Tuesday, August 14, 2018

Threat Roundup for August 3-10



----
Threat Roundup for August 3-10
// Talos Blog


Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we've observed this week — covering the dates between Aug. 3 - 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, we will summarize the threats we've observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

  • Win.Malware.Dbzx-6628757-0
    Malware
    This is a variant of the Tspy family. It is able to execute after every reboot, making it persistent. It contacts domains that are related to RATs and are generally command and control (C2) servers to upload data, and receives additional commands. The samples are often packed and contain anti-debug tricks to complicate the manual analysis.
     
  • Win.Malware.Emotet-6628754-0
    Malware
    This cluster provides generic detection for the Emotet trojan that's downloaded onto a targets machine. Emotet is a banking trojan that has remained relevant due to its continual evolution to bypass antivirus products.
     
  • Win.Malware.Zerber-6629234-0
    Malware
    This is a malware identification for a ransomware variant of Cerber.
     
  • Win.Malware.Startsurf-6628791-0
    Malware
    Strtsurf is a trojan targeted at collecting personal information, and sometimes labeled as a potentially unwanted application (PUA) in other coverage signatures.
     
  • Win.Packed.Eorezo-6629326-0
    Packed
    This malware is known to enable the display of advertisements in Internet Explorer. It's also downloads several pieces of software and installs them in the background.
     

Threats

Win.Malware.Dbzx-6628757-0


Indicators of Compromise


Registry Keys
  • <HKLM>\Software\Wow6432Node\Microsoft\Tracing
Mutexes
  • QSR_MUTEX_HnRHWDxWQnveBdUtWT
IP Addresses
  • N/A
Domain Names
  • ip-api[.]com
Files and or directories created
  • N/A
File Hashes
  • 25430a357d53aec77dd1f119b838ceae79a22bb3a60c7a002cb7328b098546a7
  • 54279416f864d374f33fe9a2fe2998db3976c4ff43e8b0da006548489a50bbdd
  • 5ce812ebf77f6d63de37a1e3d261b9688d595aaeadaef3388f4214896bb64892
  • 810fb35557e051a7be3f03b37247c90796595a2d5afa1b2c3034187de2a3f0bc
  • 8f08bcadd3a44055a70dbae3308cf18c8d1824e424100eda03ddc71e9417fb5e
  • 9435b87c7c91ac98f9f461aeaa6b1630e2270e2d2ccdf6a05d46fa02de91d1eb
  • 9634a2afb40139e39da8c8ef0da8f5104229d7bb4c3b95faee5a4396713f528e
  • a137c89d2c6f0ae74217724e1cb56aea726e285d0e6e98adfda16617ad51d176
  • a2907c7011b20373fd47e03a0f4679fdd51b982b973bb37d1d45bfa4a618bc5a
  • b3c6a0883d9ed8bcf1bf162c0ade8b16f2cd4ae890e30ba9e9540f4bdf5f5ba1
  • ba5afe1245d10f72637d34a96bf6e365c2f4326da69dcd440beacf421b634133
  • cd3a4783c2795a16c82518c56f955c9b56f415d59ef5bc77e143f6124123364b
  • d0dbd75a4d8716ba7ca7d025ee1c772aa4ff554214a993b4b874a0a26dcf5a6c
  • e2116a9a176ff765f1c5ec23003266bfe0f1592e46e41236482ad4c3520ea53a
  • e2846881f6127d99222144e4ece509bd18522fdd7791bf84d7697b37ffa40919
  • efc3e1b1d6c13c3624160edc36f678dd92f172339bfde598ad1a95b02b474981
  • f7df8c9e36cf3440709111a33721e7ac7268a2a80057df08843ba95a72c222eb
  • fdd4cce37fd524f99e096d0e45f95ac4dac696c8d7e8eb493bb485c63409c7b3

