Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 21 and June 28. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

The most prevalent threats highlighted in this roundup are:

  • Win.Trojan.Zeroaccess-7002138-0
    Trojan
    ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click fraud campaigns.
  • Win.Packed.Blackshades-7002008-1
    Packed
    Blackshades is a prevalent trojan with many capabilities including logging keystrokes, recording video from webcams, and downloading and executing additional malware.
  • Win.Malware.Gamarue-7001972-0
    Malware
    Gamarue, also known as Andromeda, is a botnet used to spread malware, steal information and perform activities such as click fraud.
  • Win.Trojan.Lokibot-7001391-1
    Trojan
    Lokibot is an information-stealing malware designed to siphon off sensitive information stored on an infected device. It is modular in nature, supporting the ability to steal sensitive information from a number of popular applications. It is commonly pushed via malicious documents delivered via spam emails.
  • Win.Malware.Ponystealer-7001707-0
    Malware
    Ponystealer is known to be able to steal credentials from over 100 different applications and may also install other malware such as a remote access trojan (RAT).
  • Win.Malware.Upatre-6997681-0
    Malware
    Upatre is a trojan that is often delivered through spam emails with malicious attachments or links. It is known to be a downloader and installer for other malware.
  • Win.Virus.Ramnit-6997840-0
    Virus
    Ramnit is a banking trojan that monitors web browser activity on an infected machine and collects login information from financial websites. It also has the ability to steal browser cookies and attempts to hide from popular antivirus software.
  • Win.Dropper.Kovter-6998646-0
    Dropper
    Kovter is known for its fileless persistence mechanism. This family of malware creates several malicious registry entries which store its malicious code. Kovter is capable of reinfecting a system, even if the file system has been cleaned of the infection. Kovter has been used in the past to spread ransomware and click-fraud malware.
  • Win.Dropper.Gh0stRAT-7003005-0
    Dropper
    Gh0stRAT is a well-known family of remote access trojans designed to provide an attacker with complete control over an infected system. Capabilities include monitoring keystrokes, collecting video footage from the webcam, and uploading/executing follow-on malware. The source code for Gh0stRAT has been publicly available on the internet for years, significantly lowering the barrier for actors to modify and reuse the code in new attacks.

Threats

Win.Trojan.Zeroaccess-7002138-0

Indicators of Compromise

Registry KeysOccurrences
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC
Value Name: DeleteFlag 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\Epoch 25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BROWSER
Value Name: Start 		25
<HKCU>\Software\Classes\clsid 25
<HKCR>\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} 25
<HKCR>\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\InprocServer32 25
<HKCR>\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32
Value Name: ThreadingModel 		25
<HKCR>\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32 25
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Windows Defender 		25
<HKLM>\SOFTWARE\CLASSES\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\INPROCSERVER32 25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND
Value Name: Type 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND
Value Name: ErrorControl 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS
Value Name: Type 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS
Value Name: ErrorControl 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC
Value Name: Type 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC
Value Name: ErrorControl 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC
Value Name: DeleteFlag 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC
Value Name: Type 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC
Value Name: ErrorControl 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC
Value Name: Type 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC
Value Name: ErrorControl 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010
Value Name: PackedCatalogItem 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009
Value Name: PackedCatalogItem 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008
Value Name: PackedCatalogItem 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007
Value Name: PackedCatalogItem 		25
MutexesOccurrences
N/A -
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
88[.]254[.]253[.]254 21
92[.]254[.]253[.]254 21
71[.]254[.]253[.]254 21
87[.]254[.]253[.]254 21
180[.]254[.]253[.]254 21
166[.]254[.]253[.]254 21
135[.]254[.]253[.]254 21
117[.]254[.]253[.]254 21
119[.]254[.]253[.]254 21
115[.]254[.]253[.]254 21
134[.]254[.]253[.]254 21
206[.]254[.]253[.]254 21
222[.]254[.]253[.]254 21
182[.]254[.]253[.]254 21
190[.]254[.]253[.]254 21
184[.]254[.]253[.]254 21
83[.]133[.]123[.]20 16
130[.]185[.]108[.]132 9
68[.]43[.]104[.]31 9
143[.]106[.]5[.]242 8
69[.]73[.]14[.]56 8
65[.]25[.]8[.]238 7
174[.]50[.]46[.]17 7
50[.]4[.]85[.]69 7
198[.]91[.]176[.]53 7
See JSON for more IOCs
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
j[.]maxmind[.]com 25
Files and or directories createdOccurrences
%System32%\config\AppEvent.Evt 25
%System32%\config\SysEvent.Evt 25
@ 25
L 25
U 25
\$Recycle.Bin\S-1-5-18 25
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f 25
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f 25
n 25
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f\@ 25
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f\n 25
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f\@ 25
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f\n 25
\systemroot\assembly\GAC_32\Desktop.ini 25
\systemroot\assembly\GAC_64\Desktop.ini 25
%System32%\logfiles\scm\e22a8667-f75b-4ba9-ba46-067ed4429de8 25
%SystemRoot%\assembly\GAC_32\Desktop.ini 25
%SystemRoot%\assembly\GAC_64\Desktop.ini 25
\RECYCLER\S-1-5-18\$ad714f5b8798518b3ccb73fd900fd2ba\@ 25
\RECYCLER\S-1-5-18\$ad714f5b8798518b3ccb73fd900fd2ba\n 25
\RECYCLER\S-1-5-21-1258710499-2222286471-4214075941-500\$ad714f5b8798518b3ccb73fd900fd2ba\@ 25
\RECYCLER\S-1-5-21-1258710499-2222286471-4214075941-500\$ad714f5b8798518b3ccb73fd900fd2ba\n 25
%SystemRoot%\assembly\GAC\Desktop.ini 25

