Showing posts with label Alexander Chiu. Show all posts
Showing posts with label Alexander Chiu. Show all posts

Saturday, May 13, 2017

Player 3 Has Entered the Game: Say Hello to ‘WannaCry’

This post was authored by Martin Lee, Warren Mercer, Paul Rascagneres, and Craig Williams.Executive SummaryA major ransomware attack has affected many organizations across the world reportedly including Telefonica in Spain, the National Health Service ...

from Player 3 Has Entered the Game: Say Hello to ‘WannaCry’
Posted by at No comments:
Labels:

Friday, May 12, 2017

Threat Round-up for May 05 – May 12

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between May 05 and May 12. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

  • Doc.Downloader.WithMacro-6310867-0
    Office Macro Downloader
    This is an obfuscated Office Macro downloader that eventually leverages Powershell to download a malicious payload executable. Typical object interactions are obfuscated via the WITH command.
     
  • Heuristics.W32.Parite.B
    Virus
    Parite.B is a polymorphic file infector. It infects executable files on the local machine and on network drives.
     
  • Js.Downloader.Nemucod-6311824-1
    Script based downloader
    Nemucod is a JS based downloader that continues to be highly used by several spam campaigns & active exploit kits, oftentimes as a stage toward dropping popular ransomware on compromised hosts. This particular variant relies heavily on hex character concatentation ∓ naming conventions consisting of randomized 0, o, or 0 characters.
     
  • Pdf.Tool.HeapSprayHeuristic-6301967-1
    PDF JS Heap Spray
    PDFs leverage embedded JavaScript to exploit vulnerabilities or at the very least gain access to additional functionality provided by JavaScript. Typical exploitation techniques require a heap spray where JavaScript is used to copy the same data many times throughout the process' memory.
     
  • Win.Dropper.Elex-6310653-0
    Dropper
    This is a dll which is downloading files from dga domain using powershell scripts. Observed installing adware Elex, but can be others. This dll is containing also indicator to perform operations on raw drives. Persistance is ensured with service installation
     
  • Win.Trojan.Generic-6305879-0
    Worm
    Gamarue is a worm that can spread via removable drives, spam emails, and exploit kits. It contacts several malicious domains, and can be used to install additional malware on the infected computer.
     
  • Win.Trojan.Nanocore-5
    RAT
    Nanocore is a .NET Remote Administration Trojan. Its source code has been leaked several times, making it widely available. Like other RATs, it allows full control of the system, including recording video and audio, stealing passwords, files, recording keystrokes, and so on.
     

