Friday, July 6, 2018

Threat Roundup for June 29 to July 6th


Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we've observed this week — covering the dates between June 29 and July 6. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, it will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive, and is current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this roundup are:

  • Win.Malware.Separ-6598261-0
    Malware
    Separ is spyware that has been delivered via several different spam campaigns. The malware establishes persistence to survive system reboots, and it's able to collect sensitive information by capturing login attempts via a web browser. It disables the Windows firewall if present, propagates and invokes scripts during runtime, and relies on FTP to upload any collected data.
     
  • Win.Malware.Daqc-6598201-0
    Malware
    Daqc is a trojan that collects sensitive information from the infected host and exfiltrates pieces of the collected data over time to a command and control (C2) server. It drops several database files and locks files to properly manage the data it has collected or is queued to collect at a future time.
     
  • Win.Malware.Tspy-6598050-0
    Malware
    Tspy is a trojan with several functionalities. It establishes system persistence to survive reboots. It also contacts domains related to remote access trojans (RATs) but are also known to be hosting C2 servers that send additional commands to the malware. The samples are often packed and contain anti-debug features intended to delay manual analysis.
     
  • Win.Malware.Fareit-6597973-0
    Malware
    Fareit is a trojan with a significant history associated with malware distribution. It is mainly an information-stealer and malware downloader network that installs other malware on infected machines.
     
  • Win.Malware.Razy-6596077-0
    Malware
    Razy is oftentimes a generic detection name for a Windows trojan. Although more recent cases have found it attributed to ransomware that uses the .razy file extension when writing encrypted files to disk, these samples are the former case. They collect sensitive information from the infected host, format and encrypt the data, and sends it to a C2 server.
     
  • Win.Malware.Zusy-6596071-0
    Malware
    Zusy is a trojan that uses Man-in-the-Middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" and "winver.exe". When the user access a banking website, it displays a form to trick the user into submitting personal information.
     

Threats

Win.Malware.Separ-6598261-0


Indicators of Compromise


Registry Keys
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
    • Value Name: lodhgyuuuf
Mutexes
  • 716BCAD1::WK
  • DILLOCREATE
  • 4C0::DA783779D0
IP Addresses
  • 198.23.57.8
Domain Names
  • ftp.freehostia.com
Files and or directories created
  • ZREA.vbs
  • nimiki09.vbs
  • enikiol03.bat
  • enikiol02.bat
  • BReader.exe
  • %AppData%\Local\4Adobe\4low
  • %AppData%\Adobe\Adobe INC\AadobeRead\BReader.exe
  • %AppData%\Adobe\Adobe INC\AadobeRead\Adobeta.exe
  • %AppData%\Adobe\Adobe INC
File Hashes
  • 09ebe700700a0e5e49d994093786f6c1bc9d3c400edc94b31693ef5961250d81
  • 12e2ba4b4a310edf9cd97405541565e20d9ea6259d86d96a36fc8b676babb228
  • 14c4a3fd18cad81c55ff4aa192803b748d8810900602c89c26114eb80c9db988
  • 198f46e81e496d6bbe573c21eff095f102d0afa877a51d3de30a2b21f90ed179
  • 21d006b8f12a6b2e3126f3a6cef4f621c314a9dc21be6ffe51950f816f6a88c9
  • 273436ba78c9973251e48bc2eb7771ded5ce3f9183d798d4663672f54ffeb2e2
  • 2b05da4dbfe7ffb80c08383d75e79cc93cf22b6b4a4ad1964f360d1a77a2e9ae
  • 2d8fb96ba74ce2f9f9e8030c4c62606d1fea677cd845f96ee8191250d76f1943
  • 354cf3031b2679f885969746afef780bb1765b0f32613afb6490d5e60b7fe6bc
  • 3ed4b85af6b20e6c2a2b1dba1f76f9e2fae9e8664a0b21cfc77b75fc7b585168
  • 3ef31d4a0bccee0994a4ee525b679da1fd2664f3d96d20371297f6f6645a2ced
  • 3f735ba16d51af841f5a48c9be5a2cb004df275c71cbbdd3497bfe34460f9c93
  • 403d91b31d44acb4a67b5b0dd7679971bedc722244f1b705adfa095632d18cf3
  • 47cd0d0181ae2d2fee85ca67b26fb4366fd44e0391f4c81e7aee2de82de2e87c
  • 4c76b5e7ad6242df21d5dc2094d4dbf6d7ab551d2055844ddb0188d410a02dbd
  • 54ad6cdb5dbdbc93f70e0e69d3e98503e96ae407de19c0d1fb3f4e0d3147e0e5
  • 5c36e8d71fa4060e98d3c6274d7332af963e0f41e3d2eef9eb0b5d96554cb94b
  • 5e43fa2988b68c9c066fe804167a9a0a0e82537359771060f894ee295c1164b4
  • 61540809d55eaa23ba0ac82ff4b530823c93fbc8e7097ccaeb8329e0eb1e48c1
  • 6d7019e4f1e02713046fedb121d15c9a423b8502e792ff42c7896c3b4d9f826d
  • 6f13c5e83ae42cbb755a44c3c45075043983d0eba2846b63442471577bdf6a98
  • 6f9c0cb13cb611de6697837c7dcdcc2899d8497e55258a2a26a41b26e5e7a8de
  • 7115ea1ab97a7187b2a1bb6936fe3df44bc754ec06f70c9f880d9787e605ea60
  • 76a98ee8f9ff749ea39acd024859ea991b2b43e79e37cb131a1a53be614bd753
  • 79789706985bcb5afeffed63805994cbe09966da0544e18a0a059a57064d7039