File Hashes

  • 076954251dae552c90215a067aac007bf0ad679029fbb1b82a698d3de09e7300
  • 08d7b4f347a16b79a62d245459cf9ab131c2df9fc1838e02802bfb9a6aca6112
  • 1181cc286159851699c0e9c1390dfca7006c8d6d4c92108c34c082941f848129
  • 1ebcb2ef3bf9c2ed7375b7948e3a0dec8b0ff0be6e059e8922c4b1547bb52e18
  • 51fdc7e0e25ecf5d90ae3c95c1c16187f2dfda8491bdd0ab9ef1378c2150c764
  • 58d8666816aad58ab24ef3ec21216266f96a3173ee8e3113ba7844b70bdd8d0d
  • 7738ac853462f4e1ed29d9d3a55319be75b952feacbb68ce1ecc21e5e3c3351e
  • 813358d1ceafa1065613f42c7f78a432c4a72f267d7a0340090d7651785bc32e
  • 84b1758b4545308192ce7ef2ea44b808fdc208bfe0d119e46e3c9a2e2a492c35
  • 9a93a769b759fd3e562b7dbd6c981e8c70942b5b9216589e57f11362af662fd0
  • a00d8e76a72f9ff877de789727c1e95b356e4fd2191445fcfc039903bd3e88d1
  • b7c20720b36e4c882c933ebb02793d40da26fa31a81b34b2ddc888c9ede3ae97
  • ba957b265fd5c148f3bbb6f8bdbbdd1a4f0559d3dd9bf35d31f1d3a4d4f7a5ef
  • bf4e99cdf812b134bba7a56bca65f17916eb8fff3b9827f71c7de8d00bc37e4e
  • c16a37d1a3f20d45179658151aacecec34708951c0de088d2038f7e5f9543f5e
  • c74110419cab5a72722b929492a9df2a236d71053b5d2198f7da1084fa50b1c8
  • ccdf01be4f8b32eb501ca6a521ae08275cc10391b0d653b4cfc2e0ddbd105df6
  • d6a15841b35a33683e7d47e9237a5011a1d66d08900b9238e2352bcc4d361fe4
  • dc2e56ce69095d93fb0a64f6c337572136dd90325908b1d273a6fda47a155047
  • df6455604ab4475f164609b573cdc60bf0f0cc0df507a2101b764b15113193c6
  • e30a7c87a93dcf2d1620e0e96fe8d4c419df59bc35ec00b5da835281546015ec
  • e52780b7e43765cff93f396b7a6721f5d41e30a169cc2beff2c0e33814a51594
  • ea07d6c283c6230f60ba73481c6304b42435a129814bbe28ad22d413af23db02
  • ea2aef3063a846658ab0e44cc2061117a9253e4d2f450f484660d671b162cce2
  • ebe860b9c6041c0704c54da28f09d82f86fd6af142c3db365fb380c54a706aa6
  • See JSON for more IOCs

Coverage


Screenshots of Detection AMP

ThreatGrid

Win.Packed.Blackshades-7002008-1

Indicators of Compromise

Registry KeysOccurrences
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE
Value Name: DoNotAllowExceptions 		15
<HKLM>\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 15
<HKLM>\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 15
<HKCU>\Software\VB and VBA Program Settings\SrvID\ID 15
<HKCU>\SOFTWARE\VB and VBA Program Settings 15
<HKCU>\SOFTWARE\VB AND VBA PROGRAM SETTINGS\SrvID 15
<HKCU>\Software\VB and VBA Program Settings\INSTALL\DATE 15
<HKCU>\SOFTWARE\VB AND VBA PROGRAM SETTINGS\INSTALL 15
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST
Value Name: C:\Users\Administrator\AppData\Roaming\svchost.exe 		15
<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\policies\Explorer\run 15
<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{E94B570B-EA1A-7B9E-DDDE-F6ADFD39B3EB} 15
<HKCU>\SOFTWARE\Microsoft\Active Setup\Installed Components\{E94B570B-EA1A-7B9E-DDDE-F6ADFD39B3EB} 15
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
Value Name: Manager 		15
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Manager 		15
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Manager 		15
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{E94B570B-EA1A-7B9E-DDDE-F6ADFD39B3EB}
Value Name: StubPath 		15
<HKCU>\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{E94B570B-EA1A-7B9E-DDDE-F6ADFD39B3EB}
Value Name: StubPath 		15
<HKCU>\SOFTWARE\VB AND VBA PROGRAM SETTINGS\SRVID\ID
Value Name: BRQY4LY7WY 		15
<HKCU>\SOFTWARE\VB AND VBA PROGRAM SETTINGS\INSTALL\DATE
Value Name: BRQY4LY7WY 		15
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST
Value Name: C:\TEMP\b426eed44205d22b31ddc9bba93777d66418725cc7389e33e94eaf82ed5a9eb5.exe 		1
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST
Value Name: C:\TEMP\93fdc3817676fae502836a274aa2444aac753f0295324c6ee1a6ba9456122323.exe 		1
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST
Value Name: C:\TEMP\f488d4abe7e53940581174ee39fa0bba3e101dcd1014e17b83eaf46ef524cd3a.exe 		1
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST
Value Name: C:\TEMP\c35c172e3ec61d1c9295eefc369e6364071b3e242bd0b7e3fe1d53e8598e5267.exe 		1
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST
Value Name: C:\TEMP\cbdc183665f526d08d30f2b9d58ecb9263d896ef89bf350354436e4ac9e084b1.exe 		1
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST
Value Name: C:\TEMP\e514982ad751e1c4d206e29300afa21d80ec2d4ab9975ef1e4fe4a0282ad1d7a.exe 		1
MutexesOccurrences
\BaseNamedObjects\BRQY4LY7WY 14
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
212[.]117[.]50[.]228 14
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
8synnanonymous[.]no-ip[.]info 15
9synnanonymous[.]no-ip[.]info 15
3synnanonymous[.]no-ip[.]info 14
synnanonymous[.]no-ip[.]info 14
2synnanonymous[.]no-ip[.]info 14
4synnanonymous[.]no-ip[.]info 14
5synnanonymous[.]no-ip[.]info 14
7synnanonymous[.]no-ip[.]info 14
6synnanonymous[.]no-ip[.]info 14
1synnanonymous[.]no-ip[.]info 14
4synnanonymous[.]no-ip[.]info[.]example[.]org 1
1synnanonymous[.]no-ip[.]info[.]example[.]org 1
5synnanonymous[.]no-ip[.]info[.]example[.]org 1
7synnanonymous[.]no-ip[.]info[.]example[.]org 1
2synnanonymous[.]no-ip[.]info[.]example[.]org 1
synnanonymous[.]no-ip[.]info[.]example[.]org 1
6synnanonymous[.]no-ip[.]info[.]example[.]org 1
Files and or directories createdOccurrences
%APPDATA%\svchost.exe 15
%APPDATA%\sysinfo 15
%SystemRoot%\Temp\scs1.tmp 11
%SystemRoot%\Temp\scs2.tmp 11
%TEMP%\6JUNY.exe 1
%TEMP%\IC12M9RR.exe 1
%TEMP%\FJR17ZE.exe 1
%TEMP%\2A7HNDZJJJ1Q15.exe 1
%TEMP%\CVFV5OH.exe 1
%TEMP%\IH53AYOW.exe 1
%TEMP%\DWWWW46.exe 1
%TEMP%\MJXXI5LRM.exe 1
%TEMP%\YB5JQ8UA2LW2C.exe 1
%TEMP%\GGZD9TW0.exe 1
%TEMP%\WUHWJ6WIC603.exe 1
%TEMP%\04RP9MOSL3GEBE.exe 1
%TEMP%\Q9JX06QPQW7.exe 1
%TEMP%\EJ1ENZ6.exe 1
%TEMP%\EO4KXVJ.exe 1
%TEMP%\SBK2S44SS10.exe 1
%TEMP%\21T4BJS31T30T0.exe 1
%TEMP%\GBST7SCK.exe 1
%TEMP%\840AG7.exe 1
%TEMP%\XYNVF6Z8GZ52.exe 1
%TEMP%\DRSSEYO.exe 1
See JSON for more IOCs