Threats

Doc.Downloader.WithMacro-6310867-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • N/A
IP Addresses
  • 185[.]165[.]29[.]36
Domain Names
  • N/A
Files and or directories created
  • N/A
File Hashes
  • 009ea577f9f7c8d311b96051c3a6e4fe288647fe4122c2fb0c14240565097012
  • 015f06d82006879a5e040e913f8ea91ed5ad01249f753cfbf1888daeb19073e3
  • 01dba2caf8c50e171d4cfb45b788b589af06f4a467174325c88f200ca7ca9198
  • 0212c580c27761eddea2af38b0a0c1fb9b32789c5574ea7a23f8184570d8dfb6
  • 03aaf18f3a59fb063622511d6b441999ff90c06742911419052251ec320146b8
  • 040e61e10a7a85c23041c1f0e4635dd2ea9307787eb17e88f80372529e9209d5
  • 06e4b3a33127ddd8ff0157fc0ba1d2d24a8f26ed1a149b4388c01d30350c0ccb
  • 072e99a20f62ec2d713db7e088edac0fcdb90a77f0b10aacd7d0e549d694f0ed
  • 0a428729361a8a712cbfd3d8574b234306c12c32b327d3cd207fa188460b1e3f
  • 0a7922eb74e6139a08fa8735a87cc47fc62c1f6325aadbac2bc82c2981f2ada1
  • 0b9e0425aea9565b0307a322976f77edc6802e443cf5f62f724fec4ad83a9d28
  • 0bacdef1c789dde9662570062587098b7c693bb7be89c0a22b824aa5fbff6056
  • 0bfc71f69f2bd4db2ae9fc900e11509852e1eb8874f39171287e86bb7284868e
  • 0c7f5c69e828c88778314be34c3468ab9a2bc9705cba727bb3c89832c3f91113
  • 0e9246ff490f54d156cc3426e434980bb98a81935f1c9666a93237428b8e0ea0
  • 11769cdaf3c210df174702803fbc4afa7b2cc20a27ec30ed0e4f81118a66de10
  • 11fe367d79f104632d9452027a7377b4c51fc0f43f32d7a6fe73f34fc2cce508
  • 11feca2c6b6d0be07e01bbaa910ef8a44c81f89ad1dabcdc5eeddb37ff12d854
  • 12e7c347609f1b2aea12e47f12d15df579c22162a49338977d4694dad7fff028
  • 1333e3e5be8cc510e33c609a7080764b12cab70e5ddbb57167309f15557edcae
  • 14cc6de1dd265d0943a96b4852e6f8c5828f636131333d0c19b2dc5f7a0ca1ff
  • 15bafa0d6de0681cd079ae866c4ed4f1c9917ce96261215564c8f0029f9675e8
  • 177477fcf8963dbef8e22bd32f7f08e4b103af89ba7f3e7a4a997513e1532629
  • 17abb7ca3e200e5c7965ffee65629d3d113717bd858377948e577200e6be11b7
  • 1997e3d6ba77ea68160b88c083aca9bca8d8bbf8e1191e86c1660f7a4b038f93
  • 19d6fc360c1af923e44f173989591f382ab965767802bc54a2df875a10ca4e38
  • 1a50f4767495978a5ca9e34fcde61a74657e04d12b04bac60c0b0b6aac26c588
  • 1b6a81db9bf395f8f80e1d23b143d5ac049af16878f66ecd3874f4cda406836a
  • 1f9a0e385cbce520988e24bf1b95b4cd7976d46637864e5fb20548068b3cc4eb
  • 220791a76a3befad1dd9e71a8664ab7546ee1cc98a9b061abb2cfd577b8bf55b
  • 25291ca354bd11e6864e84eee74b3a271541e4aa6e8479f3cafe13210b8bafcf
  • 28b343fc742da18b7ffc9a2e5e9c49b8f54cb6ac724849ccb56b4d079088d1c6
  • 2a7eae250d89a5fdc9ee3acb57d1f068eb5b1ed06aa48c9093d095c3187271e7
  • 2b3ea22573384712690f76dbc939935a848a739f61a7c69e92f11b4eb77bbc41
  • 2c960ecfc9cb060bf73cff44accc258f47164c3b7b497bdf3d02f7088bce7d7d
  • 2e0b71ae5e202e569ecfa9731f58376e1d24a5dea725e4ef2eda64939dfba226
  • 2f0220eb391f691e51b2afc724d9cd04a9f869e34fe9e8c715e864f13546136e
  • 2f0877a8ebbad2f4e11709da5a99453b812a86ba0e5502a6b0791b856fc9dc6c
  • 2f571cc5b3f708e3a6da99c9d61f99d0230052e9a0cc483644044f92537a7ddf
  • 30224c91115b5c4212de3dcb8cbb412b59084d8bea1ea9f54525de0a07362b68
  • 30a37e174b9a8433ca9befda236c985daa5b92aa8cd078e8f6e033e61914caa3
  • 31819465f95180892f68afb2f4bda5eaafcb1ac7138fcdd0e91e951eeb307e47
  • 33242ab139dfef3cd6f6e2938d54737c5efcdaf00217e1c5b49c2dc5618449ec
  • 34ca6fe49ec7c5b318e55183d09c350af5b418209558ca1ff6bdc53034fcaced
  • 358782ef63e14ff6606fc4e1b91da61ba19383e403fab6997cf5d2b000d5136d
  • 36d1b267808d306d96ff40520b1cd1f04b861847313dd0ea60fb5bf764843b21
  • 3736940527681c6c0daf9c25fdc1807868bab9c339a61a7ed88f8c7e335128f3
  • 37f39f494673dabdb49c254a02aeca1dd350f8ea828b928cd4d8f42e6c6cd264
  • 37fa50440f8950df0d0dbebe2b052925d9014ab85c3c8b62e3d9fa49f327cc41
  • 3ab653f63c43209910645d6d87d8b60419ace960dd16e275f407cf46bce0b8b8

Coverage


Screenshots of Detection

AMP


ThreatGrid



Heuristics.W32.Parite.B


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • Residented
IP Addresses
  • N/A
Domain Names
  • N/A
Files and or directories created
  • \Documents and Settings\Administrator\Local Settings\Temp\jnj1.tmp
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mhbD.tmp
File Hashes
  • 00667eb42299cf767fd996961e426f3af3471c71f1e612ec2d832576289077d2
  • d8e6807fb1b2ca4d3e9ce8c15415839ed8e9a57cfe7d3e362d0e225de436eb77
  • 5a16d398170bc582ddc864b35271526defce211dc9026739fdeca9260414f36a
  • 742fff7851b87b91583f54c2c70438ede8af603aef3e3897e5792665b382b0bb
  • 3107785dfb03aa0a1b072ab4a9de383733cc53724f94d04647129848a2418d79
  • 415d459846a0f9453963b0474d6a6ad877c7c25c72e445b0f6e6e585cd5b400e
  • 2c4657c53467b77fa8c007468ce756f623e302294a288782041c3fd225828af4
  • e67254d17730ec06704cd78f65182380f02f6e09997b2d9fec815d7209705965
  • 50ee4a9db6b125b5b57693f2aeb622c3133811f31e6b81034f3bcbec5af7f6f9
  • 644d71edbc489214fc98d55504059da222f888169363a5d7d21e44ddf1d825c9
  • a176ecdb644b79d68cd721a7b417edb425a88e9cdfec6c490b194056e3a47024
  • 8f0419896c6b0dd5bdb2748777f3e96c4bbfb7f7e96ae88fecb025607fa2d194
  • 9510fd8c732f0ffd693931090c326ebaf2ba12f2b2c6ea53225d932adfc4bd22
  • 0280366ea9ccf3412e0eb354b03c2ddb9ebf5a60eb236a0aa6a4334033b8d267
  • d31e56c10e62524c241d878b4ab94eea6193bfcd22f4b89f3fd8beb9c55cc9da
  • d2674afebf388fc5b068288df275554b098b8c2ff3bc93606025a273f5c09670
  • de0210ad1d7c25c124b110ef3fed6386ff25a311e35ea301d83bf7be9eecc23c
  • 23c81c28545fe91270f72dd2463609ecac4ba8163ebadabce343f18425a08929
  • 2345aab3ecebc954de2839fd61501f9fa8fb886566f85f88be535ecdbb263d2a
  • 0c6478931f2e3edb41d5b6cca8d4f033864a033e084323762a0cc0714b62f128

