----
Threat Roundup for August 3-10
// Talos Blog
Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we've observed this week — covering the dates between Aug. 3 - 10. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, we will summarize the threats we've observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.
The most prevalent threats highlighted in this round up are:
- Win.Malware.Dbzx-6628757-0
Malware
This is a variant of the Tspy family. It is able to execute after every reboot, making it persistent. It contacts domains that are related to RATs and are generally command and control (C2) servers to upload data, and receives additional commands. The samples are often packed and contain anti-debug tricks to complicate the manual analysis.
- Win.Malware.Emotet-6628754-0
Malware
This cluster provides generic detection for the Emotet trojan that's downloaded onto a targets machine. Emotet is a banking trojan that has remained relevant due to its continual evolution to bypass antivirus products.
- Win.Malware.Zerber-6629234-0
Malware
This is a malware identification for a ransomware variant of Cerber.
- Win.Malware.Startsurf-6628791-0
Malware
Strtsurf is a trojan targeted at collecting personal information, and sometimes labeled as a potentially unwanted application (PUA) in other coverage signatures.
- Win.Packed.Eorezo-6629326-0
Packed
This malware is known to enable the display of advertisements in Internet Explorer. It's also downloads several pieces of software and installs them in the background.
Threats
Win.Malware.Dbzx-6628757-0
Indicators of Compromise
Registry Keys
- <HKLM>\Software\Wow6432Node\Microsoft\Tracing
- QSR_MUTEX_HnRHWDxWQnveBdUtWT
- N/A
- ip-api[.]com
- N/A
- 25430a357d53aec77dd1f119b838ceae79a22bb3a60c7a002cb7328b098546a7
- 54279416f864d374f33fe9a2fe2998db3976c4ff43e8b0da006548489a50bbdd
- 5ce812ebf77f6d63de37a1e3d261b9688d595aaeadaef3388f4214896bb64892
- 810fb35557e051a7be3f03b37247c90796595a2d5afa1b2c3034187de2a3f0bc
- 8f08bcadd3a44055a70dbae3308cf18c8d1824e424100eda03ddc71e9417fb5e
- 9435b87c7c91ac98f9f461aeaa6b1630e2270e2d2ccdf6a05d46fa02de91d1eb
- 9634a2afb40139e39da8c8ef0da8f5104229d7bb4c3b95faee5a4396713f528e
- a137c89d2c6f0ae74217724e1cb56aea726e285d0e6e98adfda16617ad51d176
- a2907c7011b20373fd47e03a0f4679fdd51b982b973bb37d1d45bfa4a618bc5a
- b3c6a0883d9ed8bcf1bf162c0ade8b16f2cd4ae890e30ba9e9540f4bdf5f5ba1
- ba5afe1245d10f72637d34a96bf6e365c2f4326da69dcd440beacf421b634133
- cd3a4783c2795a16c82518c56f955c9b56f415d59ef5bc77e143f6124123364b
- d0dbd75a4d8716ba7ca7d025ee1c772aa4ff554214a993b4b874a0a26dcf5a6c
- e2116a9a176ff765f1c5ec23003266bfe0f1592e46e41236482ad4c3520ea53a
- e2846881f6127d99222144e4ece509bd18522fdd7791bf84d7697b37ffa40919
- efc3e1b1d6c13c3624160edc36f678dd92f172339bfde598ad1a95b02b474981
- f7df8c9e36cf3440709111a33721e7ac7268a2a80057df08843ba95a72c222eb