File Hashes

  • 89cec5949ed0d34c5e4acdff49fd25899aa99935fab559007b5e7f74eea11449
  • 8eeb0e3d9cce9b3cd1d3cff8747905d083ae4e8c3139b8b48fbcee00289960b1
  • 923a9f3de724c4b19dfd4915d65cb7e185e2b6e3174a6d60839b456bc87f4aa6
  • 93fdc3817676fae502836a274aa2444aac753f0295324c6ee1a6ba9456122323
  • ae44c2d406dd0d76dfb26776ba7e085a34d57b1565ac81c78fa0f0d3c1de55df
  • af5e730507faf8fa7d8f14fc2daa6d253a1a947e8227cb46fb0549cba5bd1483
  • b426eed44205d22b31ddc9bba93777d66418725cc7389e33e94eaf82ed5a9eb5
  • b8be6562a523ed101548cee88735f16778294ac8f8404d2fdf84c0353cf39987
  • c35c172e3ec61d1c9295eefc369e6364071b3e242bd0b7e3fe1d53e8598e5267
  • c4611e26199efce41b4a3daced46fbdc8e6f6cd19163f401334dc7d0086c900f
  • cbdc183665f526d08d30f2b9d58ecb9263d896ef89bf350354436e4ac9e084b1
  • e3306af770fd17f779fa3579656ffc1279e4c6a4ffb4fb317d5257070f25c39b
  • e514982ad751e1c4d206e29300afa21d80ec2d4ab9975ef1e4fe4a0282ad1d7a
  • f488d4abe7e53940581174ee39fa0bba3e101dcd1014e17b83eaf46ef524cd3a
  • ffe5d67e939edc9ff1543f61e395451af223654dd14eb33b9d6a3b106ebfa5d0

Coverage


Screenshots of Detection AMP

ThreatGrid

Win.Malware.Gamarue-7001972-0

Indicators of Compromise

Registry KeysOccurrences
<HKLM>\software\Wow6432Node\microsoft\windows\currentversion\Policies\Explorer\Run 25
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
Value Name: 36412 		25
MutexesOccurrences
2562100796 25
\BaseNamedObjects\1009299684 24
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
64[.]95[.]103[.]184 25
71[.]209[.]210[.]64 25
71[.]209[.]248[.]201 25
52[.]249[.]24[.]103 7
104[.]45[.]185[.]175 6
40[.]91[.]94[.]203 5
52[.]230[.]217[.]195 4
20[.]186[.]50[.]83 4
40[.]81[.]11[.]194 4
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
amnsreiuojy[.]ru 25
morphed[.]ru 25
www[.]update[.]microsoft[.]com[.]nsatc[.]net 24
Files and or directories createdOccurrences
%ProgramData%\Local Settings 25
%ProgramData%\Local Settings\Temp 25
%TEMP%\ccudefqw.com 2
%TEMP%\ccpaittr.scr 1
%TEMP%\ccvcbrqp.scr 1
%ProgramData%\Local Settings\Temp\ccaohaqb.scr 1
%ProgramData%\Local Settings\Temp\ccioodfy.pif 1
%ProgramData%\Local Settings\Temp\cccyokze.exe 1
%ProgramData%\Local Settings\Temp\ccfahy.exe 1
%ProgramData%\Local Settings\Temp\ccceirah.exe 1
%ProgramData%\Local Settings\Temp\cckyaew.com 1
%ProgramData%\Local Settings\Temp\ccauqse.scr 1
%ProgramData%\Local Settings\Temp\cclrzzfm.pif 1
%ProgramData%\Local Settings\Temp\ccokzu.com 1
%ProgramData%\Local Settings\Temp\ccablfq.scr 1
%ProgramData%\Local Settings\Temp\ccidop.cmd 1
%ProgramData%\Local Settings\Temp\cceazb.exe 1
%ProgramData%\Local Settings\Temp\ccraqi.exe 1
%ProgramData%\Local Settings\Temp\ccipousa.scr 1
%ProgramData%\Local Settings\Temp\ccacqvoes.pif 1
%ProgramData%\Local Settings\Temp\cciacuqeh.exe 1
%ProgramData%\Local Settings\Temp\ccyaykc.com 1
%ProgramData%\Local Settings\Temp\ccfayx.exe 1
%ProgramData%\Local Settings\Temp\cclygipzk.pif 1
%ProgramData%\Local Settings\Temp\ccuqhey.com 1
See JSON for more IOCs

File Hashes

  • 88b83d7940351d57a7415257a5c764c250796735b84dac723227090cd1583604
  • 90de0eb62d02f63a793ee83399dca3a0a26ef5778561127cdc3b7a12fdd14c20
  • 9a557649beffab5fa440fe296b033302019f588fd2a2a55f96424247ab503d5a
  • 9dbfc5901b71f9329d1df2304c04a5dc23f841fbc23ab93f1b5162bbfbd17d19
  • a5b91c4a675620e083a2469ec7e6835f4f0aeb5f8080fc86e06acf51c46af45f
  • a6e33529f62b1a06b6ebb82d262b7c271db69436cd0147bbe78b668046f14c0b
  • ae51fd15c7b341e451607a0c451b8dc202b20a4f07f9698ae03db3fc10a9b7b8
  • aeb375b2ec7bedb7cd130419135de45182b2472c854315142b237b7f458b5a3a
  • b6e98593c8e5bcafaffc7d08f59f5dce7e31248f44901a5b96977e0a93a5cf9e
  • bf272f51af40e07225731aa1ef5b558a92eca5a170b27d6830d096a10dbe5387
  • c06e2844838c870cab80f096ec83674a94a3630232eae7fd7094b83c944aad1c
  • c4968a5878f0ca3c5486b46b02ee12bb162070771acd199c1c0ae153a8b5f893
  • c50836bcdb9bd118afa149c9fa69f522cb5cd73cfafca6e39dee9c0da9fc041b
  • c543cbb30540aa3fb12bc61d2c389e0243e0cb71209e5737200403888c6c4170
  • c5dc3ca6227c7cba83899d74f040de24a681a5e4ae14563a22e3575ca26782dd
  • cd31b2573b597e43cfb6a5d83083457d01d260326d5ff50649cf7fb7facebc98
  • d26052594814c437cdef01ba6ae431f6dddb03d0e091498b4a724f555b883796
  • db657ca04f33f4a4923663d90e0b53bfab9616fea6c1b023170ac4eb2437f145
  • e4030fe726df1c3b36b5819d8189eba5ceca082d6768349d97d0f9a89ec63d3c
  • e6ba8ddeb72c376ac8bdb707fa1cf1d7afa3783f040e7ff186d3ddf2e73214ab
  • e70ed5d11dc4820b873be149df9ba68a884b03631e4b5c931698d4eb11e51213
  • ecbce2866468b9d94c979a8b947d943682846c439f76b65880f6606bd6f8141e
  • edf58c5f3dc245b7f12ecfb376f30e2be4dffaa8e4e7cfe519d521d12d70d80b
  • efc850ea39ff6f82b21d1a1036c065bd65ee251e6ef66134be6cf6aab3b27aa6
  • f054a006bb89514411ae9e9611c9acf8979e9d3ab2365d059e61eb59f6c04440
  • See JSON for more IOCs

