Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 17 and May 24. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.
As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net. For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.
The most prevalent threats highlighted in this roundup are:
Doc.Downloader.Emotet-6971400-0 Downloader Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a wide variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails.Win.Dropper.Kovter-6972554-0 Dropper Kovter is known for its fileless persistence mechanism. This family of malware creates several malicious registry entries which store its malicious code. Kovter is capable of reinfecting a system, even if the file system has been cleaned of the infection. Kovter has been used in the past to spread ransomware and click-fraud malware.Win.Dropper.Swisyn-6973984-0 Dropper This family is packed and has anti-analysis tricks to conceal its behavior. The binaries drop other executables that are executed and try to inject malicious code in the address space of other processes. Win.Malware.DarkComet-6973063-1 Malware DarkComet and related variants are a family of Remote Access Trojans designed to provide an attacker with control over an infected system. Capabilities of this malware include the ability to download files from a user's machine, mechanisms for persistence and hiding, and the ability to send back usernames and passwords from the infected system.Win.Malware.Ursu-6977282-0 Malware Ursu is a generic malware that has numerous functions. It contacts a C2 server and performs code injection in the address space of legitimate processes. It is able to achieve persistence and collect confidential data. It is spread via email.Win.Malware.Zegost-6977492-1 Malware Zegost, also known as Zusy, uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" and "winver.exe". When the user accesses a banking website, it displays a form to trick the user into submitting personal information.Win.Packed.Shipup-6973041-0 Packed This signature and IoCs cover the packed version of Shipup. These samples are packed and they gain persistence by creating a scheduled task to conduct their activities. Moreover, they inject malicious code in the address space of other processes and may hinder the analysis with anti-debugging and anti-vm checks. Win.Ransomware.Razy-6972250-0 Ransomware Razy is oftentimes a generic detection name for a Windows trojan. This malware typically collects sensitive information from the infected host, formats and encrypts the data, and sends it to a C2 server. In this case, the malware is functioning as ransomware, encrypting files with a .png, .txt, .html, or .mp3 file extension.Win.Malware.AutoIT-6974564-1 Malware This signature covers malware leveraging the well-known AutoIT automation tool, widely used by system administrators. AutoIT exposes a rich scripting language that allows to write fully functional malicious software. This family will install itself on the system and contact a C2 server to receive additional instructions or download follow-on payloads.Threats Doc.Downloader.Emotet-6971400-0 Indicators of Compromise Registry Keys Occurrences <HKLM>\SYSTEM\CONTROLSET001\SERVICES\sourcebulk
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK
Value Name: Type
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK
Value Name: Start
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK
Value Name: ErrorControl
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK
Value Name: ImagePath
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK
Value Name: DisplayName
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK
Value Name: WOW64
2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SOURCEBULK
Value Name: ObjectName
2
Mutexes Occurrences Global\I98B68E3C
2
Global\M98B68E3C
2
rrtlnsuwfk
2
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 191[.]92[.]69[.]115
2
90[.]57[.]69[.]215
2
37[.]9[.]175[.]14
2
107[.]6[.]16[.]60
1
209[.]237[.]134[.]156
1
123[.]125[.]50[.]138
1
12[.]6[.]148[.]4
1
172[.]217[.]6[.]211
1
91[.]93[.]119[.]93
1
203[.]199[.]83[.]4
1
18[.]209[.]113[.]128
1
104[.]244[.]42[.]195
1
204[.]52[.]196[.]123
1
67[.]195[.]197[.]75
1
96[.]118[.]242[.]233
1
195[.]186[.]227[.]53
1
17[.]56[.]136[.]171
1
107[.]152[.]26[.]215
1
137[.]118[.]27[.]84
1
199[.]180[.]198[.]140
1
216[.]117[.]4[.]25
1
75[.]177[.]169[.]225
1
78[.]188[.]7[.]213
1
207[.]44[.]45[.]27
1
115[.]71[.]233[.]127
1
See JSON for more IOCs
Domain Names contacted by malware. Does not indicate maliciousness Occurrences tomasoleksak[.]com
2
mail[.]amazon[.]com
1
smtp[.]amazon[.]de
1
SMTP[.]ANESA[.]MX
1
smtp[.]hotmail[.]es
1
MAIL[.]BYD[.]COM
1
mail[.]att[.]com
1
MAIL[.]TELMEX[.]COM
1
smtp[.]cronosc[.]mx
1
MAIL[.]AMAZON[.]FR
1
smtp[.]tgc[.]us[.]com
1
MAIL[.]SPROAJ[.]COM
1
MAIL[.]HOTMAIL[.]CA
1
MAIL[.]IKEA[.]GR
1
mail[.]neurologyauctoresonline[.]org
1
mail[.]dmforce01[.]de
