Quantcast
Channel: Cisco Talos Blog
Viewing all 1925 articles
Browse latest View live
↧

Cisco, Talos tout importance of IoT security at RSA keynote

March 5, 2019, 12:11 pm
$
0
0
Matt Watchinski, the vice president of Cisco Talos, delivers a keynote address at the RSA Conference in San Francisco on Tuesday.

By Jonathan Munshaw of Cisco Talos and Liza Meak of The Network, Cisco’s technology news site.

By 2020, Gartner predicts 20 billion connected devices will be online — and more devices mean more security threats. Connected devices have exploded into the public and corporate landscape, rattling the bars of the cyber security cage.

In a keynote address at the RSA Conference in San Francisco, Matt Watchinski, the vice president of Cisco Talos, said the growing prevalence of these devices has made them an urgent priority to protect them from attackers. Liz Centoni, the senior vice president of Cisco’s IoT (internet-of-things) Business Group, presented along with Watchinski.

“These technologies will make it into our critical infrastructure; they’ll make their way into how we deliver water and power,” he said during the address. “We have achieved so much in IT security. We are now going to have to learn a completely different world of OT [operational technology] security."

One of the most notable and recent IoT security attacks was VPNFilter, which Talos exposed last May. Talos researchers, working with public and private-sector threat intelligence partners and law enforcement, discovered malware infecting hundreds of thousands of networking devices worldwide, ready to act as a “kill switch” to take these devices offline at a moment’s notice.

Watchinski said VPNFilter is a well-known and well-publicized example, but there are many other daily, systemic attacks the public isn’t aware of that could disrupt daily services people need to live, such as electricity, oil and water.

Many companies are unprepared to defend against these kinds of attacks. Watchinski and Centoni reiterated that IT and OT teams need to work together to shield any device that connects to the Internet. Centoni said many Cisco customers are unaware of up to 40 or 50 percent of the devices on their network.

“Security is the reason IT and OT teams are forced to work together,” she said. “Today they work in different worlds.”

Centoni gave an analogy to group existing technology into two different spaces: carpeted and non-carpeted.

The traditional devices in carpeted environments, such as routers, switches and endpoints, are already well-secured thanks to the work of security researchers and in-house IT teams.

But other devices, even oil pipelines, parking meters and electric scooters, connect to those same networks in non-carpeted spaces, meaning they exist out in the open. These devices are most at risk because IT teams aren’t currently paying close attention to them.

Centoni explained the need for security to be baked into the DNA of OT. Once implemented, OT systems usually don’t get upgraded for decades, so security has to be a fundamental part of the original design.

For more coverage of Cisco’s keynote at RSA, check out live tweets during the event below. You can also watch a recording of the presentation here. And for more of what to expect from Talos at RSA, listen to the latest Beers with Talos podcast here.

↧
Search

Vulnerability Spotlight: Multiple local vulnerabilities in Pixar Renderman

March 7, 2019, 6:14 am
$
0
0

Tyler Bohan of Cisco Talos discovered these vulnerabilities.

Executive summary

The MacOS version of Pixar Renderman contains three local vulnerabilities in its install helper tool. An attacker could exploit these bugs to escalate their privileges to root.

Renderman is a rendering application used in animation and film production produced by Pixar, a well-known film studio. When installing the application, a helper tool is installed and launched as root. This service continues to listen even after installation is complete. These vulnerabilities lie in the `Dispatch` function of this helper tool.

In accordance with our coordinated disclosure policy, Cisco Talos worked with Pixar to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

Pixar Renderman install helper privilege escalation vulnerability (TALOS-2018-0728/CVE-2018-4054)

The MacOS version of Pixar Renderman contains a privilege escalation vulnerability in its install helper. The `Dispatch` function’s caller is not checked and is therefore exposed to any user. An attacker with local access to the victim machine could then escalate their privileges to root. In order to exploit this flaw, the attacker would also need to run a specific Python script and command.

For more information on this vulnerability, read the complete advisory here.

Pixar Renderman install helper arbitrary file read privilege escalation vulnerability (TALOS-2018-0729/CVE-2018-4055)

A privilege escalation vulnerability exists in the MacOS version of Pixar Renderman’s install helper’s `Dispatch` function. The caller of this function is not checked, and the function is exposed to any user. An attacker with local access to the victim machine could use this vulnerability to read any root file from the file system.

For more information on this vulnerability, read the complete advisory here.

Pixar Renderman install helper privilege escalation vulnerability (TALOS-2019-0773/CVE-2019-5015)

A local privilege escalation vulnerability exists in the Pixar Renderman Install Helper helper tool. A user with local access can use this vulnerability to escalate their privileges to root. An attacker would need local access to the machine for a successful exploit.

For more information on this vulnerability, read the complete advisory here.

Versions tested

Talos tested and confirmed that TALOS-2018-0728 and TALOS-2018-0729 affect Pixar Renderman, version 22.2.0. TALOS-2019-0773 affects version 22.3.0. These vulnerabilities only affect the macOS version of these products.



Coverage

The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rules: 48450 - 48453, 49088, 49089
↧
↧

Cyber Security Week in Review (March 8)

March 8, 2019, 6:55 am
$
0
0


Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. For more news delivered to your inbox every week, sign up for our Threat Source newsletter here.

Top headlines this week

  • Chinese tech company Huawei is suing the U.S. government. The company alleges that the federal government violated the Constitution when it banned government agencies from buying Huawei software. The two sides have been locked in a war of words over the past year as U.S. officials raise allegations of spying and security concerns against Huawei.
  • Cisco disclosed 23 vulnerabilities affecting the NX-OS software that could put some switches at risk. The most critical vulnerability, which received a CVSS score of 8.6, lies in the Lightweight Directory Access Protocol (LDAP) in Cisco FXOS and NX-OS. An attacker could exploit this bug to gain the ability to restart the device, resulting in a denial of service. Snort rules 49334 - 49336 and 49350 can protect you from these vulnerabilities.
  • The National Security Agency released its reverse-engineering tool, Ghidra, to the public. At the RSA security conference, the agency made the software open source. While there are many reverse-engineering tools on the market, the NSA has spent years refining Ghidra and it’s largely believed one of the most sophisticated decompilers available. 

From Talos

  • Information security and operational security teams need to work together to protect IoT. That was the main takeaway from Cisco’s keynote at the RSA conference earlier this week. Matt Watchinski, the vice president of Cisco Talos, and Liz Centoni, the head of Cisco’s internet-of-things business group, said that IoT devices have become so entrenched in our society that it’s become more important now than ever to secure them. You can watch a replay of the address here. 
  • There are three vulnerabilities in Pixar Renderman that could allow an attacker to elevate their privileges to root. Renderman is a rendering application used in animation and film production produced by Pixar, a well-known film studio. When installing the application, a helper tool is installed and launched as root. This service continues to listen even after installation is complete. These vulnerabilities lie in the `Dispatch` function of this helper tool.

Malware roundup

  • A new, layered malware has popped up on the popular Pirate Bay torrenting website. Known as PirateMatryoshka, the trojan disguises itself as a legitimate torrent. Once downloaded, it has numerous layers to it and acts as a downloader to several other malicious programs. 
  • A relatively unknown threat group known as “Whitefly” is allegedly behind an attack on Singapore’s health care database. Security researchers say the group was behind the exposure of 1.5 million patients’ records in July, most likely using DLL load-order attacks.
  • “Scarlett Widow,” a hacking group believed to be based out of Nigeria, recently started a new wave of attacks. The actor has sent several malicious to K-12 schools and non-profits, including the Boy Scouts of America. So far the group is believed to have information on 30,000 individuals from 13,000 organizations across 13 different countries. 

The rest of the news

  • More than 300 million private messages in China were exposed on the internet. It is widely believed that the messages, which were transmitted on secure messaging apps, had been collected by the Chinese government. The database made personal identities searchable by anyone who found the IP address. 
  • U.S. Cyber Command carried out an offensive operation against a U.S. Russian troll farm last year. The attack targeted hacking groups known for spreading misinformation, specifically trying to shut them down on the day of the 2018 midterm elections in the U.S. 
  • A new Senate report says Equifax neglected proper cybersecurity practices for years. The credit reporting agency was the victim of a massive cyber attack in 2017 that led to the exposure of 145 million Americans’ personal information. The report states that the attack could have been avoided had the company followed “widely agreed upon” cybersecurity practices. 


↧

Threat Roundup for Mar. 1 to Mar. 8

March 8, 2019, 9:02 am
$
0
0
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 1 8. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

The most prevalent threats highlighted in this roundup are:

  • Win.Malware.Bypassuac-6876875-0
    Malware
    Driverpack leverages 7zip to install malware on the system in the form of an HTA file (HTML), which leverages javascript to perform malicious actions on the system.
     
  • Win.Malware.Swisyn-6877070-0
    Malware
    Swisyn is a loader that installs malicious software on the system, including remote access tool functionality, allowing the controller to perform any malicious action.
     
  • Win.Malware.Autoit-6877140-0
    Malware
    This leverages the well-known AutoIT automation tool, widely used by system administrators. It exposes a rich scripting language that allows to write fully functional malicious software. This family will install itself on the system and contact a C2 server to receive additional instructions.
     
  • Win.Malware.Upatre-6877602-0
    Malware
    Upatre is a trojan that will install itself, contact a command and control (C2) server, and perform different malicious actions on the system on demand.
     
  • Win.Worm.Vobfus-6877836-0
    Worm
    Vobfus is a trojan that will install itself on the system and try to propagate to external USB drives by creating executables and writing the autorun.inf file in different files. It tries to disguise itself using file names such as "System Volume Information.exe" and changes system configuration to disable windows updates. Finally, it will contact the command and control server to receive further instructions, potentially running any malicious action on the infected system.
     
  • Win.Malware.Tinba-6877885-0
    Malware
    Tinba is a well-known trojan capable of stealing banking credentials, as well as potentially installing additional malware or performing other malicious actions.
     
  • Doc.Downloader.Emotet-6878774-0
    Downloader
    Emotet is a well-known malicious downloader that typically spreads through email in the form of Microsoft Word documents, inviting the user to open the attachment, who will immediately get infected.
     

Threats

Win.Malware.Bypassuac-6876875-0


Indicators of Compromise


Registry Keys
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CurrentVersion
  • <HKU>\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Mutexes
  • Local\DDrawDriverObjectListMutex
  • Local\DDrawWindowListMutex
IP Addresses contacted by malware. Does not indicate maliciousness
  • 104[.]200[.]23[.]95
Domain Names contacted by malware. Does not indicate maliciousness
  • www[.]aieov[.]com
  • 5isohu[.]com
Files and or directories created
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7ZipSfx.000\bin\Tools\Icon.ico
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7ZipSfx.000\bin\Tools\patch.reg
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7ZipSfx.000\bin\drp.js
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7ZipSfx.000\bin\prepare.js
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7ZipSfx.000\bin\run.hta
File Hashes
  • 019df18c50002faa5704c94a01896f745677cdc643adc48ae9257031c539f7a6
  • 0eff6bd81b1bdc44924a5e662c3902c66b97a2542016574ace670edb135f7bc5
  • 108cedab59d537fca166fec822b22039a19dcdc700e17d9ef39949ca1d3063e6
  • 15c72f8cc77837cccede6e5f239bad225cd4abc65630470f779e8141d5e36987
  • 1e8caa9a82f5170227c8ddfbb8c8dda8a89e1d0ca4a8ce517b7214a30ceb5b75
  • 30f5055191f1b545cb56fb066b256238eea105343ca08a946e7e0b5644e5eb57
  • 3c389aec59d31f2801ac82ee5eb1c31f1ece8abbfad2e3010e5cbbbb9d51109c
  • 3faafbde8739f8900fdf4fec2a3be5d8c802ded73cea96e8e5d502a265ce9ed7
  • 5a3224c6a47f10ed893e44a22e52cf41713fd284966675d59d8ca38f926313d1
  • 5c382af6790fd2da04306edd283bce8cf84a7177417a33085e531043d9e381be
  • 6b42155af6114d7098e4078fcf3e39543c9c9f1fd19d8151812bfb3da9a9fb16
  • 791a4d46420633e62ad01fae3afe3078ec94c6714a242cee9fd6da688ff54b3d
  • 79e11a42cbabf436cab208e2bcf8026f8cd3a8cf6a37179b18248db3de5ee5ec
  • 7ab57ad3e74391934dcc5b47e2953a2061722c86bba878534a43fdc59dc84b3d
  • 7badc0500d9eed34ed2b1ed51fa5312aed4d64d145f7f019c8fc00f2674163df
  • 7bf1388b2c1d681687c57b55e60bfe32dae62f2c2f97a90e4c9c7385742f2a70
  • 7fc66452efaccea5892fb62ab8c98c543d6ee2bd4b8f3d90a315cb569b3fa176
  • 876ce89d537c1ef53ea7c8664208b93951e5a4069b09ce0a438955d70619bdc5
  • 916bacb16aebc630b7dada021467e71c4368ad72174e332d4ae00afebdcf66eb
  • 91b0f5e2ba392fae46a6ee0b19d7f54ae507619e698cab005ae69168af8b1015
  • a93958ecd999fb16047e16c18412efa04cbf4bb2bd4fed0cda18dee4e244b8b3
  • aa1c060f33a382cb9cbd6a6bec709242255f0923b3b0e644bd2762ed06625f74
  • ab06d9f7f47870915f54101acbce0eb3d75995775c661a4d4547deb87d0d2661
  • ba9fee32734436ab17269197b2ec2a48ca31f7bedbade06d6e79bd450e30fc81
  • be96c668c75e1f119ef9ec9e7ead125f92171186f4d7dab78b96cf68afdea206

Coverage


Screenshots of Detection

AMP
 


ThreatGrid


Umbrella


Win.Malware.Swisyn-6877070-0


Indicators of Compromise


Registry Keys
  • <HKU>\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Mutexes
  • \BaseNamedObjects\shqq
IP Addresses contacted by malware. Does not indicate maliciousness
  • 148[.]81[.]111[.]121
Domain Names contacted by malware. Does not indicate maliciousness
  • sys[.]zief[.]pl
Files and or directories created
  • %System32%\drivers\etc\hosts
  • %System32%\wbem\Performance\WmiApRpl_new.h
  • %System32%\wbem\Performance\WmiApRpl_new.ini
File Hashes
  • 00c57f8196927287304a24ed0fa46bb3a0d4baacf3d038c8624f694f4a5ecd7b
  • 00f0b9de74ca71e3d907d210f60546daf2da9d244c4646c4f1786e21296e9018
  • 01b52b7c23101fdf1fbdd9ad88ff09be58d23300369d110f38cc68206c7bc58d
  • 06bcf9f07be68b12278e4bf3310fe363bf2fef278cdda49241639ededbc6db8d
  • 0c768e1a537daacfa5bb48d96266e0f915c5890a41bf22bef1953e786cc3288e
  • 0dc13444c42147f30aa664d5a2abe3cc06ea059f61e82ba96a5a68e2fa9bd7fa
  • 0de78cdba09c4eaa305b45c34d80bcec684a364ba84b0089d797186748a62c79
  • 10ece857bff115588a8dd3525fafe6f7e76760007cf5cab15c49cc256ed44cdd
  • 13b5799113f9c99a83cd22043bbb4c6dc4a853236ce1f7c5ffaace667f6afc88
  • 141aaea895d753aa8cf3ef7c0b28d8a03c3498094816ad9545a7da6a9cada2a1
  • 18d86d6520c9a934f50f87c8236621d177f1b2b553147f981cbb04eb49d0632d
  • 1c1f4ab2eaef44d8e3ff0b9a628b82917bf0e3b4fefb426ab29d1f4a455ab414
  • 1cdb7a0378f4e5a0765ae7691caacc2a37bd623e16ae07e3b6400829925e21a0
  • 1edc0bd44c9532ab3a94f7e61803f84108afbf85bf71d6a7885aee11ec128105
  • 2349dcb9470d7021bc0516adf76029755958a1abb1f08ddda221585e84ac3016
  • 26dd985057a470b7b2f90e3c9172df1b951f9e799ace94612a98103dcab3c5fe
  • 26f8ce54e73c28667ba5cba252771c4cf4e65e566eccb2bd715e5b12bcbb1d1e
  • 282e36c2dd1acf6c898e050e899bc7dbb0c339b16b7725f6ceae2787b43fb4df
  • 2932125cacb1c6c780b920d0fd77e70c6d15d712d752f0db8d66e78c849e0a59
  • 304a99a82faf7adf1db513b596a620ccfe1efbd91179571a1d48932c64b731dd
  • 3066c0a0cf18ffab76c9cf568201859dea7338e92eed466841f78325bfe13904
  • 31aed7d12c98ef33c1a6dccbc290cf55b0fe3f17c4bd48e88c314a3a65d40dda
  • 3692dc820821cb35f58a3d52b7365710a03eec44cd97e27e15a8f61847d55683
  • 377281d2dc1d2ac4fa6d625c2548b5d99f2836d587c3da0810a6d7a6a3f91f10
  • 38d7368e001a9e7f5fb08b02bf014577ce4705b0b3498ad564192c05dcbf9684

Coverage


Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Malware.Autoit-6877140-0


Indicators of Compromise


Registry Keys
  • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
    • Value Name: Images
  • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CurrentVersion
Mutexes
  • N/A
IP Addresses contacted by malware. Does not indicate maliciousness
  • 239[.]255[.]255[.]250
  • 173[.]254[.]223[.]118
  • 5[.]206[.]225[.]104
Domain Names contacted by malware. Does not indicate maliciousness
  • kuangdl[.]com
Files and or directories created
  • \PC*\MAILSLOT\NET\NETLOGON
  • %AllUsersProfile%\images.exe
  • %UserProfile%\bi\UevAppMonitor.exe
  • %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\upnp[1].exe
  • %AppData%\mjpkgqAFn.exe
File Hashes
  • 028914f9d3455b44d9186d218874047530a367cb1d20cbc7d9b047a42faf1774
  • 08c763e2c405884b9e98df0fe8c80bcf3f0849157f0d020aad12fcb2bbdd10c6
  • 1fcf1fb9d7966fcfe07687dabf59a358231d8807913660126c1fc1e0f733e7c8
  • 31cd978c76fd90716b57c0a9c64d1e170adc8eef42a974fce554aad542cf803e
  • 3607f653f4862019697f88de566a47309a6f9ff4aea4455f9d49645c698a64a8
  • 49a9be560e0323a6bb7c551d9b459d37f06a7712e36017f5a84e68bfd7582300
  • 5ee731f5f85627056e82ad1c53b7f3e1a407e993e863b6921d974c351af67d40
  • 6ed44d029afc8c32ce4cad58a917ac4738eeba149f3b9afb56118b8a936a1182
  • 770d42c268eb3b05de83bb3880748626e07e7d753689f85bcc64e09fc71a8ba7
  • 79c528ad5b9b65028be90bbc555664dbdb45503b11311f0f81fe462c799fe80c
  • 7dfd2b5bdacffb4dda87fbd8c98c7ccabbca64899f2eb7e50dac7919af73d4f7
  • 7e37be325f4e6295d669342e11b3769e4872128379d800fafc6eb55055d403ef
  • 954623cda203d382113272d4481e849810953e5968b42ea24017d25d1d6fbb0c
  • 9644aa2b324ce9aedc0640a29a35dcf989785ba38d6ebcc59e666ce17d114866
  • 9c1c945c3ecd7dd5be0a39e299289e8161acdb77338a96f59c27864ca817fe97
  • 9f1f4ea064c03bdf669a92c8ff94cc8c26d04630b2e7541c60ee83b7a553b6f4
  • a11f7486f33f69f874c5058081a9bdfb633660bae189c2f4cc6c3b175da2051b
  • a7aa9d84152089ed6cb256dd9a9d7aae805d4b9638341b102dd154ede29908ab
  • ca8a57aa5d7625b78fc6e9aa0e795a6961141713c724b4f24cb12b3843a4e253
  • cf3fb472560517500c7c311dbcd838ad690b0aca82778f88a8713c5768390632
  • d00dfbf02c16ff7e320702eaa41f8551084a1fcdbf2266da101df7b0ea4d4787
  • df7de7d21eb8c02e986a390b2f041b9c2296615ce23248139a7487e50a5a3bc7
  • eee4d211bbffe896f0de21854cb5adac6e10c85016986efd260b45c7022d7521
  • f79811d575ad411ea5196a8c46e7677571b6b85557fd8cb59e784241b3b9f006
  • fa2aedf34c6b24c5cff46aab216c2fa6785f8b8a67eed29ad2fe9a5248a01551