Coverage


Screenshots of Detection AMP

ThreatGrid


Umbrella

Win.Trojan.Lokibot-7001391-1

Indicators of Compromise

Registry KeysOccurrences
<HKCU>\SOFTWARE\VB and VBA Program Settings 13
<HKCU>\Software\VB and VBA Program Settings\yl6S81871663781\Cm4RF771904693 13
<HKCU>\SOFTWARE\VB AND VBA PROGRAM SETTINGS\yl6S81871663781 13
<HKCU>\SOFTWARE\VB AND VBA PROGRAM SETTINGS\YL6S81871663781\CM4RF771904693
Value Name: dvQ6A283412628 		13
None 3
None 3
<HKLM>\http://tmjchange.com/Aw_/Panel/five/fre.php 2
MutexesOccurrences
3749282D282E1E80C56CAE5A 13
\BaseNamedObjects\3BA87BBD1CC40F3583D46680 13
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
212[.]1[.]211[.]48 4
193[.]29[.]187[.]29 3
85[.]187[.]128[.]8 2
78[.]135[.]65[.]20 1
161[.]117[.]85[.]207 1
47[.]52[.]60[.]150 1
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
stcatherinescollegeug[.]com 4
theoutlookglow[.]co[.]ke 3
matbin[.]com 2
api[.]w[.]org 1
tmjchange[.]com 1
bteenerji[.]com 1
Files and or directories createdOccurrences
%APPDATA%\D282E1\1E80C5.lck 13
%ProgramData%\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol 13
%LOCALAPPDATA%\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol 13
%APPDATA%\D282E1 13
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2580483871-590521980-3826313501-500\a18ca4003deb042bbee7a40f15e1970b_d19ab989-a35f-4710-83df-7b2db7efe7c5 13
%SystemRoot%\win.ini 13
%APPDATA%\D1CC40\0F3583.lck 13
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1258710499-2222286471-4214075941-500\a18ca4003deb042bbee7a40f15e1970b_8f793a96-da80-4751-83f9-b23d8b735fb1 13
%APPDATA%\D1CC40\0F3583.hdb 11
%APPDATA%\D1CC40\0F3583.exe (copy) 4
%APPDATA%\Microsoft 1
%System32%\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx 1
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2580483871-590521980-3826313501-500 1

File Hashes

  • 0accf0fcb86d4fb3367ac3f7c70665a67ce8c83f564db604759cb3836b7f4ac8
  • 18723bb19eebe8e4e6e01c1a652b85e7359aaadcbd0ec0c57d073426b26b036d
  • 1fd0f0bb055544d562e8f44675ff0e8205149af12ce68d4ab74e2800e84618d5
  • 3f589cd475b1211115dd0acea7483819d6e6d78f3d9a9e9b389374c9afdbaad0
  • 42af756837b1c4213219b7deda4c4432dff3b35e09483f63a3acc9211e08cae6
  • 51d37cda477215a5da7872f8a178d82279f652023be289c70cd2ae983e6a2460
  • 9c71815e65a5717ab07352f76960cebd49a16c376c0853d6ac7685fbfca8e38e
  • 9c9b0cfbd7a7b04f11611f60c7f2defdbe5db81e30a7cc01cfd123f0a6b97174
  • b3c350aaeae1b1b066fd23002a3732130b3cfdf57d39a11f04112382a0594d7f
  • d0fe5eee1cfe7b595c9d69362de5d4b823ef35933f5bfbe38b19d3488a040220
  • d110960c25e29d8b687ef5000aa3761721af5510d1d7c8a72355485d82c5ce89
  • d8c181a8be250796f8ad9583393b326c3d76f6e86a81c89225660cc7bed38e61
  • ef69508adf938a083db4f91b3c40c67338623dc192983f03385a4510d3826e58

Coverage


Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Malware.Ponystealer-7001707-0

Indicators of Compromise

Registry KeysOccurrences
N/A -
MutexesOccurrences
MUTEX_s2azEwonPXfon4JrAD 25
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
69[.]195[.]146[.]130 25
213[.]183[.]40[.]31 25
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
ip-api[.]com 25
Files and or directories createdOccurrences
%System32%\Tasks\svchost 25
%APPDATA%\Logs 25
%APPDATA%\SubDir 25
%APPDATA%\Appelinstansen0.scr 25
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Appelinstansen0.vbe 25
%APPDATA%\SubDir\svchost.exe 25
%APPDATA%\Logs\06-26-2019 25
%HOMEPATH%\Start Menu\Programs\Startup\Appelinstansen0.vbe 24

File Hashes

  • 176d0695e5f9bba1761b1288d40c70381a607474edefa4b96bfdae58097775a5
  • 1f44ab287b2068f0cd7f179ae8a9fc749f54a4b75c02c1a19289820a4c5abfde
  • 20e65a6e2ef74c18fd2ec2c0df19c972cfe5271b53fbaca72f2b276e07f4c9b3
  • 30ff31bdea7abfada4022dfc4a7ff283d8d280d1778229d994924df95edf6db2
  • 3140b0c479fd50ccabe59d2a687bcd30c8d8c358e8097a3ae74b97510cc33c86
  • 321bc48ccceaa8fd3492c9713d457db00670f336e26857055e0e2c1009069032
  • 329d9e96a9dd0b45592e948cc691eee9a5b0d55f6129f25507e1f5fb40a3e02c
  • 36018abd322d8b0cf3a2e9264046a544b6ef58fe48ebd22f7df0db20b9a40ab6
  • 45e8bc09f684e9d83abab87b8f8cc6d1a498968d0aca65f0ef668f8541f8a826
  • 47d1a8a70c173cba1dcc36e26bf38b206b738eb93493a0c9d9a3d09b235e9740
  • 4dda62fdee6cdb3b592956fba1326f1b418c9d81ba2577a3ec00011fa17487e4
  • 4df99361addca5c1c414fbddf48181ff65db954bd940fd0f6a1c87fa9961edf5
  • 5143e2500885ee10fa43369052dcc02576210e566e7d26102307f554b348d231
  • 53a0d0a143bf9c4e6fa96873643d1c3d148a02180664bfe575ffaabccb9ac45c
  • 61b2848c773403ccee8ebaf8b3e72ded01728ea958f1461c72442dd84fcf29a7
  • 65bb863b0e339f8f5d97e40f0ff2883bbb3d5fc9fe8b31c1d712384da7eb7aec
  • 6730bba3452b7b977186d80c34abd839dcaf731ff0b9befdb8323254c22c4fc2
  • 707d60c52242ddb3676a351faf3f96af40b547e548b32ef4c8f6751ab3cb5ffb
  • 7117534af19394d2d394c0d39005c2a06b97326b0e51f75ec53fab2f9b76c963
  • 71708c36ae65505b44dd9bdf9e7a01a3899eb5a68015c584474bc1888d2badfe
  • 7d51854e8e23a3458d9babe9f30395161256e614c0083e9adc9da561432f837f
  • 859c8e53eeba8e4ea3721673e7beefdfff3139fcc248b118a8a6c06c17594d03
  • 937ec4452c22ae6e45ea0b2d6d75442984dc2fcf2f087ba9c7d082639ee39951
  • 9ca2236b18368afca7c75b8eebda5b64eb0d98f30351ad9eb49210a63dbb12d7
  • 9df66dd5010ff85999d78be0345b529dc1ca197fb327b42e1d6d9593f708177b
  • See JSON for more IOCs

