Today, Talos is publishing a glimpse into the most prevalent threats we've observed between August 11 and August 18. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

  • Doc.Downloader.Agent-6335676-0
    Office Macro Downloader
    This is an obfuscated Office Macro downloader that attempts to download a malicious payload executable. The execution chain typically is Word -> Shell function -> CMD -> PowerShell download and execute.
  • Doc.Dropper.Agent-6335671-0
    Office Macro Downloader
    This is an obfuscated Office Macro downloader that attempts to download a malicious payload executable.
  • Doc.Macro.JunkCode-6335442-0
    Office Macro
    Malicious Office Macros are obfuscated to prevent easy analysis. At times this results in no-operation like instructions. These no-operation (junk) instructions create artifacts that can be detected.
  • Win.Trojan.Expiro-6335658-0
    Trojan
    This sample is a Trojan. It complicates the automated analysis and the manual debugging by using anti-debug techniques. The sample needs a proper installation of the sandbox in order to run.
  • Win.Trojan.Ovidiy-6333880-0
    Trojan
    Ovidiy, or Ovidiy Stealer, is a Windows trojan that is still under active development. It serves as a credential stealer. Although modular in nature, it mostly targets credentials from web browser sessions. It does include some C2 functionality & will beacon out with select host information. The trojan itself is written in a .NET language & discovered samples are commonly protected with several packers specifically tailored to .NET binaries.
  • Win.Trojan.Tinba-6333828-1
    Trojan
    Tinba is a tiny banking trojan primarily focused on stealing sensitive information from its victims via javascript injected into web browsers. The source code for Tinba was leaked in 2014, making it very easy for malware developers to adopt and modify its functionality.

Threats

Doc.Downloader.Agent-6335676-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • 78[.]47[.]139[.]102
  • 193[.]227[.]248[.]241
  • 104[.]160[.]185[.]215 Domain Names
  • campusassas[.]com
  • campuslinne[.]com Files and or directories created
  • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\qdvjnh.bat
  • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\plzea.exe File Hashes
  • 7ffabe10f4147ce48fc9ae40cdc7778d08ac7881b779743720e2c4313592445b
  • c2a3dcd915905c09026044e8da533455a2742196e4294cfffc000c048c1ea9cc
  • f756ea3c00d7a3dc3ff1c0224add01e8189375a64fbcd5c97f551d64c80cbdba

