Threat Round-up for May 05

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 05 and May 12. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

Doc.Downloader.WithMacro-6310867-0
Office Macro Downloader
This is an obfuscated Office Macro downloader that eventually leverages Powershell to download a malicious payload executable. Typical object interactions are obfuscated via the WITH command.
Heuristics.W32.Parite.B
Virus
Parite.B is a polymorphic file infector. It infects executable files on the local machine and on network drives.
Js.Downloader.Nemucod-6311824-1
Script based downloader
Nemucod is a JS based downloader that continues to be highly used by several spam campaigns & active exploit kits, oftentimes as a stage toward dropping popular ransomware on compromised hosts. This particular variant relies heavily on hex character concatentation ∓ naming conventions consisting of randomized 0, o, or 0 characters.
Pdf.Tool.HeapSprayHeuristic-6301967-1
PDF JS Heap Spray
PDFs leverage embedded JavaScript to exploit vulnerabilities or at the very least gain access to additional functionality provided by JavaScript. Typical exploitation techniques require a heap spray where JavaScript is used to copy the same data many times throughout the process' memory.
Win.Dropper.Elex-6310653-0
Dropper
This is a dll which is downloading files from dga domain using powershell scripts. Observed installing adware Elex, but can be others. This dll is containing also indicator to perform operations on raw drives. Persistance is ensured with service installation
Win.Trojan.Generic-6305879-0
Worm
Gamarue is a worm that can spread via removable drives, spam emails, and exploit kits. It contacts several malicious domains, and can be used to install additional malware on the infected computer.
Win.Trojan.Nanocore-5
RAT
Nanocore is a .NET Remote Administration Trojan. Its source code has been leaked several times, making it widely available. Like other RATs, it allows full control of the system, including recording video and audio, stealing passwords, files, recording keystrokes, and so on.

