Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 7 and April 14. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

  • Java.Trojan.Adwind-6260775-0
    Remote Access Trojan
    Also named AlienSpy, Frutas, JRat… Adwind is a java based Remote Access Trojan that is usually distributed by email. Given it is Java based, it is portable across different operating systems and even mobile devices. It allows to capture keystrokes, record video and audio, steal cached password and stored data, etc...
  • Win.Trojan.VBSinkDropper
    Dropper
    This sample is written in Visual Basic and its main goal is to drop and execute a second stage payload. The domains are related to the Zeus trojan, indicating this is probably a Zeus variant. The sample is heavily obfuscated and has anti-debugging and anti-VM techniques to hinder the analysis and performs code injection in other processes address spaces. This sample is currently delivered in massive spam campaigns as an attachment.
  • Win.Trojan.AutoIt-6260345-0
    Trojan-Dropper
    The initial binary contains an AutoIt script. The script is obfuscated. It creates several in-memory DLL structures with AutoIt’s DllStructCreate and DllStructSetData. The script then executes the shell code injected into these DLL structures.
  • Win.Ransomware.Cerber-6267996-1
    Ransomware family
    Cerber is a popular ransomware family that continues to undergo active development to continue being dropped in the wild. It still drops multiple ransom notes, including a desktop wallpaper as a warning post.
  • Win.Virus.Hematite-6232506-0
    File Infector
    Hematite is a simple but effective virus that spreads through executables. It scans the victim’s machine for any files with the extension .exe. Hematite appends 3000 bytes of malicious shellcode to the end of each file, then modifies the entrypoint of the original executable to load and execute the shellcode.
  • Doc.Dropper.Agent-6249585-0
    Office VBA/PowerShell downloader/dropper
    This sample is a Microsoft Word document that uses a macro to launch a PowerShell script to download and execute a secondary payload.
  • Win.Virus.Sality-6193004-1
    Windows file infector
    Sality is a file infector that establishes a peer-to-peer botnet. Although it’s been prevalent for over a decade, we continue to see new samples that require marginal attention in order to remain consistent with detection. Once perimeter security has been bypassed by a Sality client, the end goal is to execute a downloader component capable of executing additional malware.
  • Doc.Dropper.Dridex-6260340-0
    Office Macro-based Downloader
    Dridex documents leverage Microsoft Office to deliver a malware payload. They have been used often with banking trojans and ransomware such as CryptXXX and Locky. This week Doc.Dropper.Dridex-6260340-0 has been delivering Cerber as redchip2.exe.
  • Doc.Macro.CmdC-6249572-0
    Office Macro Obfuscation Heuristic
    Office macro code is used to further compromise a target system. This heuristics focuses on macro techniques to obfuscate shell commands that will be executed to further compromise the system.
  • Js.File.MaliciousHeuristic-6260279-2
    JavaScript Obfuscation Heuristic
    To make javascript harder to signature on, detect or to manually analyze; obfuscation is applied by breaking up functionality into small function.