Coverage


Screenshots of Detection AMP

ThreatGrid

Win.Malware.Upatre-6997681-0

Indicators of Compromise

Registry KeysOccurrences
N/A -
MutexesOccurrences
N/A -
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
104[.]239[.]157[.]210 9
23[.]253[.]126[.]58 7
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
rockthecasbah[.]eu 16
electriciansdublinireland[.]com 3
dcmsservices[.]com 3
Files and or directories createdOccurrences
%TEMP%\budha.exe 19
%SystemRoot%\SysWOW64\secur32.dll 14
%SystemRoot%\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll 13
%SystemRoot%\SysWOW64\webio.dll 10
%SystemRoot%\SysWOW64\winhttp.dll 10
%SystemRoot%\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2
%SystemRoot%\SysWOW64\dnsapi.dll 1

File Hashes

  • 05e4fbd158d8b712eb2293bd7a8586ff451d50a4336de23277837e94ba56e8e1
  • 1dd50c279fa213938cc50b7e8d52b74598c86edcc33fdcbf7555eb529f35d7cb
  • 3198e6958489e008a41f72821b311d9e6611f33ce387f1114d6ad82bf85e25bd
  • 3d9fa6ff93769c89a6bd7cf0ab136eefe350231f433a16289f21edd1bb6adcb0
  • 5d38cb5ad7bbee701da5987a516d446ec6664e91c6f24ca01a94b19a6ecc60dd
  • 65378641d80eeec0caf4a616d2526ecdf8013c521d3f80fabceb0bbd11588da8
  • 668c8706dd4a85a2a92a04e47034faf3627a68985c2017ad76c3261c38f98cab
  • 6b78d89491561dc032767651a7fd7e4fc365ddbb3f30a61247160c5ccac56982
  • 6d61d43ea9fbb883c0eb2b18a4fdba086dc74946af12947f9cfdbddb0cbbaef6
  • 6ee66ed2e08789b99387238c1a96306e8ee9d18c16e4a3e64258ed5e03da6634
  • 810e29feb32471fb3b003f719ecf4332ac155ad4ad915a7cf78499cdc05cb85b
  • 8a18b650ec0d0dfb38d93b0504ac777a794de50b83d702b381906dd2b91c2055
  • 8e8214b61c2f9b5146541703c7c7fb176701f70bf7797d5be3202892268f8174
  • 95c3d556aa3cc4ce02a64457e948434b66727b85379b7f575e45a936420833a4
  • a0762390da8246251848bb0bddae2cfdea3b1511cba5b428b74073809c67c42d
  • a893d80022e464d48589d7a76f94108e42ac583c235ea3abd18cc6202fb15357
  • cb9857baaba1d49fdff5a644acc7bd0781d69fb3d74b3d62a17e3e9e3cdbf1da
  • e144eaf549ee6641f2689917057b6d8acf44179c0b7606961a157dd136edb715
  • e333d13bb84a89a53c7f69ebb4c435558291ead7df9acdd17ff12f5017771ec3

Coverage


Screenshots of Detection AMP


ThreatGrid


Umbrella


Win.Virus.Ramnit-6997840-0

Indicators of Compromise

Registry KeysOccurrences
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
Value Name: AntiVirusOverride 		24
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
Value Name: AntiVirusDisableNotify 		24
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
Value Name: FirewallDisableNotify 		24
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
Value Name: FirewallOverride 		24
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
Value Name: UpdatesDisableNotify 		24
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
Value Name: UacDisableNotify 		24
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
Value Name: EnableLUA 		24
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE
Value Name: EnableFirewall 		24
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE
Value Name: DoNotAllowExceptions 		24
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE
Value Name: DisableNotifications 		24
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC
Value Name: Start 		24
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND
Value Name: Start 		24
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC
Value Name: Start 		24
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION
Value Name: jfghdug_ooetvtgk 		24
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: JudCsgdy 		24
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WUAUSERV
Value Name: Start 		24
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: Windows Defender 		24
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
Value Name: Userinit 		24
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON
Value Name: Userinit 		24
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{509D0DCA-5840-11E6-A51E-806E6F6E6963}
Value Name: Generation 		5
<HKLM>\SYSTEM\CONTROLSET001\ENUM\PCIIDE\IDECHANNEL\4&A27250A&0&2
Value Name: CustomPropertyHwIdKey 		5
<HKCU>\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{509d0dca-5840-11e6-a51e-806e6f6e6963} 5
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\{509D0DCA-5840-11E6-A51E-806E6F6E6963}\shell\Autoplay\DropTarget 5
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\{509D0DCA-5840-11E6-A51E-806E6F6E6963}\shell 5
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\{509D0DCA-5840-11E6-A51E-806E6F6E6963}\SHELL\Autoplay 5
MutexesOccurrences
{7930D12C-1D38-EB63-89CF-4C8161B79ED4} 24
{79345B6A-421F-2958-EA08-07396ADB9E27} 24
\BaseNamedObjects\{137A1518-4964-635A-544B-7A4CB2C11D0D} 20
\BaseNamedObjects\{137A1A2C-4964-635A-544B-7A4CB2C11D0D} 20
\BaseNamedObjects\{137A2419-4964-635A-544B-7A4CB2C11D0D} 20
\BaseNamedObjects\{137A1A2D-4964-635A-544B-7A4CB2C11D0D} 20
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB3B51D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB9291D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB61D1D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB4BD1D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB5111D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB58D1D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB91D1D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB7391D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB7211D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB9411D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB3751D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CBA451D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB4711D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB9A51D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CBFD91D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CBA691D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB4911D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB9F51D0D} 1
\BaseNamedObjects\{137A1956-4964-635A-544B-7A4CB9351D0D} 1
See JSON for more IOCs
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
208[.]100[.]26[.]251 22
172[.]217[.]12[.]174 22
87[.]106[.]190[.]153 22
46[.]165[.]220[.]145 22
89[.]185[.]44[.]100 21
172[.]217[.]164[.]142 17
35[.]224[.]232[.]239 4
172[.]217[.]7[.]238 1
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
wstujheiancyv[.]com 22
kbivgyaakcntdet[.]com 22
yrkbpnnlxrxrbpett[.]com 22
qislvfqqp[.]com 22
bungetragecomedy9238[.]com 22
oeuwldhkrnvxg[.]com 22
kbodfwsbgfmoneuoj[.]com 22
wdgqvaya[.]com 22
ypwosgnjytynbqin[.]com 22
jlaabpmergjoflssyg[.]com 22
ausprcogpngdpkaf[.]com 22
fmsqakcxgr[.]com 22
OAWVUYCOY[.]COM 21
GFARONVW[.]COM 21
dvwtcefqgfnixlrdb[.]com 21
citnngljfbhbqtlqlrn[.]com 21
Files and or directories createdOccurrences
\Boot\BCD 24
\Boot\BCD.LOG 24
%LOCALAPPDATA%\Microsoft\Windows\UsrClass.dat 24
%LOCALAPPDATA%\Microsoft\Windows\UsrClass.dat.LOG1 24
%HOMEPATH%\NTUSER.DAT 24
%HOMEPATH%\ntuser.dat.LOG1 24
%LOCALAPPDATA%\bolpidti 24
%LOCALAPPDATA%\bolpidti\judcsgdy.exe 24
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\judcsgdy.exe 24
%SystemRoot%\bootstat.dat 24
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2580483871-590521980-3826313501-500\e6944fe95a45c918aa3f2953cd29d8f6_d19ab989-a35f-4710-83df-7b2db7efe7c5 24
%TEMP%\yowhywvr.exe 21
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1258710499-2222286471-4214075941-500\e6944fe95a45c918aa3f2953cd29d8f6_8f793a96-da80-4751-83f9-b23d8b735fb1 21
%TEMP%\guewwukj.exe 20
%HOMEPATH%\Local Settings\Application Data\hmqphkgx\pseqpmjy.exe 20
%HOMEPATH%\Local Settings\Application Data\jpnfmrvn.log 20
%HOMEPATH%\Start Menu\Programs\Startup\pseqpmjy.exe 20
%ProgramData%\wtvakgao.log 20
\nBm4h9I 4
nBm4h9I 4
\TEMP\nBm4h9I 4
oTKCR23 3
\TEMP\oTKCR23 3
\oTKCR23 3
\Device\HarddiskVolume3 2
See JSON for more IOCs

