCQUOXu	1
SUC2X0PwVg	1
X3ENRc03mQ	1
YWuTH3ehY0	1
nVz9jsXjUw	1
oFYy6Mcbck	1
0CNHUsuQfc	1
2rTNQbESAE	1
PbFIJDskBy	1
R5aLQD5OQO	1
rrQXp0Shel	1
9ykplVD3nO	1
sKcAQgjpGg	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
172[.]217[.]12[.]142	25
104[.]20[.]209[.]21	13
104[.]20[.]208[.]21	12

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
pastebin[.]com	25
www[.]fvtbhlnxj0[.]com	2
www[.]fynzp0oht8[.]com	2
www[.]in4lprxgui[.]com	2
www[.]ct1wlbyjzx[.]com	2
www[.]uttn4zziks[.]com	2
www[.]lrv8bvrmhq[.]com	2
www[.]rm1cbe2kvb[.]com	2
www[.]tcp1twzitf[.]com	2
www[.]gzw0bfzxhb[.]com	1
www[.]glixbn9lnj[.]com	1
www[.]coxymk80cd[.]com	1
www[.]exgk5nzv7m[.]com	1
www[.]c62yc6xsm1[.]com	1
www[.]hludxizrvf[.]com	1
www[.]huga7gshpk[.]com	1
www[.]rjhw2tvcvh[.]com	1
www[.]5twtwy19pp[.]com	1
www[.]fwn4l9u2gb[.]com	1
www[.]xpqvri1vhh[.]com	1
www[.]seqamoa4jp[.]com	1
www[.]b7qxyidhg5[.]com	1
www[.]porsukgrlq[.]com	1
www[.]lqdu4kraxu[.]com	1
www[.]t0uetiplqk[.]com	1

File Hashes

Coverage

Product	Protection
Amp
Cloudlock	N/A
Cws
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
Wsa	N/A

Screenshots of Detection

AMP

ThreatGrid

---

Win.Packed.Kuluoz-7051229-0

Indicators of Compromise

Mutexes	Occurrences
2GVWNQJz1	26

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
178[.]63[.]193[.]60	17
74[.]208[.]246[.]250	16
37[.]26[.]108[.]41	14
133[.]242[.]134[.]76	14
62[.]75[.]143[.]211	13
78[.]47[.]145[.]72	13
77[.]72[.]26[.]97	8

Files and or directories created	Occurrences
%LOCALAPPDATA%\hcxlrall.exe	2
%LOCALAPPDATA%\nxeeoucb.exe	2
%HOMEPATH%\Local Settings\Application Data\rbgruqii.exe	2
%HOMEPATH%\Local Settings\Application Data\leqahubc.exe	1
%HOMEPATH%\Local Settings\Application Data\kwoisujq.exe	1
%HOMEPATH%\Local Settings\Application Data\qoqjntog.exe	1
%HOMEPATH%\Local Settings\Application Data\pegwmgts.exe	1
%HOMEPATH%\Local Settings\Application Data\oubnlaau.exe	1
%LOCALAPPDATA%\bufneahr.exe	1
%LOCALAPPDATA%\ixhcodud.exe	1
%LOCALAPPDATA%\esnbtcpu.exe	1
%LOCALAPPDATA%\qphrcdrs.exe	1
%LOCALAPPDATA%\gamnsluq.exe	1
%LOCALAPPDATA%\qakojkqh.exe	1
%LOCALAPPDATA%\tachgniq.exe	1
%LOCALAPPDATA%\wcsmjqql.exe	1
%LOCALAPPDATA%\akkqeuve.exe	1
%LOCALAPPDATA%\huhqpcvi.exe	1
%LOCALAPPDATA%\bxqfccqi.exe	1
%LOCALAPPDATA%\jbsxvqlw.exe	1
%LOCALAPPDATA%\gjqfijgu.exe	1
%LOCALAPPDATA%\qxvxkxtb.exe	1
%LOCALAPPDATA%\nsahkntd.exe	1
%LOCALAPPDATA%\ptlqijon.exe	1
%LOCALAPPDATA%\saxrgecs.exe	1

File Hashes

Coverage

Product	Protection
Amp
Cloudlock	N/A
Cws
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
Wsa	N/A

