Threat Roundup for February 21 to February 28

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 21 and Feb. 28. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.


For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found herethat includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicate maliciousness.
The most prevalent threats highlighted in this roundup are:

Threat Name	Type	Description
Doc.Malware.Valyria-7595017-0	Malware	Valyria is a malicious Microsoft Word document family that is used to distribute other malware, such as Emotet.
Doc.Downloader.Emotet-7593277-0	Downloader	Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a wide variety of payloads. It is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Dropper.Bifrost-7593600-0	Dropper	Bifrost is a backdoor with more than 10 variants. Bifrost uses the typical server, server builder, and client backdoor program configuration to allow a remote attacker, who uses the client, to execute arbitrary code on the compromised machine. Bifrost contains standard RAT features including a file manager, screen capture utility, keylogging, video recording, microphone and camera monitoring, and a process manager. Bifrost uses a mutex that may be named "Bif1234," or "Tr0gBot" to obtain persistence.
Win.Dropper.XtremeRAT-7594794-0	Dropper	XtremeRAT is a remote access trojan active since 2010 that allows the attacker to eavesdrop on users and modify the running system. The source code for XtremeRAT, written in Delphi, was leaked online and has since been used by similar RATs.
Win.Dropper.Upatre-7594799-0	Dropper	Upatre is a malicious downloader often used by exploit kits and phishing campaigns. Upatre downloads and executes malicious executables, such as banking malware.
Win.Dropper.NetWire-7597088-0	Dropper	NetWire is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam, remote desktop, and read data from connected USB devices. NetWire is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Packed.njRAT-7595003-1	Packed	njRAT, also known as Bladabindi, is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.
Win.Packed.Zbot-7595026-0	Packed	Zbot, also known as Zeus, is a trojan that steals information, such as banking credentials, using methods such as key-logging and form-grabbing.
Win.Virus.Ramnit-7597892-0	Virus	Ramnit is a banking trojan that monitors web browser activity on an infected machine and collects login information from financial websites. It also has the ability to steal browser cookies and attempts to hide from popular antivirus software.

---

Threat Breakdown

Doc.Malware.Valyria-7595017-0

Indicators of Compromise

• IOCs collected from dynamic analysis of 30 samples

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
169[.]254[.]255[.]255	3

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
footarepu[.]top	11
zofelaseo[.]top	10
folueaport[.]top	6
vvorootad[.]top	2
dosehoop[.]top	1

Files and or directories created	Occurrences
%HOMEPATH%\AppData\Roaming.eXE	30

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Doc.Downloader.Emotet-7593277-0

Indicators of Compromise

• IOCs collected from dynamic analysis of 25 samples

Registry Keys	Occurrences
<HKCU>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\33E4E80807204C2B6182A3A14B591ACD25B5F0DB	25

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
91[.]199[.]212[.]52	25
88[.]198[.]60[.]25	25
160[.]153[.]137[.]40	25
27[.]254[.]81[.]87	25
45[.]119[.]83[.]237	25
165[.]22[.]221[.]121	25
216[.]218[.]206[.]69	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
api[.]w[.]org	25
crt[.]sectigo[.]com	25
secureservercdn[.]net	25
pieceofpassion[.]com	25
raisabook[.]com	25
www[.]marketfxelite[.]com	25
biswalfoodcircle[.]com	25
tananfood[.]com	25
www[.]pieceofpassion[.]net	25

Files and or directories created	Occurrences
%HOMEPATH%\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30D802E0E248FEE17AAF4A62594CC75A	25

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Malware

---

Win.Dropper.Bifrost-7593600-0

Indicators of Compromise

• IOCs collected from dynamic analysis of 10 samples

Registry Keys	Occurrences
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: wextract_cleanup0	9

Mutexes	Occurrences
Bif1234	9
0ok3s	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
lronaldinho[.]no-ip[.]biz	1
zoulou[.]zapto[.]org	1
snouci[.]no-ip[.]biz	1

Files and or directories created	Occurrences
%TEMP%\IXP000.TMP	10
%TEMP%\IXP000.TMP\TMP4351$.TMP	10
%ProgramFiles%\bifrost\server.exe	8
%TEMP%\IXP000.TMP\server.exe	7
%TEMP%\IXP000.TMP\serve.exe	2
%ProgramFiles%\h4o\h4o.exe	1

