Threat Roundup for August 17-24

Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Aug. 17 and 24. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive, and current is as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

Win.Dropper.Delf-6652911-0
Dropper
This family is a generic malware that is generally the first step of a more deep infection. Once the payload is executed on the machine, it downloads and runs new binaries. The malware is interested in credentials and focuses its attention on well-known applications such as Outlook, Thunderbird and Firefox, among others.
Win.Malware.Generic-6652641-0
Malware
These samples are generic trojans that establish persistence using the autorun key, contact a command and control (C2) server, and try to steal information from the infected host.
Win.Dropper.Generickdz-6652226-0
Dropper
This family is a generic malware that is generally the first step of a deeper infection. Once the payload is executed on the machine, it downloads and runs new binaries, such as Gandcrab.
Win.Dropper.Ponystealer-6652151-0
Dropper
This malware is a dropper for PonyStealer, a bot that attempts to steal passwords from web browsers, email clients, instant messaging applications, and other software.
Win.Dropper.Zbot-6651705-0
Dropper
Zeus (aka Zbot) is a trojan horse malware package used to carry out many malicious tasks. It is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing.
PUA.Win.Adware.Ibryte-6651661-0
Adware
Ibryte appears to be a dropper for adware. It reaches out after installation to download adware and prompts to install them, including anti-virus programs and media players.
Win.Dropper.Razy-6651608-0
Dropper
Razy is oftentimes a generic detection name for a Windows trojan. Although more recent cases have found it attributed to ransomware that uses the .razy file extension when writing encrypted files to disk, these samples are the former case. They collect sensitive information from the infected host, format and encrypt the data, and send it to a C2 server.
Win.Dropper.Cloud-6651616-0
Dropper
The initial binary contains an AutoIt script. The script is obfuscated. It creates several in-memory DLL structures with AutoIt's DllStructCreate and DllStructSetData. The script then executes the shellcode injected into these DLL structures.
PUA.Win.Adware.Dotdo-6651541-0
Adware
This adware that sets up a proxy to deliver advertisements to the machine's browser. In some variants, the adware also prevents security software from being downloaded to hinder removal of the adware.
Win.Dropper.Fareit-6651429-0
Dropper
Fareit is malware designed to steal sensitive information, such as stored login information. You can read more about it on our blog.

Threats

Win.Dropper.Delf-6652911-0

Indicators of Compromise
Registry Keys

N/A Mutexes
3749282D282E1E80C56CAE5A IP Addresses
216[.]146[.]43[.]71
103[.]63[.]2[.]227 Domain Names
checkip[.]dyndns[.]org
ajmanz[.]gq Files and or directories created
%LocalAppData%\Temp\P8g.exe
%LocalAppData%\Temp\-1260536341.bat File Hashes
11392aee8e563b31a4dd14051611148e6ec0d03b2ebcceb37631f27e4bbfcd88
12baa8549b752fb6446d498a6d9e1f1ca1b5cbefc97ae9902010a79d15165c6e
23fd50159c2daee2a9495400a08c67e92378b287b6635e30efb18b4f16acbf74
2b5f4ab8058a74d55a02d8cc6a0a8367263a1068472a2ad63092c2f1a8c825a0
2f30c3be0665864ce736acfc093553cc5b0af50146688b0b783982a336ca95c0
306a4a7a9a936a2e7aea01f9ae79e595aef2080abcf350a3c7ece41811509e84
41192d3dd2635bcd40c92ff46913842b00ac28e5f3d743ea9c79328070ed52cb
44114d762126e81487716a964ca2fe0d0fd0e4dba3dea72d619b0f4b32a26ead
45c4d4333c17ad765dfa4094e7552e11434b09c4a4274431ceb04bdbb362eddc
55ce8c73a62ccee965d023e48243d1f982c77d9fa9c34fd17f2893dd873681b0
5f4db44965a523643ad99b7fa7d28221d124a2e2c8c4be8273208b5819db78a0
6209350a55e20a0e38a65c0075c66f5e650926f9cce4ee31edb4f69aadaf5f11
63b2702c9458be0c53ac24668116946a584b5a96fe9c3379d2477374dc2ae014
76180cb564deace04d7c027d17c3297221d72abdd59dec55025507d92458076b
8650fb73b188371b1ee7c009b03267c03c3870e673f10d273291ee670d006ccc
89dbccfdb0048341d5b3ddb2af5bd8af2fff80a50799545c043bfbeee0d2fef5
8f3aaf0ed0a63e6156ab338ebe95e607b779c4ef1d3f99b2a9bf4f1ac25cf857
a3be5e9da533c35fd20bdbc1a8c4f6821c6117f63f29c6f844a4af93e2bb5a16
a6d7fc06cbf14af546b91253b55951fea195716bd40196226510b4dfc4a3cf59
ab740b4fa20b8d8c27dfba02e04d6b4f772cd3b44aa2f1d4d1e3f76ea4631f29
c57e8eb0fa71df68e6f1f8b4274d1b87f33ad7fab2ea9c3c9b9cf1ef7b572dc6
d6ec082e1da8b63e3384bce47f2b058af2acd88526964db194ce794bc5830298
d99b29fdd8fc6cb24f408feeff49fdc50fdfe79aaad541947f291ce2505a16b8
e59d68db3399185b85bff7a0538fbf6d52a81783f9cfcd48a851be7a5d00e374
e91767a779860ae57b777a1e8b6c97022556c8b36c908bba99c5b68157abd46b