Coverage


Screenshots of Detection

AMP


ThreatGrid


Js.Downloader.Nemucod-6311824-1


Indicators of Compromise


Registry Keys
  • HKU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Mutexes
  • N/A
IP Addresses
  • N/A
Domain Names
  • 37kddsserrt[.]pw
Files and or directories created
  • N/A
File Hashes
  • 15a37811fe59536bfee4155c41b94911d9d507beaaff2fa673dd1da3e1f369e0
  • 1a7e222d39aef7ac4d8006503b46145e127ce6eca82eb75c22163a73c40e27b3
  • 20ffb283d1af44cb42afbee43c2b386021e7dedb9c59c1d5a95ac3e05fce9742
  • 2f80a68b8603b77c2f138e1a6c082e1308dba1d1e7c7e4d91b25baab67251d0a
  • 2f917ae9ce62698dddc07f55bafc3f95937ba2cac1f75e5e2678a1163d175e2c
  • 3ba9904b8ebd1b81c406293a55cb1ccac03ef574bbc8f3a2ecaa726930f75b7c
  • 441ab6cd707bb4a485395edf30b7b1eff84cc02f2cbd0f6a83c8a269c72c9da7
  • 4d8d2444d77fc8c802be80fa93e317316bd86f3f9ee2699d971c89f36a4cbfd3
  • 92649f778b58afd71bc8f500465489a67c16be7789f5aff8ffcedb6216679ff2
  • 983446fa82305c52ff87a76be94a75ae1c7c10c6c43a6481bd4db8b7e679eddd
  • 9c74de5f43b79fd44843126716f8c27b1dc4f33dff779fe2cd7a5eded23c4dd2
  • a655770566e3c0783b3fbf8d9be3fb713d9e6380ec3e5a9aef5881f761e8925d
  • aec59a27af9c7ca54247666338ad0a6a0d74a23ee0e6bd7c33be76b7872a49ee
  • baae74e6a153bb597d8ceb81f22508c55d8697fb748502708c9666d78d53a4c5
  • d0f0a5c540a3e68f417590cb4f27a6f9da4401b2b0e71ccabe6f46d0a7e6135f
  • d13ffcf550abe6033977d5730babf4dff4358487d35d646c043683515f39e89a
  • e290216a1ccb5561d17e1d0d681eb27e7c301d774fdb275fbb1292ba98fa137a
  • e4acd53b4ecb0bd3cd0e7a534d4d0a80fd221bbb73c199ffa3f44019a1989a55