- fdd4cce37fd524f99e096d0e45f95ac4dac696c8d7e8eb493bb485c63409c7b3
Coverage
Screenshots of Detection
AMPThreatGrid
Umbrella
Win.Malware.Emotet-6628754-0
Indicators of Compromise
Registry Keys
- N/A
- PEMB2C
- PEM944
- PEM80C
- PEMA10
- 67[.]68[.]235[.]25
- 187[.]192[.]180[.]144
- N/A
- %WinDir%\SysWOW64\TO5sH5uBMit.exe
- 0406ad0fe90d371b02742e6821486abbfbf2bbd72a7593e8ddb650f0b97673b3
- 0604aa87706cb7890075b494f026c88b2f03b621367f1bb62a87f5c5deb87870
- 086af92d83279f5792c15a762a70e158de54b67c1a96bfc14c4ad52a24468f32
- 10f13af2a3591efa3d58c47bb0635e3a653e14ec7726493bb4595b4dd8cd51cb
- 127c316e7a10579e61369d6a8154e3e34726209b3cc075ddd6d9875c439c583e
- 1fc9fda1b0c868dc7cb0cf6d8867b7aefc202436fe9e41cba5b2b35bb1ce9e9f
- 23ba67cf24c95f3bfd36b66f822feb3d2fd0f72617921550fee034a1b7b8cc74
- 27e37ac7cc8b48573a8345223399ce6b0ab9432ee977acf02c09bcf64cf6622d
- 2bf1192e5200b6f8d25586908b05912a5fa6e06e87540dbb914200446a3deb10
- 2ee83958eb1e8cb622ca833c38e51b53548d299b6574e5b7203741a2d27963f5
- 2fca527cf8ebf4576e982118e22dfe3fd8e445749a5403dafed36089666f2357
- 30bbfb79d26a172975e9482204f06423eff6948b1732384e7b6d23f9932ec08d
- 30bf6e1a41dea6e4024853f9b7a6a878e4f5e4141dba4b0fe7686159925fe6cf
- 42fca9d196c668747b74f80ca996aee9ae38bed96956b42436949a8d4d33ecf1
- 45e6356ca3b373da3a80a72a1b64f1254f4426949598b8877abd6de99e379166
- 4ac5db87bc83dcbf1399f4fc0fede3c5ecee5b8ef2a2500fd79b1588ef033429
- 4b2f6d80bf78ad165c2f07d914cb4137ba31918f3f8f03f812b20715c3451f56
- 4d7d9d73dad989590860178530dd8848d9b79a23f1cb379bc1ca5545cb196eca
- 4e81241256ab4adb5bb96b21633d95773cc34ee72e499659064db0d32046dabf
- 4ea92195bc159e268c7a348f2649010cb01a3e67c315d2f0b8115eaf2c879692
- 5639d3af9cf530a057aebf3cbf92061b58539b2c311491a26d8f404a211d66bb
- 59644dcd34cce275ff5d72c022fa76ac42a422b038d816909281e01e392d3b40
- 599e4e8130e4a1f3f3777c6f9f088cc03c2781f4e802e0e16e417a43ec58c518
- 5eef8b5433ebc22e4c9ea3c1462d525192a4bda8d20be4e7b09fe7d03fb9d119
- 6238c7a704baa8771812e4f3452acb042c6475913db4cd57cfaf17a7454d4d22
Coverage
Screenshots of Detection
AMPThreatGrid
Win.Malware.Zerber-6629234-0
Indicators of Compromise
Registry Keys
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value Name: FlashPlayerApp
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
- Value Name: Run
- <HKCU>\SOFTWARE\MICROSOFT\COMMAND PROCESSOR
- Value Name: AutoRun
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
- Value Name: DefaultConnectionSettings
- shell.{381828AA-8B28-3374-1B67-35680555C5EF}
- N/A
- N/A
- %AppData%\Microsoft\Windows\Start Menu\Programs\StartUp\FlashPlayerApp.lnk
- %AppData%\{6F885251-E36F-0FE6-9629-63208157D7A2}\FlashPlayerApp.exe
- 25f8455b83b98f38809af120e35c3eda189a05538f7aa2d527a265520bc3c75e
- 342a9470e5d3dd522c17cf0a5bc588d87a84689d90362c0b18c320385b2e908d
- 41ebdf1d4a210f395d5ee32bf55c6b07ee1e0a0bdf939bd081f6d751323c643c