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Generic-6652641-0

Indicators of Compromise
Registry Keys

<HKCU>\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
<HKCU>\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2
<HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\
<HKLM>\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\ Mutexes
91RB0O61SEBW01Fz
O51OB0RQTC73272z IP Addresses
255[.]255[.]255[.]255
209[.]15[.]20[.]214
217[.]70[.]184[.]50
75[.]130[.]124[.]158
205[.]178[.]189[.]131
183[.]90[.]245[.]33
52[.]204[.]47[.]183
91[.]195[.]240[.]82
195[.]201[.]179[.]80
67[.]228[.]43[.]214 Domain Names
www[.]zexpar[.]com
www[.]themonkeygrindervintage[.]com
www[.]unsubchef[.]com
www[.]xn--vhq6e39ls7w[.]net
www[.]marryingmaldonado[.]com
www[.]shiqiyingli[.]com
www[.]mywdn[.]com
www[.]win[.]link
www[.]risu-nursery[.]com
www[.]sicknessfitness[.]com
www[.]saurabh[.]online
www[.]1113sophie[.]info
www[.]kacakbahisfirmasi[.]com
www[.]cryptocoindigital[.]com
www[.]41230319[.]net Files and or directories created
%AppData%\O51OB0RQ\O51log.ini
%AppData%\O51OB0RQ\O51logim.jpeg
%AppData%\O51OB0RQ\O51logrv.ini File Hashes
01ff22b56231012c85e52d2b78024bd4b9c7bc33fc73bb3e2a83a5840911002f
04f33361dc741051ae4b67475d747d8e4b60e0add47e0a2a03137a5423edf511
09578c66fa6950eb62bd7d0890546a3640878a7347ebd986911dddd9f305b867
0a4b87f413a8c8812977a80601790ecfa4429a4dc844db644a6716dce37f3240
10909a5c51633fe85233e741ed870b43c01c497a16f28baec778586bd4a5e577
149ef4c77df95084d134c13fa6a09b7695926fadf685cf3c8bf02946618125c1
15de8d526570f470f010c7dd88d1863bef27f4c62fce08fcd82d1f6651577089
163eda0df0d03eb61e15bf9e36339bb0bc76e587bcdb0aa8d6c747d039e93e29
17bcfff4f3284163944c5a027a1fef4969d2f5f53dc7437bc3b4204c35de09ab
1b0b85e1822dbd3db1b7e3459a5e0b00c195cb08f37b0ad814cc1f63aacf7252
1e4f76adc700b02c55bd1c5a084356babb407f242dece68cf9ba5ebf61f1d508
1fc76f62000f876b6994859ae31112b789851ff02750f621159ed18c303eec3e
203e94abc7b9c527b65c2217c7e2105b429c8a3552e126d1eca91fff0e41ec8d
22f482a7cee3ae84ef6e261f3cce4693534a58fd73d846b26870bf933ee80232
2a49c01fdd02032dd24b7b1c1fcb9b3aa335d269e69fa8f2a4a4424b1f3079d0
30580ba2618aa386ec975baf0b749d342c4ead3be18dd3d42dfbf7aab7321d0c
306bea0dfa73d5f76beec04ae3ba1fe4457c343f758c181ca90f91344853560e
34f40b1487afaa02bb6e0bc9c2ac5ceb0842acd09a3143a368f3c1959d9667fe
38fecd8713e3914e745e751e9c6c5d62d8caef09c46ce4742f5583ce463b0d55
3f00f59978a2af3e8f8076c4d33a626f8c4d26ef6a4bc7ae1c72544755fa5dd8
407252416a323a0dc9435d8b418137c211892db049b6e1797e2f2f506f6d7145
426a170dea0f17f430ec265efadeafad52afcf0355ebc5696259d155a48aef40
4a29cce7f2f330b801afbd3f1490f786e0786dc651100eface068576e52bc948
4e5249655b852066bb5f6213b638574625a7b60b2c6dfac3bb2e80ec9f72bc2d
4f27d56cd4f2aad7b16d568a14fad510ba816319f14006b247b09ba2c6b5d881