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

ThreatGrid

---

Win.Dropper.XtremeRAT-7594794-0

Indicators of Compromise

• IOCs collected from dynamic analysis of 21 samples

Registry Keys	Occurrences
<HKCU>\SOFTWARE\<random, matching '[a-zA-Z0-9]{5,9}'> Value Name: ServerStarted	20
<HKCU>\SOFTWARE\<random, matching '[a-zA-Z0-9]{5,9}'> Value Name: InstalledServer	20
<HKCU>\SOFTWARE\<random, matching '[a-zA-Z0-9]{5,9}'>	20
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: HKLM	9
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: HKCU	8
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN	5
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN	5
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN Value Name: Server	3
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN Value Name: Server	3
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: dll	3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{5460C4DF-B266-909E-CB58-E32B79832EB2}	2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: vlc	2
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{5460C4DF-B266-909E-CB58-E32B79832EB2} Value Name: StubPath	2
<HKCU>\SOFTWARE\FAKEMESSAGE Value Name: FakeMessage	1
<HKCU>\SOFTWARE\((MUTEX)) Value Name: InstalledServer	1
<HKCR>\LOCAL SETTINGS\MUICACHE\\52C64B7E Value Name: LanguageList	1
<HKCU>\SOFTWARE\((MUTEX))	1
<HKCU>\SOFTWARE\FAKEMESSAGE	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{4YYH6UVK-0H14-53J3-2EKB-QFCG58W0Y54X}	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{4YYH6UVK-0H14-53J3-2EKB-QFCG58W0Y54X} Value Name: StubPath	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{4N6D64W4-JGT3-3SRU-VEIG-428Y3Y04H28J}	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{4N6D64W4-JGT3-3SRU-VEIG-428Y3Y04H28J} Value Name: StubPath	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: msn	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{L026V375-M6QD-607A-01BW-NY4DH11HTA1N}	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{L026V375-M6QD-607A-01BW-NY4DH11HTA1N} Value Name: StubPath	1

Mutexes	Occurrences
XTREMEUPDATE	21
<random, matching [a-zA-Z0-9]{5,9}>	20
<random, matching [a-zA-Z0-9]{5,9}>PERSIST	17
<random, matching [a-zA-Z0-9]{5,9}EXIT>	17
((Mutex))	1
((Mutex))PERSIST	1
((Mutex))EXIT	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
in4ta[.]hopto[.]org	2
xtremerat[.]zapto[.]org	1
chrome[.]myvnc[.]com	1
antilove[.]zapto[.]org	1
lifefornoobs[.]no-ip[.]org	1
trancegend[.]servehttp[.]com	1
paxromana[.]no-ip[.]org	1

Files and or directories created	Occurrences
%APPDATA%\Microsoft\Windows\<random, matching '[a-zA-Z0-9]{5,9}'>.cfg	20
%TEMP%\x.html	13
%SystemRoot%\SysWOW64\InstallDir	9
%TEMP%\~PI<random, matching [A-F0-9]{2,4}>.tmp	7
%APPDATA%\Microsoft\Windows\<random, matching '[a-zA-Z0-9]{5,9}'>.dat	7
%APPDATA%\InstallDir	6
%SystemRoot%\SysWOW64\dllcache	4
%APPDATA%\dllcache	4
%SystemRoot%\InstallDir	3
%SystemRoot%\SysWOW64\InstallDir\Server.exe	3
%SystemRoot%\SysWOW64\InstallDir\dll.exe	3
%APPDATA%\InstallDir\dll.exe	3
%SystemRoot%\InstallDir\Server.exe	2
%APPDATA%\Microsoft\Windows\((Mutex)).cfg	1
%APPDATA%\Microsoft\Windows\((Mutex)).dat	1
%SystemRoot%\SysWOW64\windows	1
%SystemRoot%\SysWOW64\dllcache\msn.exe	1
%APPDATA%\InstallDir\xyzl.exe	1
%SystemRoot%\SysWOW64\dllcache\xxsnd.exe	1
%APPDATA%\dllcache\msn.exe	1
%APPDATA%\dllcache\xxsnd.exe	1
%SystemRoot%\SysWOW64\InstallDir\xyzl.exe	1
%SystemRoot%\SysWOW64\rar.exe	1
%TEMP%\510photo1.jpg	1
%TEMP%\510photo1.jpg.exe	1