Coverage


Screenshots of Detection

AMP


ThreatGrid

Umbrella

Win.Malware.Upatre-6877602-0


Indicators of Compromise


Registry Keys
  • <HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • <HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Mutexes
  • N/A
IP Addresses contacted by malware. Does not indicate maliciousness
  • 83[.]136[.]254[.]57
Domain Names contacted by malware. Does not indicate maliciousness
  • cardiffpower[.]com
Files and or directories created
  • %LocalAppData%\Temp\kgfdfjdk.exe
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kgfdfjdk.exe
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\lrtsdnn.exe
File Hashes
  • 021000945e0be13e5e4ecafcfa342de1741366722dcbd84ad11f47a869dd6dfd
  • 0958c14edec6c39c88019adb183f5c5064608560df9438a515d0bd0d6c30a299
  • 16c6fcdae71399a369fae48bb94b1ed3b68ff9737fe6c468e7a97828e49a1a23
  • 1b8686ab24cb569147932c35e34164bc4508fbea9816d4556751ac7bb69c4bff
  • 277bd23dbfd1d8090e2a1b97a525fdc56f025b61d966b5aaeb0a89600247c235
  • 4285e32d83e87188118ab9115456da9f93d32031b33b55426a53caf16f0840ef
  • 4a04408dab011db8870969101f41dd86872ba19cb57c057a63ac484bc0a776df
  • 4d9747e7b9a304e8b2c9d4c1e990c09c66f8bcfa580049c51c11d3cf28de8b00
  • 588a9be32c6a3f61da7ab5f60842398195d947017721c716b060a1345f90027a
  • 63597f36f154c84eba0d9624fbc5f9e94fb000a9d8e059af91b9d41c4cae72be
  • 78676aa1462a399d525b253d52c67938a0de90ac34f8f546d830cb3845456002
  • 8c8b93bb898a882b87259ca4158cdc7f80964162c2a249ce41c4b6e81a59eb69
  • a96ac64b63ab1767a5fbafe793a4bbd326484746c4c9421d836a623ec5326c29
  • aa74e0be469a8657b0c661e7fc10ab0351cad37fa0bd7f87834fdfc1ad6b26cc
  • ad98380ca200a45daf7fe6cda9f1b62eda504ff4ba9262e406c9721e94c52b19
  • c1df74ac76ce78cf49ea51879bf5e86db2435b727ddfcc2cdad94a974fe147a0
  • db5e3d86143940f4509231fa1c588c8bc92525e227e687ac4c22fe31a1b0e132
  • e8f96e00f7534193d696dbb47cbc6d3be9a1d255104d948c30de16bbdf71c37e

Coverage


Screenshots of Detection

AMP


ThreatGrid


Umbrella


Win.Worm.Vobfus-6877836-0


Indicators of Compromise


Registry Keys
  • <HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WindowsUpdate
  • <HKU>\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  • <HKU>\Software\Microsoft\Windows\CurrentVersion\Run
Mutexes
  • \BaseNamedObjects\A
IP Addresses contacted by malware. Does not indicate maliciousness
  • N/A
Domain Names contacted by malware. Does not indicate maliciousness
  • ns1[.]chopsuwey[.]org
  • ns1[.]chopsuwey[.]biz
  • ns1[.]chopsuwey[.]info
  • ns1[.]chopsuwey[.]com
  • ns1[.]chopsuwey[.]net
  • ns1[.]chopsuwey[.]net[.]example[.]org
  • ns1[.]chopsuwey[.]com[.]example[.]org
Files and or directories created
  • \autorun.inf
  • \System Volume Information.exe
  • \Secret.exe
  • \??\E:\x.mpeg
  • \Passwords.exe
  • \Porn.exe
  • \Sexy.exe
  • \??\E:\teiasid.exe
  • \teiasid.exe
File Hashes
  • 0c3b6645c222448d1d6e09e199acbef4ed86fc44aee1149a23682649291fc733
  • 1149f036bb4033a1ed49972386361ef9b1dc4770ccb44ff3efa7d6545158c95d
  • 31cd4091fa843cd5dcc43cfe0b4e80bb2cccfc8eb9f334a39fd4b5978ed4a2ab
  • 4476dc51703ba4efe1e32a3266c466d49386b6f23867b69af54d4a63b764014f
  • 4eca92bc9a9ce1cef10bae0fdcca30498fb9ff86bf09cdb5638f1d85bf1dadbe
  • 503cb71631d48a40f8bd2ed362db39e36f85ba5c177b47799ab109f4eba4df1c
  • 6418f8ed71ea55d61d786e2daafb90337cadb863ded94b9ea111dd4a2a266383
  • 6850dc31b6bfad3304202f0f4977e65a1bc09521330303f91ed88d106ed4f997
  • 6b663361002a078d7ac3a69c88b7689bc0f315554441325bc78c396f9203c61b
  • 7f630ee19177a544609bd9ef58cb153a62748a690dcd9baccacc077788e02c84
  • 82cbf00571f283546bf2e7ef61130e48e498f398365c3f65d3493059d04e2c54
  • 97ec12418e29486fbf47c5bcf47bac5ac15b63efda15a5bc1347bcfbd4b8f749
  • 9ca8807f8c3fa377bd07af42b692004210e12a5f51f7a4f0eef9848621c392e2
  • b438d083fd2471c746be18ac1289d840a5b37d6257f3d2dd3c2615e79b3a80d0
  • b71786e23ba7f5518878c16d77f2d889488ac2991d5bd4228d6910d98f3c0649
  • b8e7137d112282b3baa97b7a8a86872e1f4f46270366c357539e7cd3169837c5
  • c20a8a941e457b56f6d360f3c7354d1a7e050793fbf5c39f98401f21ef633e7e
  • d5846dca5386b4452d70975fcdd6f41da6a0202c032ef39b8b275e519815b494
  • e853753abcbf8312e1326416c1faa79f0b0f98612f7c8f2e8a76795203f5817d
  • e96368504131c26f0cae6b7a68ce5c8747b1807d4cf755460cc79d77b4ff6156
  • ee4cdc3f5b2a9b6be5a818b932f1c62fbcdd1d0fdadf13a4ae24004095850464

Coverage


Screenshots of Detection

AMP


ThreatGrid


Umbrella


Win.Malware.Tinba-6877885-0


Indicators of Compromise


Registry Keys
  • <HKU>\Software\Microsoft\Windows\CurrentVersion\Run
Mutexes
  • \BaseNamedObjects\5E60878D
  • FAFEB955
IP Addresses contacted by malware. Does not indicate maliciousness
  • 216[.]218[.]185[.]162
Domain Names contacted by malware. Does not indicate maliciousness
  • recdataoneveter[.]cc
  • diiqngijkpop[.]com
  • diiqngijkpop[.]net
Files and or directories created
  • %AppData%\5E60878D\bin.exe
  • %LocalAppData%\Temp\~DF795A5FD183ECC172.TMP
File Hashes
  • 01ae6c57ac2debd611960648013ee28a351ec631a5ecc3008520247765ab654b
  • 0cd46a0b5f2fccdbaad0c726c1688b676dbe4b56f9ab2e8a8e3a01cf31778361
  • 146500e14954b8d588b76786670c7f54d4cc2e9d807c8c6f4810e18a046b5c64
  • 2c427fd2e95371120ab9157ca3f66a5f0c9e4c3ab222407910af6aaaaa9e3813
  • 414bcee562deab35cd6b486c6334abd5b13cde91629aa2bb227c2c7b7e1ff9ff
  • 46bb9a573b6cf3988ce6378870ce0575a130a1b0f79ae9ec94a36f1bb9787c97
  • 478cab0d41118f0e46f98a2c10a9cee60c8c2f9d367e974b56ef43603d25d6f3
  • 549bb79723bdb89dd5832968c0222c5447ccc58cc49918aeb4bd971ef35039d8
  • 5a2e5cf96ba1ffa184b2dcf8dda95fccc0565138ada245612cee2e93cc9eb69b
  • 686f37fd5a86bf87495805f409fe6203fffa9f25e297d97d7cfeeffe3e19ce83
  • 6e4d29d509894f88e805d1b090d275b6a6af49b13acaad2ede39ef322658d579
  • 6f423075e86048454f921fd80d8f64981952019a4007b7ed8e4cc03dac38eca6
  • 713ae90314c0f774b5a00656db375c4b014fc9c0d5a4175bf0cd36b41a8074e7
  • 72ee4bbdec92a89949f62a75a80f78074445b4f598a8c5db32b092d7f17df18d
  • 7ee2a424f18cd91df14339bdc5852066002e4d4ec18f4f2bd9366db258c52210
  • 8ede393ec05a909c6397d6cfb5834e00280175be6a60f0b21b2b8473212f5c86
  • 9b011301e0aebcc888b54e460bcec2d8f2e43bc79f9b6b989dbd066850b73491
  • 9b49555e77ad97f9b3f65d4b33c829fcb228fbeeba6f2d1abd0651370bc57cdf
  • 9cd799126e6d3575b46226967767c5b58bf634039babfeb1c5f461396d050760
  • 9e89025c4e1aeeefbf4bcf3df807c3847024448e407dd5c65c0913ffc836f637
  • 9f20a17a7b530c7158d7e2f06d7b7a2dc2ea9b52fb450e4393cb0a4baf841df6
  • a01c0e9146b18dfa6bc652807de1b0f32f3c8f4121b1ee940982bff45128e316
  • a30245cf232f2c34ac29d074c6ebe4067f0319b95cd77a53c9558d0aedd31330
  • a40700059a7704c4ec059c4052f8dc46cdfd50a5a13ce2f5ea9cf6122903117b
  • b3383f54841bbd099b35e19fc22037769e003f5545f9d31085b9a2c425953826

Coverage


Screenshots of Detection

AMP


ThreatGrid


Umbrella


Doc.Downloader.Emotet-6878774-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • N/A
IP Addresses contacted by malware. Does not indicate maliciousness
  • 94[.]73[.]149[.]212
  • 68[.]66[.]194[.]12
  • 195[.]34[.]83[.]119
  • 98[.]129[.]229[.]92
Domain Names contacted by malware. Does not indicate maliciousness
  • www[.]litespeedtech[.]com
  • www[.]hostloco[.]de
  • hbmonte[.]com
  • www[.]hostloco[.]com
  • uka[.]me
  • woelf[.]in
  • erdemleryapimarket[.]com
  • gtechuae[.]com
  • beatport[.]com
  • qantumthemes[.]xyz
Files and or directories created
  • %AppData%\Microsoft\Word\STARTUP
  • %UserProfile%\Documents\20190305
  • %LocalAppData%\Temp\903.exe
  • %LocalAppData%\Temp\3miksw05.0qe.psm1
File Hashes
  • 066067b7ec8e80d50dec982621fbf4d86455579cab94bd64b02432c428bd73d9
  • 10ea8d3f3774af7b633330967a59a627987838ac13e50c3e4c6711bb9b75a895
  • 16fbd149fac4b9752d3d46f33816290ca20c773126a5d1a1cea288be26dcac69
  • 1e01cbc306d3d9bdd6427a6f6b52254494d83834afb303e2d21002ce1914101f
  • 40c8e5f3d6bb0657bce0d33e051e51a65339ab1e2a3015212f3702300ca61cf2
  • 412e5c8db88dab089a382c65355113c6da5b0b73aaba6ed6d29f766b2760da94
  • 45dd6ac76208435485be2e7bef2a3010cf391957c26f7f5cd13e4fe9ca55f927
  • 552adc75f4c3823ca4675ab3575731cc4eb8852a5975c96ce3e2bbb91a4af17a
  • 5b228ced9eec659cd9a80d699de841b5d8795c65171d11645e7657634545ed81
  • 616be0502a52a886d21aaaa1ffa465f08a0f21438d4c1d1b3f7810ed18a08b1a
  • 660e3165c571fab20b0c9d84dc8a9a87fc3122398ae270f0c695dc43f9b80b7b
  • 780b00aa4c06d2fa34f341dfe5fbda0d8d2ba540611df7f64c14877f373c171c
  • 7a3acb173ade4c4d0ac50dbad5ae6026af38ffe41d70081657ae42bdf6699b78
  • 7ea7598c83b94cb1b182ca41e2b1c6efef44aab17d96b40679ae3cbe6bb0407e
  • 7fb8815000d87512f061582dfa593f46a145c5474b9064247db5e6b781e827c6
  • 87267fdcf9ec4ec89d628719fe827a691741cb84136648460f84addc8c7333a2
  • a206c65013710ca24bb5d6ec59b1f20ce28c0150b6bd76305a799114f5025817
  • a44c48bfe41a7f38f858648fcafc59d68e09ce8e9255599e295d2a0f4ed0d5e3
  • a7b9578f2e9fffdd97f7447ba20f2d28c141c54a0ff632b03ea477366429ceb5
  • d125c268e5c9b296eff7ae98765c5c0d265cf5f3c9b0deaa5da25ef88d1bf052
  • d524721a950892a07d062f2f91bac09dffcede0d49d9b6a15b671595db5c7674
  • e05029e0c119d3dbf3258e13cfa66f33ee40a3eb6794d7f9068438c630d27d9e
  • f4e6790b4118be870f4eba69596e576c8fe0c34b168115aa9a53027071f03f26

Coverage


Screenshots of Detection

AMP


ThreatGrid


Umbrella


↧

The sights and sounds of Cisco Talos at RSA 2019

March 8, 2019, 1:00 pm
$
0
0

An estimated 45,000 people attended this year’s RSA Conference in San Francisco to hear talks from some of the greatest minds in security.

As always, Cisco and Talos had a massive presence at the conference, topping off the week with a keynote address featuring Matt Watchinski, the vice president of Cisco Talos, and Liz Centoni, a senior vice president and general manager of Cisco’s Internet-of-things business group.

Blue and orange Snorts could be seen all over the conference floor, and our researchers spent the past few days speaking at the Cisco Security booth, discussing some of the latest and most pressing threats.


After their keynote on how to protect IoT devices, Matt and Liz continued the rounds throughout the week, including sitting down for an interview with Shira Rubinoff, a cybersecurity social media influencer and author, to talk about the dangers the recent influx of IoT devices represents.



You can also watch a recording of their keynote below and read our recap here.



Cisco Talos would like to thank anyone who stopped by the booth, viewed our threat map or interacted with any of our threat researchers this week. For a look at what we were up to this week, click through the slideshow at the top of the post.
↧
↧

Vulnerability Spotlight: Privilege escalation bug in CleanMyMac X's helper service

March 12, 2019, 7:24 am
$
0
0

Tyler Bohan of Cisco Talos discovered this vulnerability.

Executive summary

CleanMyMac X contains a privilege escalation vulnerability in its helper service due to improper updating. The application fails to remove the vulnerable components upon upgrading to the latest version, leaving the user open to attack. CleanMyMac X is an all-in-one cleaning tool for Macs from MacPaw. The application scans through the system and user directories looking for unused and leftover files and applications.

In accordance with our coordinated disclosure policy, Cisco Talos worked with MacPaw to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

CleanMyMac X incomplete update patch privilege escalation vulnerability (TALOS-2018-0759/CVE-2019-5011)

An exploitable privilege escalation vulnerability exists in the helper service CleanMyMac X, version 4.20, due to improper updating. The application fails to remove the vulnerable components upon upgrading to the latest version, leaving the user open to attack. A user with local access can use this vulnerability to modify the file system as root. An attacker would need local access to the machine for a successful exploit.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that version 4.20 of CleanMyMac X is affected by this vulnerability.

Coverage

The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rules: 48297, 48298

↧

Microsoft Patch Tuesday — March 2019: Vulnerability disclosures and Snort coverage

March 12, 2019, 11:00 am
$
0
0

Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 64 vulnerabilities, 17 of which are rated “critical,” 45 that are considered “important” and one “moderate” and “low” vulnerability each. This release also includes two critical advisories — one covering security updates to Adobe Flash Player and another concerning SHA-2.

This month’s security update covers security issues in a variety of Microsoft’s products, including the VBScript scripting engine, Dynamic Host Configuration Protocol and the Chakra scripting engine. For coverage of these vulnerabilities, read the SNORTⓇ blog post here.

Critical vulnerabilities

Microsoft disclosed 17 critical vulnerabilities this month, all of which we will highlight below.

CVE-2019-0592 is a memory corruption vulnerability in the Chakra scripting engine that could allow an attacker to elevate their privileges. The bug lies in the way that the scripting engine handles objects in memory. In order to exploit this vulnerability, an attacker would need to trick a user into visiting a specially crafted, malicious web page in the Microsoft Edge web browser.

CVE-2019-0763 is a remote code execution vulnerability that exists when the Internet Explorer web browser improperly handles objects in memory. An attacker could exploit this vulnerability by tricking a user into visiting a malicious web page while using Internet Explorer.

CVE-2019-0756 is a remote code execution vulnerability in the Microsoft XML Core Services MSXML parser. An attacker can exploit this bug by tricking the user into opening a specially crafted website designed to invoke MSXML through a web browser. Eventually, the attacker would gain the ability to execute malicious code and take control of the user’s system.

CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771 and CVE-2019-0773 are all memory corruption vulnerabilities in Microsoft’s scripting engine that exist due to the way Microsoft Edge handles objects in memory. An attacker could exploit these bugs to corrupt memory in a way that would allow them to execute arbitrary code in the context of the current user. A user would trigger this vulnerability if they visited a specially crafted, malicious web page in Edge.

CVE-2019-0784 is a remote code execution vulnerability that exists due to the way ActiveX Data Objects (ADO) handle objects in memory. An attacker could exploit this bug by tricking a user into visiting a specially crafted, malicious web page in Internet Explorer. Alternatively, they could embed an ActiveX control marked “safe for initialization” in an application or Microsoft Office document that hosts the Internet Explorer rendering engine.

CVE-2019-0603 is a remote code execution vulnerability in Windows Deployment Services TFTP Server. The bug lies in the way the server handles objects in memory. If an attacker were to exploit this vulnerability, they’d gain the ability to execute arbitrary code with elevated permissions on a target system.

CVE-2019-0697, CVE-2019-0698 and CVE-2019-0726 are remote code execution vulnerabilities in the Windows DHCP client. The vulnerability triggers when the client receives specially crafted DHCP responses to a client, potentially allowing an attacker to execute arbitrary code on the target machine.

CVE-2019-0666 and CVE-2019-0667 are vulnerabilities in the VBScript engine that exist due to the way the engine handles objects in memory. An attacker could use these bugs to corrupt memory in a way that would allow them to execute arbitrary code in the context of the current user. A user could trigger these vulnerabilities by visiting an attacker-created website through Internet Explorer. An attacker could also provide them with an embedded ActiveX control marked “safe for initialization” in an application or Microsoft Office document that hosts the Internet Explorer rendering engine.

Important vulnerabilities

This release also contains 45 important vulnerabilities:

Moderate

There was one moderate vulnerability in this release: CVE-2019-0816, a security feature bypass vulnerability in Azure SSH Keypairs.

Low

The only low vulnerability in this release is CVE-2019-0777, a cross-site scripting vulnerability in Team Foundation.

Coverage 

In response to these vulnerability disclosures, Talos is releasing the following SNORTⓇ rules that detect attempts to exploit them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up-to-date by downloading the latest rule pack available for purchase on Snort.org.

Snort rules: 45142, 45143, 46554, 46555, 48051, 48052, 49172, 49173, 49364 - 49369, 49371, 49372, 49378 - 49395, 49400 - 49403

↧

GlitchPOS: New PoS malware for sale

March 13, 2019, 7:52 am
$
0
0


Warren Mercer and Paul Rascagneres authored this post with contributions from Ben Baker.

Executive summary


Point-of-sale malware is popular among attackers, as it usually leads to them obtaining credit card numbers and immediately use that information for financial gain. This type of malware is generally deployed on retailers' websites and retail point-of-sale locations with the goal of tracking customers' payment information. If they successfully obtain credit card details, they can use either the proceeds from the sale of that information or use the credit card data directly to obtain additional exploits and resources for other malware. Point-of-sale terminals are often forgotten about in terms of segregation and can represent a soft target for attackers. Cisco Talos recently discovered a new PoS malware that the attackers are selling on a crimeware forum. Our researchers also discovered the associated payloads with the malware, its infrastructure and control panel. We assess with high confidence that this is not the first malware developed by this actor. A few years ago, they were also pushing the DiamondFox L!NK botnet. Known as "GlitchPOS," this malware is also being distributed on alternative websites at a higher price than the original.

The actor behind this malware created a video, which we embedded below, showing how easy it is to use it. This is a case where the average user could purchase all the tools necessary to set up their own credit card-skimming botnet.



GlitchPOS


Packer overview


A packer developed in VisualBasic protects this malware. It's, on the surface, a fake game. The user interface of the main form (which is not displayed at the execution) contains various pictures of cats:

The purpose of the packer is to decode a library that's the real payload encoded with the UPX packer. Once decoded, we gain access to GlitchPOS, a memory grabber developed in VisualBasic.

Payload analysis


The payload is small and contains only a few functions. It can connect to a command and control (C2) server to:

  • Register the infected systems
  • Receive tasks (command execution in memory or on disk)
  • Exfiltrate credit card numbers from the memory of the infected system
  • Update the exclusion list of scanned processes
  • Update the "encryption" key
  • Update the User Agent
  • Clean itself


Tasks mechanism


The malware receives tasks from the C2 server. Here is the task pane:

The commands are executed via a shellcode directly sent by the C2 server. Here is an example in Wireshark:

The shellcode is encoded with base64. In our screenshot, the shellcode is a RunPE:

"Encryption" key


The "encryption" key of the communication can be updated in the panel. The communication is not encrypted but simply XORed:

Credit card grabber


The main purpose of this malware is to steal credit card numbers (Track1 and Track2) from the memory of the infected system. GlitchPOS uses a regular expression to perform this task:

  • (%B)\d{0,19}\^[\w\s\/]{2,26}\^\d{7}\w*\?
    The purpose of this regular expression is to detect Track 1 format B
    Here is an example of Track 1:
    Cardholder : M. TALOS
    Card number*: 1234 5678 9012 3445
    Expiration: 01/99
    %B1234567890123445^TALOS/M.