File Hashes

  • 020eb6da1196582c52e823a5bb222b4bfeff859c1007404e146694be17b79c0a
  • 15d31a8b30de2cc620bfaee8377fb8c2542e1fc8b3ad3ab8a19ee6d12dd0d7e8
  • 227a7a24686b80036eb0bbb6d42dc8f22c629889284dbc086c43a375b8aa4bcc
  • 2904815a1c7eccacf480673b7deb8e4f5fd0a6bd4dcc69fc2ef42e9059595b73
  • 2e324aa5b5c88f484ec89457a3d586ee17291249a053342252327876322f7ea5
  • 38dbc28e1a410c4d5b7740c2c5ad12abc72c5c4eb26961365313edee3808dc2d
  • 3e939542ad68cf7d18c4638b4ebc8f721f5d1357f8fa6068f03a5dd2f1c15a39
  • 4052f05c6345ef6306d1122f478d241ce395b6abec43af1230ad110a1fde5333
  • 4ce65aba2b6f06cb625374eb55eab94391f44f98acae5e62d38676312fb9fd23
  • 5e9441f982564e65ec1b0ddde1a164ba5d72ed18d93c28bc91d909f31134fc6c
  • 6503c9a444c480014378fc6dcc0d2bade62d0ee0a6dc9af2f8fa4e4261e5f7c1
  • 6d39754a92431ff4462ef5f4355b8f06aa371be911159507b774ee3dbfdf4bc2
  • 8b80167746d58c26a133e5f30ab82d4c295b6c2332d72b25dafedf61243e6a5b
  • 90d91197518a0e66012b8dfa52583f49968736187018ae7c821d0014184be0b5
  • 9a60fb85f32d6c9adfeaa27e2cd07752109aeaab22f9745f74de26f0eeda3cf2
  • 9e65eb141fd680acb220134c3ba615c83cc4a8d4368f0d5e659b17d5fdf3c102
  • a847ef0c0091cc8c75336551dc64bd02e21f2bcc843df68bcaeb1cfd7051e0f0
  • d58f75aa97d0bb3e3d8933f6b568bd28775f7a315d1d9f4e86fa233b3abbf32a
  • dab8c5868ad964e90df10ea1470f660076ec93532a0d5bb2e31310669c799e05
  • e7c461cba22f92a1082995142d9371d062a1788f587075c6ec3358a03f32dba9
  • e8e5366efa6d00f9a21620a3f74d65ee9eb68bced11461886c789392627ef1cf
  • f0827924286a0aaf731f2c0b8734798c42601250c12364878661d9cc8ccdc47e
  • fad70a7a283976a5409bf17038c091947bfdaa45e17e83302a1fc843c5f75f27
  • fb94f2d201e2eeaae73c43f6299225eb31d888018d2931d7385023385f455dab