Coverage


Screenshots of DetectionAMP


ThreatGrid


Umbrella


Screenshot


Doc.Dropper.Agent-6335671-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • iesimpianti[.]it
  • janssen-st[.]de Files and or directories created
  • %TEMP%\7E94\3F4A.bat
  • %AppData%\Microsoft\Office\Recent\270700481.doc.LNK
  • %AppData%\Microsoft\Office\Recent\fatt.348.LNK
  • \Users\Administrator\Documents\20170810\PowerShell_transcript.PC.PbSYjzuP.20170810091133.txt
  • %SystemDrive%\~$0700481.doc
  • %AppData%\Microsoft\CHxRthlp\api-pntw.exe
  • \TEMP\~$tt.348.doc
  • %TEMP%\33513.exe
  • %TEMP%\7E94\3F4A.tmp
  • \TEMP\fatt.348.doc File Hashes
  • 5edbc08d4e919f7186aa2b8a6e3d49ef38035c2a55b6e226910fcc60fe26a335
  • bbe5988f2470a296186ca43a76636fceb523b45273a32e83aa14a8cc1f4e3a8e
  • acdae0dde63863e8be98935254c901439b5fc36fb45f974fd7ce7c298e3ca0ca
  • b05c34ffdc8c82862b408a1f628b21bb08362de4340d768a08c511132ce7d34d
  • cad134945e7f20e99efed18650d4a7c573f8902b32c10ae89639518f94e646d0
  • 0752a00c66125520f78673e70af10123cb5b78fe4786d368f7beb586d5ce3531
  • ffc6c04d292e6618826bb09c8c63a06af3993e7b6b14171c45c7b44619b4421a
  • 758a4e1ea1fc0c9846d21f643013fd934fd23b187ca1fd32c90334ff48a60372
  • 4111dc9ca29508aa89caf873ac9359ad579270c3b3025ab0ba8098dea9c3c459
  • 0524147db311dedc4631e0749bb79865ac673763bd5ebc576855fcb9431de98b
  • 0e5240bf70e304781511de29a000c308f675d6209735c118cd0054b519eaa096
  • 09f89667dbbd0f72478f317aed5196f743693190aa3afe1f1cfccc67dad88fb6
  • 4cf480e7bab22fdd7d64c43d8f18c3c5358c25fbd063bc2d2855885b886718ac
  • 6ea7a564a6a7ba8f4c97e2eaefbedafab6dd1424d56716f1255b03f8b5879161
  • 3728cecd2be075b09a3a6d8d8c5923fe14cf381e3070266cf05fa51585def305
  • bec41e3e8d3093b58170d743ca905af81ed745a4828a42a9d39cd3373252a84d
  • bd7ed9514afabc723da282f32ad1dcfe81796a83555b7b4a6738dd0254c06ccd
  • 4b495c54056aa68e91fd481168a7ddc5d5a6cae713ab359777340f1ba901ae65
  • b588aa1d5901e2ded7dfc9fe8efbd13304f2bed37086b5c9aa498fdffaed48ba
  • 717f927b9c0b01a60eb94254d39ac5eeee24a2c10d0c59266252630202a36323
  • 056bce922fab367aabfd43f5e85bb5397755db08afcc8c38d992ffb4fe8f766f
  • 3ca148e6d17868544170351c7e0dbef38e58de9435a2f33fe174c83ea9a5a7f5
  • 6250f069e1268801cb3afaee2523df1aca628fa791a666f1d05b6cb981913461
  • 1496ddfb94f11120267fe9d6bf233ba4726754bebf3075340496a144777a6539
  • 5f1827ab138eb25289a1a76910f5dc9c96aed87dd8aa2db7e3b0d310267a5a67
  • d08c719c8ea6e5d7546e6449e6aed748ce74359e7c0dbd1f9bd08e2e8b795c68
  • 168c49c8207019008bdf746d0fa4ab33a154277c5fe50fd4900e9d77ec6a2e7d
  • e92710c582f71c4a9cb127774fa4cce0d8abb837a38d50d22d17ef7061646c92
  • f20256df607a29ef83bd035ee27fc424307712e59298f54803150a88ea5c5ece
  • 190cda0ade0c0348786652b7ee12fde595e12ab561d893224cfdafbd58ec7b75
  • cccb32f7f0408b32f3ad7f5a75adf1b955ba83a712e59c64f16b07713a6b44b8
  • 31b34ac21405f6450bef3c18249e83a7bc464dea5cd4fb239becfe0a800875a2
  • db8ee4755c2b30756abb68e14e30b7c10d283b2f989fc7f3556f92389a2c32b9
  • d26ebbc2bdf6a6b59d805f7f1e9a9b505b6ff6e8b99e254f9c5c36413142d3f8
  • f2fbac0942b08720073373536520b471229c918474cabb63fd19c3d006caaa1b
  • 366f1f331e940a462447e2b4abe9196ae7b977d281c2b9fe5e19bb0c2927b705
  • 9859e621b4d259798b2813377f9cd1736497f51cb501c6b3ea44ccae57d4e4fa
  • 94395a2b7bd0a120b55e39b3107f934f9b76faa9e2679dbae1237f69f2c3f1b9
  • 5df3016ba1cfd870d1d72e75ab9ec1d0a08a7e11d9fe7ec6b32fa0ce468206e7
  • 5624e26cace481fa4144f5ccd5bdcc7b5c3d42c035c88250312833041cf55807
  • b0610f20ce7be29f5864a02d72bcfa54e215d3159bf381d05fac58d2fa703f0d