Coverage

Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Dropper.Generickdz-6652226-0

Indicators of Compromise
Registry Keys

<HKLM>\SYSTEM\CurrentControlSet\Services\VSS\Diag\Shadow Copy Optimization Writer
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: 2951328147.exe Mutexes
N/A IP Addresses
93[.]125[.]99[.]121
94[.]231[.]109[.]239
87[.]236[.]16[.]31
80[.]77[.]123[.]23
89[.]252[.]187[.]72
87[.]236[.]16[.]29
77[.]104[.]144[.]25
87[.]236[.]19[.]51
95[.]213[.]173[.]173
87[.]236[.]16[.]208 Domain Names
www[.]lagouttedelixir[.]com
www[.]cakav[.]hu
www[.]mimid[.]cz
www[.]fabbfoundation[.]gm
relectrica[.]com[.]mx
topstockexpert[.]su
unnatimotors[.]in
vjccons[.]com[.]vn
royal[.]by
www[.]toflyaviacao[.]com[.]br Files and or directories created
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$I9DT02V.lnk.id-98B68E3C.[backmydata@cock.li].bip
%UserProfile%\Desktop\KRAB-DECRYPT.txt File Hashes
03a05565633d1a7b916339b179d2998ba0f2391a5f804076eac1bdabd58073db
0d25e78ac27d0ae33177d32ba505eb27b662e5b47eb349e3bc90ff4922912100
17d8faad65cc55ba4145d3948f2d6d8af553a20863b8e31332390e0b264fe304
19a55c08e9253b1cfb5e75ba0cc963006c4e121e6f0ae165b25c243c66f74971
27ef40a53faad7f9d08ff2e8e2649f878a3965b4e5edaf052a6fd63c52fe3da6
282482f92deecb3e6bb43aa72c39151bccc672907b4bd7e9afb51ded04ac949b
28738ba1c8191f4d4119e651436f3ab9740ee22fea8a3b877a0c1f90a7744d93
2bf26fe0f26585989ff9c23160867c05fbb817f6565266ce9faeda9291b4b89b
344fa6fe96fba331c89ca98a6b739813370519355720670d5d468a49fd9191f9
354f463a00be356335dfb1fd6d95f9888a2df87f2299a2ec78366ed983700294
3f6fba76a23b0bd34b239cb66df5d491e2ea4a3c199dee39e5f3bd1b303f201e
557e03989b74264f90a6e6e8843b7f1e2da369b83e571b31cb051fc19ec005ca
565b34697c4d45072a94a442419110f80192ac7cd093a2d695e36505c6a38574
81b55b7be0d97d2da88fc1bbb78300ed2dbded9785c8d66db42197b15707136b
8b1bb0d2446648f30b9b4847816556fc5a4ca2c3636f612cdb76a5b75c23a00c
abcf13758ac9ae41a26efaa28431aab8fa704f34f13c629b47c87188ed75ea4b
b334e0410ccb3f5a27d39ba2f55a87f491a9c18ab9fd7b935d88a4702c7412e2
c73f8c3f7133426f096b19b3354d3a4512f193c74cf36fc57878c27b318a91b8
c96689d58b7f9978aea91266888a76d7887932b65a4a257fb8bc9095469a4415
cba59594fdd4ca6932d28404abc4b0b7b41f873a45f2d47ffe5292e81094a99f
d5c1c03969093df8ded59a8f030b52a6e0b50a16b72874edeb0b1afe1341a09f
f0dab3e88bce05940f6bab366953093efc1393e76d6390225da335f70f674743
f9b03b0475e4d75742e6404e2726fc418f1af36feeded66d0d6fa05cc1dc52ab