Coverage


Screenshots of Detection

AMP


ThreatGrid




Umbrella




Win.Malware.Daqc-6598201-0


Indicators of Compromise


Registry Keys
  • <HKCU>\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2
Mutexes
  • N/A
IP Addresses
  • N/A
Domain Names
  • necter7.ru
Files and or directories created
  • %AppData%\mvsh\sghbn.exe
  • %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\mvsh.vbs
  • %AppData%\D282E1\1E80C5.lck
File Hashes
  • 00c8e16c0153a40945b77692bbc28d765e6fc1a5d7100ff67dc7d4a3cf7c250c
  • 011e0b204c466885b489a18062a763a3eab681d1f6d3ddc7584ad89429935664
  • 0681fbcb805b64a7a85ad6883e8c66af4d1cbd0cbc983e8c7c57868885c8eddb
  • 0a0c092a8a390432b9b31b8d7cc9b4780fad2b8878d0bcfdda09f7f9322b1004
  • 1bc4781824a84300edc2f1fa97e42cddce96b273c09fda794f9e30a44ae4c6d5
  • 273c7bc44acc510531dafb34a25aa0463ce28c262c360596f2387f0b3067c0fe
  • 2a63210f0832f22ff67bc5333c3e2f8e327c6353920d6d687c1dec8558e50a83
  • 2a9be0b39fc7f3cd3214ba6854699e6857ba853b175b98d0fe10e151dbce9f4e
  • 2ce787599acee9837624bfa274d04e659ac1fba27a200e451d8369025a3c3b02
  • 331dd1d9b1f53c72bb628913a0d173eb701cdf68de713c1b94bcfef1be8be8f1
  • 36dcfa6c8cb09c85d25b9cfc4ff655a6b7d4ad77b4f75107734e956b2c0c4c52
  • 4278d609c70419e054b5d514e847f05d9e854a6f67c8ca4a17ce02f14d18980e
  • 43957c1ffbb1ae837e2fe6d97603fa0c686f131beebe5c8c17e9c384bd2e5d9d
  • 46a603905dda179887be97eb0894c408613857261d275056d46aa174d1063888
  • 49560519bd1ad245ebcf596fa867db44f5460a4b6e952393c222169fae3458c1
  • 5309ac8962997edc05e88bc99f259d4a0788f08ed0ab92bfeb2075410a0f53ce
  • 60140f334d05733c9e80ec951bbf57d2355e7421197806f3e5373d87feebaca8
  • 69079ab9bf5475c7f561a849a191228e7583c7000f56623f4c2824399ab5fadf
  • 748374631d589f14126473dee5faabbb03de6f436be9ba1f4e9db4a43ad5f335
  • 7ce2a8377d841c6c35b4af7b97df7e1edf41d519026090439b0fce83ed94237e
  • 7f2167ad8d2c8523477e5c89bff7e43c4aaa63bb67738c99f3dcf699f5d23878
  • 87e4364c1075f01bbb5d2e71532eafa03319925cc76a81175f1939e865d73a22
  • 8ded9c78e10011fcc6fd9c7501b54510d64be29ea7a9512018d22a43f9e3b5be
  • 8f6841a0f19f1626723f297a3ada097342ff10b6f4242e48e3b14c8528381de9
  • 9cd31bad005306e5586bd20d5c027d15bd2bdc0f904f3f839309a25c30ffe417