Threats

Doc.Downloader.WithMacro-6310867-0

Indicators of Compromise
Registry Keys

N/A Mutexes
N/A IP Addresses
185[.]165[.]29[.]36 Domain Names
N/A Files and or directories created
N/A File Hashes
009ea577f9f7c8d311b96051c3a6e4fe288647fe4122c2fb0c14240565097012
015f06d82006879a5e040e913f8ea91ed5ad01249f753cfbf1888daeb19073e3
01dba2caf8c50e171d4cfb45b788b589af06f4a467174325c88f200ca7ca9198
0212c580c27761eddea2af38b0a0c1fb9b32789c5574ea7a23f8184570d8dfb6
03aaf18f3a59fb063622511d6b441999ff90c06742911419052251ec320146b8
040e61e10a7a85c23041c1f0e4635dd2ea9307787eb17e88f80372529e9209d5
06e4b3a33127ddd8ff0157fc0ba1d2d24a8f26ed1a149b4388c01d30350c0ccb
072e99a20f62ec2d713db7e088edac0fcdb90a77f0b10aacd7d0e549d694f0ed
0a428729361a8a712cbfd3d8574b234306c12c32b327d3cd207fa188460b1e3f
0a7922eb74e6139a08fa8735a87cc47fc62c1f6325aadbac2bc82c2981f2ada1
0b9e0425aea9565b0307a322976f77edc6802e443cf5f62f724fec4ad83a9d28
0bacdef1c789dde9662570062587098b7c693bb7be89c0a22b824aa5fbff6056
0bfc71f69f2bd4db2ae9fc900e11509852e1eb8874f39171287e86bb7284868e
0c7f5c69e828c88778314be34c3468ab9a2bc9705cba727bb3c89832c3f91113
0e9246ff490f54d156cc3426e434980bb98a81935f1c9666a93237428b8e0ea0
11769cdaf3c210df174702803fbc4afa7b2cc20a27ec30ed0e4f81118a66de10
11fe367d79f104632d9452027a7377b4c51fc0f43f32d7a6fe73f34fc2cce508
11feca2c6b6d0be07e01bbaa910ef8a44c81f89ad1dabcdc5eeddb37ff12d854
12e7c347609f1b2aea12e47f12d15df579c22162a49338977d4694dad7fff028
1333e3e5be8cc510e33c609a7080764b12cab70e5ddbb57167309f15557edcae
14cc6de1dd265d0943a96b4852e6f8c5828f636131333d0c19b2dc5f7a0ca1ff
15bafa0d6de0681cd079ae866c4ed4f1c9917ce96261215564c8f0029f9675e8
177477fcf8963dbef8e22bd32f7f08e4b103af89ba7f3e7a4a997513e1532629
17abb7ca3e200e5c7965ffee65629d3d113717bd858377948e577200e6be11b7
1997e3d6ba77ea68160b88c083aca9bca8d8bbf8e1191e86c1660f7a4b038f93
19d6fc360c1af923e44f173989591f382ab965767802bc54a2df875a10ca4e38
1a50f4767495978a5ca9e34fcde61a74657e04d12b04bac60c0b0b6aac26c588
1b6a81db9bf395f8f80e1d23b143d5ac049af16878f66ecd3874f4cda406836a
1f9a0e385cbce520988e24bf1b95b4cd7976d46637864e5fb20548068b3cc4eb
220791a76a3befad1dd9e71a8664ab7546ee1cc98a9b061abb2cfd577b8bf55b
25291ca354bd11e6864e84eee74b3a271541e4aa6e8479f3cafe13210b8bafcf
28b343fc742da18b7ffc9a2e5e9c49b8f54cb6ac724849ccb56b4d079088d1c6
2a7eae250d89a5fdc9ee3acb57d1f068eb5b1ed06aa48c9093d095c3187271e7
2b3ea22573384712690f76dbc939935a848a739f61a7c69e92f11b4eb77bbc41
2c960ecfc9cb060bf73cff44accc258f47164c3b7b497bdf3d02f7088bce7d7d
2e0b71ae5e202e569ecfa9731f58376e1d24a5dea725e4ef2eda64939dfba226
2f0220eb391f691e51b2afc724d9cd04a9f869e34fe9e8c715e864f13546136e
2f0877a8ebbad2f4e11709da5a99453b812a86ba0e5502a6b0791b856fc9dc6c
2f571cc5b3f708e3a6da99c9d61f99d0230052e9a0cc483644044f92537a7ddf
30224c91115b5c4212de3dcb8cbb412b59084d8bea1ea9f54525de0a07362b68
30a37e174b9a8433ca9befda236c985daa5b92aa8cd078e8f6e033e61914caa3
31819465f95180892f68afb2f4bda5eaafcb1ac7138fcdd0e91e951eeb307e47
33242ab139dfef3cd6f6e2938d54737c5efcdaf00217e1c5b49c2dc5618449ec
34ca6fe49ec7c5b318e55183d09c350af5b418209558ca1ff6bdc53034fcaced
358782ef63e14ff6606fc4e1b91da61ba19383e403fab6997cf5d2b000d5136d
36d1b267808d306d96ff40520b1cd1f04b861847313dd0ea60fb5bf764843b21
3736940527681c6c0daf9c25fdc1807868bab9c339a61a7ed88f8c7e335128f3
37f39f494673dabdb49c254a02aeca1dd350f8ea828b928cd4d8f42e6c6cd264
37fa50440f8950df0d0dbebe2b052925d9014ab85c3c8b62e3d9fa49f327cc41
3ab653f63c43209910645d6d87d8b60419ace960dd16e275f407cf46bce0b8b8