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Win.Dropper.Upatre-7594799-0

Indicators of Compromise

• IOCs collected from dynamic analysis of 27 samples

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
38[.]65[.]142[.]12	27
104[.]20[.]16[.]242	15
104[.]20[.]17[.]242	12
96[.]46[.]99[.]183	5
96[.]46[.]100[.]49	5
217[.]168[.]210[.]122	4
81[.]90[.]175[.]7	4
176[.]36[.]251[.]208	4
109[.]86[.]226[.]85	4
68[.]55[.]59[.]145	4
37[.]57[.]144[.]177	4
64[.]111[.]36[.]52	3
66[.]215[.]30[.]118	3
72[.]230[.]82[.]80	3
104[.]174[.]123[.]66	3
24[.]220[.]92[.]193	3
84[.]246[.]161[.]47	3
216[.]254[.]231[.]11	3
69[.]163[.]81[.]211	3
77[.]95[.]195[.]68	3
76[.]84[.]81[.]120	2
85[.]135[.]104[.]170	2
24[.]148[.]217[.]188	2
98[.]209[.]75[.]164	2
24[.]33[.]131[.]116	2

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
icanhazip[.]com	27

Files and or directories created	Occurrences
%TEMP%\murzuja.exe	27

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

---

Win.Dropper.NetWire-7597088-0

Indicators of Compromise

• IOCs collected from dynamic analysis of 34 samples

Registry Keys	Occurrences
<HKCU>\SOFTWARE\WINRAR	22
<HKCU>\SOFTWARE\WINRAR Value Name: HWID	22
<HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003E9 Value Name: F	22
<HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000001F5 Value Name: F	22
<HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003EC Value Name: F	22
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: mkre	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: MSConfig	1

Mutexes	Occurrences
-	7
jpbuqnlp	1
Global\54220ec1-56cd-11ea-a007-00501e3ae7b5	1
Global\10d125c1-56cd-11ea-a007-00501e3ae7b5	1
thxETPfM	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
194[.]4[.]56[.]252	2
104[.]215[.]148[.]63	1
192[.]169[.]69[.]25	1
104[.]47[.]54[.]36	1
111[.]121[.]193[.]242	1
103[.]60[.]181[.]238	1
185[.]201[.]10[.]1	1
103[.]48[.]6[.]14	1
191[.]252[.]63[.]14	1
68[.]65[.]122[.]86	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
james7[.]serveftp[.]com	4
dualserverz[.]info	3
myp0nysite[.]ru	2
uzo123[.]serveftp[.]com	2
api[.]w[.]org	1
gmpg[.]org	1
microsoft-com[.]mail[.]protection[.]outlook[.]com	1
web[.]whatsapp[.]com	1
gypsypy[.]duckdns[.]org	1
bags[.]mn	1
pornhouse[.]mobi	1
opixib[.]bid	1
bishop123[.]ddns[.]net	1
papergang[.]ru	1
tizardns[.]3utilities[.]com	1
eorul[.]com	1
sistemacplus[.]com[.]br	1
www[.]sistemacplus[.]com[.]br	1
frankweb[.]club	1
usbasri[.]co[.]id	1

Files and or directories created	Occurrences
%TEMP%\-<random, matching '[0-9]{9}'>.bat	20
\TEMP\.Identifier	7
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\filename.vbs	6
%APPDATA%\GHYTRFDRTTG	4
%APPDATA%\GHYTRFDRTTG\filename.exe	4
%APPDATA%\Install	2
%APPDATA%\Install\.Identifier	2
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\wind0ws.vbs	2
%APPDATA%\zqxhkpjwc	2
%APPDATA%\zqxhkpjwc\wind0ws.scr	2
%APPDATA%\Install\Host.exe	1
%APPDATA%\subfolder	1
%APPDATA%\subfolder\filename.exe	1
%TEMP%\99a0_appcompat.txt	1
%APPDATA%\Install\juyr.exe	1
%APPDATA%\FGBHYTUJIUY	1
%APPDATA%\FGBHYTUJIUY\filename.exe	1
%HOMEPATH%\obgtcgwm.exe	1
%TEMP%\711562.bat	1
%TEMP%\734171.bat	1
%TEMP%\760328.bat	1
%TEMP%\AA1AE.dmp	1