- 54be105a129d959359107d7dff6b379cd366e32bf7be9ac9a06bc2141d3ca7fa
- 5dce0e7e0a1807d2804f28c5d5afd4ac282a022acd1945786bd118e1caf4050c
- 5fe244200c9367e1b132ccc13df6daaba5479d2491db8fe95658f43981567c5a
- 6292ddf51023ccca84211ed4f33944b4c3df1b694d102d90d3dd2a5a080ed2b9
- 649c52d7b9a58837e6ccd308665d63971e424d29480c44448ddbef15e91649a6
- 6dd74f0816f8b24a6f93c2dae0c69d33689e4baba632605d138216d9c7aab2ba
- 7322fb7767b733ef5a279720f581d54edae9ea4af69d39aaa3e79fc443e2bb33
- 76be26ac77aa81a5fb7d78135adb05b579cecc2173ffef5f5ab6b484e37f9e6e
- 793b978af24469a77490ea609de0142ff817e557ad78a688dd5d65c2fe49a8db
- 7c0e65092e8786d9052bbd74f4dc7b26567e150efb25d1503c4bfd9b3895b8ab
- 8815e1daad1f9cb4ff4243ff485218e3a0be93e2afef07048852ba79fdd9294e
- 8e84fbc38403f1516447b73b73b5051777314089f0d1fefcfae004b1ef615641
- a0e3bd64d556ce80b85b7d328bb61beeaf2da297dc09058211150617d6a83b8b
- b6b3b53b1001b6de24797a89d61bd825760574ab4cb60f7a5971115acb53c8e4
- ef66d0161200d413bb8a577a517fe03f325f2fd2f0df778f6297a8658ca0abc8
- f25d03efc63cba1a262034382f809aaa5918f218b965164897df0c989a08dd04
- f8ee14337fe367aded0aee32c6c84ce404eaef53a6f75d86c6c08235f55ec303
Coverage
Screenshots of Detection
AMPThreatGrid
Umbrella
Win.Malware.Startsurf-6628791-0
Indicators of Compromise
Registry Keys
- N/A
- Local\MSCTF.Asm.MutexDefault1
- N/A
- lip[.]healthcakes[.]men
- N/A
- 00cc9438408d1b22b0afc57e3b233ff62774cbcb92e58b392403d8c794d988ed
- 118e08c379b0035cef2a155d59d97c6e8cae94b6f46c5e77f58d84c88c689d2c
- 1f270dc860158d63bb400e08f12bce40a9a50494368ea6e44cfd89f7e0dc23f4
- 3e49b3e58eec40b735124509bafcf434904f5945c9d65a5a860b0950850a979d
- 4348a4b50eba73d6eb5d0d254241d0e44fc63c975b589ac5276d6dc5cf8bab13
- 4a1c1cf9c70b127cc514fa6cdbb0e286ee33bf19f6ff41ca02951c9947dac55e
- 4ae8cf675d6517b7989391fc653e8ddc96aa81cec4802e7e66de30adf0e96d2e
- 527eac30113eb365330ec5c35591fe9ae69d4e1beca8b0ae24666e97d8773e36
- 53366f90f59348b8de81bdc04652200d2dcf8bad5cfc46a533c3b20cd0e200b2
- 5f98685ee9098a31ced944840670772bb972db31ac5d1690974e59f566d1adae
- 61e7c5b6a7f1608cf0bf728d15f8cdfc0f9f5c7c3748ee28452cfa2a496e54cc
- 70ebc88b9a71c661b68325dd92d0945ea1927e4d115da217640a4efefcf0c730
- 722e86b32635a1cace77ceee414761f28e386743fd2c513650e55814179bdac5
- 91bb8eb10e0aa88ea1e33d1ec23893d5a45e01e8ab69081b96835b4aff3b906a
- 97645bb27e056b282a0aa46dbbc79ed03bdc29c6f96e369d7537ee2bb1c8dd6e
- 9b36f0e70d5f7b4795b1278e052356484d4f2374f49563195f224ade6ce08c71
- ac86cafcc7062a389e25a4e26dd15df7ce2e64b7a6890bf5712189ab9ec81c8c
- c3883ba74230604d38a638a1b8d0673cc3c91e01b482e6b83a6e6bbd4edd3b10
- c56e3ca164803c5668cf0b8228c97626c486f5a7063d4b3109840137b67c8f98
- c82eaf2f1f156b95b43b2a984867e486911f6ceb329daea6ac9a6c53fae42685
- ca544eaedd654782fa6b7a130bdc58869c2124a59754ed1baf9a5c00fafae12a
- d4ab2cc67c707cab8f7aab0fde94b50670f1b787b049f45564fe5368205ed642
- eac8c3c76e954d8e2be7a5d1570643b4ce6a856e8143faf6263ad50cf53aceb2