Coverage


Screenshots of Detection

AMP



ThreatGrid




Umbrella


Win.Malware.Emotet-6628754-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • PEMB2C
  • PEM944
  • PEM80C
  • PEMA10
IP Addresses
  • 67[.]68[.]235[.]25
  • 187[.]192[.]180[.]144
Domain Names
  • N/A
Files and or directories created
  • %WinDir%\SysWOW64\TO5sH5uBMit.exe
File Hashes
  • 0406ad0fe90d371b02742e6821486abbfbf2bbd72a7593e8ddb650f0b97673b3
  • 0604aa87706cb7890075b494f026c88b2f03b621367f1bb62a87f5c5deb87870
  • 086af92d83279f5792c15a762a70e158de54b67c1a96bfc14c4ad52a24468f32
  • 10f13af2a3591efa3d58c47bb0635e3a653e14ec7726493bb4595b4dd8cd51cb
  • 127c316e7a10579e61369d6a8154e3e34726209b3cc075ddd6d9875c439c583e
  • 1fc9fda1b0c868dc7cb0cf6d8867b7aefc202436fe9e41cba5b2b35bb1ce9e9f
  • 23ba67cf24c95f3bfd36b66f822feb3d2fd0f72617921550fee034a1b7b8cc74
  • 27e37ac7cc8b48573a8345223399ce6b0ab9432ee977acf02c09bcf64cf6622d
  • 2bf1192e5200b6f8d25586908b05912a5fa6e06e87540dbb914200446a3deb10
  • 2ee83958eb1e8cb622ca833c38e51b53548d299b6574e5b7203741a2d27963f5
  • 2fca527cf8ebf4576e982118e22dfe3fd8e445749a5403dafed36089666f2357
  • 30bbfb79d26a172975e9482204f06423eff6948b1732384e7b6d23f9932ec08d
  • 30bf6e1a41dea6e4024853f9b7a6a878e4f5e4141dba4b0fe7686159925fe6cf
  • 42fca9d196c668747b74f80ca996aee9ae38bed96956b42436949a8d4d33ecf1
  • 45e6356ca3b373da3a80a72a1b64f1254f4426949598b8877abd6de99e379166
  • 4ac5db87bc83dcbf1399f4fc0fede3c5ecee5b8ef2a2500fd79b1588ef033429
  • 4b2f6d80bf78ad165c2f07d914cb4137ba31918f3f8f03f812b20715c3451f56
  • 4d7d9d73dad989590860178530dd8848d9b79a23f1cb379bc1ca5545cb196eca
  • 4e81241256ab4adb5bb96b21633d95773cc34ee72e499659064db0d32046dabf
  • 4ea92195bc159e268c7a348f2649010cb01a3e67c315d2f0b8115eaf2c879692
  • 5639d3af9cf530a057aebf3cbf92061b58539b2c311491a26d8f404a211d66bb
  • 59644dcd34cce275ff5d72c022fa76ac42a422b038d816909281e01e392d3b40
  • 599e4e8130e4a1f3f3777c6f9f088cc03c2781f4e802e0e16e417a43ec58c518
  • 5eef8b5433ebc22e4c9ea3c1462d525192a4bda8d20be4e7b09fe7d03fb9d119
  • 6238c7a704baa8771812e4f3452acb042c6475913db4cd57cfaf17a7454d4d22

Coverage


Screenshots of Detection

AMP




ThreatGrid


Win.Malware.Zerber-6629234-0


Indicators of Compromise


Registry Keys
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
    • Value Name: FlashPlayerApp
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
    • Value Name: Run
  • <HKCU>\SOFTWARE\MICROSOFT\COMMAND PROCESSOR
    • Value Name: AutoRun
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
    • Value Name: DefaultConnectionSettings
Mutexes
  • shell.{381828AA-8B28-3374-1B67-35680555C5EF}
IP Addresses
  • N/A
Domain Names
  • N/A
Files and or directories created
  • %AppData%\Microsoft\Windows\Start Menu\Programs\StartUp\FlashPlayerApp.lnk
  • %AppData%\{6F885251-E36F-0FE6-9629-63208157D7A2}\FlashPlayerApp.exe
File Hashes
  • 25f8455b83b98f38809af120e35c3eda189a05538f7aa2d527a265520bc3c75e
  • 342a9470e5d3dd522c17cf0a5bc588d87a84689d90362c0b18c320385b2e908d
  • 41ebdf1d4a210f395d5ee32bf55c6b07ee1e0a0bdf939bd081f6d751323c643c
  • 54be105a129d959359107d7dff6b379cd366e32bf7be9ac9a06bc2141d3ca7fa
  • 5dce0e7e0a1807d2804f28c5d5afd4ac282a022acd1945786bd118e1caf4050c
  • 5fe244200c9367e1b132ccc13df6daaba5479d2491db8fe95658f43981567c5a
  • 6292ddf51023ccca84211ed4f33944b4c3df1b694d102d90d3dd2a5a080ed2b9
  • 649c52d7b9a58837e6ccd308665d63971e424d29480c44448ddbef15e91649a6
  • 6dd74f0816f8b24a6f93c2dae0c69d33689e4baba632605d138216d9c7aab2ba
  • 7322fb7767b733ef5a279720f581d54edae9ea4af69d39aaa3e79fc443e2bb33
  • 76be26ac77aa81a5fb7d78135adb05b579cecc2173ffef5f5ab6b484e37f9e6e
  • 793b978af24469a77490ea609de0142ff817e557ad78a688dd5d65c2fe49a8db
  • 7c0e65092e8786d9052bbd74f4dc7b26567e150efb25d1503c4bfd9b3895b8ab
  • 8815e1daad1f9cb4ff4243ff485218e3a0be93e2afef07048852ba79fdd9294e
  • 8e84fbc38403f1516447b73b73b5051777314089f0d1fefcfae004b1ef615641
  • a0e3bd64d556ce80b85b7d328bb61beeaf2da297dc09058211150617d6a83b8b
  • b6b3b53b1001b6de24797a89d61bd825760574ab4cb60f7a5971115acb53c8e4
  • ef66d0161200d413bb8a577a517fe03f325f2fd2f0df778f6297a8658ca0abc8
  • f25d03efc63cba1a262034382f809aaa5918f218b965164897df0c989a08dd04
  • f8ee14337fe367aded0aee32c6c84ce404eaef53a6f75d86c6c08235f55ec303