Threats

Java.Trojan.Adwind-6260775-0

Indicators of Compromise Registry Keys

  • MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[application name].exe
  • Value: MAXIMUM ALLOWED
  • USER\[uuid]\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value: [a-zA-Z]+
  • Data: "C:\Users\[user]\AppData\Roaming\Oracle\bin\javaw.exe" -jar "C:\Users\[user]\[a-zA-Z]+\[a-zA-Z]+.[a-zA-Z]+"
  • USER\[uuid]\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\ASSOCIATIONS
  • Value: LowRiskFileTypes
    Data: .avi;.bat;.com;.cmd;.exe;.htm;.html;.lnk;.mpg;.mpeg;.mov;.mp3;.msi;.m3u;.rar;.reg;.txt;.vbs;.wav;.zip;.jar;
  • MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE
  • Value: DisableConfig
    Data:  1
  • MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
  • Value: EnableLUA
    Data: 0   Mutexes
  • N/A IP Addresses
  • 174.127.99[.]134:2888 Domain Names
  • N/A Files and or directories created
  • \Users\[user]\AppData\Local\Temp\Retrive[0-9]+.vbs Others
  • Kills AV solutions / security tools
  • taskkill.exe taskkill /IM K7AVScan.exe /T /F
  • taskkill.exe taskkill /IM V3Proxy.exe /T /F
  • taskkill.exe taskkill /IM mbam.exe /T /F
  • taskkill.exe taskkill /IM text2pcap.exe /T /F
  • taskkill.exe taskkill /IM FPWin.exe /T /F
  • taskkill.exe taskkill /IM FSM32.EXE /T /F
  • taskkill.exe taskkill /IM cmdagent.exe /T /F
  • taskkill.exe taskkill /IM ClamWin.exe /T /F
  • taskkill.exe taskkill /IM MpCmdRun.exe /T /F
  • taskkill.exe taskkill /IM V3Svc.exe /T /F
  • taskkill.exe taskkill /IM GdBgInx64.exe /T /F
  • taskkill.exe taskkill /IM freshclamwrap.exe /T /F
  • taskkill.exe taskkill /IM rawshark.exe /T /F
  • taskkill.exe taskkill /IM MsMpEng.exe /T /F
  • taskkill.exe taskkill /IM PSANHost.exe /T /F
  • taskkill.exe taskkill /IM NisSrv.exe /T /F
  • taskkill.exe taskkill /IM BullGuardUpdate.exe /T /F
  • taskkill.exe taskkill /IM procexp.exe /T /F
  • taskkill.exe taskkill /IM nfservice.exe /T /F
  • taskkill.exe taskkill /IM VIEWTCP.EXE /T /F
  • taskkill.exe taskkill /IM K7TSecurity.exe /T /F
  • taskkill.exe taskkill /IM UserAccountControlSettings.exe /T /F
  • taskkill.exe taskkill /IM QUHLPSVC.EXE /T /F
  • taskkill.exe taskkill /IM V3Up.exe /T /F
  • taskkill.exe taskkill /IM CONSCTLX.EXE /T /F
  • taskkill.exe taskkill /IM K7AVScan.exe /T /F
  • taskkill.exe taskkill /IM MWASER.EXE /T /F
  • taskkill.exe taskkill /IM K7CrvSvc.exe /T /F
  • taskkill.exe taskkill /IM editcap.exe /T /F
  • taskkill.exe taskkill /IM LittleHook.exe /T /F
  • taskkill.exe taskkill /IM ProcessHacker.exe /T /F
  • taskkill.exe taskkill /IM cis.exe /T /F
  • taskkill.exe taskkill /IM MSASCui.exe /T /F
  • taskkill.exe taskkill /IM SSUpdate64.exe /T /F
  • taskkill.exe taskkill /IM mergecap.exe /T /F
  • taskkill.exe taskkill /IM FSHDLL64.exe /T /F
  • taskkill.exe taskkill /IM AdAwareTray.exe /T /F
  • taskkill.exe taskkill /IM guardxkickoff_x64.exe /T /F
  • taskkill.exe taskkill /IM econceal.exe /T /F
  • Hides files in the filesystem
  • attrib.exe attrib +h "C:\Users\[user]\[a-zA-Z]+\*.*"
    File Hashes
  • e084341b5149d62ebd26f311e51725d3e630f5d1c154568b717d79aa0b72c441

Coverage

Screenshots of Detection AMP


ThreatGrid


Win.Trojan.VBSinkDropper

Indicators of Compromise
Registry Keys

  • HKEY_USERS\Software\Microsoft\[a-z]{5}
  • HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache
  • HKEY_USERS\Software\Microsoft\Visual Basic Mutexes
  • N/A IP Addresses
  • 191.96.15[.]154
  • 154.66.197[.]59
  • 191.101.243[.]203
  • 108.170.51[.]58 Domain Names
  • afrirent[.]net
  • ogb.mmosolicllp[.]sk
  • norlcangroup[.]com Files and or directories created
  • C:\Documents and Settings\Administrator\Application Data\Xoabhaul\[a-z]{8}.exe
  • C:\Documents and Settings\Administrator\Local Settings\Temp\subfolder\[a-z]{3}.exe
  • C:\Documents and Settings\Administrator\Local Settings\Temp\Purchase Order.doc File Hashes

Please note this is an non-exhaustive list.