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Win.Packed.njRAT-7595003-1

Indicators of Compromise

• IOCs collected from dynamic analysis of 10 samples

Registry Keys	Occurrences
<HKCU>\ENVIRONMENT Value Name: SEE_MASK_NOZONECHECKS	10
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: ParseAutoexec	10
<HKCU>\SOFTWARE\9BD3387F7E8ABEB14EFCB3BDF5E7C89B	2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 9bd3387f7e8abeb14efcb3bdf5e7c89b	2
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 9bd3387f7e8abeb14efcb3bdf5e7c89b	2
<HKCU>\SOFTWARE\9BD3387F7E8ABEB14EFCB3BDF5E7C89B Value Name: [kl]	2
<HKCU>\SOFTWARE\BB0E5F604F30988E0B2498356D0A2358	2
<HKCU>\SOFTWARE\BDBC444244C8D079DD87AC27E84A52E2	2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: bb0e5f604f30988e0b2498356d0a2358	2
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: bb0e5f604f30988e0b2498356d0a2358	2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: bdbc444244c8d079dd87ac27e84a52e2	2
<HKCU>\SOFTWARE\BB0E5F604F30988E0B2498356D0A2358 Value Name: [kl]	2
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: bdbc444244c8d079dd87ac27e84a52e2	2
<HKCU>\SOFTWARE\BDBC444244C8D079DD87AC27E84A52E2 Value Name: [kl]	2
<HKCU>\SOFTWARE\38407B401D4C3FE12E0AA019ABFE1C1E	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 38407b401d4c3fe12e0aa019abfe1c1e	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 38407b401d4c3fe12e0aa019abfe1c1e	1
<HKCU>\SOFTWARE\38407B401D4C3FE12E0AA019ABFE1C1E Value Name: [kl]	1
<HKCU>\SOFTWARE\9F78F6C54CD3644B404DDA00839B7FA6	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 9f78f6c54cd3644b404dda00839b7fa6	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 9f78f6c54cd3644b404dda00839b7fa6	1
<HKCU>\SOFTWARE\9F78F6C54CD3644B404DDA00839B7FA6 Value Name: [kl]	1
<HKCU>\SOFTWARE\E425607C2D9B7766223C902817C469E3	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: e425607c2d9b7766223c902817c469e3	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: e425607c2d9b7766223c902817c469e3	1

Mutexes	Occurrences
<32 random hex characters>	10

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
3[.]19[.]114[.]185	1
3[.]17[.]202[.]129	1
18[.]223[.]41[.]243	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
systeamwon[.]ddns[.]net	2
shwii[.]ddns[.]net	2
0[.]tcp[.]ngrok[.]io	1
windowshost[.]sytes[.]net	1
hell3324[.]ddns[.]net	1
hidden4matrix[.]ddns[.]net	1

Files and or directories created	Occurrences
%TEMP%\server.exe	3
%TEMP%\svchost.exe	2
%TEMP%\Config.exe	2
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\9bd3387f7e8abeb14efcb3bdf5e7c89b.exe	2
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\bb0e5f604f30988e0b2498356d0a2358.exe	2
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\bdbc444244c8d079dd87ac27e84a52e2.exe	2
%HOMEPATH%\svchost.exe	1
%TEMP%\svchos.exe	1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\38407b401d4c3fe12e0aa019abfe1c1e.exe	1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\9f78f6c54cd3644b404dda00839b7fa6.exe	1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\e425607c2d9b7766223c902817c469e3.exe	1
%HOMEPATH%\facebook.exe	1
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\5ebda11b3fd5a5a7f5d1714d88c0f3af.exe	1

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

ThreatGrid

---

Win.Packed.Zbot-7595026-0

Indicators of Compromise

• IOCs collected from dynamic analysis of 11 samples

Registry Keys	Occurrences
<HKCU>\SOFTWARE\WINRAR	11
<HKCU>\SOFTWARE\WINRAR Value Name: HWID	11