Coverage


Screenshots of Detection AMP

ThreatGrid

Umbrella

Win.Dropper.Kovter-6998646-0

Indicators of Compromise

Registry KeysOccurrences
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: internat.exe 		10
<HKCU>\SOFTWARE\07771b47 10
<HKLM>\SOFTWARE\WOW6432NODE\07771b47 10
<HKLM>\SOFTWARE\WOW6432NODE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 10
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION
Value Name: explorer.exe 		10
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION
Value Name: iexplore.exe 		10
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION
Value Name: explorer.exe 		10
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION
Value Name: iexplore.exe 		10
<HKLM>\SOFTWARE\WOW6432NODE\07771B47
Value Name: 956299e5 		10
<HKCU>\SOFTWARE\07771B47
Value Name: 956299e5 		10
<HKLM>\SOFTWARE\WOW6432NODE\07771B47
Value Name: 18f8f764 		10
<HKCU>\SOFTWARE\07771B47
Value Name: 18f8f764 		10
<HKLM>\SOFTWARE\WOW6432NODE\07771B47
Value Name: 8de2c2e8 		10
<HKCU>\SOFTWARE\07771B47
Value Name: 8de2c2e8 		10
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.104
Value Name: CheckSetting 		10
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION
Value Name: dllhost.exe 		10
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION
Value Name: dllhost.exe 		10
<HKLM>\SOFTWARE\WOW6432NODE\07771B47
Value Name: 412841e8 		10
<HKCU>\SOFTWARE\07771B47
Value Name: 412841e8 		10
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.101
Value Name: CheckSetting 		10
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.103
Value Name: CheckSetting 		10
<HKCU>\SOFTWARE\07771B47
Value Name: e1616c62 		10
<HKLM>\SOFTWARE\WOW6432NODE\07771B47
Value Name: e1616c62 		10
<HKCU>\SOFTWARE\07771B47
Value Name: 921a72e2 		10
<HKLM>\SOFTWARE\WOW6432NODE\07771B47
Value Name: 921a72e2 		10
MutexesOccurrences
C77D0F25 10
Global\07771b47 10
244F2418 10
906A2669 10
\BaseNamedObjects\A146B82F 9
\BaseNamedObjects\20D5C1BD 9
\BaseNamedObjects\Global\7df04eda 9
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
96[.]17[.]191[.]121 10
23[.]218[.]40[.]161 9
23[.]196[.]65[.]193 9
104[.]215[.]148[.]63 4
40[.]113[.]200[.]201 2
40[.]76[.]4[.]15 1
110[.]19[.]64[.]9 1
46[.]17[.]33[.]57 1
192[.]79[.]201[.]18 1
110[.]165[.]194[.]202 1
75[.]129[.]131[.]245 1
14[.]252[.]183[.]4 1
43[.]234[.]203[.]246 1
51[.]202[.]78[.]227 1
64[.]43[.]110[.]160 1
102[.]186[.]146[.]107 1
220[.]120[.]41[.]19 1
105[.]10[.]131[.]34 1
40[.]39[.]16[.]104 1
33[.]239[.]167[.]136 1
79[.]87[.]240[.]45 1
101[.]144[.]113[.]42 1
176[.]37[.]192[.]106 1
64[.]128[.]116[.]36 1
171[.]137[.]160[.]184 1
See JSON for more IOCs
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
fpdownload[.]macromedia[.]com 10
e13678[.]dspb[.]akamaiedge[.]net 9
clipsource[.]com 1
Files and or directories createdOccurrences
%TEMP%\install_flash_player_18_active_x.exe 10

File Hashes

  • 0405d046f18b12fa283aae775dfc86b7f37b3c9187c478b408b1d1df56e4946e
  • 0f7d26164358095c5e09500102a4fffd4bcabd86f8a8da20ce6d4b1257c6cfe7
  • 3579e91f3bbe9c7f0930e1ae804ed334d7cc7e5edea3477cc1d725cfc9721e6a
  • 4ae693d59ba77b5de104649fa4b0fbfcd4863910253219358e0b60534373d736
  • 62190bdab2b81d6af487289107c0ae880b6f4ac005c81feeefad042fd5cdd864
  • 63ab82c5bb8e3105847973879c43fc754c886bf713a3d2377efd2832ee103e99
  • 7fc0a306813ca939ecb32640b534a3686cad7146930edd8f0b947b490e976419
  • 99f3b3710f26b15d3b9e1363bd12de968651c4a6266838a0d51212dcfd80898a
  • b2859d76620c0dabaed848832f08be73e78cd4deddf9bf34c80ddd243c887f87
  • f3f4621e74ef38c9c05f34fb33fe092db859f16efbff734022617ad72ed2ddf0

Coverage


Screenshots of Detection AMP

ThreatGrid

Win.Dropper.Gh0stRAT-7003005-0

Indicators of Compromise

Registry KeysOccurrences
<HKLM>\SYSTEM\CurrentControlSet\Services\BITS 25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BITS
Value Name: InitTime 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BITS
Value Name: Group 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BITS
Value Name: Version 		25
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\Stuvwx Abcdefgh Jkl 2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\STUVWX ABCDEFGH JKL
Value Name: Type 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\STUVWX ABCDEFGH JKL
Value Name: Start 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\STUVWX ABCDEFGH JKL
Value Name: ErrorControl 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\STUVWX ABCDEFGH JKL
Value Name: DisplayName 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\STUVWX ABCDEFGH JKL
Value Name: WOW64 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\STUVWX ABCDEFGH JKL
Value Name: ObjectName 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\DirectX jrq 2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIRECTX JRQ
Value Name: Type 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIRECTX JRQ
Value Name: Start 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIRECTX JRQ
Value Name: ErrorControl 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIRECTX JRQ
Value Name: DisplayName 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIRECTX JRQ
Value Name: WOW64 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIRECTX JRQ
Value Name: ObjectName 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIRECTX JRQ
Value Name: Description 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\STUVWX ABCDEFGH JKL
Value Name: Description 		2
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
Value Name: SVCSHOST 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\DIRECTX JRQ
Value Name: ImagePath 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\STUVWX ABCDEFGH JKL
Value Name: ImagePath 		2
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NQUFHIVF
Value Name: WOW64 		1
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NQUFHIVF
Value Name: ObjectName 		1
MutexesOccurrences
C:\Windows\SysWOW64\hevtam.exe 3
wenxiaoyan.3322.org 2
xiaocheng780.3322.org 2
sjj184901537.wicp.net 2
a009188.f3322.org 2
C:\progra~1\Common Files\svchost.exe 2
tcjzzf.f3322.org 2
xinshoutouliezhe.vicp.net 1
\BaseNamedObjects\944413269.3322.org 1
104.194.20.12 1
wytcn.com 1
liwtao.f3322.org 1
182.92.223.28 1
C:\Windows\SysWOW64\akqukc.exe 1
C:\Windows\SysWOW64\lijlio.exe 1
103.40.100.191 1
C:\Windows\SysWOW64\wgccga.exe 1
C:\Windows\SysWOW64\eoemoe.exe 1
C:\Windows\SysWOW64\scokyy.exe 1
mama520.f3322.org 1
108.171.243.19 1
23.94.244.17 1
23.94.244.18 1
C:\progra~1\Common Files\SVCH0ST.EXE 1
125.46.39.66 1
See JSON for more IOCs
IP Addresses contacted by malware. Does not indicate maliciousnessOccurrences
61[.]142[.]176[.]23 3
123[.]249[.]34[.]172 2
125[.]109[.]109[.]30 2
27[.]54[.]252[.]252 2
174[.]139[.]226[.]178 1
42[.]236[.]77[.]185 1
104[.]194[.]20[.]12 1
182[.]92[.]223[.]28 1
103[.]40[.]100[.]191 1
198[.]13[.]108[.]245 1
108[.]171[.]243[.]19 1
23[.]94[.]244[.]17 1
23[.]94[.]244[.]18 1
125[.]46[.]39[.]66 1
154[.]95[.]54[.]46 1
Domain Names contacted by malware. Does not indicate maliciousnessOccurrences
sjj184901537[.]wicp[.]net 2
wenxiaoyan[.]3322[.]org 2
xiaocheng780[.]3322[.]org 2
tcjzzf[.]f3322[.]org 2
a009188[.]f3322[.]org 2
xinshoutouliezhe[.]vicp[.]net 1
944413269[.]3322[.]org 1
wytcn[.]com 1
liwtao[.]f3322[.]org 1
lbaabb123[.]f3322[.]org 1
sjj184901537[.]xicp[.]net 1
mama520[.]f3322[.]org 1
westexpired[.]dopa[.]com 1
Files and or directories createdOccurrences
%SystemRoot%\SysWOW64\hevtam.exe 3
%System32%\tgvbgq.exe 2
%CommonProgramFiles%\svchost.exe 2
%System32%\ggiogq.exe 1
%System32%\jwzvwy.exe 1
%System32%\hufzuk.exe 1
%System32%\kkwgks.exe 1
%SystemRoot%\SysWOW64\totbau.exe 1
%System32%\ycuuyi.exe 1
%SystemRoot%\SysWOW64\akqukc.exe 1
%SystemRoot%\SysWOW64\lijlio.exe 1
%SystemRoot%\SysWOW64\wgccga.exe 1
%SystemRoot%\SysWOW64\eoemoe.exe 1
%SystemRoot%\SysWOW64\scokyy.exe 1
%CommonProgramFiles%\SVCH0ST.EXE 1
%SystemRoot%\SysWOW64\wgccca.exe 1
%System32%\dqrhqi.exe 1

