Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Aug. 3 - 10. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

  • Win.Malware.Dbzx-6628757-0
    Malware
    This is a variant of the Tspy family. It is able to execute after every reboot, making it persistent. It contacts domains that are related to RATs and are generally command and control (C2) servers to upload data, and receives additional commands. The samples are often packed and contain anti-debug tricks to complicate the manual analysis.
  • Win.Malware.Emotet-6628754-0
    Malware
    This cluster provides generic detection for the Emotet trojan that's downloaded onto a targets machine. Emotet is a banking trojan that has remained relevant due to its continual evolution to bypass antivirus products.
  • Win.Malware.Zerber-6629234-0
    Malware
    This is a malware identification for a ransomware variant of Cerber.
  • Win.Malware.Startsurf-6628791-0
    Malware
    Strtsurf is a trojan targeted at collecting personal information, and sometimes labeled as a potentially unwanted application (PUA) in other coverage signatures.
  • Win.Packed.Eorezo-6629326-0
    Packed
    This malware is known to enable the display of advertisements in Internet Explorer. It's also downloads several pieces of software and installs them in the background.

Threats

Win.Malware.Dbzx-6628757-0

Indicators of Compromise
Registry Keys

  • <HKLM>\Software\Wow6432Node\Microsoft\Tracing  Mutexes
  • QSR_MUTEX_HnRHWDxWQnveBdUtWT  IP Addresses
  • N/A Domain Names
  • ip-api[.]com Files and or directories created
  • N/A File Hashes
  • 25430a357d53aec77dd1f119b838ceae79a22bb3a60c7a002cb7328b098546a7
  • 54279416f864d374f33fe9a2fe2998db3976c4ff43e8b0da006548489a50bbdd
  • 5ce812ebf77f6d63de37a1e3d261b9688d595aaeadaef3388f4214896bb64892
  • 810fb35557e051a7be3f03b37247c90796595a2d5afa1b2c3034187de2a3f0bc
  • 8f08bcadd3a44055a70dbae3308cf18c8d1824e424100eda03ddc71e9417fb5e
  • 9435b87c7c91ac98f9f461aeaa6b1630e2270e2d2ccdf6a05d46fa02de91d1eb
  • 9634a2afb40139e39da8c8ef0da8f5104229d7bb4c3b95faee5a4396713f528e
  • a137c89d2c6f0ae74217724e1cb56aea726e285d0e6e98adfda16617ad51d176
  • a2907c7011b20373fd47e03a0f4679fdd51b982b973bb37d1d45bfa4a618bc5a
  • b3c6a0883d9ed8bcf1bf162c0ade8b16f2cd4ae890e30ba9e9540f4bdf5f5ba1
  • ba5afe1245d10f72637d34a96bf6e365c2f4326da69dcd440beacf421b634133
  • cd3a4783c2795a16c82518c56f955c9b56f415d59ef5bc77e143f6124123364b
  • d0dbd75a4d8716ba7ca7d025ee1c772aa4ff554214a993b4b874a0a26dcf5a6c
  • e2116a9a176ff765f1c5ec23003266bfe0f1592e46e41236482ad4c3520ea53a
  • e2846881f6127d99222144e4ece509bd18522fdd7791bf84d7697b37ffa40919
  • efc3e1b1d6c13c3624160edc36f678dd92f172339bfde598ad1a95b02b474981
  • f7df8c9e36cf3440709111a33721e7ac7268a2a80057df08843ba95a72c222eb
  • fdd4cce37fd524f99e096d0e45f95ac4dac696c8d7e8eb493bb485c63409c7b3