  • 1c364ed502fa3710d9fa3c5a4a2ac6688bea3610acee2a6f958220d8ffca908b
  • 36472a674c751c65c15cbaab276c0fba8f3f1709750473b24e5d3c21e468617f
  • 0419cd8e5884e2918c5f0746d54efe2e2d9f0385523ecdbc395200df4004d87a
  • 29a7f99f81dd37bcbd196d635837c01d2aa48045ce4efd999a6d0da92bfbe917
  • 6451b45a4f8bdccdbce6bcd14e5fda1f976c81efed2c4dfd028386cce31250d1
  • 7a703a5e7f30a1621e204669ffefe91f22a1619814c4ef40872cd750cffb9125
  • 5de158f2b9e0039b76588fd190565bcf4e02398ec8bff57d1c55bcc1626de5f3
  • f8913513ec19ea386cb812e5e7249d44a4e4a3092fbfcea23fce692d7ed88970
  • 6dc6070451995a7dae4d5b741e291ce525aec2cf3144d9fdb8484f39079ef9e2
  • 4808a9fc9a33cf5df06d5a56f85b6e2dfdb8fc5fbb4cbd2ede05488dd566f6f5
  • eb99cecc433a5134414024c98c227f52bae7660343a36469ccf0e6a8f5af4a6d
  • b3dc9a164f1548ca0fd4618dbaae44c6a9ea05f66aafcf67758d9985b1409cb0
  • e14472604877ad85c119703225fb6086053bcaa2ebae60d38762bbdd192e2244
  • e631b1dd070f71e53dd7b5c36a1921c027257f0c79bc7964551f27d0f4ece78b
  • e342cae3c710674f0e73ea2ed1e72085d790a653e249e1b5e4d8e6696e110041
  • 9f404502e944f4cd76b902abf67717054732528a9399e23b3d90e2825316818d
  • f6c2aea9dbc12ff2dbf77637560093234465cdae03c40ee4f0afcf8365ebfab7
  • b3fffd7e92a3bb920456b149717c353c8779e45a947c0e756889956c6bc48d7a
  • 45112ef00b7d34a471655f3a7318fd2b69de1ade1889647839ff897c6e6f1c67
  • 9d52dd2437d0408e5971598b44c5dc1e1475004241bb5928d1eaee9a9aea51e1
  • 947ec2662ab377aca91f9ccb5b2a0e823ab5b814be719494c5cb8f0e7e228252
  • d076c672bdb9bd3b738edb882560482bebde469d02acd1ccda11e9c9cb6feaeb
  • dcfddf26b9699622bde12c6b64a78e5446172e57c5a29c3ea0267a0df85bc1e3
  • 0db7513e4ec8cea44afdce2d37991f5f9cbde0bb779856c10d9ffa75bed53d0f
  • b1e4e3be5dd686424763f39f8930e28044a9cda7a48d8962ba6e8978ef532fa0
  • 31755c56408a13f44d620971a60342bb0170ad78217c923c518fe4b58b4da365
  • 27772ef48d027d7e23e1f78d8ea86cb1bbcf4240cd59a8dc7ebc82f8a3a8b6dd
  • a31cbc1ce4abaa2ba7cab9ff97e1f647c3b1264c9cb7db0e20c74d151db2634d
  • c685f1c782e6b9250035f922ebc80400f2d6515e5f343a933c6c12920eb89e92
  • 5dd873a5cd07c4ac6edc7bfad7c92e1111cbddab5e72de96291e2990e0ab62e0
  • 8c43427b886d65c06a43f823511f0927b85dc5956dc7bd1bd16c59af548db6b8
  • 2aaf7791ed0a57e48c3d363b46ba5247e78a2290549bfd7f98793e9bee4c3e55
  • 9b6d3e01584f4d1238a55050c7ffad0e14299e911db8497b81529bd58afa4bc7
  • d526ffe1710b4b39866bebceb3660e1386e41df17b13a6055078b0ce7db74fbe
  • 425e004b3c9034aa17071b137ca1d4ae7a35dde5f588c05295e491b716125e2a
  • 8c4813043fa78b4aec7ada10556ddbe06eedbc81b115e4ff08371d8ee132d645
  • c7cab605153ac4718af23d87c506e46b8f62ee2bc7e7a3e6140210c0aeb83d48
  • d52318c1f83d086fcb94b8ae7288f2acb85f6e441c66a3f1d09365a1018c80bd
  • 44b6060a5406112556049bd3efef8d876fe335bb4aa0f0a6f7d0210184918c71
  • 4e812653205426b75038ce2796be5b254b61ee02da376462f3ad1ac23d898282
  • 454ed2ca7a116ad34864d4e8b232dcb50c063ffbd70f23753262aabb6b34d24e
  • bf958c7ba44b9dfdcba50eeb6f7b59fe3bd2948f1ab1a7c8ee0f162b7cac3b2c
  • de0e7aae207f7a7a1f242d849bb61c7f4e98d84f74b228439d296e6a46b2f812
  • 712a907f98efa76de2b349c90084fbef6d40d9df32a41df98fc62e19fab5329d
  • 3d081fe6a220b546af09139fda7deceb5e7f16b52fb47d15ff4e69bab9175734
  • f0b670afe4781d3e8899bf742fbd613636424681f56c4388168acea84ea344af
  • 976c6ce6c484aef7d0d801c2f5ee31c984136d91636656a7e5425fbc4e848029
  • 37e79b45ee53bc266d3602ec2cb79762a3c6360b5c173e89da045491150dbfb1
  • a4692d62273960b017d80e2b3ee9befe9b186d0609dbf4aedd1dcaf6d3aef671
  • c3e6a58e8a68518ffb43ee9026508b6520016e8d7096bf94ec2d1ed5cd328d76
  • e8290589cab3707f80ada754a31263e239b870dac5bdece15bf2e331cae5acf1