Coverage


Screenshots of Detection

AMP


Umbrella



Pdf.Tool.HeapSprayHeuristic-6301967-1


Indicators of Compromise


Registry Keys
  • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\PORTKEYWORDS\DHCP
    • Value: Collection
  • <HKLM>\System\Acrobatviewercpp304
Mutexes
  • 2AC1A572DB6944B0A65C38C4140AF2F426c714578B0
  • 2AC1A572DB6944B0A65C38C4140AF2F426c714574CC
  • 2AC1A572DB6944B0A65C38C4140AF2F426c71457750
  • 2AC1A572DB6944B0A65C38C4140AF2F426c71457468
  • 2AC1A572DB6944B0A65C38C4140AF2F426c714574A4
  • 2AC1A572DB6944B0A65C38C4140AF2F426c71457490
  • 2AC1A572DB6944B0A65C38C4140AF2F426c71457828
IP Addresses
  • 85[.]13[.]129[.]180
Domain Names
  • www[.]osterkirchengemeinde[.]de
  • www[.]evangelisch-in-rath[.]de
Files and or directories created
  • N/A
File Hashes
  • 0ed5bb2ef055843c083d2316999e99827a4ff8bbc143c88a38cc413f9c2c116e
  • 4cabe4eaf54b986b6f2170be4e89d98aed85c4012d64c8b4de0f1a74260228de
  • 9c85ae448c23c19b4049e5290453027f81681348a28b5f3859aad247855db881
  • afaaa1de8842a8e4d57c856cfa48d8eaef4177ba0842431c5108eb65e8b028f1
  • 1ef663a739551ca8e3b13ec5d174025a020ca0a9973ebf161532518a4d8c757f
  • 706672cad725b4e660d5c5d49d07ac40ecda3f063ba206bf1631ef70e1677b2d
  • 0a943757893342c4fa59b3f27b7d5495be02b19c748880fce980e17573ca3603
  • 4675f673f32f990cdd142485944cf45578aa44777905ff4f69b79bfca478f78d
  • 97dd140d08ad59d23511cd8c693e228c1873f980082a03bc7e6882ec66286cda
  • 95e247c1d3e2c57e290333a3d3ddca9d4ec10df89c65a7b2bf6dcf3a149d5707
  • b74b8beb8461f677edd2c3668cd2b1b75e10a4ad478dd3f5ab6e0e0ce411173d
  • fee4c7f0f121a24026274b75b230e8320153ca6b04398d62e727992dc7805cbf
  • 6269e027e2e35a3cc05683a26be9d3912b71821aed363ccfe03fd6714ba62bf9
  • 87d75c307f059c7c6b9dae22aa672eee59cbba102fb836157daa4022f4aa2daf
  • e708eeff27d67902a1bf69fb5e915b3387e8f978aec3381564bf216614f7fdb2
  • 10258a93f571c695996c68ed138af3cfe27599d972ece06d8ff83c41d8feea55
  • 22418e0da375bbd39ee22a31b439d943331fbf93090656e0228ba090a5411ced
  • 19c8b5e940dd58be7d922b82803551f33edfdd5b99b51f975572672355afac24
  • 4c357d0e23b940794e4fd02db568b791d4bbafc3c01f13fed36746c3a8ff7389
  • 5246ba3e5adf83a61d531b71010ee97ce95bb0f576de2e5f17d9d9335bf60b5f
  • 94a7a438d7583a89eb1c2d36a2c425d2bcebb46da9003881ca56aff7693db25d
  • 78d4ccaa8d70737c6c414e22f2fffbdc4f50ce2669d355cfc306e9765041c49d
  • 774b078fb180647b85b054f1402b593b418f46cea143ec78bfee33b8549d77eb
  • 6b54c11ba12507c70f28b1217ac12b7ffac7565269e49679358e4a6171e0b09d
  • e40981cc4fb3302bba6843222c7e2bec31128aed4307247a228656d09362640d
  • fb5cb1b158ac996ff9e2181eec27f5e165ee15b7210dc3aa7e1386dbe3fb4c02
  • ec87f2b3b3e506e4b56f6b07b6e5287b6907fe692957990581bd5855361f6548
  • f211816b7459d3f032cf816f8d218117b19d2b3936b7496e7d7f8ba25745a5a9
  • 3d84331388d5ff3bfcafbe9ac21342530028e6697e186a8f2aaeeb91dca07ae8
  • 2b8bf40b0c7a7a4c17687d997e2382c701a38704c6218e8bbd23132c755144ba
  • 35f378fadf4d4a483dd4fedbc381d3409718896c4d77a2844509f1fc54eefc48
  • 734a5745a213cea15d8136aa19134a20a128bfc946158ae3f62293e83cbc9be1
  • 97f27903b0514a185be1953a4723b41397cefb323895341976e32303a6c40496
  • a88324345da77b1bb039aae33cfaa276dbc2a23a9366ff343f7d4cc814ebed10
  • a5fc5fbebb46342d1dd34352227bfb14f95bf942a889d48503b0b70a60ade4d4
  • c7f9bd64a9ef18d38575a240490bc84e477397d0ceb92a3fd50b3c54c9e54ed6
  • de56b4596f74c18f6bf6214ab4e65f77116b310e8a29e7a311068e0d2e213ab2
  • cc218b74a0dcee14ef0ef2945e24c3131fc6ec0e686f0ae4d829884914eaf67b
  • d19e62d473c5ed40bc68c46cc3a7bebca0b88f7cb030dce05b2e2c9b65bc9cf9
  • 1a069aab9f5b2dcf80ba50bcfb2b19384f1dc366e08d2c2e6d93305340cc69e2
  • 1c4e83094a1f5ae3cb209289ea8a88610b54703669537e07acbf329c0b6dcfb1
  • 0097500439d1cdfa7201438e2b833ab9aae853d2055be97f555745d22bb4f2dc
  • 10e4a16f1dc67f56f2fb8c4e9c77f524dd8e75d3c4da16a310a14655e8f9f350
  • 095b45f74868dccbf0c16861d45d664d59207be569a0bbff61dedb6b64995f3d
  • 219e6afff26d23e1b86be14ec89573f2c212dbcb825e11fbdbdad4e6788c86b6
  • 577ed1dad1ab726daa5fc3a2efdcbd2c737d58c79f9ddd5aa2300876a9b66fc2
  • 8e95f4bfd0e6b15b7ebcc5b755419f14fae4acbdf000620be1ed4340259801a7
  • aeab75acf64b90cb741e81399ea61f31c86c2ad54ad156c6218f4cfe6b6e3dbf
  • 1113a806123f549bcab408286f05f615906bbe93016bb4678899101c533cb4eb
  • 1a303ada7458d80307c454c2dc045f169f5623e0b0282ca84ae4682c03ea41a1