1
mail[.]payment[.]visa4uk[.]fco[.]gov[.]uk
1
smtp[.]faithrv[.]com
1
mail[.]dullstroom[.]net
1
mail[.]infosync[.]ultipro[.]com
1
mail[.]worldofficeonline[.]com
1
SMTP[.]NKD[.]DE
1
smtp[.]login[.]aliexpress[.]com
1
SMTP[.]STCUSA[.]COM
1
mail[.]rijeca[.]com
1
See JSON for more IOCs
Files and or directories created Occurrences %HOMEPATH%\206.exe
2
File Hashes
06e4174bff2f35981dfd45e4376499761584cf0e87bc310e510c21a42e6cfa31
09e81da7bfaa218857aa72793b86b2f3d3d4fd102e4282702bd524c45428833c
11051f782981a2d9804cb8a373dd9e30a9b7d8f328167de13873498ed7f98674
144b230733e25b20edabe39bad87913afed9279d4bde2f9b557d8a06c0cf53d7
1d174cf281f20a5f318e24b5df536ff2d04d6ea854a81d8d45a519cf3ca60ac2
1e9e79487ef3adba5aad25a1784a828f73112435d43581734998339f184ccfe8
1f33d167cd705d1e19f8b7fb8ed5ed1c08b89bff6738b0e0264174396aa6fc15
321a3f3b901c2f33206a7306778da305454dd0a4c35cad55f2082996958ff6ff
3257cfc9caf85ca8dafb76c69f6c2744b33cd46b7d9b119fdddd78694848d358
3299e6f7204ea1a44782d496c99329b76218b70233892426c02f872221548784
37a8f9312cbc6314a69d480c19287b0c41de1f346a301d0d9e07d95da178b94d
3ba1cad4f797c189510cbffa728b2b1b85ad1400d5ecbee223e262f03acf0443
400a5d6d21230c8fe91fed9cb2fa2ddae199cfa892462281452b106bd219a782
47413a4ab923acaf1bb2ac8eccfd9a1a66d282fa0b3731ddf2d062bcc2b58f70
4821d11f5f6c1d360fb783467ccf365e9e9d412b9d63e262004e592bf8083d03
4d9b585b5bb977301647ee51bffa8dc42b2f2ef1568a1693cada306de09d134d
5b4be5216d7eb192ca92a660ecb8fb86adae5da2727485141e9e9f02d6a24544
6665273fb05925bc755b1ee27eb962d49991f2d7926821ac019bb89a3384f745
6b455aa9464a18e44571793fb467505e6a50d5881bff86e79043fed5e9216d6c
706373653bea1bfd1d577a640e2942a16d064636f6a9aec85b58da3b0cb7ce2b
724c3189c486f06b9090c094256d1ff91fd4e235ccc39a0bd96dfd1b9e2e91e7
75f8716c14b028fee42ba751d4aae0ececdead291572bc36b8f9afeb1e71fb0b
78e448a30db3d7d86c655281ccecf72f12107d1cbd3c4c989103cf3401d65e9c
7ad693a3fd9da1b97c0e7f85fb37bf15f511168d2aa397ffcd4d0f3aeacc84db
7e88b184d97bee19296f2430cb932847db7c77f51d27561bbe88230a2417fff1
See JSON for more IOCs Coverage
Screenshots of Detection AMP ThreatGrid
Malware
Win.Dropper.Kovter-6972554-0 Indicators of Compromise Registry Keys Occurrences <HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE
Value Name: DisableOSUpgrade
25
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\OSUPGRADE
Value Name: ReservationsAllowed
25
<HKLM>\SOFTWARE\WOW6432NODE\XVYG
Value Name: xedvpa
25
<HKCU>\SOFTWARE\XVYG
Value Name: xedvpa
25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: ssishoff
25
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WindowsUpdate
25
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\OSUpgrade
25
<HKCU>\SOFTWARE\xvyg
25
<HKLM>\SOFTWARE\WOW6432NODE\xvyg
25
<HKCR>\7b5078f
25
<HKCR>\7B5078F\shell
25
<HKCR>\7B5078F\SHELL\open
25
<HKCR>\7B5078F\SHELL\OPEN\command
25
<HKCR>\.16a05d4e
25
<HKCR>\.16A05D4E
25
<HKCR>\7B5078F\SHELL\OPEN\COMMAND
25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.101
Value Name: CheckSetting
25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.103
Value Name: CheckSetting
25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.100
Value Name: CheckSetting
25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.102
Value Name: CheckSetting
25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.104
Value Name: CheckSetting
25
<HKLM>\SOFTWARE\WOW6432NODE\XVYG
Value Name: svdjlvs
25
Mutexes Occurrences EA4EC370D1E573DA
25
A83BAA13F950654C
25
Global\7A7146875A8CDE1E
25
B3E8F6F86CDD9D8B
25
\BaseNamedObjects\408D8D94EC4F66FC
23
\BaseNamedObjects\Global\350160F4882D1C98
23
\BaseNamedObjects\053C7D611BC8DF3A
23
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 76[.]178[.]30[.]160
1
104[.]206[.]242[.]181
1
102[.]163[.]142[.]253
1
30[.]225[.]184[.]221
1
124[.]252[.]58[.]53
1
101[.]97[.]177[.]118
1
191[.]246[.]151[.]160
1
196[.]95[.]102[.]96
1
112[.]165[.]89[.]87
1
76[.]194[.]40[.]50
1
223[.]86[.]178[.]79
1
68[.]130[.]198[.]26
1
130[.]62[.]249[.]13
1
21[.]192[.]27[.]192
1
81[.]122[.]170[.]69
1
159[.]33[.]113[.]193
1
158[.]223[.]237[.]32
1
121[.]154[.]29[.]121
1
53[.]124[.]76[.]212
1
39[.]77[.]6[.]39
1
61[.]16[.]172[.]165
1
174[.]223[.]23[.]225
1
223[.]163[.]24[.]62
1
31[.]41[.]82[.]151
1
181[.]83[.]42[.]248
1
See JSON for more IOCs
Domain Names contacted by malware. Does not indicate maliciousness Occurrences www[.]cloudflare[.]com
1
www[.]weibo[.]com
1
time[.]earleco[.]com
1
www[.]bvihouseasia[.]com[.]hk
1
www[.]bvi[.]org[.]uk
1
www[.]bvifsc[.]vg
1
www[.]bvitourism[.]com
1
bvifinance[.]vg
1
service[.]weibo[.]com
1
www[.]fiabvi[.]vg
1
www[.]vishipping[.]gov[.]vg
1
www[.]bvi[.]gov[.]vg
1
Files and or directories created Occurrences %LOCALAPPDATA%\39b0373
25
%LOCALAPPDATA%\39b0373\6a5cc64.16a05d4e
25
%LOCALAPPDATA%\39b0373\7cbdf29.bat
25
%APPDATA%\9d0423c
25
%LOCALAPPDATA%\39b0373\a0ed4db.lnk
25
%APPDATA%\9d0423c\da4e6c9.16a05d4e
25
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\2ff4672.lnk
25