  • 00062f3d06aad63d025c8097e0bc024f23ede453751afdae0e1cc5b40f987bf6
  • 0094bcc3a70b00b2b61701a90ac2c15f3d39551adcf18b33cafb6ad8a732825c
  • 029a6ba06418d2cc2ee9e7dbbcca622b206df8a1855fa6e551c6126f07302030
  • 03580fcc6fa4d72a39b876067ae9a7c9b9c62b1a53175df0f54a2a47deee6691

Coverage

Screenshots of Detection
AMP


ThreatGrid


Umbrella


Win.Trojan.AutoIt-6260345-0

Indicators of Compromise Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • The malware copies itself to %AppData%\driver--grap.exe File Hashes
  • e6ea4d5f3bc4b53ec4777f5da3105d75cd53dd6ed4f0497b52f09f79e7183891
  • 7d05f85efe8f289d43cc3515c2399e2c8d1bfbf082fddaebaf3c9c6dcea6381d
  • 5eafd63e278510033918f63f34dae687f7a19d1fc04b479ebc09c507037409ef
  • 5fdb796f505f40a0a9add787776f12ddb02edd310ae24c9d4bd5d149fa0602c8
  • 65f372559761f703622fbe2d433f5bb92752d3cb5e17966ef987c5b40a03010d
  • 9c4be24f3245e733890ac12c8a9e2fe2a0e3be31df16edf86354cd80eccc3e95
  • a204c517252f0fb7994d4472bf0090182054825822a9d29ecb370df7c8f0d3ba
  • f7667ff6110302df2855156ad8f93e998ce646109568d443a4aac514cab71edf
  • 9b816ef40eb06982b227beaf91c2eb9bc352c915632638972f3af1c3cbb29fa5
  • 5d3324155753948adf84a3f8f0c9d69dc272929d66e294faf54689e4537c15f6
  • 0fa2383f17d23286efee1062322964550636add6d2ceba1abbeb87aead6c1649
  • d69224eeda882e34339f5f785181f49e074c3f07444d8daeaf27dfddea19cee6
  • 503ac78c383a62d207512e361af07e7be279d64237c456eb376825485a1f5dc3
  • 25bf3a2df95236cce230163e9929dab6b01242be6364c6b3de186cff8e8883df
  • dadc2e7ea2fb8cb732a3baae2d0b2978d0ee9398d8e8c12f20a2e3ede7752045
  • 6157a7293e25ab26fa360f11f1b84abe44f62f363fc284af2a2787cfb6aa4a0e
  • 7616cdc6a6619685e5a6a1534264a988f14add3192bd3fb467dce54234635026
  • 613770d0d5a1f8d8bfa39cb52bd2c4357aba183afd9ecc5c3c238e5a0aea3d8e
  • f8d0bac2dfc3dd7e16905497b427391f7887effe1ae3e3276411d5c13c416ca1
  • fd55686aab2686c4af73dbac6959cbf26e4c24fb83953d7495cc680d48d73754

Coverage


Screenshots of Detection AMP


ThreatGrid


Win.Ransomware.Cerber-6267996-1

Indicators of Compromise Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • api[.]blockcypher[.]com
  • hjhqmbxyinislkkt[.]1efxa8[.]top Files and or directories created
  • %USERPROFILE%\Desktop\_HELP_HELP_HELP_[A-Z0-9]{4,7}_.png
  • %USERPROFILE%\Desktop\_HELP_HELP_HELP_[A-Z0-9]{4,7}_.hta
  • %SystemDrive%\_HELP_HELP_HELP_[A-Z0-9]{4,7}_.png
  • %SystemDrive%\_HELP_HELP_HELP_[A-Z0-9]{4,7}_.hta
    File Hashes

Please note this list is not exhaustive.