Coverage


Screenshots of Detection

AMP


ThreatGrid


Screenshot


Win.Dropper.Elex-6310653-0


Indicators of Compromise


Registry Keys
  • <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet
    • Value: WinSAPSvc
    • Data: Parameters
  • <HKLM>\SYSTEM\ControlSet001\Services\WinSAPSvc\Parameters
Mutexes
  • N/A
IP Addresses
  • N/A
Domain Names
  • dhxx2phjrf4w5[.]cloudfront[.]net
  • d4c04g24ci6x7[.]cloudfront[.]net
  • dc44qjwal3p07[.]cloudfront[.]net
  • d3i1asoswufp5k[.]cloudfront[.]net
Files and or directories created
  • %AppData%\WinSAPSvc\WinSAP.dll
  • %SystemDrive%\winsap_update\Do24_Proxy.exe
  • %SystemDrive%\winsap_update\WinSAP.dll
  • %SystemDrive%\winsap_update\wsc.dll
  • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\cspE.tmp
  • %SystemDrive%\winsap_update\winsap_cf
File Hashes
  • 9e509317500fbc908cb5cb6a064abcbbf98eeb6ab0825fa5f962ad460674f263
  • 540af140928834a0e904d897408e6ceb118aec79835f0050b504541688b028d4
  • b00e14ffa5a1995524e938c8c89bfd4f278ffb7e98ef738412cbb0674bc0966a
  • 6ffbbfd27387e2a941293ac752b18ef9baa5801f07a3be4695ae465fd8164846
  • b1e726e34c0920f8e394af5327f86383ea014d072809f31c409e6d8428629189
  • b580b561468763a4ccdd66d37df929fe5b31f615e75dfd8b537eaed1c85213d3
  • 632d67e4b439fc0fef2a430b885ada2687e8e0af41c8cf74b37a70e809f7dcde
  • 2d9bffb5b2cd0a3d0251d753856f11d6b3fc6a26eedd17c9bbbefe52eafce55b
  • c640da31b32d736f784eee0c5adf742cd607388ac3772097b1e4bb184a9839cf
  • fd708e0fc599cc3c78f6af9f56af9da466f7f46984d3be5ecc678177a752e027

Coverage


Screenshots of Detection

AMP


ThreatGrid


Umbrella


Win.Trojan.Generic-6305879-0


Indicators of Compromise


Registry Keys
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: IntranetName
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: AutoDetect
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: IntranetName
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: ProxyBypass
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: UNCAsIntranet
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
    • Value: skypee
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
    • Value: ProxyBypass
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
    • Value: internat.exe
Mutexes
  • 4030631218
  • lol
IP Addresses
  • 23[.]253[.]126[.]58
  • 166[.]78[.]145[.]90
  • 208[.]100[.]26[.]251
  • 104[.]239[.]157[.]210
  • 65[.]55[.]50[.]189
  • 134[.]170[.]58[.]221
  • 224[.]0[.]0[.]252
  • 192[.]42[.]116[.]41
Domain Names
  • imageshells[.]com
  • sonic4us[.]ru
  • bighecks[.]net
  • www[.]yahgodz[.]com
Files and or directories created
  • %WinDir%\Skypee\skypee.exe
File Hashes
  • a53102b5cf8a0d9e395d239b7e3bcd810602d9860a6c013d98eb1260a6e556c1
  • ba811b3bdfd1a0a931327fad9ad2c093e18edf17843df225fef862c8092bb67d
  • c7b096cbc62fb44ffa9d61cfd829c6ba601996035d91635753cdfd676999bb0b
  • 9a62ff51346d88251f6ff3bb06e287adc96f9b25def1ce9fca61b8eae6ceaf31
  • 615cc70cdf50d8b217dd54f97d41f58bb3567d9bd49c09bb46d9a945239d9834
  • adc844ee16010d8333770d1eb59ced6c15e161ca08a9fd8b3540c16bfd4dde51
  • 2219c33bee232930783a85f091d1931b70d079300170699e5b9f3f958d8a504c
  • dd3991e7cf0239c99fbebab008cd8e2b4d1748f2506ce52a9dfe89049f84c25d
  • d25abadcad1e43d972828f74f6fcc8945d716193c20c966dac04458c56b16cc0
  • 7b1e6b8f13e87cdcc61c9924ccd82a9a11e250495261fe65ef9bc0cd658c0cba
  • 352485d048b952fb502e967c7504113dcaa65b6bd7d90b4ef1553300c2e1cd10
  • bf0a13f37cda4d33191115e22067a70a60ed5e8a47fe64714df6f7c7379229e8