%HOMEPATH%\Local Settings\Application Data\25013c37\1ffa0202.41d68cee7
23
%HOMEPATH%\Local Settings\Application Data\25013c37\aae7a32b.bat
23
%APPDATA%\544d89dc\bf4dd39b.41d68cee7
23
%HOMEPATH%\Local Settings\Application Data\25013c37\5f60f76a.lnk
23
%HOMEPATH%\Start Menu\Programs\Startup\b24d2b96.lnk
23
\REGISTRY\MACHINE\SOFTWARE\Classes\exefile
2
%APPDATA%\95df7\dc6f5.28e5d9
1
%HOMEPATH%\Local Settings\Application Data\cf335\03b2a.lnk
1
%HOMEPATH%\Local Settings\Application Data\cf335\1a396.28e5d9
1
%HOMEPATH%\Local Settings\Application Data\cf335\7b80b.bat
1
%HOMEPATH%\Start Menu\Programs\Startup\1f9af.lnk
1
File Hashes
0351e09f784933d3d59fe025b748e1d3fc01f545cf5dde505b034377794962c4
13d0ed2b542e6c09376adc96e9c4ef0e862727d24cbf39c6185cd8d9712c44bf
13da1a72b70ab0c78d9f1844fe5ad097e1235af32bea2f06935e32cce8e04d41
220e48a66788b6dadb06f6d326233b21694593b02140c8489dc951709a871bc1
23ae65200c6e2b11f1dfa4dc42355c2c161faa264cebe7fa62222f337a9e53f1
252de3df03b74bab9f82fe47cd809b5c3d9b86882b32a225c4abb3f9ddce955e
33d0abf301d6b4857c61e0f4d60b6a21c8ebe155731f3a737383f5f0fc055ad4
34a1ef0084d90a55ce19aa7bc0d17358247e6e3e9416b46291cb84e1b8414cef
35c9b57f3f5bffb0b1280901df5a8b4ab7fc76f453af1f72f336dad500648807
38011d4c3afaf9bb10fce05788089845a0d86edcc5424295ac3e0345d9795a59
39645016e9e74423955e24f235592ee22d48216873c6ad0abd67a57f87874af0
406a5b73c768d019808c2a779729b47d181fec402073f58ab07afc9630904198
43b3719228bb8b06e6981a2829b7920629ce1d3a650ccdf7813befe22616c3c0
57efc6fe6c36fcdac92f6210b006eac42f9ea53133f6df81a73bba822062e44d
5919b89bd4a14677da09b349d7aeeff86ba8fe690d30ce12bd55e69300393ef1
5e19b3dbc319fd8408280b4d886c9eeceffe7091151ef2b9cf5794840dd8a674
640878f3ea0254adcffe4ca564048ebe1a49a22b4821820d98a28c6f93529bc8
68f24fc9a20111bb749e1374fa1fcb832ca55f08f716561376c4aa7cc5cb60e4
6a67901c8232e4e4d9cbab3b161cd56a9c36596e92a0ad019537613f1c542ba5
6cb59a8f51d309a1b780e82c9f6e54274fdd10237dfb118fe75ce7c6d29941ec
7076e385d4b26ebaeff99786a8a5d76fedf122881d1ff29965993ee9f48bf584
730b4fade238d5afe3f535227dc729d4caf438312d6635cf65a6344ceb3888ee
74377fe4f81e47cb43780794543e5949342bb96adfb698aa80f9451a24e64b3b
7bbdad89f5b9aebe8c62048cbbc4b3f9521101ba9b25e100a3baeb24dfb1a499
7eed9a6117a9efce8a2717a695d9ccb697b0bcbd6cc85a01d530140070711945
See JSON for more IOCs Coverage
Screenshots of Detection AMP
Win.Dropper.Swisyn-6973984-0 Indicators of Compromise Registry Keys Occurrences <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: WINCHAT
11
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 210[.]241[.]123[.]205
5
61[.]60[.]12[.]164
5
64[.]76[.]147[.]89
5
190[.]85[.]16[.]13
4
187[.]45[.]228[.]58
1
Domain Names contacted by malware. Does not indicate maliciousness Occurrences economic[.]3cnet[.]tw
4
larry[.]yumiya[.]com
1
Files and or directories created Occurrences %APPDATA%\Help
11
ka4281x3.log
11
\TEMP\ka4281x3.log
11
%TEMP%\kb71271.log
11
%TEMP%\~$$workp.doc
11
%TEMP%\~$workp.doc
11
%APPDATA%\Help\WINCHAT.EXE
11
\ka4281x3.log
10
\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell
2
%TEMP%\CVRE02.tmp
1
%TEMP%\CVRFEB.tmp
1
%TEMP%\CVR6C7.tmp
1
%TEMP%\CVR725.tmp
1
%TEMP%\CVRC82.tmp
1
File Hashes
007ca03c6d3185983f7628ce283087dca0d5bed03ec912200d1e921672303209
1baf10a1266410e3d9ea5010a86493f7a7c5cc8025fa1960e0fc3473827aaa23
3a6dd31a0a1382f74b13a1d1d4906c570302f858ac0c8c101865b3b6c7d448f8
53219b02a2c4231a996f9eebc53fd0a822e123efd47317789331822c02b3e3ab
56a652a5242989a2dfdc91a588180e939120a0b749e4cfb45b65a01399957143
602dc673518f70c3b55b8c0092435c40cdcec1725af015eae7a3ed869530c5cc
6b50e3860285f021a508a13dcd80c1325560ccdefbed642db3f607d3187ddebb
7722f295fa1cf7a3b5cda45aea62c1d4e7269bb964848a5cb6fe3098902b361d
a3683189e55067e50a65d37af97d8273ccacc87336ac4b7a2023032431f0cac2
a6991f1e575a92024a7dab7ab5e16f2c64a5caf59054ab326cb648ebdb7b1537
bc38eda2656f510bbeaf4dc14f25e97f249f5b3dc8327999ad44d2b4b98bd090
Coverage
Screenshots of Detection AMP ThreatGrid
Malware
Win.Malware.DarkComet-6973063-1 Indicators of Compromise Registry Keys Occurrences <HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
14
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
14
<HKCU>\SOFTWARE\CYBER
Value Name: NewGroup
7
<HKCU>\SOFTWARE\CYBER
Value Name: NewIdentification
7
<HKCU>\SOFTWARE\Cyber
7
<HKCU>\SOFTWARE\CYBER
Value Name: FirstExecution
7
<HKLM>\Software\Wow6432Node\Microsoft\DownloadManager
5
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Q448C2M3-FYKV-7ID0-27GB-B0YJ02KV7B37}
2
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: MicrosoftPrint
2
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: MicrosoftPrint
2
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{Q448C2M3-FYKV-7ID0-27GB-B0YJ02KV7B37}
Value Name: StubPath
2
<HKCU>\SOFTWARE\cgtestor
2
<HKCU>\SOFTWARE\CGTESTOR
Value Name: NewIdentification
2
<HKCU>\SOFTWARE\CGTESTOR
Value Name: NewGroup
2
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A006786A-AF6Y-2H12-1ULT-6X56A8L375TN}
1