  • ;\d{13,19}=\d{7}\w*\?
    The purpose of this regular expression is to detect Track 2
    Here is an example of Track 2 based on the previous example:
    ;1234567890123445=99011200XXXX00000000?*


If a match is identified in memory, the result is sent to the C2 server. The malware maintains an exclusion list provided by the server. Here is the default list: chrome, firefox, iexplore, svchost, smss, csrss, wininit, steam, devenv, thunderbird, skype, pidgin, services, dwn, dllhost, jusched, jucheck, lsass, winlogon, alg, wscntfy, taskmgr, taskhost, spoolsv, qml, akw.

Panel


Here are some additional screenshots of the GlitchPOS panel. These screenshots were provided by the seller to promote the malware.

The "Dashboard:"

The "Clients" list:

The "Cards Date:"

Linked with DiamondFox L!NK botnet


Author: Edbitss


The first mention of GlitchPOS was on Feb. 2, 2019 on a malware forum:

Edbitss is allegedly the developer of the DiamondFox L!NK botnet in 2015/2016 and 2017 as explained in a report by CheckPoint.

The developer created this video to promote GlitchPOS, as well. In this video, you can see the author set up the malware and capture the data from a swiped card. We apologize for the quality, shakiness, music, and generally anything else with this video, again, it's not ours.


The built malware is sold for $250, the builder $600 and finally, the gate address change is charged at $80.

Panel similarities


In addition to the malware language (VisualBasic), we identified similarities between the DiamondFox panel and the GlitchPOS panel. In this section, the DiamondPOS screenshots come from the CheckPoint report mentioned previously.

Both dashboards' world map are similar (image, code and color):

The author used the same terminology such ask "Clients" or "Tasks" on the left menu:

The icons are the same too in both panels, as well as the infected machine list (starting with the HWID). The PHP file naming convention is similar to DiamondFox, too.

The author clearly reused code from DiamondFox panel on the GlitchPOS panel.

Comparison of GlitchPOS and the DiamondFox POS module


In 2017, the DiamondFox malware included a POS plugin. We decided to check if this module was the same as GlitchPOS, but it is not. For DiamondFox, the author decided to use the leaked code of BlackPOS to build the credit card grabber. On GlitchPOS, the author developed its own code to perform this task and did not use the previously leaked code.

Bad guys are everywhere


It's interesting to see that someone else attempted to push the same malware 25 days after edbitss on an alternative forum:

This attacker even tried to cash in by increasing some prices.

Some members even attempted to call out the unscrupulous behaviour:

With the different information we have, we think that Chameleon101 has taken the previous malware created by Edbitss to sell it on an alternative forum and with a higher price.

Conclusion


This investigation shows us that POS malware is still attractive and some people are still working on the development of this family of malware. We can see that edbitss developed malware years even after being publicly mentioned by cybersecurity companies. He left DiamondFox to switch on a new project targeting point-of-sale. The sale opened a few weeks ago, so we don't know yet how many people bought it or use it. We also see that bad guys steal the work of each other and try to sell malware developed by other developers at a higher price. The final word will be a quote from Edbitss on a DiamondFox screenshot published by himself "In the future, even bank robbers will be replaced."

Coverage


Additional ways our customers can detect and block this threat are listed below.

Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors. Below is a screenshot showing how AMP can protect customers from this threat. Try AMP for free here.

Cisco Cloud Web Security (CWS) orWeb Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

Network Security appliances such asNext-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), and Meraki MX can detect malicious activity associated with this threat.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

Open Source SNORTⓇ Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Indicators of Compromise (IOCs)


The following IOCs are associated to this campaign:

GlitchPOS samples

ed043ff67cc28e67ba36566c340090a19e5bf87c6092d418ff0fd3759fb661ab (SHA256)
abfadb6686459f69a92ede367a2713fc2a1289ebe0c8596964682e4334cee553 (SHA256)

C2 server

coupondemo[.]dynamicinnovation[.]net

URLs

hxxp://coupondemo[.]dynamicinnovation[.]net/cgl-bin/gate.php
hxxp://coupondemo[.]dynamicinnovation[.]net/admin/gate.php
hxxp://coupondemo[.]dynamicinnovation[.]net/glitch/gate.php

↧
Search

Cyber Security Week in Review (March 15)

March 15, 2019, 5:59 am
$
0
0

Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. For more news delivered to your inbox every week, sign up for our Threat Source newsletter here.

Top headlines this week

  • The U.S. warned Germany that using Huawei’s 5G technology could result in a drop in information-sharing. American officials have consistently criticized the use of the Chinese company’s technology, saying they pose a national security risk. If other countries were to use Huawei’s 5G network, the U.S. says it would fear its intelligence was not being kept safe. 
  • It is reported that a hacking group stole an estimated six terabytes of data from the Citrix enterprise network. The company said it took steps to contain this data breach after it was alerted by the FBI, but thousands of customers’ information could still be at risk. It is not yet known what the nature of the information taken was.
  • Adobe fixed multiple remote code execution vulnerabilities in Photoshop and Digital Editions. The company released its monthly security update earlier this week. Two of the vulnerabilities were classified as critical, as an attacker could exploit them to execute code under the context of the current user.

From Talos

  • A new point-of-sale malware known as “GlitchPOS” has popped up on some online marketplaces. The malware is easy enough to install and use that virtually any user could buy their way into setting up their own botnet. We believe with high confidence that this is not the first malware created by this actor.
  • Microsoft released its monthly security update earlier this week, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 64 vulnerabilities, 17 of which are rated “critical,” 45 that are considered “important” and one “moderate” and “low” vulnerability each. This release also includes two critical advisories — one covering security updates to Adobe Flash Player and another concerning SHA-2.
  • CleanMyMac X contains a privilege escalation vulnerability in its helper service due to improper updating. The application fails to remove the vulnerable components upon upgrading to the latest version, leaving the user open to attack. CleanMyMac X is an all-in-one cleaning tool for Macs from MacPaw.

The rest of the news

  • Video app TikTok paid a $5.7 million fine to the Federal Trade Commission this week as part of a settlement. The FTC rules that the app, which allows users to upload short videos of them performing songs, improperly handled the data of users who are under the age of 13.
  • Two U.S. Senators introduced a new bill that would overhaul the country’s child privacy laws. The new bill would give parents complete control over their children's data online, and even allow them to completely erase information from certain websites. It would also ban targeted ads toward anyone under the age of 13.
  • Security researchers discovered a critical flaw in Switzerland’s new voting system that would allow attackers to manipulate votes. The group is now urging the Swiss government to halt the rollout of the online system.
  • Social media hackers are stepping up their activity as Brexit votes continue in the U.K. Researchers discovered an uptick in fake accounts that are spreading pro-Brexit sentiment over the past several weeks.
  • The U.S.’s Office of the Inspector General says NASA’s information security program contains several critical vulnerabilities. A new report states that the space agency could be open to an attack from a nation-state actor.


↧
↧

Threat Roundup for March 8 to March 15

March 15, 2019, 1:41 pm
$
0
0

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 08 and March 15. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

The most prevalent threats highlighted in this roundup are:

  • Win.Malware.Emotet-6888316-0
    Malware
    Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a wide variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails.
     
  • Win.Packed.Bladabindi-6888152-0
    Packed
    njRAT, also known as Bladabindi, is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.
     
  • Win.Packed.Kovter-6888122-0
    Packed
    Kovter is known for it's fileless persistence mechanism. This family of malware creates several malicious registry entries which store its malicious code. Kovter is capable of reinfecting a system even if the file system has been cleaned of the infection. Kovter has been used in the past to spread ransomware and click-fraud malware.
     
  • Win.Malware.Ircbot-6887900-0
    Malware
    Ircbot, also known as Eldorado, is known for injecting into processes, spreading to removable media, and gaining execution via Autorun.inf files.
     
  • Win.Downloader.Dofoil-6887823-0
    Downloader
    Dofoil, aka SmokeLoader, is primarily used to download and execute additional malware. Read more about this threat on our blog https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html.
     
  • Win.Malware.Upatre-6887803-0
    Malware
    Upatre is a trojan that is often delivered through spam emails with malicious attachments or links. It is known to be a downloader and installer for other malware.
     

Threats

Win.Malware.Emotet-6888316-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • Global\I98B68E3C
  • Global\M98B68E3C
  • MC8D2645C
  • MFA4F69B7
IP Addresses contacted by malware. Does not indicate maliciousness
  • 82[.]211[.]30[.]202
  • 119[.]59[.]124[.]163
  • 37[.]97[.]135[.]82
  • 69[.]45[.]19[.]251
  • 217[.]13[.]106[.]16
  • 160[.]16[.]109[.]161
Domain Names contacted by malware. Does not indicate maliciousness
  • N/A
Files and or directories created
  • N/A
File Hashes
  • 14873aa714a65cf71fc4fcf0b22aeb6d98718e56c6b30abf0b88313abb7096cf
  • 2aa82a27cfbd810db7a1989f7a854dcf8f0470854f64cbe5a6e66b426d4f5d39
  • 64b55f7724d69e0e5240d0b892fc8f427b1951909160821d890860b9502c0184
  • 756ce0947db75cee371d64495e3c371a5d81c99191f695568b3fdeadc9c31fb4
  • 77c23c37835701bea789493bda50a6270f477407afc5a51766124e0d7d98c183
  • 7a5cc102dd6b2a6a6560cd9413915e9a0331bdb94d9614a5ec8231080b1d47a3
  • 87c41d1f7fb8539eb5a3c819c89a29d2efdc09c336388b49b4e7ea2fb143a732
  • 8953cb59046bb2d303057684612a98c3de56e016d7a47c2b47eaa4dddd254f9b
  • a267997c229e0ca3dc27d27bf34c55dab32dfc9c3505cd3dcc1d778badf32fee
  • a6eb96882eea810dda7cea793c53d0e1cd651d52287c61f641b4891e0c110c1d
  • a77d91f122316c2be0e344c8a2de00ef2ac17650c3ab353de6b12c313f2927a8
  • c4cd6fbdc2f37be8c6ed3d165839c7f993ca6cc5614e770523ca6fda775819fa
  • e33695b999b2a53ebad043fb88165a59c5b623059a2f9b1e3c4aa26226eb5aaa
  • e36d39ae360f17a3c1987c71b7c43c537549481cb0e26ab32de3110eeb3417d2
  • e82c81df777d002701a31f6942ecfbb72fdf08386e7c4f7520e15eada3c7b649
  • f92e9016c5dc3903edf3fd6d1bed1d095da9dbf8e817e6497290aa40f617c776

Coverage


Screenshots of Detection

AMP



ThreatGrid



Win.Packed.Bladabindi-6888152-0


Indicators of Compromise


Registry Keys
  • <HKCU>\Software\5cd8f17f4086744065eb0992a09e05a2
Mutexes
  • \BaseNamedObjects\5cd8f17f4086744065eb0992a09e05a2
  • 9B737EAE3B0C796AE23ED0068C79CF59
  • be7bd1af3359996ed9bf
IP Addresses contacted by malware. Does not indicate maliciousness
  • N/A
Domain Names contacted by malware. Does not indicate maliciousness
  • paste[.]ee
  • pastebin[.]com
  • mine[.]moneropool[.]com
Files and or directories created
  • %System32%\Tasks\Administrator
  • %LocalAppData%\Administrator_.jpeg
  • %LocalAppData%\MQMQ
  • %LocalAppData%\_foldernamelocalappdata_\msrating32.exe
  • %LocalAppData%\_foldernamelocalappdata_\msrating32.exe.config
  • %WinDir%\Tasks\Administrator.job
File Hashes
  • 0081ac22b9b1c8070970ab4d1edfad5cf0df57206ac9f35675ce96c914d9a35e
  • 009b727284d9b7fb948273254c104ccc07df738f7f9ac4034b8035b11e1c8b73
  • 02fa5b2eb08fa878de231c1e1aadb8ae890d1205d75c6e78704ccc656072a521
  • 03574be4fab0b0dfbc4a08474bac9ec5face953e96f274e284d85f23e0394572
  • 039d0a85df67a302f8403b1ab5d829ad95ca1f6bd16c712fcfff924953aea417
  • 04eb8ea0cc1e3f1bb8420ffb41ca73650e17647b5a125b4e0b50ebcbe3e2586f
  • 05e2b0b5b303a6f0a4255728075cd57d6cb9512c6784a3d9841431f81d17fbd1
  • 07366374c7531cf8931f983c48d200ce64ca9ef1e2b8e7beda93f00494e9c4be
  • 07bbd30ebede3f32346869773bfffd7a03561a237d0b155659881c6bfcf2bcbe
  • 087f983881da308a40887d48ff51a47dc2653006b347bad377b06560bdedf54e
  • 0aafa85fde357b5468bd161e4dbf5ad281f4b65a8a6e8fac8ea61b6b97fb401a
  • 0ae37610706265b32944bde963a021536ddeb3ef2a46fba7a2dd506a84122aaf
  • 0af299fa65082907eaf022655a1d297f0bcebf9cc4299fa3e09712b9f6f3638b
  • 0b3cddec065917def4974c7e6c2db4a68bd66c240afcc6788f042fcf370dda0a
  • 0b7584dbe453ba56a37362502ad8362c7806ad55f93f459bb1520ba8b7e83260
  • 0cc3468620a282282493373cab6e0147414ab8b45b9207c135fc0ca2ced4a6a8
  • 0cc3ec52a4cccd7f66c39b0598ee3cd5057bbae5f76b6f53ba1dc7b244528d7d
  • 0d833bdb0a327257282952658f4022615da662b26ce96c7d7daa745123b539a7
  • 0e3f846a7e867311a3a4b5c3cd12e2cf3cd6e53dac743bf169922e5d5522c56b
  • 0eb558acbf404a8498bd62d39f915dc8878cab06b42110254bb0f95fed1a1cfb
  • 0f06812951241534a7de2f68d72178512bf8dd2fcaad68fc08361e09d936a0d2
  • 0f3110996e2c6dcafab54e881b4ae20b79a9a8a9e4bdea4e9282c59dceeba1de
  • 0fb34201e918d0b82093836b00a3f28e14b915b4458500206054c0ff89ff4386
  • 10ff1192d5f400ba24dc35c92cf93ee6f4d907f6a91d73960db9de6f9b6d908e
  • 12ff945a104096e2e33bff767e20f3fa1954261932d5b547632a2fa4b3532fa3

Coverage


Screenshots of Detection

AMP



ThreatGrid




Win.Packed.Kovter-6888122-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • 3F102AB2
  • 3F102AB2C2
  • 3F102AB2C1
  • \BaseNamedObjects\FBB4FA59C1
  • \BaseNamedObjects\CD5F8C5651203DDA8FEF88477479E431
  • \BaseNamedObjects\FBB4FA59
  • \BaseNamedObjects\FBB4FA59C2
IP Addresses contacted by malware. Does not indicate maliciousness
  • N/A
Domain Names contacted by malware. Does not indicate maliciousness
  • a15-smo[.]biz
Files and or directories created
  • %AppData%\Microsoft\Protect\S-1-5-21-2580483871-590521980-3826313501-500\5731e7cd-8311-408b-8f7b-20cabfeabcac
  • %AllUsersProfile%\Microsoft\{aeb72b63-4072-2739-ee13-f68145a36fd1}\{aeb72b63-4072-2739-ee13-f68145a36fd1}.exe
  • %AllUsersProfile%\Microsoft\{1ddc6d11-74a9-a07d-cfb7-a965c7d68cea}\{1ddc6d11-74a9-a07d-cfb7-a965c7d68cea}.exe
File Hashes
  • 0266eb0181e6d3cd1112bd582f87711cd0dddc3131f8cd961ef38911958d4d83
  • 037ac73363dda68d628670db90cf1d5baee2614545c633fe7a5ef80ded8833d3
  • 04052b00ab52dbb2bbbadc9b60122437dfcf1b82a399e1bd6dc868a7764e1622
  • 0446028c1c63060111c2f507ade24abf198eeb990c853f75fc285ab55e7e93c4
  • 0ea33d1365678ed238613d44f6154b3090728b073cbab653bd0cb851be70b357
  • 112e3cd76f74cc5611da59df8b3d07ef643915dc118bc8a8fa7ec6470c3c2918
  • 13c46670e8501c9de948fb75a227486299afc6c9f195979a304a3d89bd0f2860
  • 1d4cd9c8380430ea3786fd0a3ebb2f369b4db7779662eaf85997876708f5e0ed
  • 25ad560fdec751db9190cdaa21467ade949e5f555a213a583c0d59b809d1ffea
  • 263e9704f5d4d81c9de6459df0e3bb07571a94e96eaaf6e7978466e83c804c77
  • 29f77d861fcea9116cc943b853a54b44449e9f3722e692c8216ec223b96d2b3e
  • 3d27db6491de2111b9e47776e7b8913d37f967bd592f0d8b15d8b2abf25fe5c8
  • 45ce1cdd1f531667e6ec61341890d2ce5d6dc8ef827cd8b87fa90c1b482a864c
  • 476ba0cafaf6caab3d3065c54088cdbeaaf62581e371aa6b7a5add2c66a4c63b
  • 4c30f1f40076abac7cd30ed0f1a586d841d5f8e619bec01ed415d7dc181e0e7b
  • 4eda50c6c2b19e0871a703d29573c819b16581e59e76743eff31c8581a4f1479
  • 5015414e220101ebebef92b8780cebd51e41ba04f6e880a531807f96a58bf463
  • 511802d4ba18e098a313a7b5f21adf485632352ad84e9bb9620b85451cc8738e
  • 528c4c72ddc84ff3c6cba7ff634b9444c639b5eb435dbac1eb085a6e20531b89
  • 5297a054165c283ecc468f500eeadadf21fa0f8fedbe678cf94c578a134b5b2f
  • 530cb7062f46e9778d8797930d114f685f1ecd161a20e930c4649682e32758ee
  • 5f65eb86f57c979ed006ae5c8f1eddd52729a09f1a80efb092f10ccfa3a7dc99
  • 61bc6c41e2184f6c876d11d786bd83bcf330b2f867471457e295ed7e9bf6a4e1
  • 690f078af59858cd6d1ebf87104f84831c75eb3eb00c36cfc5a40af4cf52ee97
  • 6cf0017b223337ea77ec0a6452fcd68b3d5f79006212baadef5dc1ae8deabaf5

Coverage


Screenshots of Detection

AMP



ThreatGrid



Win.Malware.Ircbot-6887900-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • N/A
IP Addresses contacted by malware. Does not indicate maliciousness
  • 220[.]181[.]87[.]80
  • 192[.]42[.]119[.]41
Domain Names contacted by malware. Does not indicate maliciousness
  • mokoaehaeihgiaheih[.]ru
Files and or directories created
  • \??\E:\autorun.inf
  • \??\E:\.lnk
  • \??\E:\DeviceConfigManager.vbs
  • \??\E:\_\DeviceConfigManager.exe
  • %LocalAppData%\Temp\edakubnfgu
  • %LocalAppData%\Temp\gwhroqkhwu
  • %LocalAppData%\Temp\phqghumeay
  • %LocalAppData%\Temp\rgjqmvnkyr
  • %LocalAppData%\Temp\sxstlbzalm.bat
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tinwmbkjsh.bat
File Hashes
  • 0d1408f43b64724f4e1bc689af06c76a7a8bad4f4cc4accb697680827a2e8401
  • 11f919f38f7ffc654a9ae3ebc00bd8055f0540fc34742c6c41b3a6cc770e86a1
  • 13ad8720c3dc6997a728d970e7e8d8da3bdf47a9aa7122f2062418efbcba8067
  • 1450123a608b6f6b0c459e42733c33aef85df3d592424254ad793631c650724d
  • 176f000c04ad54f98af1b6fa78caeff969ba9fec1747416a6089717208f4e6bb
  • 224c6cdb3319d4ce8dbddafa7db57357a05ff6d25b3cf938e3a277e83415473a
  • 22ae2800578ea95c8439851ae40a20535cd13290aa93d78e9fd4f335c7bfcd06
  • 240865fcbc40ec209ee7ab43f0ac8a11d4c3c0a994b829097d0ee7e7c9cd0398
  • 25ab25d5887e3786532a15211c54143dffe27b27a1794fc0caa2fac26b814441
  • 25b97ddb73ec779f09b9d663a1c5695ab1e54857e83a03c719a71c464aa339b7
  • 34bde6576413b381f10540db6a5b0c0b2e42c60c5f29cb97d35712f38d9b2348
  • 37b5d81e2b9fb2fa99c5ec7c116675a132485549917ae75f19e9a037e4b85831
  • 3e537425161e844c07baf229e8e040d2be2337ad465f90082aa143ba890a87ca
  • 3fd4652e7dd1c445d4541d4da1c6e4a0eb13534579f1ce0c95733721423257b8
  • 4689813970088424400a2e073afa152d5d1ec8a8a200dbed4da70fcfcdde04d3
  • 4cecc5c73e73ff45d634919a4546f1f8cfbfb1ba0944da0fafd9ee8383704c1e
  • 4d8fa8c3d41f0cead59eb47a536dde17c90758872262c1e772ec65da5b5e3a2b
  • 51f7c74fda3ed980e6172b57d38b230bf77630ad3c687b6457c8a3475cee9b7e
  • 55eed01902268734a6fad2dc9b7a23bbd3e660f93f848d316468f50f47492ffa
  • 618798e167c8afd92bac52d42e9cb6d7abc85ff562d67411ee4732c761753670
  • 6c320dc8cfba148f2fa62eb938b5e9273130960ab65f83d9b754788cd643d1fe
  • 6dfabdef4c67f0e7770cd07e1ea60ca3f0f1c75e670ea47062086507be61b958
  • 70cf498d687c2c36198c4102115632debb42780e2e482cc1bfbf7613210cb870
  • 7dffd571164c077f38221c9a45dcbd36f069fb684c8f4e9164f8cc7a3253d9b9
  • 83e85a70bef91092a6030a7bd4f8d6caea9f10d58993b1d03321b7083bc6b827