Coverage


Screenshots of Detection

AMP


ThreatGrid


Umbrella



Win.Trojan.Nanocore-5


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • N/A
IP Addresses
  • 95[.]136[.]188[.]213
Domain Names
  • denialfx[.]ddns[.]net
Files and or directories created
  • N/A
File Hashes
  • af74e9d03183e787b7be30e5b8cdeb2caab2efed50ff100b783fa718f5091f17
  • 1092399e3f24750b7dcc6bad8ab83011ad36dfb96b0d7096d5589a1c7aeab4f3
  • 1b672136fb4aed1cf243d8a60e5f16f22cb7419e3b5bc874d572e1b64e714e9c
  • 0d798d302878b8f8860ca469239d18dbe41e6df7fe3e6643783eeb4c8a2f8f84
  • 58592983390f2aec8659a7d3750bb11c236fa747408b96e9ec00558c4d7783d8
  • aee3bb0f4210c2821c379ba88f06070debef705a3cf14ba3f20a25f9e69d57bc
  • 5a08c426b6741e3ecea4b46120f4aaa231aa3718c51e0c026a5a6811b75ee2ca
  • 8738e8f913de386cc8e38acab178d73778a2e7e6fb9b9d93654cc965be5d4d2c
  • 3e77823a066203d327fe020185852b38d6c7aecf28fa84907cd31d897a3ddb6d
  • 9f1c2a1a9068fb232fd072f8c02b88c70303f53f1d816a42902263d2f4ee8103
  • 93b627ee36e381a3fe557fc3ac43e5734bcec288a1b96ab84c77c6565ead8c18

Coverage


Screenshots of Detection

AMP


ThreatGrid


Screenshot


from Threat Round-up for May 05 – May 12
Posted by at No comments:
Labels:

Wednesday, May 10, 2017

Microsoft Patch Tuesday – May 2017

Today, Microsoft has release their monthly set of security updates designed to address vulnerabilities. This month's release addresses 56 vulnerabilities with 15 of them rated critical and 41 rated important. Impacted products include .NET, DirectX, Ed...

from Microsoft Patch Tuesday – May 2017
Posted by at No comments:
Labels:

Saturday, April 29, 2017

Threat Round-up for Apr 21 – Apr 28

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 21 and April 28. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:
  • Doc.Macro.MaliciousHeuristic-6298845-0
    Office Macro
    Office macro code is used to further compromise a target system. Macros can leverage external system binaries to execute other binaries to further compromise the system. This signature looks for code associated with hiding the core functionality by including junk code.
     
  • Win.Dropper.DarkComet-6301230-0
    Trojan/RAT dropper
    This is a malware dropper. It currently drops the DarkComet RAT. The file is a slightly modified version of wextract.exe, a legitimate Windows tool to unpack archives. The malware payload is stored in the resource section of the binary. The dropper binary is actually a multi-format file, and can be interpreted both as a PE executable as well as a cab archive. The modified Windows binary will extract the payload binary from itself and run the extracted file.
     
  • Win.Trojan.ServStart
    Trojan
    ServStart is a trojan that installs a persistent service on the victim’s machine. The service exfiltrates information about the infected computer including machine name, username, keyboard language, and computer performance specifications. The malware server can respond with commands to download and execute files, or execute shell commands. ServStart has been observed using multiple dynamic DNS providers for its command and control infrastructure.
     
  • Win.Trojan.Agent-6298180-0
    Trojan (credential stealer)
    This sample attempts to collect stored credentials from a number of installed applications and then attempts to transmit those credentials back to a PHP application on a possibly compromised server.
     
  • Win.Trojan.PWS-6299789-0
    Password stealer, injector
    PWS (also known as Fareit or Chisburg) is a credential & sensitive information harvester. Select information such as banking credentials or web browser password databases are queried for on the infected host. Any discovered data is propagated to a C2. These recent samples are protected with the Armadillo packer & rely on both code injections & dropped VBScript code.
     
  • Win.Dropper.Emotet-6301061-0
    Dropper
    This dropper is delivered through different mechanism, most of the time the victims is redirected to a website to get it through malicious pdf, http iframe injected. Once running on the computer the binary is gathering details on volume disk drive and other details, injecting process, dropping itself and contacting internet to execute more. Websites observed delivering ransomware and trojan banker.