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{H3T87034-72YI-HVWU-8TW1-XRLG3A51O2N1}
1
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{XE2AOBQB-F345-88YC-GMXW-03PEJ75V7WN8}
1
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{40UP52E3-1BA3-1FVA-0830-0LPA8BB74KCM}
1
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{80MR36N0-3A0L-8U63-4ABE-DIG840AJ43R5}
1
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y6OM0HT5-JGS2-L6NN-55A2-41O6554166B1}
1
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{U24C12U8-JR64-860I-NR12-HX5Y3UL2O2GM}
1
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5CJXRF76-BP1U-TPUE-6DCM-I034DALUNKB4}
1
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{L24VWK2P-22R2-46K2-V8RJ-XK2H03J01HJL}
1
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{A8081X6Q-NN6X-B62A-4715-HN312RI8G7N5}
1
<HKLM>\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{7A1IWYJ7-F7XK-O3G5-N0V0-434M8W04DQ1K}
1
Mutexes Occurrences \BaseNamedObjects\Administrator5
12
\BaseNamedObjects\Administrator1
12
\BaseNamedObjects\Administrator4
12
{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}
2
2V1AWS6YF6TXG2
2
2V1AWS6YF6TXG2_PERSIST
2
2V1AWS6YF6TXG2_SAIR
2
8KRK5M71VU1M5K
1
8KRK5M71VU1M5K_PERSIST
1
2V80730O046N4E
1
2V80730O046N4E_PERSIST
1
2V80730O046N4E_SAIR
1
52736ID51F81S2
1
52736ID51F81S2_PERSIST
1
21J3T4M0224831
1
21J3T4M0224831_PERSIST
1
21J3T4M0224831_SAIR
1
Global\a76de881-7963-11e9-a007-00501e3ae7b5
1
Global\a54a6c41-7963-11e9-a007-00501e3ae7b5
1
7IJA3Q405R67XA
1
7IJA3Q405R67XA_PERSIST
1
7IJA3Q405R67XA_SAIR
1
BAND78GIQB66CP
1
BAND78GIQB66CP_PERSIST
1
BAND78GIQB66CP_SAIR
1
See JSON for more IOCs
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 52[.]8[.]126[.]80
3
162[.]125[.]8[.]6
2
Domain Names contacted by malware. Does not indicate maliciousness Occurrences www[.]server[.]com
3
dl[.]dropbox[.]com
2
amphetamin[.]dyndns[.]org
2
bll3bll3[.]no-ip[.]biz
2
chugychugy[.]no-ip[.]biz
1
thecool[.]zapto[.]org
1
danyeltdc[.]no-ip[.]biz
1
cybergateratmortal[.]no-ip[.]biz
1
mark1[.]dyndns[.]info
1
NKG[.]NO-IP[.]BIZ
1
tomate12345[.]zapto[.]org
1
freecoolstuff[.]dyndns[.]org
1
Files and or directories created Occurrences %TEMP%\Administrator2.txt
15
%TEMP%\Administrator7
15
%TEMP%\Administrator8
15
%APPDATA%\Administratorlog.dat
15
%TEMP%
14
%SystemRoot%\SysWOW64\WinDir
3
%SystemRoot%\SysWOW64\WinDir\Svchost.exe
2
\directory
2
\directory\CyberGate\install\server.exe
2
\directory\CyberGate
2
\directory\CyberGate\install
2
%SystemRoot%\SysWOW64\Windefend
2
%APPDATA%\Windefend
2
%APPDATA%\Windefend\wdlc.exe
2
%SystemRoot%\SysWOW64\Windefend\wdlc.exe
2
%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\sqlite3[1].htm
2
%SystemRoot%\SysWOW64\Java
2
%SystemRoot%\SysWOW64\Java\Java.exe
2
%SystemRoot%\svchost.exe
1
%SystemRoot%\install\server.exe
1
%SystemRoot%\SysWOW64\Svchost\Svchost.exe
1
%TEMP%\fKbeeL8LAf7RNJz277.exe
1
%TEMP%\wNXued4pQq1zObh0H1.exe
1
%TEMP%\WqtgkF7HZR2P6A.exe
1
%TEMP%\yORdpf8sEy7.exe
1
See JSON for more IOCs
File Hashes
042cc2f502cc7a8830f1422060bc7087218516dde6da1b82f13fce5dfb7fefc9
09de6f1c248817500b6dd911e7cca1f662e4d4cc8f4ade8b9ede3af558553074
15573121831d3e2c67bf219bbcd4e78c65e20d92f00bc16f2dbe564b02add7ce
3041bd2d8b516685011bc96d42f6b0c5814790e51a7935a9b9a4f0e3d35b87f4
33b215de55923f27998929217024c409e0b9059ae5f970aaeae6e8436185f615
3708fb9505564ee292d27082f43ff080fe3545e5d9bdab204ac2b0e26825d4e9
3a396d00735cb58475f7dfc44748a8b8b797157aa7c0ddbe73386434ad33382d
98db7f273a141813f60c82b113635f0cbf0ec5e25ac58e518c629790a6536882
9bffcee38ba555a0a522c3f18ac96fcb44b0a692007271fd239e8437756d379f
a192abef36bafcd1e7bad8620fc08a1618b285fcbec6a097521b0a99102d05c8
b64e1524cc098319cfd34d594e48b1ddad7690c9bb2e5a273e518fdf7b09ace2
c458867497286338031748ea86a7accb00bc03bd879cbcbf9102f5b4dcd9f360
f79c376b416bcfac45152f1b2a9809b12a1e7ee3afb50a0ccd4c1799b51735d3
fe712cd1343925500766a1bcff4c5221838998cf8dee475f0e84e9aa476a6583
fe9e3a928bdf85a0013f677b77acd177b7ae3a366cab7717a1871c537250b062
Coverage
Screenshots of Detection AMP ThreatGrid
Win.Malware.Ursu-6977282-0 Indicators of Compromise Registry Keys Occurrences <HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR
Value Name: Locked
23
<HKCU>\SOFTWARE\VB and VBA Program Settings
23
<HKCU>\Software\VB and VBA Program Settings\Explorer\Process
23
<HKCU>\SOFTWARE\VB AND VBA PROGRAM SETTINGS\Explorer
23
<HKCU>\SOFTWARE\VB AND VBA PROGRAM SETTINGS\EXPLORER\PROCESS
Value Name: LO
23
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Explorer
23
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Svchost
23
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
Value Name: ShowSuperHidden
23
<HKLM>\SYSTEM\CurrentControlSet\Services\Schedule
23
<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess
23
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SCHEDULE
Value Name: Start
23
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS
Value Name: Start
23