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
91[.]195[.]240[.]126	11
108[.]166[.]65[.]182	11

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
aloucakbileti[.]com	11

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

ThreatGrid

---

Win.Virus.Ramnit-7597892-0

Indicators of Compromise

• IOCs collected from dynamic analysis of 15 samples

Mutexes	Occurrences
KyUffThOkYwRRtgPP	13

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
204[.]79[.]197[.]200	13
72[.]26[.]218[.]70	13
172[.]217[.]164[.]174	12
13[.]107[.]21[.]200	9

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
fget-career[.]com	13

Files and or directories created	Occurrences
%ProgramFiles%\Internet Explorer\dmlconf.dat	13
%ProgramFiles(x86)%\Microsoft\DesktopLayer.exe	13
%ProgramFiles%\Microsoft\DesktopLayer.exe	13
%ProgramFiles(x86)%\Microsoft	13
%SystemRoot%\SysWOW64\rundll32Srv.exe	13
%System32%\rundll32Srv.exe	13
%SystemRoot%\SysWOW64\rundll32SrvSrv.exe	7

File Hashes

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

ThreatGrid

---

Exploit Prevention

Cisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits. These exploits use certain features to bypass typical anti-virus software, but were blocked by AMP thanks to its advanced scanning capabilities, even protecting against zero-day vulnerabilities.

CVE-2019-0708 detected - (3979)

An attempt to exploit CVE-2019-0708 has been detected. The vulnerability, dubbed BlueKeep, is a heap memory corruption which can be triggered by sending a specially crafted Remote Desktop Protocol (RDP) request. Since this vulnerability can be triggered without authentication and allows remote code execution, it can be used by worms to spread automatically without human interaction.

Excessively long PowerShell command detected - (402)

A PowerShell command with a very long command line argument that may indicate an obfuscated script has been detected. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.

Process hollowing detected - (340)

Process hollowing is a technique used by some programs to avoid static analysis. In typical usage, a process is started and its obfuscated or encrypted contents are unpacked into memory. The parent then manually sets up the first stages of launching a child process, but before launching it, the memory is cleared and filled in with the memory from the parent instead.

Kovter injection detected - (109)

A process was injected into, most likely by an existing Kovter infection. Kovter is a click fraud Trojan that can also act as an information stealer. Kovter is also file-less malware meaning the malicious DLL is stored inside Windows registry and injected directly into memory using PowerShell. It can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2. It spreads through malicious advertising and spam campaigns.

Installcore adware detected - (89)

Install core is an installer which bundles legitimate applications with offers for additional third-party applications that may be unwanted. The unwanted applications are often adware that display advertising in the form of popups or by injecting into browsers and adding or altering advertisements on webpages. Adware is known to sometimes download and install malware.

Gamarue malware detected - (82)

Gamarue is a family of malware that can download files and steal information from an infected system. Worm variants of the Gamarue family may spread by infecting USB drives or portable hard disks that have been plugged into a compromised system.

Dealply adware detected - (59)

DealPly is adware, which claims to improve your online shopping experience. It is often bundled into other legitimate installers and is difficult to uninstall. It creates pop-up advertisements and injects advertisements on webpages. Adware has also been known to download and install malware.

Corebot malware detected - (14)

Corebot is a Trojan with many capabilities found in other prominent families. It features a plugin system to enable it to load a variety of features from the C&C server at any time. Known plugins include RAT capabilities such as taking desktop screenshots, as well as being able to intercept and modify browser communications and steal data, especially data related to banking.

Reverse tcp payload detected - (10)

An exploit payload intended to connect back to an attacker controlled host using tcp has been detected.

Trickbot malware detected - (9)

Trickbot is a banking Trojan which appeared in late 2016. Due to the similarities between Trickbot and Dyre, it is suspected some of the individuals responsible for Dyre are now responsible for Trickbot. Trickbot has been rapidly evolving over the months since it has appeared. However, Trickbot is still missing some of the capabilities Dyre possessed. Its current modules include DLL injection, system information gathering, and email searching.