  • 04abd9e0fe7d1ea53836de6429bdca8f2db992e203675e0dc36b75355fd0432d
  • 0b9cbc73f23208828a6c92fc85cadf31e22fe0b8852a100f72418394de455854
  • 6f93a071e1b7f33f62cb0ebdade39826d1fb2539dfe3d3bb5329f1b05f01d2d1
  • 37e6f3b2a5228e10564bafcec2ca700359d5e9265d6f6d1c57a275007760876b
  • 01eb9e772dcae43eb4c8d23c69775dfe18ec133b2650663a81f40861728dac4c
  • 09e6190ac04db46f1463c539a80973d9de17de23fc11a87adcc59a78950df342
  • 648f4e50848a55deb1c51fa8d82674bc7dbf3c630c6b6956c015258157736389
  • 07514ea42b4da1110166369fd3ed806189f3c3731717e51dfb5f2835a0fbf6bc
  • 635007aedf337778cc75d4dc51e25041b89faa06c91a40378d86224dd1230e36
  • 4cf1591e9e49d796183ce7a55420cd54681afbe1ebfe6e012cceb35f74c75dbb

Coverage


Screenshots of Detection
AMP

ThreatGrid

Umbrella

Malware Screenshot

Win.Virus.Hematite-6232506-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • N/A File Hashes
  • N/A

Coverage

Screenshots of Detection AMP


ThreatGrid


Doc.Dropper.Agent-6249585-0

Indicators of Compromise IP Addresses

  • 217.23.12[.]111 Domain Names
  • N/A Files and or directories created
  • %TEMP%\uuqjd.exe File Hashes
  • 79fb46efcdff1f2e5ab8114f2e4d27de56d72ef2b01664870108793663b1c85e
  • 1007936720cdcb884a675912ee552d13d7e2a9c77fdcb7602380f5b789c55354
  • 79fb46efcdff1f2e5ab8114f2e4d27de56d72ef2b01664870108793663b1c85e
  • 89847e43aec98d5f80488b6ed609dfc50fab8df248267ae9bd57de4d5fa4815e
  • ebd2775940368bcbd9717bac69f68fa53012013bf4091d2a8506df1cf82a7ce4

Coverage


Screenshots of Detection AMP

ThreatGrid

Malware Screenshot


Win.Virus.Sality-6193004-1

Indicators of Compromise Registry Keys

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
  • HKEY_USERS\Software\Fobvexllmtqkq
  • HKEY_USERS\Software\Fobvexllmtqkq\-993627007 Mutexes
  • \BaseNamedObjects\xx19867861872901047sdf
  • \BaseNamedObjects\winbmcavr.exeM_584_
  • \BaseNamedObjects\uxJLpe1m IP Addresses
  • 94.76.225[.]131 Domain Names
  • N/A Files and or directories created
  • %SystemRoot%\ab4f7
  • %TEMP%\winksbq.exe
  • %SystemRoot%\rugrijfnvpkmu.log
  • %SystemRoot%\system32\drivers\sfmom.sys
  • %SystemDrive%\kojchn.exe File Hashes
  • cf3eda07e7394abcd11b9d63e9489c8c5ef9d799d79f111e78aefeed44136475