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: Explorer
23
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
Value Name: Svchost
23
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences N/A
-
Domain Names contacted by malware. Does not indicate maliciousness Occurrences N/A
-
Files and or directories created Occurrences %SystemRoot%\Resources\Themes\explorer.exe
25
%SystemRoot%\Resources\spoolsv.exe
25
%SystemRoot%\Resources\svchost.exe
25
\atsvc
23
%System32%\Tasks\svchost
23
%SystemRoot%\Resources\Themes\tjcm.cmn
23
%System32%\drivers\oreans32.sys
23
%System32%\en-US\imageres.dll.mui
2
%SystemRoot%\Globalization\Sorting\sortdefault.nls
1
\??\NTICE
1
File Hashes
2e95794cf4894836b24b8d63f7d01139135e15d5fd812551265155d3ec0a36e2
373b6d81957c30c8b5cb4d5ff66511d9e0b308e3457023421ccc693bb60859ca
39c6009a9f65fc0bd39f8e610783084e7611be480522e76d928e3e29b8b85a55
3ab8dbe50d5b2a8d5e7643d59c0e2572fa4ee06dcebccbe633e996ce215d2fd0
43ce287dab8e1471defe0f40f07c13fe4bf03ce03353b11fff3b2f2f1b5998a3
47f97a745fd206df983cb63192aa2ad0cfe6f0a2ccbc2652bdcd83bf9c7bb707
630e3a845a2099c100dd766f92a51100338a22c50849f00a805a05f3049ec844
665b3e6eff2cc67b7c609af33521b00c93482612de5963f6924a6a68f2d07da2
690259339ab8cec23f2461593a3620d910b6f76ff22e38ed7143472cd4ca667d
6ca1e0caa0c5e634a66b3e1d3204cb93fc5806a8313a05d45a480c4903a7fde9
6ccc81bec3a9344b374d9a62f297ac9811912b8d4f2fa887d5beb7fe7a16c116
77a7bffcedc1638995971267e62a7e3f0b900ed7af4a98c7b831b4bf7c99d6d9
7a636b56140c6b1ff69aa713d4db994b8be893f9009faea048016b92103c2310
7c9dbb9c3ac7dd94bcc79e828596516e66b4348e0f8bd581fea660d5da0f7d68
83a1152f36ce9eda3546517d4a2e96eb183f613870aae71b330a73b8d3f774db
885bfa45c4c0dc4de65e777d4230ef3ba11a6d39f6785b9a7f4f231e37b9efca
89ffe264e5d751253570f51215234cccb4daa74e01a4556611851db821c1b505
8e31825cd4844cf15c4e69b3cd0e8daa410a6ece67324f26d65764934507b6d8
8ff2a0391fac1832f423e1c0b156291751a81f3be34f31b9e77e39eb215c8acc
9412fd31320ffb831d69a4a7db2317d17d6ed91f246b52d1fd0ff9dfd0ec9da8
96f43911f3a315a34c2a29886d6b3bab6bacfa867bf3bdf85766c546f5e49ed1
ae352a71d00f328be74de101fe0a9ee2b08ba6a30b233c44505efd45c5af113c
b058353182c961e81209f09203f59da326fca6c7397c2d05ecdde7018c6191cd
b1db9ddfd0492846007e6ce13f295a463293bd45f36012d576aa9285830950ee
bd977100e6206d546c7b90be267bf8e6d6005327014a671c58fa44b8b104e91d
See JSON for more IOCs Coverage
Screenshots of Detection AMP ThreatGrid
Win.Malware.Zegost-6977492-1 Indicators of Compromise Registry Keys Occurrences <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: XXXXXX579E5A5B VVVVVVrr2unw==
24
Mutexes Occurrences AAAAAA9PT0vfT4rqenp70A/Pqpp6+vr58= BBBBBB9PT0vf4Fr7K0sr0A/Pqpp6+vr58= CCCCCC9PT0vQXpr7K0sr0A/Pqpp6+vr58= GGGGGG4wIF/vL7858= XXXXXX579E5A5B VVVVVVrr2unw==
24
\BaseNamedObjects\AAAAAA9PT0vfT4rqenp70A/Pqpp6+vr58= BBBBBB9PT0vf4Fr7K0sr0A/Pqpp6+vr58= CCCCCC9PT0vQXpr7K0sr0A/Pqpp6+vr58= GGGGGG4wIF/vL7858= XXXXXX579E5A5B VVVVVVrr2unw==
9
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 107[.]165[.]236[.]233
24
45[.]39[.]189[.]31
24
154[.]90[.]68[.]52
24
Domain Names contacted by malware. Does not indicate maliciousness Occurrences www[.]af0575[.]com
24
www[.]fz0575[.]com
24
www[.]wk1888[.]com
24
Files and or directories created Occurrences %SystemRoot%\XXXXXX579E5A5B VVVVVVrr2unw==
24
%SystemRoot%\XXXXXX579E5A5B VVVVVVrr2unw==\svchsot.exe
24
File Hashes
05866fb33429838331d475305f0b208d9aba77147dbf3010dd5c1ed502aed237
1bc0cc8e902068bced4d8a5a3995996e4004aaf4f7f7d472a137ead9d9531f6a
7ba1eaf4a7b6298ea88d653015a586daedef1931b868d72067919b85f09192e3
a02b367269e6a04ff08f088f372dba36289890cb0ac0200ece43d9eb76f8fffa
b52acfe618192ea2c16518b22b565adae69496dce66e0fa344cf3c3c343d531d
b78f867b6c84795c7b1aba7e607ecea8ebbb2e05c72c4c6118bf2c73fc582641
b80a7942deb3a734e54a3e55e01fd5c8b548c8c263423861e8293d64358f8dd0
c2db0b91efc4d4d6f7f6b8261fbf87502234d8dddfee28d1fb3f3a0aa9036aa3
c4e18af265e4a04ef594e8eb4272e06a4d2d17b711318ed87e92e023e1e93cca
c7df429173e8ea67d0d6db359b4bb591b63d605e308c9e5782e98bc859dde11a
cdd73dcea4ebab00fef66f15eb816c35abebe2cabbd6c1083134c5f00604fa1b
d100a56dc5beb1b8e0cb061d8eac0ec7d9a38d59c9494e4b54cd9347c1d3990f
d19888826f2bc2c913123848d16a33ad2e4c2816926e2eb2b0d2b0b7e07ea743
d2963a935336cae74222b86b3cea3746b661b6cc2856b18ae90950f4074eb809
d4412464d02bbfe2e9594988854e14af082ee7a9ae3523839f333fdcf53aa338
d453f0d4bade25d5f69227940a93d1bda71708160ef2abdf395572a7a1092865
d505c38f3fea2def0c138cdac765458439f4d6485f5d4958b78c275a16bb1f6e
d6cdaf52318fbd8a246b229130c9f0f65a2f47825f69110ddac6466651c2ee78
d84754b76bea45d66d81d7e9b21508cd0444166d972ebed290e6579b9232500b
d8ed266a2992c92c6cdb8c091347fa914c0f6329bb7d1b7a534608780bafb34d
dad1288296135661b94cbd1d330c89664c60d6e62eb401aae07153d0a833a5bb
db3236cbfbbb26811e79d0c406d69b0c07d90bb757fc167815187c7880049a2b
dd90a85a837547695bb16b420c60f0736ce2d941f39f89a2784a26d3a69fd137
de92f9212a5cef7538654b04e0c12939ef29bbed1899346130b934e05eb74a1a
e07953b5a16b4a232dcd0029f277290114c10d17bfaf85c1743dc6a0fa6b1583