Screenshots of Detection

AMP

ThreatGrid

---

Win.Ransomware.Cerber-7052005-0

Indicators of Compromise

Registry Keys	Occurrences
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	18
<HKCU>\Printers\Defaults\{21A3D5EE-E123-244A-98A1-8E36C26EFF6D}	18
<HKCU>\PRINTERS\Defaults	18
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER Value Name: Run	18
<HKCU>\SOFTWARE\MICROSOFT\COMMAND PROCESSOR Value Name: AutoRun	18
<HKCU>\CONTROL PANEL\DESKTOP Value Name: SCRNSAVE.EXE	18
<HKCU>\PRINTERS\DEFAULTS\{21A3D5EE-E123-244A-98A1-8E36C26EFF6D} Value Name: Installed	12
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER Value Name: CleanShutdown	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{509D0DCA-5840-11E6-A51E-806E6F6E6963} Value Name: Generation	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{6DD1DC5F-5840-11E6-B80E-00501E3AE7B5} Value Name: Data	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{6DD1DC5F-5840-11E6-B80E-00501E3AE7B5} Value Name: Generation	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{3F37BA63-EF5C-11E4-BB8D-806E6F6E6963} Value Name: Data	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{3F37BA63-EF5C-11E4-BB8D-806E6F6E6963} Value Name: Generation	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963} Value Name: Data	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963} Value Name: Generation	7
<HKLM>\SYSTEM\CONTROLSET001\ENUM\PCIIDE\IDECHANNEL\4&A27250A&0&2 Value Name: CustomPropertyHwIdKey	7
<HKLM>\SYSTEM\CONTROLSET001\ENUM\USB\VID_46F4&PID_0001\1-0000:00:1D.7-2 Value Name: CustomPropertyHwIdKey	7
<HKLM>\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_1AF4&DEV_1001&SUBSYS_00021AF4&REV_00\3&2411E6FE&2&18 Value Name: CustomPropertyHwIdKey	7
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: winrs	2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: rasautou	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: rasautou	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: getmac	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: getmac	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Utilman	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: Utilman	1

Mutexes	Occurrences
shell.{381828AA-8B28-3374-1B67-35680555C5EF}	18
\BaseNamedObjects\shell.{573F0F01-C284-E3E4-B166-E3C39544ED56}	17
cversions.1.m	12
GeneratingSchemaGlobalMapping	12
cversions.2.m	12
Local\ExplorerIsShellMutex	8
	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
31[.]184[.]235[.]224	18
31[.]184[.]234[.]128	18
31[.]184[.]234[.]0	18
31[.]184[.]235[.]252	18
31[.]184[.]235[.]254	18
31[.]184[.]235[.]248	18
31[.]184[.]235[.]128	18
31[.]184[.]234[.]224	18
31[.]184[.]234[.]192	18
31[.]184[.]235[.]192	18
31[.]184[.]234[.]252	18
31[.]184[.]234[.]254	18
31[.]184[.]234[.]248	18
31[.]184[.]235[.]0	18
31[.]184[.]235[.]240	18
31[.]184[.]234[.]240	18
216[.]239[.]32[.]21	8
216[.]239[.]34[.]21	7
216[.]239[.]38[.]21	7
216[.]239[.]36[.]21	7
104[.]26[.]15[.]73	6
147[.]135[.]15[.]186	5
104[.]26[.]14[.]73	5
185[.]100[.]85[.]150	1
54[.]84[.]252[.]139	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
ipinfo[.]io	18
en[.]wikipedia[.]org	8
www[.]collectionscanada[.]ca	8
alpha3[.]suffolk[.]lib[.]ny[.]us	8
www[.]archives[.]gov	8
www[.]vitalrec[.]com	8
www[.]cdc[.]gov	8
freegeoip[.]net	6
ip-api[.]com	5
52uo5k3t73ypjije[.]hlu8yz[.]top	2
52uo5k3t73ypjije[.]xmfru5[.]top	2
onion[.]to	1
cerberhhyed5frqa[.]onion[.]to	1
52uo5k3t73ypjije[.]zclw5i[.]top	1
52uo5k3t73ypjije[.]ujtwhg[.]top	1
52uo5k3t73ypjije[.]ka0te8[.]top	1
52uo5k3t73ypjije[.]j92msu[.]top	1
52uo5k3t73ypjije[.]nameuser[.]site	1
52uo5k3t73ypjije[.]b7mciu[.]top	1
52uo5k3t73ypjije[.]marksgain[.]kim	1
52uo5k3t73ypjije[.]moonsides[.]faith	1
52uo5k3t73ypjije[.]bigfooters[.]loan	1
52uo5k3t73ypjije[.]poplenjohs[.]review	1