Coverage


Screenshots of Detection AMP


ThreatGrid


Doc.Dropper.Dridex-6260340-0

Indicators of Compromise IP Addresses

  • 104.41.146[.]46
  • 13.65.245[.]138
  • 13.65.245[.]138
  • 131.107.255[.]255
  • 134.184.129[.]2
  • 138.201.223[.]6
  • 143.95.251[.]11
  • 184.169.138[.]0
  • 185.20.29[.]90
  • 185.75.47[.]96
  • 185.82.217[.]110
  • 192.254.183[.]111
  • 208.113.184[.]69
  • 208.115.216[.]66
  • 212.19.96[.]44
  • 213.98.59[.]242
  • 27.254.36[.]68
  • 37.152.88[.]54
  • 40.84.199[.]233
  • 52.178.167[.]109
  • 59.188.5[.]122
  • 64.111.126[.]184
  • 72.13.63[.]55
  • 72.52.4[.]119
  • 74.209.240[.]161
  • 82.208.10[.]231
  • 85.114.146[.]10
  • 91.121.36[.]222
  • 91.215.152[.]210
  • 93.184.216[.]34
  • 94.23.19[.]56 Domain Names
  • abcdef[.]hr
  • animo[.]br
  • dva[.]hr
  • ektro[.]cz
  • emaiserver[.]ro
  • fafa[.]pk
  • fb[.]cz
  • libertynet[.]org
  • litwareinc[.]com
  • musical.com[.]br
  • negdje[.]hr
  • orice[.]com
  • philteksystem[.]com
  • pirajui[.]br
  • poveglianoatuttogas[.]org
  • ppp[.]ro
  • princehkg[.]com
  • proseware[.]com
  • quatro[.]br
  • rockgarden.co[.]th
  • tek-astore[.]cz
  • villa-kunterbunt-geseke[.]de
  • vlada[.]hr
  • vub.ac[.]be
  • www.offertevacanzeshock[.]net
  • www.philteksystem[.]com
  • www.soulcube[.]com
  • xara[.]pl
  • xyz.com[.]br Files and or directories created
  • redchip2.exe File Hashes
  • 01b12a002debc9820f93b6a9086412c19e1f6d9668673cc2cc1f6c93aabfd8d6
  • 049bc0d32a6b918ca4fd65cb183bcb2c0ff06628d4fc6c42ae092d0ab0be7604
  • 0c7f7dfc2b6945f46b96c8c62aa0fd9f9694fe9645ce6be52d85788ff687e76e
  • 0cfdb3ef99de18a48291ad6a900026b788e40045cf2ab84f84297a1a5df06623
  • 0d493c55eb56321b022dcac836ea01e5b0ea29610bc8690baa979e14580d50b1
  • 1084f2ecde7fb1be955cf465854439843e9a4e8ac8ff85232b6d1bf1fff4839b
  • 15063800322f6fa377dcc9b21a7283174922ab37cb84e519cd838fc76bb70eb9
  • 1678fe4b970b78989ca8abe3c830f4e110b6bca57de4ac701e7aee3b28dc6360
  • 167ed42bfeeed279d6d6633b3e4f449fbc8ddd6afb3c71ecf004d04d8196cd3e
  • 176722ee68098d6e3788c61b901976692b506b3ebc4ef750e4358c14ac764e5b
  • 17ae9aac1dcea2d5a134393fc8b0a764f5e0c6844a8cea57ec76e34e7ba9d28e
  • 1b7210dce366e228d20cbe1ce61d9970f1668a16e5c49a98fd7cda941a424250
  • 1bc207f9a7d0934afbd74bd1283ce6479ab11354406428c798432992f88af579
  • 1cf1178bb1a391756fab1273c62fec1be4b594ace355da3e71c45c74a92a0870
  • 1e5da3edef25c914e15b40f8b3e435eb462acfed2a15167c9a7ad6c9180def05
  • 1f490a190ef296c8cd6cd2df5eb4671e02b5c3de39059bd98e4216bca08dedb3
  • 24f6690360a0f839b14fdd4620f56f72380b0bf086b130a1921640212d2ab716
  • 2647e99046ec808e3aafe5cc1764902888b75acc89d8126545c0d37a56d85dd8
  • 28a91316512591938857a4264396f775851a2e7a25f6dff665057ae95e06dd8c
  • 28ab7ec22ff42b301c6336b9aaa53bb3aace63675e93eb7907c1680d7936f331
  • 2b3f8964155c237e9ff28d505e0756e1873ed9f2e56f04b8dbe6862e188b1a4b
  • 2dba0ea599270832f5b88fbe71c7795ba3c36a44ab573a157b615b93c78cf389
  • 2e0683cd448ed61994e38789224545963a37d59dbaa49f4f24a3740674d4ec12
  • 30924070e951f97dee75990fe0a9651d8a87267e511f6172ca5ec3446dddb02f
  • 38898c7d496439e9e5da5e4cc40d65aa5fae348085f2406b66810be14cb7e47e
  • 3c35385c0fe82b7f62fe95ba73aa9e4ff8d22a4193d59c11ff262650cb5f27cc
  • 3db4d968b4dff8a15379d9f2e0f1084c96d8d480dbf7ad53e7e9e8e47899a727
  • 3ff9e1394bd51320bb30280575913d91783a6b9f63f5d4b739851726f0ed8f01
  • 402a54cd56f699250064032c71e27a2a981affdf22248cc59a2599c6407d94d5
  • 4202e58c98095862c4bcdbd55c98b42788d951879f7f82341dca213a1524ff0a
  • 46080bd19531929fa0bef917ed8de88946cd4029eaaaaf9fc593514ff9384e49
  • 49119b680f9fedb19b9e1b36046b12d05ebbee4ef1040b33b9e1e4afcd38c3a1
  • 493cffa37b28beee9e404b48ab82953a61fe1bdfa41b68ea34336b817eec6438
  • 4d1960e5b18624f8ffe659719a6af49806a661abc4776fb9da173907105a0016
  • 4f13124b24c71e2d8c551f9d5123aecd49b5632cedc93d0b8a8ebc4adf244270
  • 5262369be5e983a682c9bb59fbbef0fc3dfc98feaf85278a319fb026fec93cd1
  • 55bb1ea2b1504d28fc397543e55f3c301fb58803d4e8448a38f53ba29d24bc9a
  • 57bf408c7525458ed58ae59dc57a7d0574cb6b453ab2e3e735ab93a94db61471
  • 584c8bfbf964695949fcd0c8a66e0beb1d4803afe4977e504c721a7ce38e97a0
  • 58c52566376771654ec4bd135c92ee7fe03795b1dc4f81e0609f4252f803e889
  • 14230d3e19cbef146e83bc7e6bed4f08eb8857a8a11765a09dece6458cf998d5 (redchip2.exe (Cerber))