Threats

Doc.Macro.MaliciousHeuristic-6298845-0

Indicators of Compromise

Registry Keys
  • N/A
Mutexes
  • N/A
IP Addresses
  • N/A
Domain Names
  • storefronts[.]pl
File Hashes
  • 23b90b1c55fdbbd371655da0ccf359e891deb51ed5bbc0ac772c5d572f4b3a42
  • 2471636a92daa0a54095aa66b55ad2fea5fd5d6372b0be9d65d1d1e2cef31bd5
  • 2b24221aabc8cd18e756a579b29a005fc9c33213f5ec963b9b6ccf4e6187b23b
  • 4b781b8370f973b9204b44c8ce3615692fc66c1613967a44924984d35fba7bc4
  • 4ee6b9bb8e903bed9a82c7dad6d62163e3a4f759ade5f5f8fcf899945bfd9264
  • 564c37dcd8322bd6e8cabc788f982a35f7d3e335c3d736ce544fc17a6b090183
  • 59b54e7c4e052adbc1d64dc61623af6f55db1a8692b373cb6ca871ba087feaac
  • 6930d456c506c94b9e19a08659181b7d376254dca652d0e56c305764867578d2
  • 6a0eae0addd6ce84966ac1bd006e9582036eaaa1011a38190f700871cc37de24
  • 7045d8f339cab73cf0ec7f31a7b3a31a84057f0b275f789f4bfed9dffee35564
  • 7638745d08de218fa16e9c0828ed0a1139223d3ebddf4bb528bc3ae185cea90e
  • 81cdded9aa21513ad9c6ae04455a7fce68129135f3358b9c5e28a80139e78f21
  • 93472e054b4b4fcc54a71a32b6275f8b35c8ef84490248d21c094f19a537c773
  • a0bfeb90468ddf50a3c85d5074e002b1d89995d6377eceeb0781ba5292facbcc
  • b3dfdfcfea160ed34eb69da55909294f78d2b5a6320cbf5151a3da01c6449631
  • c185559d0a38e782167beacff78a7a72544d82890b5e5723e6a25a70e6e16d59
  • d2c1b89129e3e26544bfbef3fac4567c3629817a98ded9ce5c7dee485d0364a9
  • f2e4fe273c4a8cc1cd7799d5558c58b8a08dfe160235dfa2eb2a8bad9bba40aa
  • 02481825e922c38ba797ebc18d5a8273ede8c5a4d52eecd2f58eb569533d780b
  • 06736e5f3127a54bbe6bb25f4a82ca95371e5cc8654a893c02d3d4e677e0b916
  • 21b039f3171f26911290dad3e1ce0da6d6d3545e11f9a119408922ac2ae06db6
  • 2643f9f8dce45983eac80feeebd16adbd498e3a644ef8b05bc40448be9342ddf
  • 2ac6b5487c69427476b48bcbbddd7646842e02363a0d4ebe1b1998da6d1f55a8
  • 2dad87b69ee91bfa71d911b791e5468efb6ce689ccc4cde3e91626cbfcfc14ab
  • 2f4853b54c36adf9ca9fbb163dacedee78b6b027fac3c24c72120e9d8cc6f01e

Coverage


Detection Screenshots

AMP


ThreatGrid


Umbrella


Malware




Win.Dropper.DarkComet-6301230-0

Indicators of Compromise

Registry Keys
  • N/A
Mutexes
  • N/A
IP Addresses
  • N/A
Domain Names
  • N/A
File Hashes
  • 05C8DE4B97737440913F5C714082AD647281FA50F1904B1BF11EDB8560294FAC
  • 07D9D6DA8C6CD162DD9FC78AC48EAF82BC49D4239908AF354E44C4822FE06D62
  • 099ADD24586D77C5F2B8EFB9C33A8A11B5A0C11001A8534D9635A674ADC260AD
  • 0A155F4F20367E4D23B6D238208FA5F943A1341E47BDBB2DBC520CCB27AD120B
  • 150420EDB4BF00DADCF71601781DBE3BD6E34CBA767153B9F82307EDDF391395
  • 15F2BB3B4A12A6F5B0965FDE62AE21B2796D7659BBA8011FC22AF40D465984BE
  • 318B2A4F06345E95C63E4623F52E0E7C57257548C74E0C7A272FCB64D3F49692
  • 4B0BB06E09ED0B2EDB085641E125490E9B1A6CC5652C05C77C78E47CF9448D35
  • 507874BA705282183F928D3AE11ED5497A0F1EAC3368DE75C392D17749CB8EE9
  • 55FDFC65C0C10A958239E0447E5696989FE66557437EB725849BB578D882D74E
  • 5D31C073C4B7322A7DE871D533D520DE2444466D0C944CB06F6244D2CE57D49D
  • 6597E2DD82FC203BA2C609B358B2E0CAE37A4309808626DA27BD58614077D646
  • 6A23031FDD70C6D57D8FE9C8D3EFE6A423C38BF2D46B9B24959E5CA7D0714FCA
  • 6C652B0E4998456F150515EBF50CA569CF373BA709442F6909DD7D4330C83D2E
  • 6EB12C46F0605D8F915C8E895FC70D189D9E8825775EBDB464A9A24834887E60
  • 776B2679819B1E0385E1630EEEC50190DAAAEC0EEF9F659EE728C47991FABFBB
  • 77FA104262E3FF983B3418540FF744E0EAAE5E66388333ED785EF6F5AA2801F9
  • 7D6765A1F6589A554457D9363F702F65E81DDDA52EB62C600250E0F94C473A16
  • 8590486CD299DAA9BF42497EF28028364E4E18B6C60B725736A7D2DDC73BBC2F
  • 92EABA06563800BA670249E90D91C32F9D315889439BCAA73F24D2C08E285B84