Coverage


Screenshots of Detection

AMP




ThreatGrid




Umbrella




Win.Malware.Startsurf-6628791-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • Local\MSCTF.Asm.MutexDefault1
IP Addresses
  • N/A
Domain Names
  • lip[.]healthcakes[.]men
Files and or directories created
  • N/A
File Hashes
  • 00cc9438408d1b22b0afc57e3b233ff62774cbcb92e58b392403d8c794d988ed
  • 118e08c379b0035cef2a155d59d97c6e8cae94b6f46c5e77f58d84c88c689d2c
  • 1f270dc860158d63bb400e08f12bce40a9a50494368ea6e44cfd89f7e0dc23f4
  • 3e49b3e58eec40b735124509bafcf434904f5945c9d65a5a860b0950850a979d
  • 4348a4b50eba73d6eb5d0d254241d0e44fc63c975b589ac5276d6dc5cf8bab13
  • 4a1c1cf9c70b127cc514fa6cdbb0e286ee33bf19f6ff41ca02951c9947dac55e
  • 4ae8cf675d6517b7989391fc653e8ddc96aa81cec4802e7e66de30adf0e96d2e
  • 527eac30113eb365330ec5c35591fe9ae69d4e1beca8b0ae24666e97d8773e36
  • 53366f90f59348b8de81bdc04652200d2dcf8bad5cfc46a533c3b20cd0e200b2
  • 5f98685ee9098a31ced944840670772bb972db31ac5d1690974e59f566d1adae
  • 61e7c5b6a7f1608cf0bf728d15f8cdfc0f9f5c7c3748ee28452cfa2a496e54cc
  • 70ebc88b9a71c661b68325dd92d0945ea1927e4d115da217640a4efefcf0c730
  • 722e86b32635a1cace77ceee414761f28e386743fd2c513650e55814179bdac5
  • 91bb8eb10e0aa88ea1e33d1ec23893d5a45e01e8ab69081b96835b4aff3b906a
  • 97645bb27e056b282a0aa46dbbc79ed03bdc29c6f96e369d7537ee2bb1c8dd6e
  • 9b36f0e70d5f7b4795b1278e052356484d4f2374f49563195f224ade6ce08c71
  • ac86cafcc7062a389e25a4e26dd15df7ce2e64b7a6890bf5712189ab9ec81c8c
  • c3883ba74230604d38a638a1b8d0673cc3c91e01b482e6b83a6e6bbd4edd3b10
  • c56e3ca164803c5668cf0b8228c97626c486f5a7063d4b3109840137b67c8f98
  • c82eaf2f1f156b95b43b2a984867e486911f6ceb329daea6ac9a6c53fae42685
  • ca544eaedd654782fa6b7a130bdc58869c2124a59754ed1baf9a5c00fafae12a
  • d4ab2cc67c707cab8f7aab0fde94b50670f1b787b049f45564fe5368205ed642
  • eac8c3c76e954d8e2be7a5d1570643b4ce6a856e8143faf6263ad50cf53aceb2
  • f0a9c1c2fc19b4abd905e8a2f187f94e74dfe1e7de2d9a5328b13893b301488d
  • fb2aa3891cc9383631ddcca4076ae800d67d701a7ffb83d48240cc1d72372175