Coverage

Screenshots of Detection AMP


ThreatGrid


Umbrella

Malware Screenshots


Doc.Macro.CmdC-6249572-0

Indicators of Compromise Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • gosterd[.]pl
  • ywkl.nonfect[.]com
  • etesusozim.nonfect[.]com
  • urojab.nonfect[.]com
  • abap.nonfect[.]com
  • knygobynuwa.nonfect[.]com
  • ohpkyxij.nonfect[.]com
  • ofinepi.nonfect[.]com
  • asode.nonfect[.]com
  • otos.nonfect[.]com
  • egaqf.nonfect[.]com
  • djirus.nonfect[.]com
  • olyfabe.nonfect[.]com
  • yloked.nonfect[.]com
  • ydgnucif.nonfect[.]com
  • ygudu.nonfect[.]com
  • ovislragil.nonfect[.]com
  • onem.nonfect[.]com
  • ybelikyvygo.nonfect[.]com
  • ijezqqwgamy.nonfect[.]com
  • ytijaboqo.nonfect[.]com
  • ogazedy.nonfect[.]com
  • ucigudago.nonfect[.]com
  • omisagirul.nonfect[.]com Files and or directories created
  • %WINDIR%\hh.exe
  • %ALLUSERSPROFILE%\<random_folder_name>\<random_file_name> File Hashes
  • 8f314f6773f6ef4af43432c49756c9a4af32b2fe0e0ca91937972728421ea1b6
  • 318cb81cf8ee609f8a6a8e8866bf4bc48013c6cf75ecfb1d806c523afbd3589b
  • a5f0aaa5e33615ab666d92b3542792d2be582bf6b0e8f3c0d2bee86ecbe552d4
  • 741d5e7d7cc13a496440c26b1bbe0080307338e9e419a154470855a5b1157ba3
  • 85d1f6ad4c4babe1a5bbde3d583411142e6cefa60631f8a5f3f7b823a107b51e
  • 99f8c220519c82de58ddf609cd5de57b6542addea00213e068030d2c5d9d6763
  • 00abd8fb0560766aef3dd884677a643244e56b03c3a4b82dea6d79d7d2f04a29
  • e12e25b9871268adb4540ed866f47d653632d85fcdcc737ddf69e99e1bc9782c
  • 61d68dbbed963678323be37753159f381e0c21e8c56fc8cbd1acd3ea5c669e12
  • 64d03eaa413a3efae12a4f72967b64625afaa0f01caf69349377795683a0c79f
  • 76a0bfa693a9d7c312c36050ff497aaa0d423a6f335ff204d4c8334d3cc8be8f
  • 253f451f36a49e093191e5583cf4a3041407082168b29299429e66d968a186ba
  • c0982749d0bef7b337f4f737f683a6ba63794ada050adfec2d094b7e55ad4355
  • ea8619a50fbdd60b797880fbd725e6d0e495d23447d365a31076837058b982ce
  • 873166cbaa52eb4e24d96097de6f5b3322012f8e4aacdecf380476624e909b6d
  • a81534f11ee7875199487f926a96b53af265afb7f96e97bdb0c477d3d18c4614
  • e62f33ff3c59c1f4ac633e228a3693e7a9f3eaf0385a41633e24dc4260d683b1
  • 215dedd739516fb6054d0b6cfc0863c9f71c56479521362fd0e088536efd4191
  • 39ed73fe10a6aa325322399c0038a8e405a27a66cf740c975418021efa5da457
  • 3c574a5e6e8994691ee39855b85fba9d961ce807e77b65093fa875292da1d5a7
  • 5ac4f7bd73fbf822c5e5e7a319776c1b79593b7604fae84c0598a1d2e99a567a
  • 6a24dbe8aeabcaea4bc9454815751037cfd1da4a82359b830df93eb67452809e
  • 6f34227aa29d33d4e7b853743818006900bb9df39cf3e6bd86cf7a1836b9a2d9
  • a1e1dd4ed46ccb95b2f95ad57a582e7df8422e4c2ebdf853356701b6ad6cc2e2
  • b42f91110d802e4363ce9664d5401f84beb08328c8e8d81a50290f49758ba434