Files and or directories created	Occurrences
%APPDATA%\Adobe\Acrobat\9.0\# DECRYPT MY FILES #.html	17
%APPDATA%\Adobe\Acrobat\9.0\# DECRYPT MY FILES #.txt	17
%APPDATA%\Adobe\Acrobat\9.0\# DECRYPT MY FILES #.url	17
%APPDATA%\Adobe\Acrobat\9.0\# DECRYPT MY FILES #.vbs	17
%APPDATA%\Adobe\Acrobat\9.0\JavaScripts\# DECRYPT MY FILES #.url	17
%APPDATA%\Microsoft\Office\Recent\# DECRYPT MY FILES #.html	17
%APPDATA%\Microsoft\Office\Recent\# DECRYPT MY FILES #.txt	17
%APPDATA%\Microsoft\Office\Recent\# DECRYPT MY FILES #.url	17
%APPDATA%\Microsoft\Office\Recent\# DECRYPT MY FILES #.vbs	17
\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html	17
\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt	17
\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.url	17
\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbs	17
\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html	17
\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt	17
\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.url	17
\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbs	17
\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html	17
\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt	17
\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.url	17
\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbs	17
\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html	17
\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt	17
\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbs	17
\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html	17

File Hashes

Coverage

Product	Protection
Amp
Cloudlock	N/A
Cws
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
Wsa

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Exploit Prevention

Cisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits. These exploits use certain features to bypass typical anti-virus software, but were blocked by AMP thanks to its advanced scanning capabilities, even protecting against zero-day vulnerabilities.

Madshi injection detected - (1969)

Madshi is a code injection framework that uses process injection to start a new thread if other methods to start a thread within a process fail. This framework is used by a number of security solutions. It is also possible for malware to use this technique.

Kovter injection detected - (1195)

A process was injected into, most likely by an existing Kovter infection. Kovter is a click fraud Trojan that can also act as an information stealer. Kovter is also file-less malware meaning the malicious DLL is stored inside Windows registry and injected directly into memory using PowerShell. It can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2. It spreads through malicious advertising and spam campaigns.

Process hollowing detected - (792)

Process hollowing is a technique used by some programs to avoid static analysis. In typical usage, a process is started and its obfuscated or encrypted contents are unpacked into memory. The parent then manually sets up the first stages of launching a child process, but before launching it, the memory is cleared and filled in with the memory from the parent instead.

Trickbot malware detected - (714)

Trickbot is a banking Trojan which appeared in late 2016. Due to the similarities between Trickbot and Dyre, it is suspected some of the individuals responsible for Dyre are now responsible for Trickbot. Trickbot has been rapidly evolving over the months since it has appeared. However, Trickbot is still missing some of the capabilities Dyre possessed. Its current modules include DLL injection, system information gathering, and email searching.

Dealply adware detected - (468)

DealPly is adware, which claims to improve your online shopping experience. It is often bundled into other legitimate installers and is difficult to uninstall. It creates pop-up advertisements and injects advertisements on webpages. Adware has also been known to download and install malware.

Gamarue malware detected - (125)

Gamarue is a family of malware that can download files and steal information from an infected system. Worm variants of the Gamarue family may spread by infecting USB drives or portable hard disks that have been plugged into a compromised system.

Atom Bombing code injection technique detected - (61)

A process created a suspicious Atom, which is indicative of a known process injection technique called Atom Bombing. Atoms are Windows identifiers that associate a string with a 16-bit integer. These Atoms are accessible across processes when placed in the global Atom table. Malware exploits this by placing shell code as a global Atom, then accessing it through an Asynchronous Process Call (APC). A target process runs the APC function, which loads and runs the shellcode. The malware family Dridex is known to use Atom Bombing, but other threats may leverage it as well.

PowerShell file-less infection detected - (42)

A PowerShell command was stored in an environment variable and run. The environment variable is commonly set by a previously run script and is used as a means of evasion. This behavior is a known tactic of the Kovter and Poweliks malware families.

Installcore adware detected - (38)

Install core is an installer which bundles legitimate applications with offers for additional third-party applications that may be unwanted. The unwanted applications are often adware that display advertising in the form of popups or by injecting into browsers and adding or altering advertisements on webpages. Adware is known to sometimes download and install malware.

Excessively long PowerShell command detected - (37)

A PowerShell command with a very long command line argument that may indicate an obfuscated script has been detected. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.