Coverage


Screenshots of Detection

AMP


ThreatGrid




Umbrella




Win.Malware.Tspy-6598050-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • 3749282D282E1E80C56CAE5A
IP Addresses
  • 31.220.56.187
Domain Names
  • N/A
Files and or directories created
  • \PC*\MAILSLOT\NET\NETLOGON
  • %AppData%\D282E1\1E80C5.lck
  • %AppData%\D282E1
File Hashes
  • 014e34668fdca31f2a599d3fc772fa60893b2790227fe283b6ed73fe207ab091
  • 09df166cabf8e547ba597ece2efac55626fc5148dceacfa85da87bcb4753376e
  • 2b6b2a20912a1d906b374ab10fb6c4ae4d0b3509b5f22543357372ec58e0ebed
  • 3be01ef8167c8be00af7e4c5d6fff6a7429cf31094074fbe9cf2565b4cb67d5b
  • 3f3ff0bfd3eb8ea896a5eaf39c95799124d5e48c892428a1c33395b53fb99d34
  • 4ba249143540292a58750d78c60baaf1903b0bdb4b39447a7cc75e933ba4d360
  • 4ebbaeb26cc27b394e81fd2c361fc21d8ec2bcebd120d2e23b3ab8de09c6de89
  • 4fc79ecb69c7fca766f4da8fbe6c20d35cf45c56fa79dd2599a086683f495c12
  • 51ee89debd42065508888bd475221990c00213e711b9f835768b6c10ff69526b
  • 5548a1dd962ff1c290b39ca973922fe0f4b6906a9ee89504ee935ba71cf41138
  • 572b052bb1eda202ebb968e4c652ccd6b5dc3bb749c3cea41620f095a1ac5192
  • 5a14367912fffeae4298445fb401777c000e8b3fb30bfd148156107b10225b01
  • 617aeefe2f7f063a48b968dc4f08d1ba11165f08a220e802b23ef7dfa80c5e40
  • 66d4fc50ab34bafc66090beccca49fb1cdc59051201f9908836e8ef0b212957a
  • 68b943af3db8015deaf948718711ce477934ded7b26818bc284541744005b89e
  • 6ebd3a5c153e185cbf3aac1e4e8724cece65990726bd75cb3182e40510a27db3
  • 807f1c87820ce553653f29c4cd4aa6bdb12007bdddfb78cc7646a61b7be52a52
  • 80e118cfbd1c4af5658bea2f9d0ab233f015e0add74ca766fde4b9f208db462c
  • 86579c2189c128a9c858acfeb60139323fe01398cee2de6d2fa7e4ef92e937a5
  • 8aca4e49934582ff2db33c822b0d4d32d2623638485df2d8069dcf5572c0d931
  • 90f20d1e2b755846fae5465a086b93937a641cfb4a3337794d5c6dab6f927ea5
  • a2c8af1f4b90fbd2db57433f99f8680df4b529e5580c7d951a48effe8b0783a5
  • aba1625cf886e5ec14860510648e77b4df66b81f6b01ca5627ee376f1c6e203b