Coverage


Screenshots of Detection

AMP



ThreatGrid



Umbrella



Win.Downloader.Dofoil-6887823-0


Indicators of Compromise


Registry Keys
  • N/A
Mutexes
  • D19AB989A35F471083DFB
IP Addresses contacted by malware. Does not indicate maliciousness
  • 51[.]15[.]93[.]62
Domain Names contacted by malware. Does not indicate maliciousness
  • pagefinder52[.]uz
Files and or directories created
  • %LocalAppData%\Temp\D19AB989A35F471083DFB
  • %AppData%\D19AB989A35F471083DFB
  • %AppData%\D19AB989A35F471083DFB\D19AB989A35F471083DFB.exe
  • %LocalAppData%\Temp\D19AB989A35F471083DFB32
  • %LocalAppData%\Temp\D19AB989A35F471083DFB64
File Hashes
  • 06141533408e6052c57801bc1a13d9eae0c5473cbd4daefc3c82cc16df02121b
  • 0da877fa450e61c35f184f935c866b85adf087aa36840c7bb6d4f5e78caeee3d
  • 10a60d91d0993fc42fc0e2dcaf23c6292a6fe3992d30b9a070aff9e901a476d8
  • 18a51f34d616573e350344420b4fbca5cf5a22b2c58af39f240beeafeb32272a
  • 1f361e3172998b311ef8e688807e6e7ab2b1e08ba779518e5d596dac0459c1c9
  • 20562a37ce8338817ef3b2cf00c9aca6aaa22efb90462d29a8276e6fb4a8b4fd
  • 284aca36a9bca682b5285d5ce746813b309708d421f4b64f3ad88053a5fb585e
  • 35923a5c4509b0cb4c0b0d157ba573387b098cc8fea83f91b075c2cd73c0246e
  • 395c3f755c6350037b89f1147496896938fdc3bda6d3113fde3714696e1c022e
  • 3c61461aa0f49596538c971740ce8e1b4ba2591233b7f3084acb8b48befde56d
  • 473df910306146759bc2478ee77f50cbf944e23a37c82f05563902b752a993de
  • 4de2facda43622ed776a0e38d8c7f913acfb700fbeb454d51199159249023840
  • 4f05ede1bbf72903141b54089f41b1f5ecfbf68b195acfa0ff73771219ae7245
  • 52cf86ed74dce82133c38b4cc0e2804878307925c293d00e19bdeabb5e78aa8a
  • 563a88feb872206c770fd6e9efabe66d48ceb34b4bc5cbc482042e33fe9b76e3
  • 586e3a4f9bcea6f8759dbb01dceae9c9ec195c9f275c78fd884cb29e3b707c08
  • 5ede64cb3093932c752defc4223d596fd6733e945d002785f15b4b2756bb899c
  • 6139f943467db8cfffa485c55c891cce2d181df869fc22e6b4a4bf2361e062a3
  • 9a8f38571026845836851fa780c25f7f48960b5e248610a42e3ccdad8495852d
  • 9cbd93cb77e64c6df894a34ad850f1777f7792729e9029ce3fb34dfc807d616e
  • 9dd88df8e9581bbca947def5ca7c835290a59bfd2e8f7a9647e2e58ad9800fbf
  • af8a6165044affaec01d741f87df3688c6da82aa636f7aaafc53cc13e2c616ff
  • b5de32f4ad9759d3175a2e55817c1f129645d530503f52a2e01501e9a2dcd78e
  • b84b1a2bb33df715eef75ab45554d69efe40704bc59b54a798bbd84c9824ddd8
  • b94aa2b5628ad5b1944b92485a760427babe9e4de12b66c8e22d89bf8ba904e6

Coverage


Screenshots of Detection

AMP



ThreatGrid



Win.Malware.Upatre-6887803-0


Indicators of Compromise


Registry Keys
  • <HKCU>\Software\Microsoft\Umqitiexdeuq
Mutexes
  • N/A
IP Addresses contacted by malware. Does not indicate maliciousness
  • 172[.]217[.]6[.]228
  • 184[.]168[.]131[.]241
  • 184[.]168[.]131[.]241
  • 68[.]235[.]37[.]83
  • 68[.]235[.]37[.]83
  • 94[.]64[.]68[.]197
  • 190[.]37[.]207[.]199
  • 71[.]91[.]43[.]179
  • 79[.]187[.]164[.]155
  • 63[.]227[.]34[.]28
  • 178[.]116[.]48[.]217
  • 86[.]135[.]144[.]6
  • 94[.]189[.]230[.]78
  • 206[.]190[.]252[.]6
  • 86[.]140[.]35[.]54
  • 59[.]90[.]26[.]49
  • 123[.]203[.]139[.]252
  • 86[.]158[.]144[.]27
  • 75[.]87[.]87[.]199
  • 84[.]234[.]151[.]23
  • 222[.]96[.]81[.]59
  • 172[.]245[.]217[.]122
  • 58[.]252[.]57[.]193
  • 103[.]14[.]195[.]20
  • 108[.]230[.]237[.]240
  • 18[.]207[.]122[.]59
Domain Names contacted by malware. Does not indicate maliciousness
  • kofinyame[.]com
  • www[.]california89[.]com
  • pnknjhuxsskskonvohioau[.]info
  • vsvkyxofropkfnvxtqu[.]ru
  • ypijaiuofuwgijcaqwohzttg[.]org
  • mzguonizaiofcwgxnzvwherszlmz[.]com
  • nzvoeikvdmpinoozhamd[.]com
  • lkbeyypifvcjvxwgsgdrcwkvydrc[.]com
  • jsodtcfuieijvpbyfewgyybmpj[.]info
  • lndnbibwojvpttjrlheuxby[.]info
  • vggaprxwdaqkrlvkeanrjnrwgmj[.]com
  • bamfzxfhazxfefylreaytvgulf[.]biz
  • eylinjbhuypwgtwqgovwstbyqcpj[.]net
  • pzfihbalfharxouokrlcuzxhtpr[.]biz
  • zhibylozydfqtukeamzpzppvif[.]org
  • lvwodonehibqsdprllgapjoriz[.]biz
  • zlursovdmvtgekqwozlwgmhgu[.]com
  • vsjfljuktcprpzcixtdamljdqztdy[.]ru
  • gebypvkbqstqsscizdheyxpfi[.]com
  • ppjjvfmjntoxsttbihhofizofiv[.]ru
  • lmzamkfmfaejfkvinkjkjtdznf[.]net
  • kfduojjrzxqkirtdgamjydpjtgil[.]net
  • skzaegitbqjnxczwvxkciqkxwha[.]biz
  • daovdoztdyskzppxkbyiaipr[.]ru
  • plphqnbubqifdmjfyekr[.]com
  • ayaytgarstgcmgyqhluouoduxp[.]info
  • thmxtkrgibmntaqprzusph[.]org
  • fyskhabnfxkzxhztpjpzobtwl[.]net
  • eawomrwysotslhbudmlbtspbrlv[.]org
  • amifxopfwnrpfvnzprculnwomjwo[.]com
  • ijpjzqlflonhqsckydtjib[.]com
  • hqjbkngeugdmzthvdixhmtd[.]ru
  • julnlfxcdlzxssciayeydphq[.]biz
  • dyqcdmnameilrprtgefydmvlrkb[.]ru
  • usxsplvoaucmcqzhylvydpbvoux[.]net
Files and or directories created
  • %LocalAppData%\Temp\budha.exe
  • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\budha.exe
  • %LocalAppData%\Temp\kilf.exe
  • %LocalAppData%\Temp\mciD000.tmp
  • %LocalAppData%\Temp\mciD212.tmp
  • %LocalAppData%\Temp\QQQ19A.bat
  • %LocalAppData%Low\yquv.sij
  • %AppData%\Siig\zuquzi.exe
File Hashes
  • 0166c9039455db0ea98683386b70f50b0112762e382ea4abd1e93b06c92def5e
  • 0167c644b8865c63304aaee76387e7a6e3b6cb02cc842c8fb8501ee8f77e1289
  • 07e28bf1b7435b3720b71b7746e4e80500c83be05af84d2d00a029af3a50e12b
  • 08c11779eaef3d77856505245682b893de88d564cb72c089ba6868a67bb5b615
  • 098aaeb04eacd88d2f1e015e99ba27bfdfc7a7e546baebe5a7e2973ea906834a
  • 0faa654f47498dad4ba37edbf51e139b403950901036b4b20965ece482a227b4
  • 10bc9653e8caa085a6f4c5b8138304322218c038707b0d96370aaf7b763f3c63
  • 188b97e1357a61019cee3f7f1922f884a8a11e5bd844c244524355053a2a91a6
  • 1c3ac82f646e2f984514b6a1df33b5cb1afce9822636c3cab7cf22556a215996
  • 25df09d4d6d8ef905b0024af40e8ca2f28a95c6ffb67bbd5e377d11f2a324b81
  • 265f68069c3f4f37ba64b18464a9d5ebb6db7c2bcfa43b4f7c3c01e08d8f979b
  • 27d134dc861c927028d13eebe67b15bf15258fdf58af6f54e2fdf4862bc5332d
  • 28d4d14611715adf25229f528c5c904c7a476b547d748b54e75e25d453daaca5
  • 2c7d97a3194c69de640bf7dd22ecc6bb887db6ac45fe51f73e983fd251f75305
  • 309617ae45a709d3be67aa9e14ec5d00731c6e4ae46960465fea0f4ed7433da4
  • 32253daaf93f636af8e995ecc02865927affd0f2f403691079040785e90acabb
  • 34ecfb02a49a5bc13a1872ab9ae31fef8a58b688c87faead979ad242e4bc27d2
  • 3c1577927878cbb48b0e9d6cf00c031de57af45d019cf3ffb079990cc5f21adc
  • 40da8071021b3bc12cada1ae026799d035b6b42d7aeca3d82a820e777f5a56fd
  • 43819962ad29ae185caefd004c718c78503203f643c750904f8fcc4ccb4c21f6
  • 4b7fac51617a8b03da4061ce21dea06d3ccca2bf06c962dd5222ca8f74731910
  • 4de920bcddd350ee1571d8cc96ed4875ca92f4095e63147b949859f498ade1dd
  • 55ec12cd22820605e1e4d28f9bce981434bed569b4677fd16d0ec3f6477839ea
  • 5a3c39384578544a4ee7f6bc4357b6c1c22d8f08e58181e4f766dabdf07fc3b1
  • 5f2b23d3795f5ee5be46948471d9ebe3f940e9d90bbd61099f06809770d99659

Coverage


Screenshots of Detection

AMP



ThreatGrid



Umbrella



↧

IPv6 unmasking via UPnP

March 18, 2019, 9:44 am
$
0
0

Martin Zeiser and Aleksandar Nikolich authored this post.

Executive summary

With tools such as ZMap and Masscan and general higher bandwidth availability, exhaustive internet-wide scans of full IPv4 address space have become the norm after it was once impractical. Projects like Shodan and Scans.io aggregate and publish frequently updated datasets of scan results for public analysis, giving researchers greater insight into the current state of the internet.

While IPv4 is the norm, the use of IPv6 is on the rise. However, there's been very little analysis on the most recent version of the internet protocol because it's impossible to run exhaustive scans given the size of the address space. We need to deploy novel techniques to enumerate active IPv6 hosts.

In the following post, we'll present a technique that uses the properties of the Universal Plug and Play (UPnP) protocol to get specific IPv4 hosts to divulge their IPv6 address. This allows us to enumerate a particular subset of active IPv6 hosts which can then be scanned. We performed comparative scans of discovered hosts on both IPv4 and IPv6 and presented the results and analysis. Our findings show that this technique is valid and that there are significant security discrepancies in filtering between IPv4 and IPv6 interfaces of these hosts and unintended IPv6 connectivity will be a growing problem.

Introduction, motivation and previous research

Multiple high-profile vulnerabilities have prompted extensive scans of the entire internet to gauge the concrete impact and remediation to such an extent that exhaustive scans of full IPv4 address space have become an integral part of modern network security research. The Heartbleed vulnerability, a bug in the OpenSSL cryptographic software library, prompted extensive analysis of how widespread the vulnerability is, as well as patch adoption over time.

Several research publications tried to raise awareness of database misconfiguration issues that plague publicly accessible MongoDB and Redis instances.

We have previously conducted internet-wide scans for accessible Memcached servers to assess the exposure to multiple vulnerabilities. We scanned the software affected by the vulnerabilities TALOS-2016-0219, TALOS-2016-0220 and TALOS-2016-0221 to study patch adoption rates and if they were vulnerable.

Distributed denial-of-service (DDoS) campaigns such as the Mirai botnet rely on IPv4 scans and default credentials to spread and infect millions of devices.

All of these, good and bad, are enabled by the fact that with relatively few resources, one can conduct a full IPv4 port scan in a matter of hours.

With IPv6 currently being the only viable long term solution to IPv4 address exhaustion, we are witnessing a steady rise in both IPv6-capable networks and active IPv6 hosts.



To alleviate the problem of IPv4 exhaustion, IPv6 uses 128-bit addresses, resulting in the theoretical maximum number of hosts being tens of orders of magnitude larger than IPv4. Such astronomical numbers of available addresses make the current IPv6 address space very sparse. There's a relatively small number of actual IPv6 addresses in use, and the addresses that are used are somewhat random, meaning that addresses are scattered. Enumerating all active hosts by scanning all of this address space is practically, and theoretically, infeasible. With the greater adoption of IPv6, this threatens to hide an ever larger number of hosts in future internet surveys. This is especially critical as a growing number of unsecured internet-of-things devices come online.

Several researchers have developed novel techniques to uncover active, internet-connected, IPv6 hosts to solve this issue. Some use a privileged network position to compile lists of active hosts, while others use legitimate features of different protocols that could be misused. The Shodan project used features of Network Time Protocol to get hosts to reveal their IPv6 addresses. The IPv6Hitlist project uses multiple sources and techniques to make a daily updated list of active IPv6 hosts and networks such as forward DNS lookups, certificate transparency logs, RIPE Atlas and others. The IPv6 Farm project has used properties of DNS and DNSSEC to uncover active hosts and do comparative scans against IPv4 address counterparts.

We intend to contribute to public IPv6 research with a technique that relies on UPnP NOTIFY packets to uncover pairs of IPv4 and IPv6 addresses of dual-homed hosts. Although relatively small in magnitude, our resulting dataset consists of mostly end-user, client-side, consumer devices that are largely not covered in previously published datasets.

UPnP and the internet

Universal Plug And Play is a set of network protocols initially designed for network discovery. In essence, different devices on a local network can announce their presence and capabilities to others. Another common use for UPnP is Network Address Translation or NAT traversal where devices can use Internet Gateway Device Protocol to forward ports.

As designed, UPnP has no place outside the local network, yet many devices do expose UPnP ports openly to the internet. This has led to abuses and attacks over the years. UPnP has been abused to maliciously punch holes in NAT, remotely disclose sensitive network configuration information and perform DDoS attacks, among others. We have previously published research into possible UPnP client-side attacks and abuses, which gives us an idea of how to use it to umask IPv6 addresses.

When a new device connects to the network, it announces its presence and capabilities by sending a UPnP NOTIFY packet to a multicast address. The packet usually looks like this:
NOTIFY * HTTP/1.1
Host:239.255.255.250:1900
Cache-control:max-age=1800
Location: http://host/description.xml
Nt:upnp:rootdevice
Nts:ssdp:alive
Usn:uuid:de5d6118-bfcb-918e-0000-00001eccef34::upnp:rootdevice
The important bit in that packet is the "Location" header, which specifies a description URL that points to an XML file describing the device's capabilities. When this packet is sent via UDP to special address "239.255.255.250" any device that supports UPnP and Simple Service Discovery Protocol (SSDP) is supposed to visit that URL, fetch the XML and parse it. Coincidentally, this was the core of MiniUPnP vulnerability we published in 2015 (TALOS-2015-0035).

UPnP implementations don't care where the NOTIFY packet comes from, whether from the local network to multicast IP address or if it was delivered to the endpoint directly. This means that by sending this specific UPnP packet, we can have the target UPnP endpoint connect back to a URL of our choosing. As previously mentioned, many devices on the internet expose UPnP port, 1900 UDP by default, unfiltered.

Combining this, we can have a NOTIFY packet that specifies an URL containing an IPv6 address. If we send that NOTIFY packet to an IPv4 address that has UPnP port open and if that host also has IPv6 connectivity, it would connect back to the specified URL, thus revealing it's IPv6 address. If we do this for all IPv4 addresses, we expect to get various IPv6 hosts connecting back. That way, we can make pairs of IPv4 and corresponding IPv6 addresses, scan both and look for discrepancies.

Scan execution

The scanning consists of two steps. First, we send specific UPnP NOTIFY packets to every IPv4 address to gather IPv6/IPv4 pairs. Then, we perform full port scans of uncovered pairs and compare the open port states on the IPv4 and IPv6 side.

For the first step, we decided to use Masscan's modified packet templates to send our NOTIFY packet. To record the HTTP requests coming from hosts that try to retrieve the description URL, we simply ran a web server with full logging. To be able to distinguish HTTP requests coming from different hosts, we needed a way to make every request unique. A nice way to do so was to encode the target IPv4 address into the "Location" URL. Our NOTIFY packet looks like this:
NOTIFY * HTTP/1.1
Host:239.255.255.250:1900
Cache-control:max-age=1800
Location:http://[IPv6_address_of_our_server]/?IPv4_ADDR_OF_TARGET
Nt:upnp:rootdevice
Nts:ssdp:alive
Usn:uuid:de5d6118-bfcb-918e-0000-00001eccef34::upnp:rootdevice
If the target UPnP IPv4 host receives this packet and has IPv6 connectivity, it will make an HTTP GET request to our IPv6 server with its IPv4 address in the URL. In our HTTP server log file we would see something like this:

2406:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:7090 [IPv6_address_of_our_server]:55555 –[20/Dec/2018:16:47:30 -0500] "GET /?IPv4_ADDR_OF_TARGET HTTP/1.1" 404 345"-" "Linux/3.10.0_hi3536, UPnP/1.0, Portable SDK for UPnP devices/1.6.18"
In the above output, we can see the target host's IPv6 address, its corresponding IPv4 address in the GET request, and its User-Agent string, which reveals its UPnP implementation and version. Additionally, since we didn't want anyone intentionally polluting our data, we used a simple encryption scheme to encrypt the IPv4 address embedded in the URL. That way, when parsing logs, we could authenticate that what we got were legitimate requests resulting from our NOTIFY packets.

After tallying the results, the second part of the scan can begin. We conducted two more detailed scans, one for each IPv4 and IPv6 address in the resulting dataset. Since the number of hosts that replied was manageable, we scanned the top 100 most popular ports using NMap.

The results

To have an internet host connect back to us and reveal its IPv6 address, there are conditions that need to be satisfied. First, the host needs to have UDP port 1900 open, it needs to accept and parse our UPnP packet and it needs to request the specified URL. In order for the URL request to succeed, the host needs to be dual-homed (connected to both IPv4 and IPv6) and the outgoing traffic to our HTTP port needs to be allowed. We conducted these scans multiple times over the course of two months. Each time, about 12,000 unique IPv6 addresses were logged. Given the requirements, we expected and were proven correct, to see a majority of consumer devices in our results. As such, a large number of them have dynamic IPv4 addresses which change occasionally meaning that the validity of the dataset degrades over time.

There are multiple ways to assign an IPv6 address to a host and there are a few transitional technologies in use. For example, 8 percent of the hosts in the dataset have their IPv6 address assigned by using "6to4" mechanism which is a transition mechanism in place to enable transport of IPv6 traffic over IPv4 networks by way of relays. Similarly, Teredo Tunneling is also a transition mechanism employed by default in some versions of Windows. Less than 1 percent of the hosts replied to our scans with a Teredo address.

Some of the devices in the dataset rely on default IPv6 addressing scheme which specifies that 64 bits that represent interface identifier are based on hosts MAC address. Since MAC addresses each fit into their own group, we can make an educated guess about the device type. The user agent strings further corroborate this.

Top 10 device manufacturers
  1. Huawei Technologies
  2. Zhejiang Uniview Technologies
  3. Amazon Technologies
  4. Swann communications
  5. LT Security
  6. Trendnet
  7. Netgem
  8. Shenzhen Giec Electronics
  9. Synology Incorporated
  10. Panasonic AVC Networks Company
Based on reported user agent strings, 98 percent of the hosts are embedded Linux devices such as security cameras, media and NAS servers and Android devices that consist of smart TVs and media dongles. Windows hosts that replied consisted of mostly BitTorrent clients such as Azureus.