Coverage


Screenshots of Detection AMP


ThreatGrid


Umbrella


Screenshot


Doc.Macro.JunkCode-6335442-0

Indicators of Compromise
Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value: internat.exe Mutexes
  • Local\_!MSFTHISTORY!_ IP Addresses
  • 52[.]173[.]193[.]166
  • 185[.]206[.]144[.]152
  • 190[.]107[.]177[.]115 Domain Names
  • plantatulapiz[.]cl
  • kalawatu[.]site Files and or directories created
  • %TEMP%\CVRDF32.tmp.cvr File Hashes
  • a5eb0f2e7d972b47c5016dd755bfce2e794822ef6933ff9759fd70e72b137a16
  • 404987cbcc932ba68aa9abd4607ea81ba4feb167c3f333c800a56cb2620ffd9f
  • 046809ff996329f2bb539128d51a0c21179ac6d117688281dd927df4b0aaf85b
  • 9679b02ca07d40f2d2d84445b5683fe2c1a135ecf73886d2ed27dc387b108417
  • 3a79a33855731c0066016de8baf9ef6b946b06b1ce4fda28f3c68265afa6c89a
  • 3b0997b98551548002dd9cd977cd3f881f0496ab2f86ef1a90d6c7a13765366c
  • 148b0ed81c95496d80778c7d3d093627a7395b76bf9b457f958201be66e8ea1f
  • 9ba948417071478c1fa3fe89c46c19c56190f47f2ba141a446166eff5a71fbb4
  • 1a1a48c35aee34ba91d83ae97865d75319112165ee8e7dad7cb7714ab57c40b7
  • 5b1e2ebb1baa600fba198e5c233ebb431311c976ef23f5c2f2c74ff03392a824

Coverage


Screenshots of Detection AMP


ThreatGrid


Umbrella


Win.Trojan.Expiro-6335658-0

Indicators of Compromise
Registry Keys

  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
  • Value: Collection Mutexes
  • N/A IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • \TEMP\60d2422af917cb8aa58c14b8b78d4af112c9c78343da8f7aa3fbcb87be1a4de0.exe File Hashes
  • 60d2422af917cb8aa58c14b8b78d4af112c9c78343da8f7aa3fbcb87be1a4de0
  • 5fd134b6abe1473fd5a7f96c711a4270fbc364bc6e3b10b5b344e0a1bfb0e4d8
  • 5f5e9e5952765887211883b42e508b4b14c62a1685092978f98c6619229796b5
  • 5fe205ea4f5f975703e242e8079dc471a5363538535d76584e7138ed3fb67546
  • 5ffa0097ebcba0e1921c6607a644e2649532ae07b1c7d6533a3cbef52ee51620