See JSON for more IOCs Coverage
Screenshots of Detection AMP ThreatGrid
Umbrella
Win.Packed.Shipup-6973041-0 Indicators of Compromise Registry Keys Occurrences <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
Value Name: LoadAppInit_DLLs
32
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
Value Name: AppInit_DLLs
32
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences N/A
-
Domain Names contacted by malware. Does not indicate maliciousness Occurrences N/A
-
Files and or directories created Occurrences %ProgramData%\Mozilla\thfirxd.exe
32
%System32%\Tasks\aybbmte
32
%ProgramData%\Mozilla\lygbwac.dll
32
%HOMEPATH%\APPLIC~1\Mozilla\kvlcuie.dll
31
%HOMEPATH%\APPLIC~1\Mozilla\tfbkpde.exe
31
%SystemRoot%\Tasks\kylaxsk.job
31
File Hashes
052547bc8db09ae2df36819ad53a4174d593082c4a416d06a09e40598163c318
052d32680a239673a9972d09723fdd4f75ea05af4671d971031bbc48d6da9501
0e841ddbe5a8ea180d0e3ca81cb3d88fe9a78b5ab04f9374220c82a4f9a7ab46
0ecb413195e8be913236983ef106a90197f815ecfbd94d78dafadefd37025628
13ca3ebbaf2c837078de5a6bbc8de54c8cf3762f7ece550f8066df6523ab6c96
13e9aa44c96f7eb8272d232924facc85c184329e2a776f627a49af9a00f5ac95
15e2fa7064464e8e3b9a1ec51d032e8170084c9e232396e649f0e8bdc8e6b9b0
15f9e930562516a455a50ccab4b413121dd1f5dae7ed7ebbf777bbf9c6d3ce43
179405e24adc742b476282a1849f96de091a92bac7f1fa5399750c74089f706b
3e8d09e57b8b169940c173c76c36cb6306ad194be51b568829afda9abe5c9dac
437028671afa7e4b26814fad641b8f8b59bdb8ab838461ffc359c8fb1ba6505c
44628bc60cf2fcbb774b7102add73b0ec05c90db6a5c0a51e58a2b8b03187ce9
4f4eed8ad44a81f5bcea4956c17793c467d2f35d751bd3d5041bdb02173dceef
5ca3a2ff96cc24eb5c555ccb2c5fa22b86248f742ce3c6e0c930a57f530a5558
607ca3c1344a6dca8a0df8ca61924247f5d7abe5fb082546e66282a85a463d83
77b1590916699002e1211803f858749dfe258de2faeba7cb33da399992a7a021
7c81845b0a79769bd476c01a51cfb1f10774be0e082ed52b431899e5756810e3
7ed507a6eb3af46b6c14c91772fce87c6968d025ad4a8747963fc5ae8205dde2
842a281a82d966ec59f255326ab5a37fdeff6028d59a164fd00de8c77dc5146c
889284a84faf65ba6ef4295f35dd6aa3c524965226c725337639e62dd17c0d78
9f2f173a793d3e02f67047c09e3e5680b017eecc9a2ecef2269cf72a3e6e2801
a662fcb03c1837ddbb13b145e7f1236a2839c25c7bbf30afb11836b5a01cf5a7
b69fb1c8cfc8cf49b20f00591ff647e4629370f68010e6f0900d5266817d0bcc
cb8365c6b74023800369bd87743d23c481adc2f8965b8b2e1c0e4ee6074d2f30
dc45c478635d4bd2b242dbd49218aeeafb3e3a92e10edf4417c46c48a49f54a5
See JSON for more IOCs Coverage
Screenshots of Detection AMP ThreatGrid
Win.Ransomware.Razy-6972250-0 Indicators of Compromise Registry Keys Occurrences <HKCU>\Software\zzzsys
29
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value Name: EnableLinkedConnections
29
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: aroinics_svc
29
<HKCU>\SOFTWARE\ZZZSYS
Value Name: ID
29
<HKLM>\Software\Microsoft\DownloadManager
2
<HKCU>\Software\DCAE84951C1ABA1
1
<HKCU>\SOFTWARE\DCAE84951C1ABA1
Value Name: data
1
<HKCU>\Software\1CB360B14DD9DEE
1
<HKCU>\SOFTWARE\1CB360B14DD9DEE
Value Name: data
1
<HKCU>\Software\4A8D80F87D78C75
1
<HKCU>\SOFTWARE\4A8D80F87D78C75
Value Name: data
1
<HKCU>\Software\3C10A2EC8C6F11A3
1
<HKCU>\SOFTWARE\3C10A2EC8C6F11A3
Value Name: data
1
<HKCU>\Software\B23F47051906EBA
1
<HKCU>\SOFTWARE\B23F47051906EBA
Value Name: data
1
<HKCU>\Software\EDF09EC2BB87785A
1
<HKCU>\SOFTWARE\EDF09EC2BB87785A
Value Name: data
1
<HKCU>\Software\43A7BE96FA393A15
1
<HKCU>\SOFTWARE\43A7BE96FA393A15
Value Name: data
1
<HKCU>\Software\B26B751ACE1935
1
<HKCU>\SOFTWARE\B26B751ACE1935
Value Name: data
1
<HKCU>\Software\2B359187F23A1A5
1
<HKCU>\SOFTWARE\2B359187F23A1A5
Value Name: data
1
<HKCU>\Software\66655966ACCADC47
1
<HKCU>\SOFTWARE\66655966ACCADC47
Value Name: data
1
Mutexes Occurrences \BaseNamedObjects\345432-123rvr4
29
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences 204[.]11[.]56[.]48
29
97[.]74[.]249[.]1
29
23[.]225[.]15[.]164
27
204[.]79[.]197[.]200
11
13[.]107[.]21[.]200
8
88[.]99[.]146[.]131
2
Domain Names contacted by malware. Does not indicate maliciousness Occurrences en[.]wikipedia[.]org
29
www[.]torproject[.]org
29
rbg4hfbilrf7to452p89hrfq[.]boonmower[.]com
29
sappmtraining[.]com
29
multibrandphone[.]com
29
vtechshop[.]net
29
controlfreaknetworks[.]com
29
tele-channel[.]com
29
shirongfeng[.]cn
29
irhng84nfaslbv243ljtblwqjrb[.]pinnafaon[.]at
24
t54ndnku456ngkwsudqer[.]wallymac[.]com
24
bfd45u8ehdklrfqwlhbhjbgqw[.]niptana[.]at
5
kh5jfnvkk5twerfnku5twuilrnglnuw45yhlw[.]vealsithe[.]com
5
Files and or directories created Occurrences %HOMEPATH%
29
File Hashes
1905c1e8b2d6c268f627e8dbc059555510cbe2871ad529894e8d6353418a05ab
22957751bc62369fd5349c30bfa365ea37b8e132af29abd40a3b920f47b6eb32
2c6da4b5560472d787e4fdf7ae5f40e28d4fbf31648874d30b3ee62f6f94d621
45cfcd5fc1d12f0b8c5ecd100f9b2d7e537a3804605337e581b2e6f7d8769662
4955d9cb5931f433c3e52b30c6089e5466af4da52eec32842115a169b7a0d5d4
751a1db3495b1c2d385b4ceaf33a4051a7fcdc3fb93b306fdbe1f6b143694db5