The most common UPnP implementation is still LibUPNP, with the most popular version being 1.6.18, which was likely released in 2013. Second is MiniUPNP with less than 1 percent of hosts. The most popular version of MiniUPnP is 1.9, released in 2014. Both of these versions contain multiple public vulnerabilities.
  • Other common user agent strings
  • Android/4.4.2 UPnP/1.0 Cling/2.0
  • Android/5.0 UPnP/1.0 Cling/2.0
  • Android/5.0.2 UPnP/1.0 Cling/2.0
  • Android/7.1.2 UPnP/1.0 Cling/2.0
  • Android/8.0.0 UPnP/1.0 Cling/2.0
  • Android/8.1.0 UPnP/1.0 Cling/2.0
  • Azureus 4.3.0.6
  • Azureus 4.9.0.0
  • Azureus 5.7.5.0;Mac OS X;Java 1.8.0_66
  • Azureus 5.7.5.0;Windows 10;Java 1.8.0_121
  • Azureus 5.7.5.0;Windows Server 2012 R2;Java 1.8.0_121
  • Azureus 5.7.5.0;Windows Server 2012;Java 1.8.0_121
  • Dalvik/2.1.0 (Linux; U; Android 6.0; vivo Y67L Build/MRA58K)
  • Dalvik/2.1.0 (Linux; U; Android 7.0; JMM-AL00 Build/HONORJMM-AL00)
  • Dalvik/2.1.0 (Linux; U; Android 8.0.0; DUK-AL20 Build/HUAWEIDUK-AL20)
  • Dalvik/2.1.0 (Linux; U; Android 8.0.0; SM-A720F Build/R16NW)
  • Dalvik/2.1.0 (Linux; U; Android 8.1.0; EML-AL00 Build/HUAWEIEML-AL00)
  • Debian/8 UPnP/1.0 MiniUPnPc/
  • Linux/2.6.32-042stab128.2 UPnP/1.0 Cling/2.0
  • Linux/3.0.35 UPnP/1.0 Portable SDK for UPnP devices/1.6.21
  • Linux/3.10.0_s40 UPnP/1.0 Portable SDK for UPnP devices/1.6.19
  • Linux/3.18.22+ UPnP/1.0 HUAWEI_iCOS/iCOS V1R1C00 DLNADOC/1.50
  • Linux/3.4.67_s40 UPnP/1.0 HUAWEI_iCOS/iCOS V1R1C00 DLNADOC/1.50
  • Linux/4.14.79 UPnP/1.0 jUPnP/2.0
  • Linux/4.9.97 UPnP/1.0 HUAWEI_iCOS/iCOS V1R1C00 DLNADOC/1.50
  • Ubuntu/12.04 UPnP/1.1 MiniUPnPc/1.9
  • WindowsNTunknown/6.2 UPnP/1.0 Teleal-Cling/1.0

The most common implementation, LibUPNP embeds a Linux kernel name and version into the user agent string. The most popular Linux kernel version is 3.0, with 4,248 hosts out of 10,390, followed by 3.10 with 3,950 hosts. Only 196 hosts are using Linux kernel version 4.x. A total of 660 hosts replied with Linux kernel version 2.6, which is still very common with consumer-grade wireless routers. Out of the 523 hosts that explicitly stated their Android version, 293 were on 5.1.1 version, followed by 102 on various releases of Android 8.

When we started this research, we hypothesized that we would likely find hosts that have proper filtering, all important ports firewalled, on IPv4 side, but more relaxed, or non-existent filtering on the IPv6 side. And indeed, after comparing the top 100 TCP port scan results on corresponding IPv6 and IPv4 addresses, we have found 0.3 percent of hosts to have more open ports on IPv6 side. This leads to unintended exposure of sensitive data and services such as SMB network shares, FTP and HTTP servers.

As previously mentioned, the IPv6 Hitlist project maintains a daily updated list of known active IPv6 hosts aggregated from multiple sources. Comparing active hosts from our scans to their list yielded less than 0.1 percent of overlap, meaning that even though our resulting dataset is small, it represents a unique subset of active IPv6 devices which were so far unexplored.

Conclusion

We can infer several things by looking at this data. First, the problem of open UPnP devices on the internet isn't going away. And we can confirm that there are thousands of devices on the internet whose owners aren't aware of their IPv6 connectivity. Our test required that a host has a publicly accessible IPv4 address along with IPv6 — the number of hosts with public IPv6, but private IPv4, addresses unbeknownst by their owners is likely even higher. Coupled with the fact that there are a significant number of scanned hosts with less filtering on the IPv6 side than on IPv4, this unintended IPv6 connectivity results in additional exposure of these devices and their networks. Additionally, from our relatively small dataset, we can see that these hosts run severely outdated software and operating systems, compounding the effect of unintended exposure to the internet.

With a growing number of connected IPv6 hosts, even though they cannot be directly and exhaustively enumerated, higher exposure through public addresses means that poorly configured and maintained devices that are usually hidden behind NAT in private IPv4 space can and will be abused by employing techniques to actively uncover them.

Users should ensure that their devices don't have unintentional IPv6 connectivity or if it's intentional, that it's adequately firewalled.

↧

Vulnerability Spotlight: Multiple Vulnerabilities in CUJO Smart Firewall, Das U-Boot, OCTEON SDK, Webroot BrightCloud

March 19, 2019, 8:00 am
$
0
0

Claudio Bozzato of Cisco Talos discovered these vulnerabilities.

 

Executive summary


CUJO AI produces the CUJO Smart Firewall, a device that provides protection to home networks against a myriad of threats such as malware, phishing websites and hacking attempts. Cisco Talos recently discovered 11 vulnerabilities in the CUJO Smart Firewall. These vulnerabilities could allow an attacker to bypass the safe browsing function and completely take control of the device, either by executing arbitrary code in the context of the root account, or by uploading and executing unsigned kernels on affected systems.

In accordance with our coordinated disclosure policy, Cisco Talos worked with CUJO AI to ensure that these issues are resolved and that a firmware update is available for affected customers. In most typical scenarios the firmware update process is handled by CUJO AI, allowing this update to be deployed to affected customers automatically. Given that these devices are typically deployed to provide protection for networked environments, it is recommended that affected users confirm their devices have been updated as soon as possible to ensure that the devices are no longer affected by these vulnerabilities.

Exploitation


In order to better convey the threat that these issues pose in real-world implementations, this section groups the vulnerabilities based on realistic attack scenarios in which the vulnerabilities would likely be exploited, and illustrates how chaining them together would raise the impact on the device.

CUJO is based on the OCTEON's SDK, which results in a Linux-based operating system running a kernel with PaX patches, which is not common for internet-of-things (IoT) appliances. However, the majority of the vulnerabilities are not affected by this countermeasure.

Remote code execution, unauthenticated, with persistence


We identified two chains that could be used to execute code remotely without authentication.

    1. TALOS-2018-0683 describes a vulnerability in the Webroot BrightCloud SDK, a service used to retrieve websites' classification and reputation data. CUJO uses BrightCloud as part of their safe browsing protection. By exploiting this vulnerability, an unauthenticated attacker could be able to impersonate BrightCloud's services and execute code on the device as the root user. As described in TALOS-2018-0686, the BrightCloud SDK defaults to using HTTP connections to communicate with the remote BrightCloud services, making the exploitation of TALOS-2018-0683 trivial if an attacker is able to intercept traffic between CUJO and BrightCloud. 

    2. CUJO uses the Lunatik Lua engine in order to execute Lua scripts from within the kernel context. This is used to analyze the traffic of the entire network and is part of CUJO's safe browsing protection. TALOS-2018-0703 describes a script injection vulnerability that allows any unauthenticated user in the local network to execute Lua scripts in the kernel by specifying an arbitrary "Host" header in HTTP requests. Since Lunatik permits the use of the unsafe `load()` Lua function, this allows an attacker to execute arbitrary code in the kernel. Additionally, TALOS-2018-0702 describes an issue that can be used to trick CUJO into extracting and analyzing any arbitrary hostname. As shown at the end of the TALOS-2018-0703 advisory, a malicious website could chain both vulnerabilities together in order to force any client machine in CUJO's network to perform a POST request via JavaScript, triggering the Lua injection and effectively executing code in the kernel.
      Note that the vulnerabilities above can also be executed from the local network. Moreover, they can be further chained with the "verified boot bypass" described below in order to permanently compromise the device.

      Local network code execution, unauthenticated


      As previously stated, the two chains above can be exploited from the local network.

      Additionally, we identified two code execution vulnerabilities (TALOS-2018-0653 and TALOS-2018-0672) that affect the parsing of mDNS messages. Note, however, that CUJO constrains the affected `mdnscap` process in a low-privileged chroot-ed environment. Therefore, an attacker would need to escalate their privileges in order to fully compromise the device.

      Smartphone app code execution, with persistence


      CUJO users can download an app on Android and iOS devices to configure their device. Since CUJO acts as a router and serves DHCP requests, it is possible to use the app to set up static DHCP entries. TALOS-2018-0627 shows how to leverage a vulnerability in the way DHCP hostnames are handled in order to execute arbitrary operating system commands as the root user.

      Note that this can be further chained with the "verified boot bypass" described below in order to permanently compromise the device.

      Device-local verified boot bypass (persistence methods)


      CUJO uses Das U-Boot's "Verified Boot," an open-source primary boot loader that aims to protect the boot process from unauthorized modifications, and as a consequence, at avoiding a persistent compromise of the device. Moreover, the first 16MB of CUJO's eMMC have been permanently write-protected, so that it is not possible, even for the manufacturer, to modify the system's bootloaders. We identified two vulnerabilities that bypass these protections.

      • We identified an issue in Das U-Boot, affecting versions 2013.07-rc1 to 2014.07-rc2 (inclusive). TALOS-2018-0633 shows that U-Boot FIT images' signatures are not enforced, since it is still possible to boot from legacy unsigned images. This behavior can be exploited by simply replacing a signed FIT image with a legacy (and thus unsigned) image. CUJO uses the OCTEON SDK, which in turn uses U-Boot version 2013.07, so they are both vulnerable to this issue. Because of this, and since products have no possibility to use the impacted U-Boot versions without avoiding the issue, this CVE has been assigned to U-Boot.

      As previously stated, since the U-Boot bootloader is unmodifiable, TALOS-2018-0633 cannot be fixed in CUJO. Note, however, that, in isolation, this is less severe of an issue. See our discussion below for more details.

      • TALOS-2018-0634 describes an additional way to bypass the secure boot process. By modifying the `dhcpd.conf` file, it is possible to make the DHCP server execute shell commands. Since this file persists across reboots, it is possible to execute arbitrary commands as root at each boot, effectively compromising the system's integrity.

      Safe browsing bypass


      Finally, TALOS-2018-0702 shows how to bypass CUJO's safe browsing, potentially allowing malicious websites to serve malware even in presence of CUJO's filtering.

      Vulnerability details


      CUJO Smart Firewall static DHCP hostname command injection vulnerability (TALOS-2018-0627/CVE-2018-3963)


      The CUJO Smart Firewall is vulnerable to command injection within the DHCP daemon configuration present on affected devices. This vulnerability exists due to a lack of proper input sanitization during the DHCP configuration process. This vulnerability can be triggered when configuring a new static DHCP address on affected devices. An attacker could send a DHCP request message and set up a corresponding static DHCP entry to trigger this vulnerability. It should be noted that in order to modify the DHCP configuration on devices, an attacker would first need to authenticate to the system using valid user credentials. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands within the context of the root account on the system. For additional information, please see the advisory here.

      Das U-Boot verified boot bypass (TALOS-2018-0633/CVE-2018-3968)


      Das U-Boot allows an attacker to execute an unsigned kernel embedded in a legacy image format if they are able to supply a boot image to the device. This vulnerability exists due to the fact that the version of Das U-Boot used by the devices lacks proper FIT signature enforcement during the boot process. While Das U-Boot has silently fixed this issue, the version used by the CUJO Smart Firewall was not updated to the new version, and is thus vulnerable. However we believe it's only a medium severity issue in CUJO specifically, since the exploitation requires either physical or local access to the device (e.g. via an additional root exploit). For additional information, please see the advisory here.

      CUJO Smart Firewall dhcpd.conf verified boot bypass (TALOS-2018-0634/CVE-2018-3969)


      The CUJO Smart Firewall is vulnerable to a bypass of the verified boot process. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary system commands during the system boot process. By embedding system commands into the `/config/dhcpd.conf` file, an attacker can force those commands to be executed each time the system is rebooted. Also, since this information is stored in the /config partition, it is persistent across reboots. In order to successfully exploit this vulnerability, an attacker would need the ability to write to the `/config/dhcpd.conf` file on affected systems. It is important to note that this is achievable using TALOS-2018-0627, which is described above. For additional information, please see the advisory here.

      CUJO Smart Firewall mdnscap mDNS record parsing code execution vulnerability (TALOS-2018-0653/CVE-2018-3985)


      The CUJO Smart Firewall is vulnerable to an exploitable double free vulnerability present in the `mdnscap` binary on affected systems. This vulnerability exists due to the system freeing a memory space twice when an invalid query name is encountered while the device is parsing mDNS packets. This vulnerability could be leveraged by an unauthenticated attacker to obtain the ability to execute arbitrary code in the context of the mdnscap process. In order to fully compromise the system, an attacker would still need to escape the `chroot` environment and further escalate privileges. For additional information, please see the advisory here.


      CUJO Smart Firewall mdnscap mDNS label compression denial-of-service vulnerability (TALOS-2018-0671/CVE-2018-4002)


      The CUJO Smart Firewall is vulnerable to an exploitable denial-of-service vulnerability in the `mdnscap` binary present on affected systems. This vulnerability exists due to the system incorrectly processing label compression pointers while parsing mDNS packets. In certain conditions, the improper handling of compression pointers in mDNS packets can lead to uncontrolled recursion, which causes stack exhaustion and ultimately crashes the `mdnscap` process, causing a denial-of-service condition. An unauthenticated remote attacker could leverage a specially crafted mDNS packet to exploit this vulnerability and create a denial-of-service condition on affected devices. For additional information, please see the advisory here.


      CUJO Smart Firewall mdnscap mDNS character-strings code execution vulnerability (TALOS-2018-0672/CVE-2018-4003)


      The CUJO Smart Firewall is vulnerable to an exploitable code execution vulnerability in the `mdnscap` binary present on affected systems. This vulnerability exists due to the system incorrectly handling string lengths that may exist in the character strings in mDNS resource records. A specially crafted mDNS resource record could be leveraged by an unauthenticated remote attacker to create a heap-based buffer overflow condition and ultimately lead to arbitrary code execution in the context of the `mdnscap` process on affected devices. In order to fully compromise the system, an attacker would still need to escape the `chroot` environment and further escalate privileges. For additional information, please see the advisory here.


      CUJO Smart Firewall mdnscap mDNS SRV Record denial-of-service vulnerability (TALOS-2018-0681/CVE-2018-4011)


      The CUJO Smart Firewall is vulnerable to an exploitable integer underflow vulnerability present in the `mdnscap` binary present on affected systems. This vulnerability exists due to the system incorrectly handling the "RDLENGTH" value when parsing SRV records in mDNS packets. An unauthenticated remote attacker could leverage a specially crafted SRV record to trigger this vulnerability and create a denial-of-service condition on affected devices. For additional information, please see the advisory here.


      Webroot BrightCloud SDK HTTP headers-parsing code execution vulnerability (TALOS-2018-0683/CVE-2018-4012)


      The Webroot BrightCloud SDK is vulnerable to an exploitable buffer overflow in the HTTP header-parsing function. The function `bc_http_read_header` incorrectly handles overlong headers, leading to arbitrary code execution. An unauthenticated attacker could impersonate a remote BrightCloud server to trigger this vulnerability and gain arbitrary code execution on affected devices. This SDK is found inside the CUJO Smart Firewall, as well as the CUJO Smart Firewall and the Webroot BrightCloud SDK. For additional information, please see the advisory here.


      Webroot BrightCloud SDK HTTP connection unsafe defaults vulnerability (TALOS-2018-0686/CVE-2018-4015)


      An exploitable vulnerability exists in the HTTP client function of the Webroot BrightCloud SDK, which is used by the CUJO Smart Firewall. The configuration of the HTTP client does not enforce a secure connection by default, resulting in a failure to validate TLS certificates. An attacker could impersonate a remote BrightCloud server to exploit this vulnerability using a man-in-the-middle attack. Successful exploitation could result in exposure of sensitive credentials, the transparent alteration of BrightCloud queries, or exploitation of vulnerabilities in the underlying SDK. For additional information, please see the advisory here.

      CUJO Smart Firewall safe browsing Host header parsing firewall bypass vulnerability (TALOS-2018-0702/CVE-2018-4030)


      The CUJO Smart Firewall is vulnerable to an exploitable firewall evasion in the HTTP and HTTPS parsing used by the firewall's safe browsing function. This vulnerability exists due to the firewall improperly processing host information in HTTP and HTTPS traffic that is inspected by the devices during web reputation checking. An attacker could create specially crafted web traffic to evade this reputation checking and allow hosts to access external web servers that the firewall would not otherwise allow access to. For additional information, please see the advisory here.


      CUJO Smart Firewall threatd hostname reputation check code execution vulnerability (TALOS-2018-0703 / CVE-2018-4031)


      The CUJO Smart Firewall is vulnerable to an exploitable code execution vulnerability in the HTTP and HTTPS parsing used by the firewall's safe browsing function. This vulnerability exists due to lack of sanitization of host information present in HTTP and HTTPS traffic that is inspected by the devices during web reputation checking. This vulnerability could be leveraged by an attacker to execute arbitrary code on affected devices. An attacker could create a specially crafted network packet or leverage a malicious web server to exploit this vulnerability. For additional information, please see the advisory here.

      Versions Tested


      Talos tested and confirmed that the following CUJO Smart Firewall firmware versions are affected:

      TALOS-2018-0627 affects CUJO Smart Firewall, version 7003.

      TALOS-2018-0633 affects CUJO Smart Firewall, version 7003; OCTEON-SDK 3.1.2 to 5.1; and Das U-Boot 2013.07-rc1 to 2014.07-rc2.

      Conclusion


      As previously described, CUJO AI has provided a system update to resolve these issues. Since these devices are typically relied on to secure home network environments, they may be deployed in sensitive locations within the network. It is recommended that affected users confirm their devices have been updated as soon as possible to ensure that the devices are no longer affected by these vulnerabilities.

      Coverage


      The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

      Snort Rules: 47234, 47663, 47809, 47811, 47842, 48261, 48262

      ↧

      Beers with Talos Ep. #49: POS Malware, RSA Highlights, and SOL OpSec Fails

      March 20, 2019, 8:08 am
      $
      0
      0


      Beers with Talos (BWT) Podcast Ep. #49 is now available. Download this episode and subscribe to Beers with Talos:

      If iTunes and Google Play aren't your thing, click here.

      Recorded March 15, 2019. We recorded this after coming back from RSA, with some on-location highlights included. This episode opens a bit more thought-provoking than we typically do, and we move toward discussing point-of-sale malware like Glitch. After the RSA highlights, we discuss OpSec fails, and Nigel becomes a Burning Man convert after learning there are people there on drugs with rockets that he watches for fun.

      The timeline:

      • 01:15 — Roundtable: Some different, if not important takes today.
      • 16:00 — Glitch POS: Why POS is a hot vector ($$$$)
      • 34:00 — RSA Highlights and random musings (with Ashely Kane and Matt Watchinski)
      • 45:10 — OpSec fails: Try to avoid sending photos of your felonies to police
      • 54:00 — Closing thoughts, parting shots

      The links:

      ==========

      Featuring: Craig Williams (@Security_Craig), Joel Esler (@JoelEsler), Matt Olney (@kpyke) and Nigel Houghton (@EnglishLFC).

      Hosted by Mitch Neff (@MitchNeff).


      Subscribe via iTunes (and leave a review!)


      Subscribe to the Threat Source newsletter



      Give us your feedback and suggestions for topics: beerswithtalos@cisco.com

      ↧
      ↧

      Ransomware or Wiper? LockerGoga Straddles the Line

      March 20, 2019, 11:08 am
      $
      0
      0

      Executive Summary

      Ransomware attacks have been in the news with increased frequency over the past few years. This type of malware can be extremely disruptive and even cause operational impacts in critical systems that may be infected. LockerGoga is yet another example of this sort of malware. It is a ransomware variant that, while lacking in sophistication, can still cause extensive damage when leveraged against organizations or individuals. Cisco Talos has also seen wiper malware impersonate ransomware, such as the NotPetya attack.

      Earlier versions of LockerGoga leverage an encryption process to remove the victim's ability to access files and other data that may be stored on infected systems. A ransom note is then presented to the victim that demands the victim pay the attacker in Bitcoin in exchange for keys that may be used to decrypt the data that LockerGoga has impacted. Some of the later versions of LockerGoga, while still employing the same encryption, have also been observed forcibly logging the victim off of the infected systems and removing their ability to log back in to the system following the encryption process. The consequence is that in many cases, the victim may not even be able to view the ransom note, let alone attempt to comply with any ransom demands. These later versions of LockerGoga could then be described as destructive.

      While the initial infection vector associated with LockerGoga is currently unknown, attackers can use a wide variety of techniques to gain network access, including exploiting unpatched vulnerabilities and phishing user credentials. Expanding initial access into widespread control of the network is facilitated by similar techniques with stolen user credentials being an especially lucrative vector to facilitate lateral movement. For example, the actors behind the SamSam attacks leveraged vulnerable servers exposed to the internet as their means of obtaining initial access to environments they were targeting.