Coverage

Screenshots of Detection AMP

ThreatGrid

Heuristics.W32.Parite.B

Indicators of Compromise
Registry Keys

N/A Mutexes
Residented IP Addresses
N/A Domain Names
N/A Files and or directories created
\Documents and Settings\Administrator\Local Settings\Temp\jnj1.tmp
%SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mhbD.tmp File Hashes
00667eb42299cf767fd996961e426f3af3471c71f1e612ec2d832576289077d2
d8e6807fb1b2ca4d3e9ce8c15415839ed8e9a57cfe7d3e362d0e225de436eb77
5a16d398170bc582ddc864b35271526defce211dc9026739fdeca9260414f36a
742fff7851b87b91583f54c2c70438ede8af603aef3e3897e5792665b382b0bb
3107785dfb03aa0a1b072ab4a9de383733cc53724f94d04647129848a2418d79
415d459846a0f9453963b0474d6a6ad877c7c25c72e445b0f6e6e585cd5b400e
2c4657c53467b77fa8c007468ce756f623e302294a288782041c3fd225828af4
e67254d17730ec06704cd78f65182380f02f6e09997b2d9fec815d7209705965
50ee4a9db6b125b5b57693f2aeb622c3133811f31e6b81034f3bcbec5af7f6f9
644d71edbc489214fc98d55504059da222f888169363a5d7d21e44ddf1d825c9
a176ecdb644b79d68cd721a7b417edb425a88e9cdfec6c490b194056e3a47024
8f0419896c6b0dd5bdb2748777f3e96c4bbfb7f7e96ae88fecb025607fa2d194
9510fd8c732f0ffd693931090c326ebaf2ba12f2b2c6ea53225d932adfc4bd22
0280366ea9ccf3412e0eb354b03c2ddb9ebf5a60eb236a0aa6a4334033b8d267
d31e56c10e62524c241d878b4ab94eea6193bfcd22f4b89f3fd8beb9c55cc9da
d2674afebf388fc5b068288df275554b098b8c2ff3bc93606025a273f5c09670
de0210ad1d7c25c124b110ef3fed6386ff25a311e35ea301d83bf7be9eecc23c
23c81c28545fe91270f72dd2463609ecac4ba8163ebadabce343f18425a08929
2345aab3ecebc954de2839fd61501f9fa8fb886566f85f88be535ecdbb263d2a
0c6478931f2e3edb41d5b6cca8d4f033864a033e084323762a0cc0714b62f128

Coverage

Screenshots of Detection AMP

ThreatGrid

Js.Downloader.Nemucod-6311824-1

Indicators of Compromise
Registry Keys

HKU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Mutexes
N/A IP Addresses
N/A Domain Names
37kddsserrt[.]pw Files and or directories created
N/A File Hashes
15a37811fe59536bfee4155c41b94911d9d507beaaff2fa673dd1da3e1f369e0
1a7e222d39aef7ac4d8006503b46145e127ce6eca82eb75c22163a73c40e27b3
20ffb283d1af44cb42afbee43c2b386021e7dedb9c59c1d5a95ac3e05fce9742
2f80a68b8603b77c2f138e1a6c082e1308dba1d1e7c7e4d91b25baab67251d0a
2f917ae9ce62698dddc07f55bafc3f95937ba2cac1f75e5e2678a1163d175e2c
3ba9904b8ebd1b81c406293a55cb1ccac03ef574bbc8f3a2ecaa726930f75b7c
441ab6cd707bb4a485395edf30b7b1eff84cc02f2cbd0f6a83c8a269c72c9da7
4d8d2444d77fc8c802be80fa93e317316bd86f3f9ee2699d971c89f36a4cbfd3
92649f778b58afd71bc8f500465489a67c16be7789f5aff8ffcedb6216679ff2
983446fa82305c52ff87a76be94a75ae1c7c10c6c43a6481bd4db8b7e679eddd
9c74de5f43b79fd44843126716f8c27b1dc4f33dff779fe2cd7a5eded23c4dd2
a655770566e3c0783b3fbf8d9be3fb713d9e6380ec3e5a9aef5881f761e8925d
aec59a27af9c7ca54247666338ad0a6a0d74a23ee0e6bd7c33be76b7872a49ee
baae74e6a153bb597d8ceb81f22508c55d8697fb748502708c9666d78d53a4c5
d0f0a5c540a3e68f417590cb4f27a6f9da4401b2b0e71ccabe6f46d0a7e6135f
d13ffcf550abe6033977d5730babf4dff4358487d35d646c043683515f39e89a
e290216a1ccb5561d17e1d0d681eb27e7c301d774fdb275fbb1292ba98fa137a
e4acd53b4ecb0bd3cd0e7a534d4d0a80fd221bbb73c199ffa3f44019a1989a55