Coverage


Screenshots of Detection AMP


ThreatGrid


Win.Trojan.Ovidiy-6333880-0

Indicators of Compromise
Registry Keys

  • <HKLM>\SOFTWARE\MICROSOFT\TRACING\6838BCE2F6C831414DF831040FC14287_RASAPI32
  • Value: EnableFileTracing
  • <HKLM>\SOFTWARE\MICROSOFT\TRACING\6838BCE2F6C831414DF831040FC14287_RASMANCS
  • Value: ConsoleTracingMask
  • <HKLM>\SOFTWARE\MICROSOFT\TRACING\6838BCE2F6C831414DF831040FC14287_RASAPI32
  • Value: EnableConsoleTracing
  • <HKLM>\SOFTWARE\MICROSOFT\TRACING\6838BCE2F6C831414DF831040FC14287_RASAPI32
  • Value: FileTracingMask
  • <HKLM>\Software\Microsoft\WBEM\CIMOM
  • <HKCU>\Software\Microsoft\SystemCertificates\My
  • <HKLM>\System\CurrentControlSet\Services\EventLog\System\Schannel
  • <HKLM>\Software\Microsoft\SystemCertificates\CA
  • <HKLM>\Software\Microsoft\SystemCertificates\Disallowed
  • <HKLM>\Software\Microsoft\SystemCertificates\TrustedPeople
  • <HKLM>\Software\Microsoft\SystemCertificates\trust
  • <HKLM>\Software\Microsoft\Tracing\6838bce2f6c831414df831040fc14287_RASMANCS Mutexes
  • N/A IP Addresses
  • 104[.]27[.]132[.]79
  • 104[.]27[.]133[.]79 Domain Names
  • ovidiystealer[.]ru Files and or directories created
  • N/A File Hashes
  • c16408967de0ca4d3a1d28530453e1c395a5166b469893f14c47fc6683033cb3
  • 062bd1d88e7b5c08444de559961f68694a445bc69807f57aa4ac581c377bc432
  • 22fc445798cd3481018c66b308af8545821b2f8f7f5a86133f562b362fc17a05
  • 80d450ca5b01a086806855356611405b2c87b3822c0c1c38a118bca57d87c410
  • 8f6939ac776dac54c2433b33386169b4d45cfea9b8eb59fef3b922d994313b71

Coverage


Screenshots of Detection AMP


ThreatGrid


Umbrella


Win.Trojan.Tinba-6333828-1

Indicators of Compromise
Registry Keys

  • HKU\Software\Microsoft\Windows\CurrentVersion\Run Mutexes
  • \BaseNamedObjects\5E60878D IP Addresses
  • N/A Domain Names
  • recdataoneveter[.]cc Files and or directories created
  • %AppData%\5E60878D\bin.exe File Hashes
  • 0ce6189ecd16fbf2f885a8516836c7bb9d0685f6ff2c4a3df80e236ef5d0d803
  • 33fd66f4cee5bdd9f30eb2e5bd7a65367e10f55495c1122430685a8ff0d90fcc
  • 51769c916a89522975cb1babb4c9c7b18f3530286c66f3d735751cbdac02a160
  • 56f91537753491cd32a250428b146d7685362c762c7e8f39703b4cf6cd92c020
  • 6fd80f8da071c3dc482314cbc994b22f105bce22acdad9e9bd86bae5abed53d9
  • 7607a0e1be2a8f50959ef42b78edd156aa76741fdc8ee2be9d375610c0b130b2
  • 7bbd6d3d6bf6e991e023395e3cb31c18b2a106eef036ad175736a17fb1099b39
  • 856ed534a7c32ab7799756c33f7ee104718c89add001428a41dc57e8449167c8
  • 968ff771eab9d14d1847f489f425e44532522c7b9fe7407b09d7cc594da0eb84
  • e2776a037dcad9e2c752ac4f07dfae0412312ba9b1b748a48922ed572f83eb9c

Coverage


Screenshots of Detection AMP


ThreatGrid


Umbrella