Coverage


Detection Screenshots


AMP


ThreatGrid



Win.Trojan.ServStart

Indicators of Compromise

Registry Keys
  • HKLM\SYSTEM\CONTROLSET001\SERVICES\NATIONALLWC\Description
    "Providesufl a domain server for NI security."
Mutexes
  • Nationallwc
IP Addresses
  • N/A
Domain Names
  • syhaw1516.codns[.]com
  • wrop0422.codns[.]com
  • ansbase.9966[.]org
File Hashes
  • fbbc6852ff1947fcd820b90e60ab71af93ffad079bd13a0d2b514955bb1c9d62
  • 40eddfac964b69ee2e26742faaacfe50960fa0232a1b9a11c382e61cecd700ff
  • 6106eda3ae39449fec42db2caf4f1b5f994d72b5a759dddfd77a8a29ebb3f497
  • c106435a2aced27d03ee5531eda025b14cec106106a1c7ca750127090f6d2039
  • 8d4366eff17da1c18ab3fed1692628756a8f41f3145877f895b7ef950055262f
  • 3be7ab79f032cf24b09fc05b08544fd61ec7e3fd355f8ab7b4580eb43d8c3e55
  • ff6b7320d6b75a638c0f2d024f43853dd78993276a8f6b5f7463d6317858dd9c
  • c9a193d273f606860bee0dd4a878a6421233b05ac4c6faf357d9324f0d6a575a
  • 932d8d5829570237e9ab7688dd2d3c03812a05157f72af124cabf530be583789
  • ba07a79a2f4d51eaac585b0f50e3b1e61d8fc555592aadb1e5d3916fb26b0e27

Coverage


Detection Screenshots

AMP


ThreatGrid


Umbrella



Win.Trojan.Agent-6298180-0

Indicators of Compromise

Registry Keys
  • N/A
Mutexes
  • N/A
IP Addresses
  • 212.129.14[.]211
Domain Names
  • tranexestin[.]com
File Hashes
  • afc3ba4941b89a4467e2f1a4ab0df2c88ef5e39264182a4b3a2dbbfa5b022e3f

Coverage


Detection Screenshots

AMP


ThreatGrid


Umbrella



Win.Trojan.PWS-6299789-0

Indicators of Compromise

Registry Keys
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • \MACHINE\Software\Wow6432Node\Microsoft\Tracing
  • \MACHINE\Software\Wow6432Node\Microsoft\Tracing\tmpVtFw4a_RASMANCS
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\Software\Microsoft\Visual Basic\6.0
  • \MACHINE\Software\Wow6432Node\Microsoft\Tracing\tmpVtFw4a_RASAPI32
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\Software
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History
  • MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\SOFTWARE\MICROSOFT\Visual Basic
  • USER\S-1-5-21-2580483871-590521980-3826313501-500\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2
Mutexes
  • N/A
IP Addresses
  • 92.53.96[.]120
Domain Names
  • cv42569.tmweb[.]ru
File Hashes
  • dddde27836842e0f950b5622e1be7a0f51072db573b2f2e41d20d4b4c45028d8
  • dc086f745c35b2abe58675e546b475ed64f15ea6e9d4492a0502476f784ea85c
  • 97cd05c529002b85ae756a9e7b7da7a538026583f0886a235cf48b72c378551a
  • 2992c6ce7ccda6fef751a912eafb8a31e3426bde8964ccf31b0512390bd61615

Coverage


Detection Screenshots

AMP


ThreatGrid


Umbrella




Win.Dropper.Emotet-6301061-0

Indicators of Compromise

Registry Keys
  • N/A
Mutexes
  • N/A
IP Addresses
  • 188.165.220[.]214
Domain Names
  • N/A
File Hashes
  • f566fdc382f6988599cb16894d8a9a92e291d83574834de705d6367b520b6b50
  • dda1fffa38e3f9d30833d201b542422aed15a41253b2a72797ad38dfba8fe535
  • 6d4fa878e2930cb3bedc2078855f6d7db7b6b136464f6dff256d8c62657b505f
  • 8ad1c1655d6d3b2a4931ae2dd9eb4e3b7be488a7f39b9c396fe1eeda2eda05a7
  • c0e8a92ba6ce12d803ecfccd01432f855e6fd9ad19825602a74a081459e25389
  • 5598fdcc6c0c2e7bdb095193a5f986e6cf22fdcca26c2e8451c46d787ef18435

Coverage


Detection Screenshots

AMP


ThreatGrid


Umbrella



from Threat Round-up for Apr 21 – Apr 28
Posted by at No comments:
Labels:
Subscribe to: Posts (Atom)