Coverage


Screenshots of Detection AMP

ThreatGrid

Umbrella


Screenshot


Js.File.MaliciousHeuristic-6260279-2

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • N/A  Files and or directories created
  • N/A File Hashes
  • 18ec2f58ca800b00e0abc6cb7235a3caa65d120ba1fe14ad8160c3c3f450e19a
  • 352540dce31dc80bd938fc90a06322b8fcbb2e1db7a76d254eabc93cca4e9a5e
  • 4bb8119527c8da29ce70926efe15fed0305a3b9518da40f9551ee62606f3dccf
  • 5a6526a7753245fc0837ea3b8a536fd5e587dafa3aa2fe58e58f69132404639d
  • 5fc98c58ee911fad22e27203b649d78ddff67503357038c0c7a2733ebe70d8e0
  • 72e173a8c5828a7eb2f6e29ae047492d7d5ed030d8c126c6259a4be147debcbd
  • 860302d167ec4aad867b193eebc60fca7bf407f01ef58de6957c1b0ff6f5cd7b
  • 914680df0be91b8c175c08ec050d443a60a0b7bfce3bc4136d08d432e0a0d3db
  • 91cd175bddcd53bbafccb70356b9bae310cbadaa864494a19f47a46b5523cda3
  • 99b9911869b733d6cbfeedcdbd9ae165f8250d1b9cfb62af05e314c62d502548
  • a7227042a9d48e78a696ee0e45066a324b3a0b32ec24b35cf96b38550f991e92
  • aaa8a4c8afa43f8a0bd5cffb1e1a01dc503d7c9ba4b646789107e12d68f66ab4
  • aeffb11a5ede257b91c8f1a481ff7c27f74774cb32665d04cf3a92fc9c7be14e
  • dee2a92b982ee9ad225f8ee7a5b393ce78604cd41f094fa058891e09e97f242d
  • e3a01bd742364862ea7336574fd030c8e53bfb9819b5458976fe6e7107a120c9
  • e3ce60862c0d258511c492a03b3adb5d86c665f490fe231997045a1ddf5b2daf
  • e3e4bbd670fe41e6608b0e17778ddf70b2c2e37591b265bc16089f84ee7ef7fb
  • ece6551b97bd990b40a78d683943e48313be26a46daeded3b232e4ec47814adf
  • f873d1bf619f28ac6200d8d669c3bba5bd69b0cdbd513d6d9461bc6c308e416c

Coverage


Screenshots of Detection

  • N/A