937e5573b147a897e27aba03bc8e21c3e4e32b89e4c596bf5a1b65eddafe88cd
939e5d2051e8e0256d39f1c55f847831f9de1b140fc8581edd324f5ae08c26b8
94dbe3111292115fc9ec7616ff8c32f636315f2589b05292e32f8bf4da42757d
a2be2b0912b691d4c3d85f458b6e01228680df6d0d7ec2820467fc8794b0bab0
a76170367b5a5b49eed6c02bfe35d62506781fb25abd42f151a088b39526cc76
aafa9d17e3e276c0d3ebbca2d7f9b51e658ee19181543f57029da7f0ecb16c85
aba204cbd49df46ca1a1bce301de80cdf85440928a70207a35df3768eca2ba03
ae5f00f552b48e9d4ab11ec2c110ec7d2040f638507e074fc59e8e6f195a9e96
b4d601ff6d892011692e72b14fa102f674015b6f673bb67ddb6ce299f5fc0225
b4f43a3b21f24af7639f8d505a729fd063ea617efe5e2bf3d1b7cfc972a1174c
b719d46aa7b9a2af7164e4b2b50bb6fb569405c11d65c3d79715b56eba30abe8
b81df15c1e85bfbd32732e1415b88534d30949030da784d44094bc464e784929
ba784059fa75fa4669b0bdf1f9c37846b72dbc475fd616e3d919da320585bb26
bdbc5002551f35b9828206efe63775cda2a3b0ddc0b1a3cea69712645acae9f6
c1200ec3e6d577abbdf3ffa675c0c5a74c19404b48f17c7a9575e52f9f587fdd
c29e65f5d0a286c4a6200eff1243110665b50225a60f293ad3993a4433f75eab
ca3857d4f20eb830c5d281b36fb5cfa9e1dc3195e07763d8541d4782a297cb41
d27199f85f5225fd359532c6f72d82d86d54c4a9eb2094ea1987701cce9a13d2
d2c51c28a29b7188d7597867ecf3b46d6c680f3fc5b08d1b62b11d7e35f7c432
See JSON for more IOCs Coverage
Screenshots of Detection AMP ThreatGrid
Umbrella
Malware
Win.Malware.AutoIT-6974564-1 Indicators of Compromise Registry Keys Occurrences <HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
Value Name: Load
23
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\avgui.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\avgcsrvx.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\avgidsagent.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\avgrsx.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\avgwdsvc.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\egui.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\zlclient.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\bdagent.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\keyscrambler.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\avp.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\wireshark.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ComboFix.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSASCui.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MpCmdRun.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\msseces.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MsMpEng.exe
20
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RSTRUI.EXE
Value Name: Debugger
1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AVASTSVC.EXE
Value Name: Debugger
1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AVCONFIG.EXE
Value Name: Debugger
1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AVASTUI.EXE
Value Name: Debugger
1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AVSCAN.EXE
Value Name: Debugger
1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\INSTUP.EXE
Value Name: Debugger
1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MBAM.EXE
Value Name: Debugger
1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MBAMGUI.EXE
Value Name: Debugger
1
Mutexes Occurrences a6aa8a0b-6e56-4c3b-907b-050c9f3cd849
23
IP Addresses contacted by malware. Does not indicate maliciousness Occurrences N/A
-
Domain Names contacted by malware. Does not indicate maliciousness Occurrences N/A
-
Files and or directories created Occurrences %TEMP%\AppVShNotify
23
%TEMP%\AppVShNotify\adsldpc.exe
23
%TEMP%\tmp1.tmp
19
%TEMP%\9820e8a7-0923-3042-c2a0-c5f11027aa0c
1
%TEMP%\e2fa612d-1e2f-35b5-a199-944faa71010b
1
%TEMP%\6b2d093a-7df5-80b3-3f99-4e2c9f1b13c8
1
%TEMP%\4f2d29d3-fbde-e6ff-ad4a-df0b85cdeddd
1
%TEMP%\fe5fdbd7-d952-2867-3827-7057bc588851
1
%TEMP%\c457fd8a-143f-203d-0170-439f7c58973c
1
%TEMP%\914c8aee-d3ec-de0a-1145-f7bddaa17f99
1
%TEMP%\ee04db46-f4ea-7f77-8bbc-01f32a7cc91d
1
%TEMP%\8b20e715-a03f-4588-1643-683c4f1c2815
1
%TEMP%\30c2a40c-4fe5-ce75-1ced-261814da72b9
1
%TEMP%\295bf3aa-19e0-3c5a-0683-f84fd23e5863
1
%TEMP%\159f88b1-1b0a-90f0-8fdc-216ce2a76423
1
%TEMP%\1781907d-118d-abbc-e63c-ffefec1db0fe
1
%TEMP%\ac2f593e-117e-d2e9-5326-7e5853e9a327
1
%TEMP%\b60fdf77-11cd-a028-be3d-31ad857bb8ca
1
%TEMP%\f1d8b9f0-0a08-9f11-7bf2-beb0259e0aba
1
%TEMP%\39fd9262-2c05-b304-c2e3-82be0f250151
1
%TEMP%\6db51643-db24-1925-0a44-6ec878aba104
1
%TEMP%\f7913a71-88aa-05ca-5d01-f9cd8ec5cf3e
1
%TEMP%\c0ebfd8e-41db-b5f8-8907-2aad802486f9
1
File Hashes
13d1d9eeba3a08a30db5812b628d1c68fb87b2c320260850a32d37fdc45de2ee
2d63201ae10bef24d9a28f054a504a4f4d7c5992656fccd2bc22a4515fa6b820
2e1b4c9c33da8a159915d696e24cc658f98ef9793b80ddfc9ca7827cd00af279
3e3c18e431e5782e8576766b9c3c8dbcf2e00eb5fb252b090fb5becd997004d7
4670ed1f97a6c49498dc49f996daa8570ccdcd07922bfdacd3230861aec54a0a
4ffd29b36c3059b81555f7dbb11e2e03b56b31a31f644e8d2267a1ef6d3229b2
56ebb8570a0f3490449c95e1285d36ca87801f0a044f262aceac90c7e2dfe7f3