Coverage


Screenshots of Detection AMP


ThreatGrid


Umbrella


Win.Malware.Emotet-6628754-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • PEMB2C
  • PEM944
  • PEM80C
  • PEMA10 IP Addresses
  • 67[.]68[.]235[.]25
  • 187[.]192[.]180[.]144 Domain Names
  • N/A Files and or directories created
  • %WinDir%\SysWOW64\TO5sH5uBMit.exe File Hashes
  • 0406ad0fe90d371b02742e6821486abbfbf2bbd72a7593e8ddb650f0b97673b3
  • 0604aa87706cb7890075b494f026c88b2f03b621367f1bb62a87f5c5deb87870
  • 086af92d83279f5792c15a762a70e158de54b67c1a96bfc14c4ad52a24468f32
  • 10f13af2a3591efa3d58c47bb0635e3a653e14ec7726493bb4595b4dd8cd51cb
  • 127c316e7a10579e61369d6a8154e3e34726209b3cc075ddd6d9875c439c583e
  • 1fc9fda1b0c868dc7cb0cf6d8867b7aefc202436fe9e41cba5b2b35bb1ce9e9f
  • 23ba67cf24c95f3bfd36b66f822feb3d2fd0f72617921550fee034a1b7b8cc74
  • 27e37ac7cc8b48573a8345223399ce6b0ab9432ee977acf02c09bcf64cf6622d
  • 2bf1192e5200b6f8d25586908b05912a5fa6e06e87540dbb914200446a3deb10
  • 2ee83958eb1e8cb622ca833c38e51b53548d299b6574e5b7203741a2d27963f5
  • 2fca527cf8ebf4576e982118e22dfe3fd8e445749a5403dafed36089666f2357
  • 30bbfb79d26a172975e9482204f06423eff6948b1732384e7b6d23f9932ec08d
  • 30bf6e1a41dea6e4024853f9b7a6a878e4f5e4141dba4b0fe7686159925fe6cf
  • 42fca9d196c668747b74f80ca996aee9ae38bed96956b42436949a8d4d33ecf1
  • 45e6356ca3b373da3a80a72a1b64f1254f4426949598b8877abd6de99e379166
  • 4ac5db87bc83dcbf1399f4fc0fede3c5ecee5b8ef2a2500fd79b1588ef033429
  • 4b2f6d80bf78ad165c2f07d914cb4137ba31918f3f8f03f812b20715c3451f56
  • 4d7d9d73dad989590860178530dd8848d9b79a23f1cb379bc1ca5545cb196eca
  • 4e81241256ab4adb5bb96b21633d95773cc34ee72e499659064db0d32046dabf
  • 4ea92195bc159e268c7a348f2649010cb01a3e67c315d2f0b8115eaf2c879692
  • 5639d3af9cf530a057aebf3cbf92061b58539b2c311491a26d8f404a211d66bb
  • 59644dcd34cce275ff5d72c022fa76ac42a422b038d816909281e01e392d3b40
  • 599e4e8130e4a1f3f3777c6f9f088cc03c2781f4e802e0e16e417a43ec58c518
  • 5eef8b5433ebc22e4c9ea3c1462d525192a4bda8d20be4e7b09fe7d03fb9d119
  • 6238c7a704baa8771812e4f3452acb042c6475913db4cd57cfaf17a7454d4d22

Coverage


Screenshots of Detection AMP


ThreatGrid


Win.Malware.Zerber-6629234-0

Indicators of Compromise
Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: FlashPlayerApp
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
  • Value Name: Run
  • <HKCU>\SOFTWARE\MICROSOFT\COMMAND PROCESSOR
  • Value Name: AutoRun
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value Name: DefaultConnectionSettings Mutexes
  • shell.{381828AA-8B28-3374-1B67-35680555C5EF} IP Addresses
  • N/A Domain Names
  • N/A Files and or directories created
  • %AppData%\Microsoft\Windows\Start Menu\Programs\StartUp\FlashPlayerApp.lnk
  • %AppData%\{6F885251-E36F-0FE6-9629-63208157D7A2}\FlashPlayerApp.exe File Hashes
  • 25f8455b83b98f38809af120e35c3eda189a05538f7aa2d527a265520bc3c75e
  • 342a9470e5d3dd522c17cf0a5bc588d87a84689d90362c0b18c320385b2e908d
  • 41ebdf1d4a210f395d5ee32bf55c6b07ee1e0a0bdf939bd081f6d751323c643c
  • 54be105a129d959359107d7dff6b379cd366e32bf7be9ac9a06bc2141d3ca7fa
  • 5dce0e7e0a1807d2804f28c5d5afd4ac282a022acd1945786bd118e1caf4050c
  • 5fe244200c9367e1b132ccc13df6daaba5479d2491db8fe95658f43981567c5a
  • 6292ddf51023ccca84211ed4f33944b4c3df1b694d102d90d3dd2a5a080ed2b9
  • 649c52d7b9a58837e6ccd308665d63971e424d29480c44448ddbef15e91649a6
  • 6dd74f0816f8b24a6f93c2dae0c69d33689e4baba632605d138216d9c7aab2ba
  • 7322fb7767b733ef5a279720f581d54edae9ea4af69d39aaa3e79fc443e2bb33
  • 76be26ac77aa81a5fb7d78135adb05b579cecc2173ffef5f5ab6b484e37f9e6e
  • 793b978af24469a77490ea609de0142ff817e557ad78a688dd5d65c2fe49a8db
  • 7c0e65092e8786d9052bbd74f4dc7b26567e150efb25d1503c4bfd9b3895b8ab
  • 8815e1daad1f9cb4ff4243ff485218e3a0be93e2afef07048852ba79fdd9294e
  • 8e84fbc38403f1516447b73b73b5051777314089f0d1fefcfae004b1ef615641
  • a0e3bd64d556ce80b85b7d328bb61beeaf2da297dc09058211150617d6a83b8b
  • b6b3b53b1001b6de24797a89d61bd825760574ab4cb60f7a5971115acb53c8e4
  • ef66d0161200d413bb8a577a517fe03f325f2fd2f0df778f6297a8658ca0abc8
  • f25d03efc63cba1a262034382f809aaa5918f218b965164897df0c989a08dd04
  • f8ee14337fe367aded0aee32c6c84ce404eaef53a6f75d86c6c08235f55ec303