      LockerGoga Details

      Several of the LockerGoga samples observed in the wild appear to have been signed using a certificate that was issued to ALISA LTD by Sectigo:
      This was likely an attempt by the malware author to minimize anti-malware detection, as executables that are signed using valid certificates may not be analyzed as rigorously as executables with no signature verification. The certificate has since been revoked by the issuer.

      During the infection process, the LockerGoga executable is copied to the %TEMP% directory on the victim system and executed.

      Talos has also observed versions of the LockerGoga ransomware that attempt to clear the Windows Event Logs using the following command syntax:
      The ransomware then creates the ransom note and begins the encryption process. LockerGoga supports many of the common types of files that organizations typically use to store important data. As files are encrypted, the originals are deleted and replaced with the encrypted data, which is stored as files with the "*.LOCKED" file extension. Unlike many ransomware variants commonly observed, LockerGoga also encrypts the contents of the victim's Recycle Bin directory.

      One other interesting aspect of the LockerGoga variant is that the files appear to be encrypted individually. When interacting with the sample, Talos observed commands being executed to encrypt each individual file, an example of which you can find below. This isn't commonly done since it's inefficient and creates overhead.

      LockerGoga Ransom Note

      Following a successful infection, the LockerGoga ransomware writes a ransom note to the victim's desktop as a text file called "README_LOCKED.txt." Note that, in our research, we did find another campaign in January that was using a ransom note filename of "README-NOW.txt." Opening the ransom note with Notepad reveals the following:
      Interestingly, unlike many of the more sophisticated ransomware variants seen in recent years, the ransom note does not include instructions for using a payment portal to process the ransom payment. It also does not include a Bitcoin or Monero wallet address and simply includes instructions for contacting the malware distributor via two email addresses that are included in the note. Talos has observed different emails listed across various samples that were analyzed.

      There also does not appear to be a dedicated command and control (C2) structure set up to facilitate remote connectivity with the attackers. The attackers are also offering to decrypt a small number of encrypted files for free as a way to further convince victims of the legitimacy of the operation and maximize the likelihood that the victim will pay the ransom demand. Additionally, Talos has observed no evidence to suggest that LockerGoga has the ability to self propagate across hosts on a network where an infection has taken place.

      Conclusion

      Data is a valuable resource on all of our systems, whether that data is user photos or corporate documents. Therefore, ransomware continues to be a significant threat because it enables an attacker to steal that valuable data and hold it for ransom. Talos has seen financially motivated cybercriminals using ransomware in an attempt to generate a profit while other adversaries have used ransomware as a cover (such as the Not Petya attack) to disrupt the operation of the network, and hide their tracks by making forensic analysis more difficult.

      Between using active exploitation, sending a threat via email or over the web, or even using stolen or bought credentials the possibilities are virtually endless. This is where some of the basic tenets of security come into play. Organizations increasingly need to have near real-time visibility into their endpoints in addition to the protective capabilities that products like AMP provide. Additionally, having multi-factor authentication (MFA) like Duo, enabled on systems can help prevent initial infection or slow its spread by limiting lateral access. Following established best practices with regard to network architecture and proper network segmentation can also help minimize operational disruption from threats such as ransomware, wiper malware, etc. Talos will continue to monitor this threat to ensure that customers remain protected from any evolutions that will inevitably occur.

      Note: This blog post discusses active research by Talos. This information should be considered preliminary and will be updated as research continues.

      Coverage

      LockerGoga is currently detected by Cisco security products which can be used by organizations to protect their environments from this and other ransomware attacks.

      Example ThreatGrid Indicator Report:
      Example AMP Detection:
      Additional ways our customers can detect and block this threat are listed below.
      Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

      AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

      Indicators of Compromise

      The following indicators of compromise have been observed to be associated with attacks leveraging the LockerGoga ransomware.

      LockerGoga Executables (SHA256):

      c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15
      88d149f3e47dc337695d76da52b25660e3a454768af0d7e59c913995af496a0f
      eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0
      ba15c27f26265f4b063b65654e9d7c248d0d651919fafb68cb4765d1e057f93f
      7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26
      C3d334cb7f6007c9ebee1a68c4f3f72eac9b3c102461d39f2a0a4b32a053843a

      Email Addresses from Ransom Notes

      MayarChenot@protonmail[.]com
      DharmaParrack@protonmail[.]com
      SayanWalsworth96@protonmail[.]com
      DharmaParrack@protonmail[.]com
      wyattpettigrew8922555@mail[.]com
      SuzuMcpherson@protonmail[.]com
      QicifomuEjijika@o2[.]pl
      AsuxidOruraep1999@o2[.]pl
      RezawyreEdipi1998@o2[.]pl
      AbbsChevis@protonmail[.]com
      IjuqodiSunovib98@o2[.]pl
      RezawyreEdipi1998@o2[.]pl
      ↧

      Cyber Security Week in Review (March 22)

      March 22, 2019, 6:37 am
      $
      0
      0

      Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. For more news delivered to your inbox every week, sign up for our Threat Source newsletter here.

      Top headlines this week


      • Norwegian aluminum company Norsk Hydro was hit with a “severe” ransomware attack. The malware affected production operations in the U.S. and Europe. The company says they do not know the origin of the attack and are still working to contain the effects. 
      • Cisco disclosed several vulnerabilities in some of its IP phones. The bugs could allow an attacker to carry out a cross-site request forgery attack or write arbitrary files to the filesystem. Cisco’s IP Phone 8800 series, a desk phone for businesses that includes HD video features, and the 7800 series, which are mainly used in conference rooms at businesses. Snort rules 49509 - 49511 protects users from these vulnerabilities. 
      • A new variant of the Mirai botnet is in the wild targeting televisions hosting signage and presentation systems. The malware uses 27 different exploits to infect systems, 11 that are completely new to Mirai. Snort rules 49512 - 49520 protects users from this new variant. 

      From Talos


      • The new LockerGoga malware straddles the line between a wiper and ransomware. Earlier versions of LockerGoga leverage an encryption process to remove the victim's ability to access files and other data that may be stored on infected systems. A ransom note is then presented to the victim that demands the victim pay the attacker in Bitcoin in exchange for keys that may be used to decrypt the data that LockerGoga has impacted.
      • The latest episode of the Beers with Talos podcast covers point-of-sale malware. Additionally, the guys recap the RSA Conference from earlier this month and talk OpSec fails. 
      • We recently discovered 11 vulnerabilities in the CUJO Smart Firewall. These vulnerabilities could allow an attacker to bypass the safe browsing function and completely take control of the device, either by executing arbitrary code in the context of the root account or by uploading and executing unsigned kernels on affected systems. Snort rules 47234, 47663, 47809, 47811, 47842,48261 and 48262 provide coverage for these bugs.
      • Our researchers discovered a new way to unmask IPv6 addresses using UPnP. This allows us to enumerate a particular subset of active IPv6 hosts which can then be scanned. We performed comparative scans of discovered hosts on both IPv4 and IPv6 and presented the results and analysis.

      The rest of the news


      • A health care vendor in Singapore mistakenly exposed the personal information of 800,000 blood donors. The vendor reportedly used an unsecured database on an internet-facing server without properly protecting it from authorized access. All affected donors have been notified by Singapore’s government. 
        • Talos Take: "The data leak in Singapore is the latest in a string of these. Last summer (June/July) it was 1.5 million records, earlier this year it was 14,000 HIV patients and now this 800,000 blood donor info that you have," Nigel Houghton, director of Talos operations.
      • Google patched a bug in its Photos app that could have allowed an attacker to track users. The vulnerability opened mobile devices to browser-based timing attacks that could produce information about when, where and with whom a user had taken a photo. 
      • The European Union hit Google with another fine, this time worth roughly $1.7 billion. A recent report from the European Commission found that Google “shielded itself from competitive pressure” by blocking rivals from placing advertisements on third-party websites by adding certain clauses in AdSense contracts.
      • Windows is ending support for Windows 7. The company says it will cease support for the operating system on Jan. 14, 2020. Users are being notified of the change via a recent update. 
      • U.S. officials at the recent RSA Conference warned that China is the greatest cyber threat to America, not Russia. Rob Joyce, a cybersecurity adviser at the National Security Agency, compared Russia to a hurricane that can move quickly, while China is closer to the long-term problems that can come with climate change.


      ↧
      Search

      Threat Roundup for March 15 to March 22

      March 22, 2019, 11:27 am
      $
      0
      0

      Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 15 and March 22. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

      As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

      For each threat described below, this blog post only lists 25 of the associated file hashes. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

      The most prevalent threats highlighted in this roundup are:

      • Win.Ransomware.Gandcrab-6900355-0
        Ransomware
        GandCrab is ransomware that encrypts documents, photos, databases and other important files using the file extension ".GDCB", ".CRAB" or ".KRAB". GandCrab is spread through both traditional spam campaigns, as well as multiple exploit kits, including Rig and GrandSoft.
         
      • Win.Trojan.Remcos-6898089-0
        Trojan
        Remcos is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam, and capture screenshots. Remcos is commonly delivered through Microsoft Office Documents with macros, sent as attachments on malicious emails.
         
      • Win.Malware.Autoit-6897734-0
        Malware
        Autoit is a malware family leveraging the well-known AutoIT automation tool, widely used by system administrators. AutoIT exposes a rich scripting language that allows to write fully functional malicious software. This family will install itself on the system and contact a C2 server to receive additional instructions.
         
      • Win.Ransomware.Cerber-6896901-0
        Ransomware
        Cerber is ransomware that encrypts documents, photos, databases and other important files using the file extension ".cerber."
         
      • Win.Malware.Zbot-6896522-0
        Malware
        Zbot, also known as Zeus, is trojan that steals information such as banking credentials using a variety of methods, including key-logging and form-grabbing.
         
      • Win.Malware.Ursnif-6896385-0
        Malware
        Ursnif is used to steal sensitive information from an infected host and can also act as a malware downloader. It is commonly spread through malicious emails or exploit kits.
         
      • Win.Packed.Kovter-6895460-0
        Packed
        Kovter is known for its fileless persistence mechanism. This family of malware creates several malicious registry entries that store its malicious code. Kovter is capable of reinfecting a system even if the file system has been cleaned of the infection. Kovter has been used in the past to spread ransomware and click-fraud malware.
         
      • Win.Malware.Upatre-6894504-0
        Malware
        Upatre is a trojan that is often delivered through spam emails with malicious attachments or links. It is known to be a downloader and installer for other malware.
         
      • Doc.Downloader.Emotet-6894115-0
        Downloader
        Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a wide variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails.
         
      • Win.Trojan.NetWire-6893426-1
        Trojan
        NetWire is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam, remote desktop, and read data from connected USB devices. NetWire is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.
         

      Threats

      Win.Ransomware.Gandcrab-6900355-0


      Indicators of Compromise


      Registry Keys
      • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE
        • Value Name: xbnykvblxlz
      Mutexes
      • N/A
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 66[.]171[.]248[.]178
      Domain Names contacted by malware. Does not indicate maliciousness
      • carder[.]bit
      • ransomware[.]bit
      • ns2[.]wowservers[.]ru
      Files and or directories created
      • %AppData%\Microsoft\jfwwxp.exe
      File Hashes
      • 19b5f589a31dd4b6fd6fcda9e529f04adee6628740cfb4354b7fde94ca4c8fe8
      • 2870e29273fac8161c571505e2081afe0aa8c9e198150923f9efcb15a0379e66
      • 31bbc9f6a7d5b5c248c6379afcf7c7026fb0f3b521016d918edba1fad085a9cc
      • 3e9ae9bb1061f2335cbca35ddfe71f7b93d8ff14a79c362b7a5e22a3c19f5af0
      • 3f18aeab0f40e3f957807fdb6142cafcfd4faeac39b0f31df9e869cca981cb70
      • 5a6f4af9f4c0230111b39ff7cf127db182738ed735fa72183f935f272491b53d
      • 635cd9d2065acf51745629ff92e41c8b331d25376868cfde5ec3dfab91cd0026
      • 961b6caacf88d67139309a5dbec806301a1e7fc8eec7db166d9d0d0120346cad
      • a8d145d01780227cecb322d69d173248c122c5c5b5ffe74c28e1ef89958b4dd7
      • c4e78e775a53a51eefc2b5dd4ce161bd1794119a02481e03b9917aba5279d9c0
      • cfb324eb0b95048aa3248b4475902e575da996b63ff86cf78211424ec8c1c561
      • e43d30708069f2ec0b0237144b23e2d337521174530caefd04728fcc0cbbfd6e
      • fcefe7d20db180411dd0f1ae2749e622738d9b8e6cca09a01b870551823ccbd3

      Coverage


      Screenshots of Detection

      AMP



      ThreatGrid




      Umbrella




      Win.Trojan.Remcos-6898089-0


      Indicators of Compromise


      Registry Keys
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
        • Value Name: internat.exe
      • <HKCU>\SOFTWARE\IYFIZFIFK-HKLTVU
        • Value Name: exepath
      • <HKCU>\SOFTWARE\IYFIZFIFK-HKLTVU
        • Value Name: licence
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
        • Value Name: Wordpads
      Mutexes
      • Remcos_Mutex_Inj
      • iyfizfifk-HKLTVU
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 194[.]5[.]98[.]147
      • 103[.]200[.]5[.]128
      Domain Names contacted by malware. Does not indicate maliciousness
      • N/A
      Files and or directories created
      • %LocalAppData%\Temp\install.vbs
      • %TEMP%\pyrogenetic.exe
      • %TEMP%\pyrogenetic.vbs
      • %ProgramFiles%\Wordpads\Wordpads.exe
      File Hashes
      • 0a1d151c7170baace5e771feb217ee3a685f8af2ddf5c51571d321b2253fa48a
      • 2b6ea3f861899440039f30018f2593a3202b27e3a7f7adec5d5a3703dce3ed59
      • 2c125850f874973b605b04f2ca76d4ae3476bd495890a55f1be3d74de4ca5015
      • 2ea12c4cf9c0c9a3926e0f77333a5e74faf1f4956ab4a599bfd1be6410a4a348
      • 34ce4dbec1155384abd4eab34fa0bc7ca1ead6ae2c4be9a54299e051100245fa
      • 55f209afba93e7a881ad14761b1349349548843a388af32e084a58fe51bc1d34
      • 616ece9b51f1fead02cbc893af7f76240a84a39a9096b4d6cdb066b6ad8a7f4d
      • 786fd0f58b0731ae1326c434ff77bb3f40405dc0fd9f2814d8b41265325920de
      • b76d7be62eb4b198c540220e8b697e01fa80e42465ba314992002175b6593bae
      • bdeea19cc4255537c110faa58fb74721e6503d8815cc62b0fe14a77eba0c4bef
      • c4d675f3f5941b6488fc4c3ecf540c106ef21aa8b8be858cd9ed750888947032
      • c5d8569dbe75f1725774befcd82f1f0cabd8baf07759d60f9b2691870954408f
      • d414046e1fa2ab58f5cb5ea84db538bec4ccff435a7d7c2aab826ebfd584a518
      • dcedf388c083bb55821749ed00e80c96e2aef01fe0e1a26bfdba8b9b8b3d1556
      • e6d04db2794d86b03d8deb2d8c902f76dda946240dc8fbc82d7509c722fa571a
      • e8649923e071a79f7810eddb32257d5782e39428da217cd5aa34af4c821cb0f6
      • fa73eb7829ef969e79d43f647136bdcac25a9b3739961b0653e7bab640966f12

      Coverage


      Screenshots of Detection

      AMP



      ThreatGrid



      Win.Malware.Autoit-6897734-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • altspace
      IP Addresses contacted by malware. Does not indicate maliciousness
      • N/A
      Domain Names contacted by malware. Does not indicate maliciousness
      • charlesprofile[.]website
      Files and or directories created
      • %UserProfile%\archiveint\adalsql.exe
      • %System32%\Tasks\Gfxv4_0
      File Hashes
      • 0df27d70990f8b8ec8b3df25cf1eb9666bf92526095da227080a0372c60aa588
      • 287d43060fcca28466206776b5a147e83d3fd7de4230f1cd909953daa12d0156
      • 43e9ecb0c189695bbb533ec47746edf76778aa1a8b0266f5ac267f79f5cef03d
      • 4634ecfa0699f7408c84fc3c2cdb42601d372777237eec1fe0a58868ef693c1a
      • 5721c80fb52b4db900819b1738db0ad82c502eb7d79e152edb9f2e371f3c9664
      • 6635eb7fc5c7c454b6c5c19018820e249318c34305420cf27392c171df491635
      • 6b327d6a88a18c1167637a8878bf441cfcf567e9c1e19a95c27b93c16e69b45e
      • 7642637e654417d9add1a62ac596cb8d1d84f793749e9e4cc92a117e33d56133
      • 87d5cafaf2e1bb5f56caa5aebd24fbf9941db0e079ba854fb9aaf3bce4c819b2
      • 93cfe8d255a490ac9f173ceb7618a019a25b9246b87e0493acaa20dda799950c
      • d8c4ea9786f6ddc62da7b3555b3efb138ca0c4a0348be83ecec060618db2c276
      • e4503c499e82fa0bce07fd10fdcf132d4a0933d309973b94823366d97a05c4e6
      • e48da123e2e08dd9f62abb56e630b8edfe4ea7977149bda53522bebacfb10d00
      • f51011fa1fbfdf0be75a9300931d33b850b601a01d1a4bfab33c346e3fdde5f2
      • f5bbc3ec89ae91eb6a25cbdb66c4a95b1756298815a50a9e0ce2f27ba57a878f
      • f95c285f6632fecd805fab3e79d018ab4e34e2c230adac317a94ca55b15fd35b

      Coverage


      Screenshots of Detection

      AMP



      ThreatGrid



      Umbrella



      Win.Ransomware.Cerber-6896901-0


      Indicators of Compromise


      Registry Keys
      • <HKCU>\CONTROL PANEL\DESKTOP
        • Value Name: SCRNSAVE.EXE
      Mutexes
      • shell.{381828AA-8B28-3374-1B67-35680555C5EF}
      IP Addresses contacted by malware. Does not indicate maliciousness
      • N/A
      Domain Names contacted by malware. Does not indicate maliciousness
      • cerberhhyed5frqa[.]vmfu48[.]win
      Files and or directories created
      • %SystemDrive%\Documents and Settings\All Users\# DECRYPT MY FILES #.html
      • %SystemDrive%\Documents and Settings\All Users\# DECRYPT MY FILES #.txt
      • %SystemDrive%\Documents and Settings\All Users\# DECRYPT MY FILES #.url
      • %SystemDrive%\Documents and Settings\All Users\# DECRYPT MY FILES #.vbs
      • %AppData%\Microsoft\Internet Explorer\apXmmhm1Ka.cerber (copy)
      • %AllUsersProfile%\Microsoft\Dr Watson\tMYvM36CEP.cerber (copy)
      File Hashes
      • 001b33940ee8465748b743f0df809eae3a2a08a78af15243312584cce53393c1
      • 01906006204a9a84fd0dd7d061aacbb093d09a8192c65cc55e3be6edd164c908
      • 02f66c7648b064b49da5218664d1f5abbe954c6a02f46db9dac77358a0d9b92f
      • 0830faf3346becd79a49df77f0d181c66bed86d1771622f0b8315e288ba29e77
      • 0affee8e0b6dce3ec8c453b6a7ac92648bea9006a63c77b7efd36537adabf5b4
      • 0d899afe8df44ba83ee7b02f621100ed721dd0bd9411d6d0a6e3935baa65cc0f
      • 0df1130e9f23b007643dd0ed3375528cb08d0496b195401078fbd27d2fa5de10
      • 0f3c4c70da6c8a58c0f6844eabc40773e0622f8a1e3f13370538112634ae0079
      • 127d0879d93ff4fb65ff40d723480e62e0144483f4be7da0a739ceae9c446d3f
      • 133a9faa5bd0bd157660e67bf208cdea7cde346836df7ed3f0619edf9e652313
      • 1ab65651d3c70301f55f31fa294e215b1c72e9aa7f87d894e493b5e25d2d35d2
      • 1ad4afdcb9a62b69473149a0e70c38822be0f566b6759922f730c074bffcd09c
      • 1cd3e3a997e017a9ad7883dbee9ba8c71f416e56e1113c96d13290dd998ad8da
      • 1df2e8bb31a42361b916a71aa2e816dcc7279b93a80b2613d5dd8681f007cec1
      • 20e0fc147c170e25c8ba1dbb4e6d0dcafa6771659ba101b67e5b2176d41fb81e
      • 2232654770e8440f3d4629753cc78bcc97b054c5df003ac3908da5b20d058659
      • 2b5295639ab89940a16a9b7dc80f7eefbe065fd0bcbdb7d1c783cebd93dd9db8
      • 2dae95760c360eadeba55f370e3e78e9761f436539ffc3cc1e8e91395722ab4b
      • 2e87382ab956e8db123f80f8ecffeb61c4461b5c77d6deed2952c68b9a96f3d8
      • 2ffc4d2116734e50078268c07b7b972d9d127e9d83513d331d13788c7c941990
      • 31235847a5b061a60d79ad9f634455bfc95ce68667ec4df1fc479d147c794649
      • 320281163724c2d356f3ba9e7ccab33fa06b584f841dcbed783cb65432f1498c
      • 3374ca6683d9bb5434fa192eebe615ba6a609cbd8063c47eca42c47bb480e886
      • 3444fa109868538f1b25a0b4e1e8b1b8545ae88e0dc4a71161e64a868826d301
      • 369dc38935f947829cfa4c85e8262a594ef9bd1ece3479c980d90e62ebfeea68