File Hashes

  • 0403e7f8d9892722756918c24801cad3d661815f5c306c8c5391f1ab8a630ec4
  • 04d45c30a242afecf9a8d9e6cbf583029f794f13b22c22108cc0f5a6d79aff1f
  • 0a18fd63c2489ee27c7f4802ef60011cf270fd035ca3153ff0587fb201683c07
  • 0b88e2e952e057d1e67eb9aced20ed79cdb4ec00b4de5c306394d5996f6c1cb3
  • 0d9854cb571a8ef781ef4ebfd82bd461b47273fb637e80b8863388eaa7325c37
  • 19268cf4f3d3e6f37cea8d3eb6c67bd4f9abbe0dee6cba4c5ee623904e781574
  • 3464e90e1b93df7d1bf837fa799be811665b1d12d5320a2419d5cdb354cfe6c8
  • 429cca47e464202273ccf9a33f2e08aa366fe1bb59cee9ebbb1735b401b72be3
  • 4675518e7355804e0134dbb26889ae2fa0e3857110645076082087fd0c9d7517
  • 4f64ef87e5b5094f0f3b501f46f8029f0ddb47054a2d1810b50b149d6f179ae6
  • 4fcfea79eaf6fcb55cf0fdf5feab7217f949af742f52a6e12ed8e6590b19494b
  • 51b8854b75c9c928ef77a2d76ecdab13ff6aab4399960005acd4a9dd8ed4df18
  • 526e31726b1a3109312721f5d210db6e384a799951fbb9b2170a34672cd15f18
  • 553d09ad92a5abcb4987335fba0ca0fda30ceef2c33e8f72747dcc1de969ae32
  • 5ba1e4767e5e9f9d0c10d64d5399e13f83e727b96d68c68413a40773f11d1690
  • 5c2d5a7e9fe0721c8c00bc61b8b32db9bdfdd874cf2cdc3542c719b289535f87
  • 5c9a6cded235870fc95ca7e3a2aea98d642da688a7fdef40391bcd52435723ca
  • 5fb34b0666b3e21e5835c2f7d05ccab2b076e462c6982175eb638d9c08b9f138
  • 64f8a4a03ed33a6ce0b19e52411ecb58a834840db6f1fbaa46ee815a667cd362
  • 681e1d899c9342f6cf5a2600b1af723f1ea0216467050f023ed7f33da078ec72
  • 6cf9e25edd01d958328923af88edfc9224d26e1ce72a677f6f0f4c64cff11600
  • 70bb286abdffddf3137e5f8c2f3fde94fbb3c58dacc9bd7ac5c2e816829429a6
  • 712e9f3f962722317243c52aec1edeaecc59d53180873b67b108eeacc27ba84c
  • 7433255788cf4f6761369a89313ed5786b32049c7bd48c50fb8f62328744f5aa
  • 77e44b92cd3403248e82b31b16efa7b4114e872c5c1206600c2222d8020cc2b7
  • See JSON for more IOCs

Coverage


Screenshots of Detection AMP

ThreatGrid

Exprev Cisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits. These exploits use certain features to bypass typical anti-virus software, but were blocked by AMP thanks to its advanced scanning capabilities, even protecting against zero-day vulnerabilities.

  • Atom Bombing code injection technique detected (10876)
    A process created a suspicious Atom, which is indicative of a known process injection technique called Atom Bombing. Atoms are Windows identifiers that associate a string with a 16-bit integer. These Atoms are accessible across processes when placed in the global Atom table. Malware exploits this by placing shell code as a global Atom, then accessing it through an Asynchronous Process Call (APC). A target process runs the APC function, which loads and runs the shellcode. The malware family Dridex is known to use Atom Bombing, but other threats may leverage it as well.
  • Madshi injection detected (1932)
    Madshi is a code injection framework that uses process injection to start a new thread if other methods to start a thread within a process fail. This framework is used by a number of security solutions. It is also possible for malware to use this technique.
  • Trickbot malware detected (1694)
    Trickbot is a banking Trojan which appeared in late 2016. Due to the similarities between Trickbot and Dyre, it is suspected some of the individuals responsible for Dyre are now responsible for Trickbot. Trickbot has been rapidly evolving over the months since it has appeared. However, Trickbot is still missing some of the capabilities Dyre possessed. Its current modules include DLL injection, system information gathering, and email searching.
  • Process hollowing detected (941)
    Process hollowing is a technique used by some programs to avoid static analysis. In typical usage, a process is started and its obfuscated or encrypted contents are unpacked into memory. The parent then manually sets up the first stages of launching a child process, but before launching it, the memory is cleared and filled in with the memory from the parent instead.
  • Kovter injection detected (727)
    A process was injected into, most likely by an existing Kovter infection. Kovter is a click fraud Trojan that can also act as an information stealer. Kovter is also file-less malware meaning the malicious DLL is stored inside Windows registry and injected directly into memory using PowerShell. It can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2. It spreads through malicious advertising and spam campaigns.
  • Dealply adware detected (605)
    DealPly is adware, which claims to improve your online shopping experience. It is often bundled into other legitimate installers and is difficult to uninstall. It creates pop-up advertisements and injects advertisements on webpages. Adware has also been known to download and install malware.
  • Gamarue malware detected (231)
    Gamarue is a family of malware that can download files and steal information from an infected system. Worm variants of the Gamarue family may spread by infecting USB drives or portable hard disks that have been plugged into a compromised system.
  • PowerShell file-less infection detected (61)
    A PowerShell command was stored in an environment variable and run. The environment variable is commonly set by a previously run script and is used as a means of evasion. This behavior is a known tactic of the Kovter and Poweliks malware families.
  • Fusion adware detected (45)
    Fusion (or FusionPlayer) is an adware family that displays unwanted advertising in the form of popups or by injecting into browsers and altering advertisements on webpages. Adware is known to sometimes download and install malware.
  • Excessively long PowerShell command detected (43)
    A PowerShell command with a very long command line argument that may indicate an obfuscated script has been detected. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.