Coverage


Screenshots of Detection AMP


ThreatGrid


Umbrella


Win.Malware.Startsurf-6628791-0

Indicators of Compromise
Registry Keys

  • N/A Mutexes
  • Local\MSCTF.Asm.MutexDefault1 IP Addresses
  • N/A Domain Names
  • lip[.]healthcakes[.]men Files and or directories created
  • N/A File Hashes
  • 00cc9438408d1b22b0afc57e3b233ff62774cbcb92e58b392403d8c794d988ed
  • 118e08c379b0035cef2a155d59d97c6e8cae94b6f46c5e77f58d84c88c689d2c
  • 1f270dc860158d63bb400e08f12bce40a9a50494368ea6e44cfd89f7e0dc23f4
  • 3e49b3e58eec40b735124509bafcf434904f5945c9d65a5a860b0950850a979d
  • 4348a4b50eba73d6eb5d0d254241d0e44fc63c975b589ac5276d6dc5cf8bab13
  • 4a1c1cf9c70b127cc514fa6cdbb0e286ee33bf19f6ff41ca02951c9947dac55e
  • 4ae8cf675d6517b7989391fc653e8ddc96aa81cec4802e7e66de30adf0e96d2e
  • 527eac30113eb365330ec5c35591fe9ae69d4e1beca8b0ae24666e97d8773e36
  • 53366f90f59348b8de81bdc04652200d2dcf8bad5cfc46a533c3b20cd0e200b2
  • 5f98685ee9098a31ced944840670772bb972db31ac5d1690974e59f566d1adae
  • 61e7c5b6a7f1608cf0bf728d15f8cdfc0f9f5c7c3748ee28452cfa2a496e54cc
  • 70ebc88b9a71c661b68325dd92d0945ea1927e4d115da217640a4efefcf0c730
  • 722e86b32635a1cace77ceee414761f28e386743fd2c513650e55814179bdac5
  • 91bb8eb10e0aa88ea1e33d1ec23893d5a45e01e8ab69081b96835b4aff3b906a
  • 97645bb27e056b282a0aa46dbbc79ed03bdc29c6f96e369d7537ee2bb1c8dd6e
  • 9b36f0e70d5f7b4795b1278e052356484d4f2374f49563195f224ade6ce08c71
  • ac86cafcc7062a389e25a4e26dd15df7ce2e64b7a6890bf5712189ab9ec81c8c
  • c3883ba74230604d38a638a1b8d0673cc3c91e01b482e6b83a6e6bbd4edd3b10
  • c56e3ca164803c5668cf0b8228c97626c486f5a7063d4b3109840137b67c8f98
  • c82eaf2f1f156b95b43b2a984867e486911f6ceb329daea6ac9a6c53fae42685
  • ca544eaedd654782fa6b7a130bdc58869c2124a59754ed1baf9a5c00fafae12a
  • d4ab2cc67c707cab8f7aab0fde94b50670f1b787b049f45564fe5368205ed642
  • eac8c3c76e954d8e2be7a5d1570643b4ce6a856e8143faf6263ad50cf53aceb2
  • f0a9c1c2fc19b4abd905e8a2f187f94e74dfe1e7de2d9a5328b13893b301488d
  • fb2aa3891cc9383631ddcca4076ae800d67d701a7ffb83d48240cc1d72372175