      Coverage


      Screenshots of Detection

      AMP




      Umbrella



      Malware



      Win.Malware.Zbot-6896522-0


      Indicators of Compromise


      Registry Keys
      • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
        • Value Name: AppInit_DLLs
      Mutexes
      • N/A
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 216[.]218[.]206[.]69
      Domain Names contacted by malware. Does not indicate maliciousness
      • N/A
      Files and or directories created
      • %SystemDrive%\PROGRA~3\Mozilla\thfirxd.exe
      • %System32%\Tasks\aybbmte
      • %SystemDrive%\PROGRA~3\Mozilla\lygbwac.dll
      File Hashes
      • 00ffecb86e72d9357a6bbd15b6354fc9213033f748d9b51b597fcc365a9e1f7d
      • 010d598fc0465864690982eec5f30ef48c713916ef4e45a8d8d49420342df428
      • 018edfb60377a0c076e1297bb407cd42b16ffb2c08d4d2aa32b860b061ca5ed3
      • 01bce31e9de13c804a18643616bc34f64bd1c5b25bf8a10f422e2ad19fb7730c
      • 02701dff6c0a0f71b66c9cf69bd895129e810a1a13bcb18be9a8388ff7821b89
      • 02b10171ce53f9592cb441792f91f1d2a7ea1af92e8a814e3bbc42b647afff2c
      • 02c63a651be113f6b1816a357a97af54141e2bd6d9ce4aa2827a629031b8eaf7
      • 02e7cf905bba1542c36e54c120d57c583f6bf33fc15a4fea4e8a41187801b041
      • 0491fc85d831a1f252b61ad87941db7174c53c1b849bc3fa67604251bdbc7fe0
      • 060b3e97fe90a1c725a41fb0ffd3a01ff7b34c74f1460b68dcf05b668dd5521c
      • 06b7d5b411bc5c2b50aa6a257b0799dfa4e098a249602c39a3a43160539087e3
      • 06dea51ea8ec0bbe9578024339ef207c8cac340ca608b519c22999e109514b47
      • 082549d3ad41312e5014c2ada5b99d6dfabc29f09b19ef4d1d9a7ec1297e8356
      • 08807c13e43fd5d202c97c68e25c6178445a65cb0c8f957ff3dc17a293b11020
      • 08d6916f9a64fc2e725d578d1c11c1f77894edc35373d7d308e039bc85e889a7
      • 0997d72a90fbb50cc4fd395c6d9b5bc38f622f5bd66befc055fad32c19ae686e
      • 0a5e7372e854b6ab82834abfaef00be3a1713ae3c921f3d693112482b8d91dff
      • 0aa62de7c50e0d0498ff66687e0ed5ce905f7fe5014b765586ca64c283c2b595
      • 0bca5fd01e55d40ca9d324e0011f56de76cab17d399f6655019f85cbe16ae060
      • 0c3fea106ea5b2d0f943580279e0ddc729e210716ba82344a619ab901438511e
      • 0d08edbe5a8d68b1a6c29fd0956514036a94638e6443db85c37c8e532d15a2c4
      • 0d9c6fe9e4172a80ad9c912eebeecf2baa094012552267ad70d49d6f583add8f
      • 0e9189428c742936b52149e2579844257ab381570b9c13d440fb3304b7cfd935
      • 0ee3a3afec6551c3cdc20836f7d3ae8ac1b20cd7dfa6a14e379ca975d9b342b5
      • 0f18e6faa5e6bc9e81e5cb5c51a7cbd03589eedae7565d1b270fdb803c78c437

      Coverage


      Screenshots of Detection

      AMP




      ThreatGrid



      Win.Malware.Ursnif-6896385-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • N/A
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 91[.]134[.]203[.]113
      Domain Names contacted by malware. Does not indicate maliciousness
      • kkariannekatrina[.]company
      • f61leeii[.]com
      • qmitchelkp[.]com
      Files and or directories created
      • %LocalAppData%\Temp\~DFDEB0FC636A1346E9.TMP
      • %LocalAppData%\Temp\~DFCE77235CFE7E5202.TMP
      • %LocalAppData%\Temp\~DFD0DDA0AA1947567A.TMP
      • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFA0E5.tmp
      • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFBF00.tmp
      • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFD9FC.tmp
      File Hashes
      • 002c189b365fecdd1a985d49bb4fb006c15efc47b1000defbdd6f4af1c11a19a
      • 02a860f30efb515b8c290d7eec3aaacc31e13db934b950c12c46c2b418f44c6f
      • 0698973ada3bb251a5d7d24af6532bfe757f26e21c5ccb4683ea90fa22000d31
      • 0bf3ad196d5c033b96508b82a4627371b410a4171a112fe87749ffa35148e700
      • 4e8a9df93d31b02390be3f76e8092bb8dd1296da7b583f0ef7d1e0a4b621f5c9
      • 50e11389b6a65a77dd2806b0101c00c3ecab05c885904d8ed93fd7d5a22caa29
      • 65365868838db8f45660946e8cf4e48420fef2f191087adff2c8525e1e9b92ab
      • 68ac70dcad46e80bb89338cc239d9c7942a4d7baeb39c783cf7f3f41338afee6
      • 72ea94949e5a93a9470f528c2e19fee632f1c35e6592e7466d230fcd4425adca
      • 8b07ef958d6f3f94cb45580d4aaa99202870f35e6c309d94894c5601c861cfff
      • 8ee22466de53f493c666b1f805bfad58f4b9d33b657e266dd65724efb96002e7
      • 9124364a4c9db508a438403d4742db5ba39542753f2a67e4b1f77854962ca1d2
      • ae0f77690e47a8662efaa1507002e3924c2d0986e6c1cd39d3d775e53ad982d2
      • af421716811ae86cf1b9cb4c1615ae152515f3dcbe3bef603737d663839bf520
      • b6ed38788fd409ada58fb0446d839eed07783e79b829e75ef031d67a53a3b62b
      • b90a9ca23c1b2667d8a8a8e14bd3ccec4f928734e91dc28af26e69dafb991668
      • f5bad2d671dc5b30fdbc93304e2d9b194033cc307099eae1d58cee17a2cb717a

      Coverage


      Screenshots of Detection

      AMP



      ThreatGrid



      Umbrella



      Win.Packed.Kovter-6895460-0


      Indicators of Compromise


      Registry Keys
      • <HKCU>\SOFTWARE\FC6A75BE78
        • Value Name: b97dea2a
      • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
        • Value Name: 99297e9b
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
        • Value Name: cafa44a6
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
        • Value Name: b612d32f
      Mutexes
      • C59C87A31F74FB56
      • 1315B41013857E19
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 97[.]12[.]118[.]34
      • 95[.]173[.]120[.]56
      • 90[.]243[.]251[.]205
      • 96[.]18[.]11[.]140
      Domain Names contacted by malware. Does not indicate maliciousness
      • N/A
      Files and or directories created
      • %LocalAppData%\recol\PqIpWoU.asARM
      • %LocalAppData%\Temp\ay35fayo.2m3.ps1
      • %LocalAppData%\Temp\uipfcjr2.khy.psm1
      File Hashes
      • 352bc4694ee225e59f50875fbfbe2502a0223daa22b94eafed6e997e71588433
      • ae9789ced159c8fe284e49c8352a66070b8a52bc256847be11ad0890da6b1a99
      • b93e29b1ed93143a85a7d6cff2cd87b5c12e8923bea9f50923dbae429c950f2f
      • dbebf2bbd28c1bf5b327a09fef96cba4078ce033b52488ce936dd53e92302437
      • dffa4d8bbde6b5efbc79a4a05df2e4528f5dc991783e81844685bdf1c175b716
      • e1161786aaf5ce7cf3938e1a105a150f3e7e6c4ab44e1b6dc26004b07dbcc6cc
      • e4d4dfa171983e794cf68492fcfd6bb7312b953d22ae03df64213a5dd6496ee3
      • e79f05d135d2c8524a190bd7d22d20674a21c149cc379299011390b932e056af
      • f7c9f1a37f688b54b3494696c2ac6898fb6945038f4306737299750bec901b20
      • fa6adb0b0a129ada90e2dcef5dcd34c2cae28496689630e7f0415882f12e608a

      Coverage


      Screenshots of Detection

      AMP




      ThreatGrid



      Win.Malware.Upatre-6894504-0


      Indicators of Compromise


      Registry Keys
      • <HKCU>\SOFTWARE\FC6A75BE78
        • Value Name: 0521341d
      • <HKLM>\SOFTWARE\WOW6432NODE\6C5692EEDA48CF842254
        • Value Name: 4DE9F1CC8F5AEB40A9
      Mutexes
      • N/A
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 139[.]59[.]81[.]114
      Domain Names contacted by malware. Does not indicate maliciousness
      • ncaappraisers[.]com
      Files and or directories created
      • %LocalAppData%\Temp\opera_autoupdater.exe
      • %LocalAppData%\Temp\wadly.exe
      File Hashes
      • 15e6ce12614b3b296ddd76343b5703d87beb736b162128aedca6499e40ccdfed
      • 1ad3cf284008b50456bdfd4b8b6bdb0558e5667c34d1406bd7f879b33e8cf6f5
      • 24ebabc590cff41db4261eea662c91d3e3d48bc7da2be03009fddac26861117b
      • 3ea2036f27be61f73ef313f78a094c767164becbcbbfc9c4c7a33f3160d9f2bf
      • 498d367976283785672c2c695e29ad7b20a2b0157dc1dc13acef67426da96e58
      • 4c9b775952a0b574d258a982b0fe3bfca25f450b7e4ddc76a20981432135afa3
      • 5d9721eff25abcb7d7a4af4af2d0dd568b181375186ef20a024cb9408a1b3975
      • 68c841e9b1e4d2b2cb65177913d0a7152decd5ecc15f9d424897f2b277ef75c8
      • 7f26231615eab934cf6cf7d54c9ded34b04fc068fd9ee274b4037843ca22c69d
      • 80e7912b1921cfb610b2b43d5ca74c3aa5c6c3edce4aac9bb554b58dc9ddd6e9
      • 81c52a86cae959eac3382cb9b72a8afb47db16746b9e9c3b9254dc0353174530
      • 886515171b4b044976140bcfe2036796c80320072f54ad60078203d7523aad1c
      • 8a53bf2d3220ef740147699a1a801cc58e4b48052b9c5569f3659ba1a26e3a6f
      • 8b241d4a533f3f6ac4819a22e7c1dd7f18556e1f6f835584973902e63ababb66
      • 945055c780e4f5855616bab1b2b94807ae603c6b2c8cedfb0dd5f32a4c07a784
      • a3438650289b8b3025f6d08414af69cafc016080868a0a30d48239716eea2420
      • a95e1d9364069d02e6f844461cd9e7525f1c3f7a07960486403fee266f0fe8c1
      • abb26593cd2fa77ee16fb0640465ec21592cda8d370c13a2fb74836e065b8f69
      • c036fcf79a071d900b32100d015fc16bff5d82044139b6098eebc98009d2b056
      • ca0bbd8f09581c6c0920c782a06d66e5cad25ce672f22e4ca0dde4ea98b905a6
      • e45189ab53b35195f4676bc9081a605dc28cc79e26047763ccf2661d82120221
      • ed75f96c614623b6c1aaa793cd8239c86049635d75406339ec778e7ba23eb317
      • f9ccc2fe7e013cc9ee47eecc3dde93f6bae4aadc00a421254ed6fe35370b6984
      • fcc0294acfcd7e2231d83841cb31e88363f75efab063c79c4a193f2c0cc26460

      Coverage


      Screenshots of Detection

      AMP



      ThreatGrid




      Umbrella



      Doc.Downloader.Emotet-6894115-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • Global\I98B68E3C
      • Global\M98B68E3C
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 181[.]197[.]2[.]252
      • 94[.]73[.]147[.]237
      Domain Names contacted by malware. Does not indicate maliciousness
      • emseenerji[.]com
      Files and or directories created
      • %UserProfile%\208.exe
      • %WinDir%\SysWOW64\SCwdrA.exe
      • %LocalAppData%\Temp\CVR478.tmp
      • %LocalAppData%\Temp\iidzocqo.viy.psm1
      • %LocalAppData%\Temp\oflithzz.nz2.ps1
      File Hashes
      • 2ed65e9a1e796862f97eeebdf46152caf4f7f4204b801287bafe5b11e948ee1b
      • 4c9295e6906108f3dc926a9591a148e4e2636a893d4d2505b35a0d030635462a
      • 563991d43d484069890ca97745c1d7267c918afc260d31a52ec5bfc899a30c94
      • 848b0b2455cb049ec8dfa798592de326b67abe036ae7a637c8aa3ab9e91f5cb7
      • a06d630f62bc13cb49c794bf934a4a3dbe8cf63f352304e71c056199a065958f
      • a42af575f713389ca1b0cd0156dceb753c1728cfe7c0e7a6036c53aef2d2d3fc
      • b9f83bd5eebbdabf1cc5ff8587ca2f12a91f4905538e65587b35bd8bf1132e9c
      • bf0ee1f25309aea8e27968f5d927fe8d05a66437cb86102d367305e61ec9f5d6
      • c60eb3d68445ab0471aceef71bf75182d9d2f92e3ef3ab4fb148d8852dd2c5d0
      • c9bdfb2d6ac9e493bc391b2f64b48d8d5cde10645ea921951b23112e6d73545c
      • d818fd24d2ee5426ca535b7c966021cafbe7bcbb68b9d6ce420b9006859f2df0
      • f3d7d9b36113ffc6aa4388f4d2f3f52349a3ba0984f9adc696b1a6d9db4108e0
      • f832543e87f24eaa23f85c8976b79d7e49d1b4899f5358ba54a71b7c5f803e2d

      Coverage


      Screenshots of Detection

      AMP




      ThreatGrid



      Umbrella



      Malware




      Win.Trojan.NetWire-6893426-1


      Indicators of Compromise


      Registry Keys
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
        • Value Name: internat.exe
      Mutexes
      • AlIgmljN
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 194[.]5[.]99[.]194
      Domain Names contacted by malware. Does not indicate maliciousness
      • N/A
      Files and or directories created
      • %AppData%\Install\Host.exe
      • %UserProfile%\nltest\print.exe
      File Hashes
      • 1388ba005085c7a25e2680d0f7ee1d81c49924f3b555b4b6dbec68dddbf9b0e3
      • 189525aa17b231ea223cd3c09443662341f908afc3973d88753ef78570b408ba
      • 1cc74120569cff7c550b730223d0aed91a334c66f4dc2aa751e723e7c2ac2a14
      • 1d9c379630d8d65bed03e26b9564651f0c16ae675ddcbf56ba607a107de27221
      • 24f0f08e4774c2f4d1411ea8b57fcae3b37266830601f6ec30899126d93881f6
      • 26917f6538fa6e8796c3c18c5f018370f6491adc63f4f466365d0c0186e9dd41
      • 286a254ceeb034dc7417e5b9fab7141472a1db6500900f951775b07cd07f22c6
      • 44cf94db97f1af9478f75e1df1afe36931fd741e1717601cc2e3d1d228c8b6c7
      • 47571de1a9a22ae99d0cc5ac1d788a238dc1bdd416d32db63ffde7041bc98d1a
      • 4eea828a9f2ff26440954da153a19d9667592a2c47206b7b5e161751794e3307
      • 50b2adbbbba3fb086169174cd9c64a4f536c455231ae3dc93fb1ed6a71e48cad
      • 530a89d43c4bd1ce99fd7dea8fa148158508653bd56063288da3e1086f274fe9
      • 609676ce7da214d0340436956d1c4733a019811a6ffed5a74e5fa680ccfcdb0b
      • 624b38be3943d4580a7bfe3d22a82dc451e9d5b4e8367886dda182e477e926d3
      • 62b5df538e8e6a1737a0125202ca3a0d99610c08a839bb181cd6abaa9e768ceb
      • 633c5f260bd8794b962c85de11f8eed31bb1bd14b5a11b9de564d6a06796ee7e
      • 7220e58e3625c5d26b7be8450b1d8db9e10cdc4cca9173f372f2e7935fae18c3
      • 7e366ff68193007a80f04d0cf6b33841dfc1a46b815992f241a51120cabab9ba
      • 82a165f62e5c7727289e037c1dc4061aeb894403227a27b7366104ecd5cd08a9
      • 8602358388e40b49cecbbc9e04e9863e95c7b24be53c053098b65553e252d74a
      • 8f1ec1fa3db18ab4d7f716d55f67efb65e126742e7a0b3e276822d516bf53182
      • 9b4f90c1ec5a35213b196fb4e0444f86a5ab394d0111a696ab197fbb5006cdb9
      • a0aeb2aa7b2b833ff153bb372a6e3feadf04cf45035e49168331f26d9c887ec1
      • a2327077fa20fc6c10e72031cb249a874531b376ad335bf5367f6a13566db109
      • a513a5d7c1fcabdd53896d054eac221dcba70f4636b8d3c2f306f121ada943bf

      Coverage


      Screenshots of Detection

      AMP



      ThreatGrid



      ↧

      Cisco Talos adds new Content Category

      March 25, 2019, 6:00 am
      $
      0
      0
      Our goal at Cisco Talos is to provide detailed and actionable information in order to let customers decide how best to protect their networks and users based on their needs.

      To this end, Cisco Talos is adding a new content category to Talos Intelligence. Starting on April 3, supported Cisco platforms using Talos Intelligence will receive a new "Not Actionable" category. This category applies to sites that Cisco Talos has analyzed, but due to the nature of the site, a more specific category cannot be applied.

      Some customers require more restrictive policies to be enforced on their networks but have found that blocking uncategorized URLs too prohibitive for their users. The Not Actionable category includes sites that previously would be blocked if the customer restricted access to uncategorized sites. Sites labeled “Not Actionable” may not load any content or remain unresponsive when directly loaded into a browser, the domains may not currently be reachable, or they are primarily composed of dynamically generated media that does not fit into a more specific category. Cisco Talos does not recommend that customers write blocking policies based solely on the Not Actionable category designation but should use it in conjunction with web reputation intelligence.

      Additional details may be found on the Talos Intelligence Categories page.

      ↧
      ↧

      Vulnerability Spotlight: Multiple vulnerabilities in GOG Galaxy Games

      March 26, 2019, 7:59 am
      $
      0
      0


      Richard Johnson and Tyler Bohan of Cisco Talos discovered these vulnerabilities.

      Executive summary

      The GOG Galaxy video game launcher contains multiple vulnerabilities that could allow a malicious actor to carry out a variety of attacks. GOG Galaxy Games is a video game storefront that allows users to purchase new games and launch them from their desktop. 

      In accordance with our coordinated disclosure policy, Cisco Talos worked with GOG to ensure that these issues are resolved and that an update is available for affected customers.

      Vulnerability details

      GOG Galaxy Updater Temp directory insecure file permissions local privilege elevation vulnerability (TALOS-2018-0722/CVE-2018-4048)

      An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's `Temp` directory. An attacker can overwrite executables of the Desktop Galaxy Updater to exploit this vulnerability and execute arbitrary code with SYSTEM privileges. By default, GOG Galaxy extracts the executables for the automatic update function in a directory that allows anyone on the system to have "full control." This allows all users to read, write or modify arbitrary files related to the GOG Galaxy Updater Service. The executables include sensitive data, such as a root CA, as well as executables that will be run with SYSTEM privileges once they are installed, allowing an attacker to overwrite them prior to installation to achieve arbitrary code execution with SYSTEM privileges.

      For more information, read the full advisory here.

      GOG Galaxy Games directory insecure file permissions local privilege elevation vulnerability (TALOS-2018-0723/CVE-2018-4049)

      An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's “Games” directory. An attacker can overwrite executables of installed games to exploit this vulnerability and execute arbitrary code with elevated privileges. By default, GOG Galaxy installs games in a directory that allows anyone on the system to have "full control." This allows all users to read, write or modify arbitrary files in the “Games” directory. If the installed games include a privileged installer component, such as a DirectX installer, Visual Studio redistributable, the attack can obtain Administrative access. Users can also elevate to other user accounts by overwriting arbitrary executables.

      For more information, read the full advisory here.

      GOG Galaxy Games changeFolderPermissionsAtPath privilege escalation vulnerability (TALOS-2018-0724/CVE-2018-4050)

      An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy Games. An attacker can globally adjust folder permissions leading to the execution of arbitrary code with elevated privileges. The vulnerability arises in the `changeFolderPermissionsAtPath`. This function takes a path as its first argument and changes the permissions of the folder and all files located there to be globally readable writeable and executable. This could allow an attacker to change privileged folders on the file system crossing a privilege boundary and creating an exploitable situation.

      For more information, read the full advisory here.

      GOG Galaxy Games createFolderAtPath privilege escalation vulnerability (TALOS-2018-0725/CVE-2018-4051)

      An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can globally create directories and subdirectories on the root file system, as well as change the permissions of existing directories. The vulnerability arises in the `createFolderAtPath`. This function takes a path as its first argument and creates a folder at that location. The function also builds any nested directories that are needed. These directories are owned by a root wheel but have global read write and execute set abilities. This creates a privilege escalation vulnerability, allowing an attacker to modify the root file system.

      For more information, read the full advisory here.