Coverage


Screenshots of Detection

AMP


ThreatGrid




Win.Malware.Fareit-6597973-0


Indicators of Compromise


Registry Keys
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
    • Value Name: J2UXTX7H4BT
Mutexes
  • AE7ED74491CA89C0FD1212B015FD0F24
  • 922ORSE7XC24WH0Z
  • 8-3503835SZBFHHZ
IP Addresses
  • 98.124.199.96
  • 50.97.212.250
  • 38.18.228.192
  • 23.247.23.36
Domain Names
  • www.understandinggod.faith
  • www.ethmined.com
  • www.yyphg8.com
  • www.dariomatamoros.com
  • www.ecomepiphany.com
  • www.enarhcxx.com
  • www.ferertya.com
  • www.rgpclaw.com
  • www.starcarpetcleaningpros.com
  • www.available2.info
Files and or directories created
  • %LocalAppData%\Temp\rhvh0.exe
  • %AppData%\922ORSE7\922logrv.ini
  • %AppData%\922ORSE7\922logri.ini
  • %AppData%\922ORSE7\922logim.jpeg
  • %AppData%\922ORSE7
File Hashes
  • 06700dc880f285572c711fc4adfce57045158ed481d2effca8f4bd07a46ebc6e
  • 24e59d09af4f3ff5fb90ad6468c6e5a03dff284cf28b09f63602e59c17c96c70
  • 2ddc6c4ecf32333927cc32169eb0c291ff3265ff979b6436ce8650072214b58b
  • 328261b4d00e03b8ff7572b1e24b5caf5216579007105761a71207eb31a052d9
  • 466d77d24f1efc960036ec58173872a99a91eb5862bf11079de7dacdfe149926
  • 4706ebc86e7d1e2a179ceeed68948948b1dc864d41b0362e5c69796a674e8429
  • 49cba36aadf7d8d9fae0b76aa465a0d0dc8d24ce4b5325acd6850140d632872a
  • 56d6c66c01fc39a1522a0faa2dbc8d63df17b058fe5bc61a042a727fb156a16d
  • 5c3b4262b04a7b092481019181967ecd4dfe7428845c5f2320fea0960e321f64
  • 5e0c32b0a8425ea362554fa58dfea23c6410aec3c02200ba9fa5ebf04a2f6853
  • 6324c7d1a57f57b9407c78cfdcfd0c60115389b56953ccbd0cc450d616cd6be3
  • 6630e3c3efa79e74d3974abca99c7b6b2260e271b17e87875d3939425c649705
  • 7ff5dc962d9d73109f54ab6dfc7b3242f560f8758fb683070a5ce8a3d3d5bfd5
  • 9d070ad80ebdd96767fef1b1478037125726f70602924bb400128db3765ab8b8
  • a14660359321c5cc109e2ea0cd8effa8efb913d035c7d2aa85a9d7fb72914e0d
  • ab6550747aa04bd64e002fb84f2fb1a9c3d267328f9b4475c31b5e8e41a2197b
  • b6aae639a221efc5c4fb234e554e6123e27e19e90180f22826902d1a61a55eda
  • c37614c78fca54274fdc1d6958ddae14a833791eac9ca1fe2eb6d86f27589936
  • c47de79387cae47c50619e921a182de369f4552a44f447f30777d6dc4dde12de
  • c50019481f97c3b97b4155f06484e90ed2980583efd9146a981f598301802134
  • cb10d039bd219f5fce8ee71a0e447ee1f7a59413613db2efb898314159912a7e
  • d259365b6e3d0f313b5dd634600869f68b3460a4e8acac6f0306ff152cd44340
  • d56c7bb7b58cc99668118ef277a62b85161360546500c12e5ea2f721b456d65f
  • d6e9ec4bea5aff79aead3c25e17f3708aabb9aaf797f9752d10d4e84a7f87151
  • dba3edee7d56ed9cce110b3a172e607639dcb18901a78c8d5721c4f21acd43cd

Coverage


Screenshots of Detection

AMP


ThreatGrid




Umbrella




Win.Malware.Razy-6596077-0


Indicators of Compromise


Registry Keys
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Mutexes
  • WmiApRpl_Perf_Library_Lock_PID_968
  • Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_968
  • ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_968
  • PerfNet_Perf_Library_Lock_PID_968
  • Outlook_Perf_Library_Lock_PID_968
IP Addresses
  • 107.180.26.90
Domain Names
  • asli-id.com
Files and or directories created
  • %LocalAppData%\Temp\Ph4.exe
  • %AppData%\K-Mart Corp\K-Mart Corp.exe
  • %AppData%\K-Mart Corp
File Hashes
  • 058f2a286b9dbce25b14efa7a4321505d443a97c11d773024b2e222c54894dfc
  • 0931d88de9c4a7af4484d1a2285f001512c83a721d6e7d9177d6fa3c9c2ff494
  • 0c1609585500a71c55999ca82ff617cf209e09ef640d35d8b334bc0949e1f5c1
  • 0d4b4e859ba805e854df7f44c31745e554275b9c36997c0516b5acad4a29c739
  • 232b077e1df7e90f39f92200c9424918eff1c34d2adf98befb28a2cc664e133c
  • 2f670ff3dd609f23f4c7213a20e5f87e01d1895c08045b7ff70b746b11d7797e
  • 32d5a8609132a6619c27d5da066d6cd0c01ede44e23ae88b3e1a94c31264a2b0
  • 385ebc30d9bf602ce39b8b2d7d09787fd859fca5391f7e282f9a57fb1a7792fc
  • 3b65e590fbd2be761a6cbe540c680d63358dddfc838acd3164a1580dfa3782c6
  • 3f0ce29604df46a478183cba3fe075ac92fbc70221b7163833c9bab62b216aae
  • 40b9d27d3e3e78e52c5df9a060126d0111e6337e86e50962cce38c814ce0c365
  • 419c206b2701529e1475fafde37adad222eceef28a5b6b0ba1e34232ec3e95bd
  • 447ab1be7b297d6b592cbad8f6c35cb269e25c817d6900726fd131234427b898
  • 5cd16c9b64a18d8b8852c0e113b3347e630518e2c034ee8ecdf11c048a5e82fd
  • 5d97798b9fbc7692c9dbcfb0643da0de491b36e2e0cf51060254a2dd6238ea62
  • 608b6dad966c287cdb214acc6883a7bbbb2a0bb12f0dae2a4eaea451186aa899
  • 61ac9dae3f72b71a6128af5207f00d2e48243423596fde881811e5525a53d509
  • 63d3cf1bbf4e3352033506d7feccd4366361b0ccccf6efc7d1bde38593f396dc
  • 6cba1c23e95028056557db02a25d81a6882ca381f44153b338a8fb028f5a81d1
  • 72f3289960744faf657f7f84e98d8f1da3576451aa23f3813e00fcf956920cb1
  • 73f6dee570c360d0b2c6b4f1669aadbe1fda320838f80c8ffa030ba3b6f61738
  • 751269d78fdf8e244295d87a76a839b15672f5d0e6e7bc62cdd31f1deb5c0fa5
  • 75bdd5417105c495fd111bcaafcbed1f37a1e77c64d788f5884df5018c82a4e6
  • 760a2cb6fae52b26406a38e6a93952d2162c27c6712842c8d125685b2b540264
  • 79cd4f4accadc3edcfa90b11b19e56fa4a6a6a5150c3e2f9a467154523ff1870