Coverage


Screenshots of Detection

AMP




ThreatGrid




Umbrella



Win.Packed.Eorezo-6629326-0


Indicators of Compromise


Registry Keys
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
    • Value Name: 6518673
Mutexes
  • Amazonassistant2018
  • Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_2c8
  • Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_2c8
  • WmiApRpl_Perf_Library_Lock_PID_2c8
IP Addresses
  • N/A
Domain Names
  • www[.]wizzmonetize[.]com
  • ionesystemcare[.]info
  • www[.]rothsideadome[.]pw
  • www[.]usatdkeyboardhelper[.]pw
Files and or directories created
  • %ProgramFiles%\WJTLINYZUI\cast.config
  • %LocalAppData%\Temp\DaGXhZc6w\Nursehealth.exe
  • %System32%\Tasks\One System Care Monitor
  • %ProgramFiles% (x86)\OneSystemCare
  • %SystemDrive%\TEMP\config.conf
  • %LocalAppData%\Temp\U8R09Z5FM2\OneTwo.exe
  • %LocalAppData%\Temp\U8R09Z5FM2\up.exe
  • %WinDir%\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new
  • %ProgramFiles%\WJTLINYZUI\GCOMQP0KN.exe
File Hashes
  • 002d9959f5e7417cc2cbc657243f2dab82fac3d2e94fa2d0c8e45eda10889b08
  • 03c948623cf78efe90258d894ab0e793bca7009bd73d0be0f652575f81bda621
  • 0f8d729821902252b7f7a1c0d51004d3770356969e7181548126f13f1e2ebf2a
  • 1e64134ff7358ea6e632fd2377532491235cf089f33095a72552e150088b42f1
  • 1eed9456e69a80cb4e8444ad0356d71e09a073715f92e51afa008e80d2a0352a
  • 26f928ef89fde0e3e3fa996073c7c0bba00c2cbfe280de338de15367f4c8f76b
  • 2b0c6557b39ad8cca97ea6975aa3f4a8341774461b1bacab05d04ab20a9463eb
  • 3a5ac5c5ee7985367349d84d60be2c5f94f876c56cf73acbae6fc680ebbdb3c6
  • 47bcf1f1bca23a36e291a0ac4cb8d1cd59c0c80d6a8e3b2cc3d646284cc531d5
  • 4ae3efb9a9cca68c098dcdba33d2aef39888cf229cd02be64cbf59a0b68dae30
  • 5112edf0351d70ad31152f67e8996c9c4ad062f0023cfd43b4baecb8aa7b16b4
  • 52544303a89f2c4e3eedd64c000504a2ef4c920c20361961fc81cae3f520244f
  • 55e181f0e0e88efccf6534949ad8dd93a179e2b94b71e76a9e7db4d938ea2bd2
  • 56982cc1f4b4e92aea28a30684bdfc752122eb78fc545ccc3f4169a1597233cc
  • 5c3982a206d40ec00b2029d4bdde1bb37192341583e803556872b97a609411ae
  • 61ee5c724a4c9408e9c8120eabac1babea8e91bf5719b02c78ce129f68239ff6
  • 63cc723ad7e85798e9126f5cc933c48d0e3cdfa7504579ef0b0b3cced9cb19c8
  • 65a0bb3fd94ec888696598703ed111471bd47962278a5f1006e7e0716bd5b58e
  • 71d6d1ed9a5bd71e8dbd03a91151a2965ac12198fa1825366bf19c4b14106cb7
  • 71e3009284ae35a3087ef041162a2ada636b388738033ea62faefc2bbfca9dfc
  • 7e17ee126754a9306b4ffcf536f384abe5c718672807de1e27e7c7f3846d9e74
  • 85b36ab50aeb452822886815076c7c90c30273854496dde7fd3473e62119f672
  • 877b9a03f0b8763c265ecbc4be76ffafc9eb26c4b618c2827ce1e200797ca876
  • 885718a7bd95c44d14dec7f0efa101147b671e60a7ecac2622ac86061dab17f2
  • 9583c8f1f3c9982a45ed56fbc30f8be06708cfaa8557aa7f5b6117847018cd4f

Coverage


Screenshots of Detection

ThreatGrid



Umbrella




----

Read in my feedly


Sent from my iPhone