- f0a9c1c2fc19b4abd905e8a2f187f94e74dfe1e7de2d9a5328b13893b301488d
- fb2aa3891cc9383631ddcca4076ae800d67d701a7ffb83d48240cc1d72372175
Coverage
Screenshots of Detection
AMPThreatGrid
Umbrella
Win.Packed.Eorezo-6629326-0
Indicators of Compromise
Registry Keys
- <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
- Value Name: 6518673
- Amazonassistant2018
- Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_2c8
- Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_2c8
- WmiApRpl_Perf_Library_Lock_PID_2c8
- N/A
- www[.]wizzmonetize[.]com
- ionesystemcare[.]info
- www[.]rothsideadome[.]pw
- www[.]usatdkeyboardhelper[.]pw
- %ProgramFiles%\WJTLINYZUI\cast.config
- %LocalAppData%\Temp\DaGXhZc6w\Nursehealth.exe
- %System32%\Tasks\One System Care Monitor
- %ProgramFiles% (x86)\OneSystemCare
- %SystemDrive%\TEMP\config.conf
- %LocalAppData%\Temp\U8R09Z5FM2\OneTwo.exe
- %LocalAppData%\Temp\U8R09Z5FM2\up.exe
- %WinDir%\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new
- %ProgramFiles%\WJTLINYZUI\GCOMQP0KN.exe
- 002d9959f5e7417cc2cbc657243f2dab82fac3d2e94fa2d0c8e45eda10889b08
- 03c948623cf78efe90258d894ab0e793bca7009bd73d0be0f652575f81bda621
- 0f8d729821902252b7f7a1c0d51004d3770356969e7181548126f13f1e2ebf2a
- 1e64134ff7358ea6e632fd2377532491235cf089f33095a72552e150088b42f1
- 1eed9456e69a80cb4e8444ad0356d71e09a073715f92e51afa008e80d2a0352a
- 26f928ef89fde0e3e3fa996073c7c0bba00c2cbfe280de338de15367f4c8f76b
- 2b0c6557b39ad8cca97ea6975aa3f4a8341774461b1bacab05d04ab20a9463eb
- 3a5ac5c5ee7985367349d84d60be2c5f94f876c56cf73acbae6fc680ebbdb3c6
- 47bcf1f1bca23a36e291a0ac4cb8d1cd59c0c80d6a8e3b2cc3d646284cc531d5
- 4ae3efb9a9cca68c098dcdba33d2aef39888cf229cd02be64cbf59a0b68dae30
- 5112edf0351d70ad31152f67e8996c9c4ad062f0023cfd43b4baecb8aa7b16b4
- 52544303a89f2c4e3eedd64c000504a2ef4c920c20361961fc81cae3f520244f
- 55e181f0e0e88efccf6534949ad8dd93a179e2b94b71e76a9e7db4d938ea2bd2
- 56982cc1f4b4e92aea28a30684bdfc752122eb78fc545ccc3f4169a1597233cc
- 5c3982a206d40ec00b2029d4bdde1bb37192341583e803556872b97a609411ae
- 61ee5c724a4c9408e9c8120eabac1babea8e91bf5719b02c78ce129f68239ff6
- 63cc723ad7e85798e9126f5cc933c48d0e3cdfa7504579ef0b0b3cced9cb19c8
- 65a0bb3fd94ec888696598703ed111471bd47962278a5f1006e7e0716bd5b58e
- 71d6d1ed9a5bd71e8dbd03a91151a2965ac12198fa1825366bf19c4b14106cb7
- 71e3009284ae35a3087ef041162a2ada636b388738033ea62faefc2bbfca9dfc
- 7e17ee126754a9306b4ffcf536f384abe5c718672807de1e27e7c7f3846d9e74
- 85b36ab50aeb452822886815076c7c90c30273854496dde7fd3473e62119f672
- 877b9a03f0b8763c265ecbc4be76ffafc9eb26c4b618c2827ce1e200797ca876
- 885718a7bd95c44d14dec7f0efa101147b671e60a7ecac2622ac86061dab17f2
- 9583c8f1f3c9982a45ed56fbc30f8be06708cfaa8557aa7f5b6117847018cd4f
Coverage
Screenshots of Detection
ThreatGridUmbrella
----
Read in my feedly
Sent from my iPhone
No comments:
Post a Comment