Coverage


Screenshots of Detection AMP


ThreatGrid


Umbrella

Win.Packed.Eorezo-6629326-0

Indicators of Compromise
Registry Keys

  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: 6518673 Mutexes
  • Amazonassistant2018
  • Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_2c8
  • Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_2c8
  • WmiApRpl_Perf_Library_Lock_PID_2c8 IP Addresses
  • N/A Domain Names
  • www[.]wizzmonetize[.]com
  • ionesystemcare[.]info
  • www[.]rothsideadome[.]pw
  • www[.]usatdkeyboardhelper[.]pw Files and or directories created
  • %ProgramFiles%\WJTLINYZUI\cast.config
  • %LocalAppData%\Temp\DaGXhZc6w\Nursehealth.exe
  • %System32%\Tasks\One System Care Monitor
  • %ProgramFiles% (x86)\OneSystemCare
  • %SystemDrive%\TEMP\config.conf
  • %LocalAppData%\Temp\U8R09Z5FM2\OneTwo.exe
  • %LocalAppData%\Temp\U8R09Z5FM2\up.exe
  • %WinDir%\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new
  • %ProgramFiles%\WJTLINYZUI\GCOMQP0KN.exe File Hashes
  • 002d9959f5e7417cc2cbc657243f2dab82fac3d2e94fa2d0c8e45eda10889b08
  • 03c948623cf78efe90258d894ab0e793bca7009bd73d0be0f652575f81bda621
  • 0f8d729821902252b7f7a1c0d51004d3770356969e7181548126f13f1e2ebf2a
  • 1e64134ff7358ea6e632fd2377532491235cf089f33095a72552e150088b42f1
  • 1eed9456e69a80cb4e8444ad0356d71e09a073715f92e51afa008e80d2a0352a
  • 26f928ef89fde0e3e3fa996073c7c0bba00c2cbfe280de338de15367f4c8f76b
  • 2b0c6557b39ad8cca97ea6975aa3f4a8341774461b1bacab05d04ab20a9463eb
  • 3a5ac5c5ee7985367349d84d60be2c5f94f876c56cf73acbae6fc680ebbdb3c6
  • 47bcf1f1bca23a36e291a0ac4cb8d1cd59c0c80d6a8e3b2cc3d646284cc531d5
  • 4ae3efb9a9cca68c098dcdba33d2aef39888cf229cd02be64cbf59a0b68dae30
  • 5112edf0351d70ad31152f67e8996c9c4ad062f0023cfd43b4baecb8aa7b16b4
  • 52544303a89f2c4e3eedd64c000504a2ef4c920c20361961fc81cae3f520244f
  • 55e181f0e0e88efccf6534949ad8dd93a179e2b94b71e76a9e7db4d938ea2bd2
  • 56982cc1f4b4e92aea28a30684bdfc752122eb78fc545ccc3f4169a1597233cc
  • 5c3982a206d40ec00b2029d4bdde1bb37192341583e803556872b97a609411ae
  • 61ee5c724a4c9408e9c8120eabac1babea8e91bf5719b02c78ce129f68239ff6
  • 63cc723ad7e85798e9126f5cc933c48d0e3cdfa7504579ef0b0b3cced9cb19c8
  • 65a0bb3fd94ec888696598703ed111471bd47962278a5f1006e7e0716bd5b58e
  • 71d6d1ed9a5bd71e8dbd03a91151a2965ac12198fa1825366bf19c4b14106cb7
  • 71e3009284ae35a3087ef041162a2ada636b388738033ea62faefc2bbfca9dfc
  • 7e17ee126754a9306b4ffcf536f384abe5c718672807de1e27e7c7f3846d9e74
  • 85b36ab50aeb452822886815076c7c90c30273854496dde7fd3473e62119f672
  • 877b9a03f0b8763c265ecbc4be76ffafc9eb26c4b618c2827ce1e200797ca876
  • 885718a7bd95c44d14dec7f0efa101147b671e60a7ecac2622ac86061dab17f2
  • 9583c8f1f3c9982a45ed56fbc30f8be06708cfaa8557aa7f5b6117847018cd4f  

Coverage


Screenshots of Detection ThreatGrid


Umbrella