Coverage


Screenshots of Detection

AMP


ThreatGrid




Umbrella




Win.Malware.Zusy-6596071-0


Indicators of Compromise


Registry Keys
  • <HKLM>\Software\Wow6432Node\Policies\Microsoft\SystemCertificates\CA
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
    • Value Name: internat.exe
Mutexes
  • Sandboxie_SingleInstanceMutex_Control
  • Frz_State
IP Addresses
  • 47.74.230.86
  • 176.9.193.212
Domain Names
  • ffmovne.top
Files and or directories created
  • %LocalAppData%\Temp\Non-resident RunPE Loader(1).exe
  • %LocalAppData%\Temp\flashplayer30_xa_install(2).exe
  • %LocalAppData%\Temp\upd63bc908e.bat
  • %LocalAppData%\Adobe\83474DC8-60A7-4AE9-9182-F2D369E40051
  • %AppData%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\bookmarks-2017-10-03.wyz
File Hashes
  • 00c8d056d3fef3bba3eb185bd837c1fd051376a7e22356a4a82f38f8974cc387
  • 0662906a29d782593e50f6e39dadcf45219ab7265c920406460b77c3501c5413
  • 0744a0cf29c89debc833f46ff72954a860a3e01e1c7b22655e82c5b54bde1158
  • 0864a2254013f1a9d642fe0bf2ecc7ab04933660e2dcf2198e348115b743b422
  • 09df2594832182d1a80285cae34d488db1bed8206e962d20a5f59e78439a70f1
  • 0d16cfb1916b5c969b8ffada7ccbcbbdabe8d479ad713f57f939c47b42150bd5
  • 0eb0e116cd371b7b2b8464056f386a67894525ac7f195d76e45dad6d03ba5c60
  • 18fccd80b2d4b1052db0ce9873204c9a607faae9b69a89013f12423ce01b2aec
  • 1956f981e134f4f3967f6e6c4c5ba5890cf06589e3556466a19c63105fd8b0e1
  • 19e65a425ba57b23ba1238d268335396b245d1393527411a61b46ddfb1a50531
  • 1a42b7494191af666910b9b1c60af40eacd06e7444dd8e01bc4d932134622269
  • 1bdb9eb3a95b52e1833ee7d48c69b3d07134d91c71214637d7a3947582ee5ea0
  • 1f918795596a888660a6ea88157fb86c38c533e4d57a6105801c80abd5ea0008
  • 207b7eab5d6d8bb1e91e188a4c7e6a9d60b5312c5505a0183918b81e83aa63fb
  • 21a48b04e16128278123f694574009104f2d5a8364c38de4cdd52259bf1ee1dc
  • 23cea222de3f0a61da1046f08c77063edb20d9d89add0ab77849909f853d9cf9
  • 23f20614cf3dae1ecfd6291f90cca1645ab4784d449e642dd170cd3e552b24ee
  • 2c224bb1f73819ab08c1a79f553cb348ab9d460fe16ce5950c81d77cba801ada
  • 2cbc5d0f6342db2c3a1af4fc943c69c986b73bd4ed36b69cbbbe89d40c00179c
  • 323e82e0a8fe16b671aab982297a8e22358fdf6aff8d1a6d19f6f401ea24a024
  • 32f0012d9609b9e4bd78838e7f53d4d929174e64ba898ea1b5cd747771ec3862
  • 35a6fe0d09b87c7098e5acd2e23ad034ae7205816a27fd292d940e2b5fb31c57

Coverage


Screenshots of Detection

AMP


ThreatGrid




Umbrella



No comments:

Post a Comment