714d4ef7cf6fad145d2e3bfa069957c4cc5ee6b3cd471e9ed8e64b7bbbb98369
840c394f5562db9be1291578d19ba069016a62551ac15d5d062ad5623a0bc5e3
8b568da7e24bef7371551c0a2541cbcf90294af04e4d99c196717d5473e399a3
8ec63eae66ac11026ca51828206a784bcb5bc5c87f33e455ade4ac4c5d7c875e
95ae77952c43bb538baf4f704e588b8ec229a3a116254d902b89a3dc999561da
9b9aff6df6f3f71722a0499119b1b32d6d8f66f7a84dc71228395040d587d43e
9df3b3b9eb5cd86fb0e56ae740c158b25fad2ce7936d266b83073f8021d032fe
a5e7b3a7b85e1c3f8a084e7d3a476c7bf04704200e6bd2e0b7975f830079673f
adeb18901edd0593719d05183644231b9da920db4ba640e7463ee4d4af6a68bd
b625c7a83fa0235a74106792181e684df7f109cf0d5123a95368fc649fb57862
bd949d0e8de9b1544505ee8a0bd18bfd438ec75652e6cf17c057062c798d7b44
c46563e9052f35a23b4ce4242fadf2e04edb038010ed7b49c5caab607199c59a
da9b5f246510d2751970cbbda141c6319feb58fb105c5235b40ce88c0385fea4
dd2343c12228a08717b9d4041c696b958d9d673b9a1f4894db4fd679e386e00d
ea03c2e4ed78fb0f2789d28b3ac5d2041bea1fd9cc576db83e7a1b9893b890c3
eea28710d09c0e9776bb877baa9a78a90286f38b3b947527cc4950b28d582829
Coverage
Screenshots of Detection AMP ThreatGrid
Exprev Cisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits. These exploits use certain features to bypass typical anti-virus software, but were blocked by AMP thanks to its advanced scanning capabilities, even protecting against zero-day vulnerabilities. Madshi injection detected (3672) Madshi is a code injection framework that uses process injection to start a new thread if other methods to start a thread within a process fail. This framework is used by a number of security solutions. It is also possible for malware to use this technique.Kovter injection detected (2773) A process was injected into, most likely by an existing Kovter infection. Kovter is a click fraud Trojan that can also act as an information stealer. Kovter is also file-less malware meaning the malicious DLL is stored inside Windows registry and injected directly into memory using PowerShell. It can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2. It spreads through malicious advertising and spam campaigns.PowerShell file-less infection detected (1849) A PowerShell command was stored in an environment variable and run. The environment variable is commonly set by a previously run script and is used as a means of evasion. This behavior is a known tactic of the Kovter and Poweliks malware families.Process hollowing detected (255) Process hollowing is a technique used by some programs to avoid static analysis. In typical usage, a process is started and its obfuscated or encrypted contents are unpacked into memory. The parent then manually sets up the first stages of launching a child process, but before launching it, the memory is cleared and filled in with the memory from the parent instead.Gamarue malware detected (186) Gamarue is a family of malware that can download files and steal information from an infected system. Worm variants of the Gamarue family may spread by infecting USB drives or portable hard disks that have been plugged into a compromised system.Suspicious PowerShell execution detected (151) A PowerShell command has attempted to bypass execution policy to run unsigned or untrusted script content. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.Excessively long PowerShell command detected (69) A PowerShell command with a very long command line argument that may indicate an obfuscated script has been detected. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.Installcore adware detected (43) Install core is an installer which bundles legitimate applications with offers for additional third-party applications that may be unwanted. The unwanted applications are often adware that display advertising in the form of popups or by injecting into browsers and adding or altering advertisements on webpages. Adware is known to sometimes download and install malware.Atom Bombing code injection technique detected (39) A process created a suspicious Atom, which is indicative of a known process injection technique called Atom Bombing. Atoms are Windows identifiers that associate a string with a 16-bit integer. These Atoms are accessible across processes when placed in the global Atom table. Malware exploits this by placing shell code as a global Atom, then accessing it through an Asynchronous Process Call (APC). A target process runs the APC function, which loads and runs the shellcode. The malware family Dridex is known to use Atom Bombing, but other threats may leverage it as well.Corebot malware detected (34) Corebot is a Trojan with many capabilities found in other prominent families. It features a plugin system to enable it to load a variety of features from the C&C server at any time. Known plugins include RAT capabilities such as taking desktop screenshots, as well as being able to intercept and modify browser communications and steal data, especially data related to banking.