      GOG Galaxy Games fillProcessInformationForPids information leak vulnerability (TALOS-2018-0726/CVE-2018-4052)

      An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games. An attacker can pass a PID and receive information running on it that would usually only be accessible to the root user. The vulnerability arises in the `fillProcessInformationForPids`. If an attacker passes in values of root processes during this function, sensitive information is returned, creating an information disclosure vulnerability.

      For more information, read the full advisory here.

      GOG Galaxy Games privileged helper denial-of-service vulnerability (TALOS-2018-0727/CVE-2018-4053)

      An exploitable local denial-of-service vulnerability exists in the privileged helper tool of GOG Galaxy's Games. An attacker can send malicious data to the root-listening service, causing the application to terminate and become unavailable. Each function in the privileged helper expects a closure to be passed along for the reply. There is no checking the type or validity of the closure before using it. By passing in a null value, the program responds with a particular stack trace. It may be possible to send in an alternative type for the closure to gain code execution. However, as it is, there is a denial-of-service vulnerability, leading to a lack of availability of resources.

      For more information, read the full advisory here.

      Versions tested

      Talos tested and confirmed that GOG Galaxy, version 1.2.48.36 is affected by this vulnerability.

      Conclusion

      Users are encouraged to update to the latest version of GOG Galaxy Games here as soon as possible in order to avoid these vulnerabilities. As they all come from different functions, there is no one, clear workaround and they can only be fixed through this patch.

      Coverage
      The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

      Snort Rules: 48433, 48434

      ↧

      Cyber Security Week in Review (March 28)

      March 28, 2019, 2:00 pm
      $
      0
      0

      Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world.

      Top headlines this week

      • ASUS had to release an emergency fix for a malware that may have accidentally deployed to their machines. Attackers may have implanted the backdoor, “known as ShadowHammer” and disguised it as a legitimate ASUS update. ASUS released a new firmware version that promises “multiple security verification mechanisms” to reduce the chance of future attacks, and started using an “enhanced end-to-end encryption mechanisms.
      • Facebook kept hundreds of thousands of users’ passwords stored in plaintext for years. The social media site says it has no information to indicate employees with access to that data abused the privileges. Reportedly, between 200 million and 600 million users may have had their passwords stored in plaintext and searchable by more than 20,000 Facebook employees.
      • Attackers are increasingly working together to spread banking trojans. A new report states that there’s been a recent uptick in the spread of certain trojans, including IcedID, with evidence that they are working with longstanding droppers. Snort rules 49544 - 49547, 49549 and 49550 can protect users from the IcedID trojan.

      From Talos

      • GOG Galaxy Games contains multiple vulnerabilities that could allow a malicious actor to carry out a variety of attacks. Talos tested and confirmed that GOG Galaxy, version 1.2.48.36 is affected by these vulnerabilities. Snort rules 48433 and 48434 protects users from the exploitation of these vulnerabilities. 
      • Cisco Talos is adding a new content category to Talos Intelligence. Starting on April 3, supported Cisco platforms using Talos Intelligence will receive a new "Not Actionable" category. This category applies to sites that Cisco Talos has analyzed, but due to the nature of the site, a more specific category cannot be applied.

      The rest of the news

      • WordPress patched major vulnerabilities in two of its plugins that were being exploited by attackers in the wild. If exploited, the bugs could allow attackers to run extensions over top of the content management system. Users of the Social Warfare plugin can use Snort rules 49527 and 49528 to stay protected. 
      • The U.S. Federal Emergency Management Agency mistakenly leaked the personal identifiable of disaster survivors. The agency says it has no information that would indicate the information was being used maliciously. At one time, the agency said it shared more information with a third-party contractor than necessary, including the PIIs.
      • Norwegian aluminum producer Norsk Hydro lost an estimated $40 million in the one week after it was struck with a ransomware attack. The company says its Building Systems unit is still almost completely shut down, and its Extruded Solutions unit was, at one point, running at 50 percent of its normal capacity. 
      • Cisco released patches for 27 vulnerabilities in IOS XE. The company also warned that two small office routers, the RV320 and RV325, are still open to attack. As of Thursday morning, no patches were available for those two routers. Snort users should use rules 49606 - 49612 and 49588 - 49591 to protect themselves from these bugs.
      • iOS 12.2 included fixes for more than 50 vulnerabilities in Apple products. The bugs fixed existed in some high-profile apps, including Contacts, FaceTime, Mail and Messages. There was also a vulnerability in WebKit when using Safari that could have allowed sites to access the user’s microphone without any notification. 
      ↧

      Threat Roundup for March 22 to March 29

      March 29, 2019, 10:04 am
      $
      0
      0

      Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 22 and March 29. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

      As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

      For each threat described below, this blog post only lists 25 of the associated file hashes. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

      The most prevalent threats highlighted in this roundup are:

      • PUA.Win.Adware.Dealply-6911925-0
        Adware
        DealPly is an adware program that installs an add-on for web browsers and displays malicious ads.
         
      • Win.Malware.Razy-6911785-0
        Malware
        Razy is oftentimes a generic detection name for a Windows trojan. They collect sensitive information from the infected host and encrypt the data, and send it to a command and control (C2) server. Information collected might include screenshots. The samples modify auto-execute functionality by setting/creating a value in the registry for persistence.
         
      • Win.Malware.Emotet-6910311-0
        Malware
        Emotet is a banking trojan that has remained relevant due to its continual evolution to better avoid detection. It is commonly spread via malicious emails.
         
      • Win.Packed.Zbot-6911628-0
        Packed
        Zbot, also known as Zeus, is trojan that steals information such as banking credentials using a variety of methods, including key-logging and form-grabbing.
         
      • Win.Malware.Sakurel-6911517-0
        Malware
        Sakurel is a variant of the Sakula trojan (first surfaced in November 2012)that downloads potentially malicious files onto the compromised computer. It also enables an adversary to run interactive commands and upload files to the C2 host.
         
      • Win.Malware.Triusor-6911670-0
        Malware
        Triusor is a highly polymorphic malware family. All the binaries are packed and obfuscated to hinder the static analysis. The malware contains code that complicates the dynamic analysis. Once it is executed, the samples perform code injection.
         
      • Win.Malware.Lunam-6911603-0
        Malware
        Lunam is a trojan that contains Autorun-worm functionality. It injects into the Windows system to change permissions. It also disables anti-virus security suites or the Windows firewall and changes browser settings
         

      Threats

      PUA.Win.Adware.Dealply-6911925-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • N/A
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 239[.]255[.]255[.]250
      • 172[.]217[.]12[.]206
      • 172[.]217[.]12[.]163
      • 172[.]217[.]10[.]67
      • 172[.]217[.]10[.]35
      • 224[.]0[.]0[.]251
      • 216[.]1[.]28[.]82
      • 172[.]217[.]15[.]99
      • 62[.]212[.]73[.]98
      • 100[.]43[.]94[.]16
      • 5[.]45[.]205[.]241
      • 5[.]45[.]205[.]244
      • 100[.]43[.]94[.]15
      • 172[.]217[.]10[.]109
      Domain Names contacted by malware. Does not indicate maliciousness
      • accounts[.]google[.]com
      • www[.]gstatic[.]com
      • ssl[.]gstatic[.]com
      • update[.]googleapis[.]com
      • clients2[.]google[.]com
      • redirector[.]gvt1[.]com
      • _googlecast[.]_tcp[.]local
      • clientservices[.]googleapis[.]com
      • download[.]yandex[.]ru
      • dl[.]xetapp[.]us
      • xetapp[.]com
      • cdn[.]yandex[.]net
      • cache-ash03[.]cdn[.]yandex[.]net
      • r7---sn-mv-2iae[.]gvt1[.]com
      • YBFXNRZPPP
      • IJTEPYX
      • GVJDSZTMWUXYXZ
      Files and or directories created
      • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsk2.tmp\INetC.dll
      • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\y_installer.exe
      • %TEMP%orary Internet Files\Content.IE5\X1IF8CSM\downloader[1].exe
      • \TEMP\Google Chrome\chrome.setup.exe
      • %WinDir%\Temp\gui2E57.tmp
      File Hashes
      • 00123316d0d50612ae581d310b722adcfe97939180f3d02034deb8a4935db073
      • 005d28b3585939c62cdf9de3c8622d7d11a4a8e48a2066bea1a37e6bd59f19e6
      • 01b53d747656c8975c8dc26f6d1cf869209cb1cdc91e1b1d1ab0d2421e82c6dc
      • 03d4f4533bca92fc7f4f8b789b5406cde3dfa8e0f51587d442ab65576b051379
      • 0584466198891f6726a8bebd13bb5566deb9eaa7f9c39086959e43558576e5eb
      • 08aa13cd31f3a41d553f852cc15ae35104bb8fdea8ddc4183b60d3570733990c
      • 08d3879f6a6413026a2a3c0a2af5949fabd241f26be53081b72a03f71618fe3a
      • 08e5212e369cadc9997c0fa6ab388299424f3854c872e267b74195d2f64ff501
      • 09fbdc8c40da22238392ffc7d45c1aaba3a1fa4073ab5177fc799b722e12f252
      • 0b3af8d26acf742223b6dac474c571bf743bb72f58063279b408515cb3ebfbb7
      • 0d7b69e58899e6a43eb7b2827d9d00b208c30c22ee46852d96b80dafae7a04e2
      • 0e6a6dcb6e595f45cf8fe16af2f9bae5eaa8ce3b9169ac340d289c76957e22b1
      • 11445175b675b5ee7b10d5b28480db8c827e2ebe768b0834733e76dbf22b8ad6
      • 115e00754759406773da16c1b0668f88f23e5ea124e1d588a483bb2c56764b74
      • 11732b1aac1328bae5eb1b96aa697216b8ee6f1253f151a7d757bc4542f0c791
      • 11b4e49162f47d330544617a8f0fe6593329ce4d1cc839602460085444df70b8
      • 1210b7eb9b7c3b8c4718c77d7cff8856982b66080ad3c2331d45e4e8deac22ab
      • 1259006aa8f53918b989be47ca6a6cbe0e3335acea98ab1944c851879c3f42c1
      • 126892e91774e5ad27d17b80b48b781cb47d8087e2555bb4afa4bfbcb26e2f60
      • 12a3a0f24d76144112dbe76f48a82e41ada02464e9bb412a100a67dfb4c73165
      • 14176d5bcf716484d40e3a53c7e9038115fe74cb0a4f13f8a2f814e6cd2b361c
      • 15d3b56e2b9727161bca8cf336cff5db3673ba4a0d764216ab77818a2994567c
      • 164fbcde41707cbda009ec59bc09b66c7e24a6a2725b45f235074b30952cc1d0
      • 169a9b9d6722fa3a4336063814a5ad1ffefcb7a8f7e124fcdc2e64793201cd44
      • 17a7101429c0d488610f9d47c489cc220db79ed501db1f362840c879cdd7f25c

      Coverage


      Screenshots of Detection

      AMP




      ThreatGrid




      Malware




      Win.Malware.Razy-6911785-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • N/A
      IP Addresses contacted by malware. Does not indicate maliciousness
      • N/A
      Domain Names contacted by malware. Does not indicate maliciousness
      • N/A
      Files and or directories created
      • %SystemDrive%\TEMP\b35ab4f64eca00d5aea7ffefd5a39385a8412c6149e5b668ed283dca017891ef.exe
      • %SystemDrive%\375278630.exe
      • %SystemDrive%\old_375278630.exe (copy)
      File Hashes
      • 3a05c43d6d78b963868d6a5c753adfbc15278a8e28f53d88cfbd872547ec3aec
      • 41b538fe12a5e63e8098e697f74bf54eecb3110ac76e40815691962a8d9d3f09
      • 533084e836d9450028b1bdf1513af2a608ee34fed7b8e3a72e68840b838ab5b1
      • 815131146c5665a49b103b24c32a55cde259e2019d3f1b086d822aedbb8ab3db
      • 838db2a9ceaf95fd2eaaec1c09707c763e6d7c349d62c9d9cb6037ed43dab1bc
      • 84c8d09cdbf087971625951be2cd3a3d284b079917e9511b6b3195e1b37caa6b
      • 9d5a0d566dcbeccb9d5f4a6f566491169d4c40730308907e37ff56a655646f2f
      • b35ab4f64eca00d5aea7ffefd5a39385a8412c6149e5b668ed283dca017891ef
      • bf78cb5fe8652c2d8fefbb2180266763b54d6714de861496373fd4d3383f1fb0
      • c1d8276493d369115b9c7cd2bf4aeb7cc19541daac649febe0fb9e5d921d67b1
      • d33d6e3c9eea1d11b5264243a78ee3224d2c25d80ba50dc654d5b8f78d3c8560
      • d67cae05ddf102085c273532565eb11060311ef323a493dc0892876e5ad6fb42
      • e643beed5c1dc1b4a28e8f0c6cc2452a8f5199b1225d6bc3231c3d805ca32085

      Coverage


      Screenshots of Detection

      AMP



      ThreatGrid



      Malware



      Win.Malware.Emotet-6910311-0


      Indicators of Compromise


      Registry Keys
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\startedturned
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
        • Value Name: Type
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
        • Value Name: Start
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
        • Value Name: ErrorControl
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
        • Value Name: ImagePath
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
        • Value Name: DisplayName
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
        • Value Name: WOW64
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
        • Value Name: ObjectName
      • <HKLM>\SYSTEM\CONTROLSET001\SERVICES\STARTEDTURNED
        • Value Name: Description
      Mutexes
      • Global\I98B68E3C
      • Global\M98B68E3C
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 190[.]48[.]129[.]88
      • 186[.]71[.]61[.]94
      • 189[.]250[.]182[.]236
      • 188[.]48[.]145[.]96
      • 189[.]155[.]152[.]129
      • 187[.]136[.]144[.]197
      • 189[.]236[.]193[.]173
      Domain Names contacted by malware. Does not indicate maliciousness
      • N/A
      Files and or directories created
      • %WinDir%\SysWOW64\XS0hFlArdwCf0zhrY35.exe
      File Hashes
      • 02dc761ae5a8a5542891efd4c7c5e5f60c52b34fc2934aa0d4f2995a02ac2bc4
      • 0f5c870d9dd71cd8d69d94ae0bedbc1f6d9a987819b3267e5b418448ae2d5d06
      • 1f34fd280d7c58e27f43025d09b39a77227fe79b1256e11e546beee969661ae8
      • 3e0482cb8f6a4f2d5be6c231595b00e609d0ce1838e82557d831f9a040b736ff
      • 40e798c3b6a17cea35eec9d36e19769d08b5943d6a268fd604982700a5190cf5
      • 453660efedf6d54a62413366943f253ce66ae2b7e86279cc97422f10ad70c3de
      • 4c95516e8c914ae60f88d592755325a681dfb733b5d0bbd61bf9fc531df54488
      • 61739f55965706a048c60f1e71be620da070ff36a14c4d73979144725e580513
      • 7184a99a2bd5bf6db7ba4da71339f43bbfde3609ed2cc4be8b1d907306d14428
      • 762234da23e0457add13183b41711504bbd2feff7c7c72074491c6a072111bd7
      • 8f0e47da47bd92eb6b9378f45b5ac9a5f74272d9cca6579163167f05437a02d3
      • 9e7f5171472e332c77f8b7d0579269e57c8134b159c88a68855b7f72ca170ad3
      • ae9c8e66b79f89482e2f000f45d038c1d34f9fd273bdce7e39bb41f74ddd5feb
      • c8a066be1844023052522a57c358b1a8f2b33efebbc4e9d4571bb853782490cc
      • dc411454126d314aa4163c446bc127acb4f5d3089c04307cc3b2a80d788b32eb
      • e022960903709ba6bc0686a41ecba98dddbeb2afc45c8ec3ef6612d3ca7154af
      • e1c8d1494031d4e48044da56b6f9e42a4debfee273bb23c34bfcaf01f24d03ba
      • fa57b2fa7dff02e445be673d1c20e09c6e15515b05b729c5ae29c38cf4ca1918

      Coverage


      Screenshots of Detection

      AMP




      ThreatGrid



      Win.Packed.Zbot-6911628-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • N/A
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 207[.]148[.]248[.]143
      Domain Names contacted by malware. Does not indicate maliciousness
      • aatextiles[.]com
      Files and or directories created
      • %LocalAppData%\Temp\budha.exe
      File Hashes
      • 006fcf37a0eb468cc72fd889b5a681d95408211c72ff26f9622bf6f34deac34a
      • 032c2e1170585576a48dac78598f2c6e0cff6660a2357aaf530bc48a09a88bf5
      • 03f24818854c539e345eadf79579b18a07bae62cb0694e57f2fa38dcfaab2b6e
      • 04d1f5ec23449c4f732acc9871df1bc0273ebd7decaecf4a23cf0d36c9492050
      • 053b92b9d7df8f0da498304efe8630b1a52206cc4ec97d72e4372ea4feeebeaf
      • 0577c05d5a14456d6ecaf2e89f44fe2765fddc26e4ad1a8be0561883546b5ce1
      • 064718741b944136613994295d0bfd2aaa4e8e0ccc4ce926cb8e5fea73d99b43
      • 07bd1541aba14c60addc1eb4850c14c227d826ecfd0ddd27705c15aad8b321f8
      • 07cb9376ea9258a4589f0c163035139c6ee8198df832dffa0de6cbc4995e1f10
      • 0862089c5b5460b063b4d31e5f1f86e196e5c9eb2d5bad1ddaeba547dfa468f1
      • 089c5bcad0f614fd269e5965bbb1511def4900f291ea8a4f4a1aca40216ac937
      • 08fed1af781ac399a40d43f2e24b63407523e0b14f95b9eb6e4684ef41dbf8da
      • 093b2949f7eeb6b39257a2c8f39e13bb9db57d67d061c27e27ef6e277a6ea8b5
      • 097259c049318a5db1857e229b1ee7c9d94ec345a18520d8575fdf35eac82176
      • 0b7f0baf87ed9c40db3b4e815d8f6c7f0bd7b8e7d7206995ca8a5ace51abbf28
      • 0c63edade791db8a62b82efe5a939cbf8d4871ae591bf15c76fa33b644a82b0b
      • 0dd82df5bb5e22a46bb144b4160979a35c5e797312c0fb0bbbc8c9d9ebb4338a
      • 0e26f8c0c7c9135596c7509af558f395b448c1e86bb5aee9390ee273bd7e94f8
      • 0edbb5f72d21295d80038f417a5820d9b14b5a9f925ee7fc4729bad033e7102c
      • 0efda7d9834bfa4a6376a3ee2015d46839617a459b1a1e6f6ad4bbe18f3c1460
      • 11f616a534a8ddd2c4a6f568170ba94fd6201f3e32df93a9c1a3ddde65280bb5
      • 1219a20531c12eb6eee26c29cd0eabfd5b5576891529b2d47b6d13607481d1de
      • 123730b855330b05fb55d5c2cd2aa8f7afb7949370c4271b3d826880c22f89ba
      • 1341bafd3d3de435258abc5bd5b45a7930cb4c8755cbabdee1b7df022cfb5119
      • 1378a83d0b13060d77f0312292b79f374633475dffeaebaea7b4bcef0639dd3f

      Coverage


      Screenshots of Detection

      AMP



      ThreatGrid




      Win.Malware.Sakurel-6911517-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • \BaseNamedObjects\I-Worm.PlutonX
      IP Addresses contacted by malware. Does not indicate maliciousness
      • 204[.]11[.]56[.]48
      • 184[.]22[.]175[.]13
      • 216[.]218[.]206[.]69
      Domain Names contacted by malware. Does not indicate maliciousness
      • citrix[.]vipreclod[.]com
      Files and or directories created
      • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\MicroMedia\MediaCenter.exe
      • \My Downloads\Winzip 8.0 Full Downloader.exe
      • \My Downloads\The Neverending Story Part I ISO - Full Downloader.exe
      • \My Downloads\The Eye Of Kraken ISO - Full Downloader.exe
      • \My Downloads\The Thing Crack.exe
      • \My Downloads\Zidane-ScreenInstaler Crack.exe
      • %WinDir%\rundll32_.exe
      • \My Downloads\The Thing Full Downloader.exe
      • \My Downloads\The Eye Of Kraken Full Downloader.exe
      • \My Downloads\ZoneAlarm Firewall Full Downloader.exe
      • \My Downloads\Xbox.info Crack.exe
      File Hashes
      • 21d0875cb4b3a6eaa8aaedc10df7ac41491933d83bf5737ac2b153b04bbaaa25
      • 31729931bcf1f4880d7ba572162c9de25e4c492da45dde394388a589db572973
      • 47d4dc07f53d47045c9429f7c58b9a3f7a2b1f4f9896372de24aaab6a195006b
      • 59dcec5311f321bc0271b412fbdf3a3afc7e081b7248cc34ee41b705a71de37a
      • 5fea4433f887675fff05d18a1e73b51c711075743f5effd0124d386161eb714e
      • 7b98c5758daae76d49f2cc088385920c8c0025e605170a76db82e076461cf4cf
      • 8486bbbd2b8dd837bfb5ffdefeb3bd6462696792ce768bf4d4bd07f60b0b6023
      • a55672ffa051c6331e51e36e050a37a1822c3e4ad3b23c32fbc712101c1841cc
      • c12dcb306f9f3d54aeb93672fb67bbb6e02e7bfd02606a24964902ea5c31988b
      • cc8b72eab90eddc9495b3168f7f5e56b61831c7f5828a8c2ac019d7821ae05ce
      • f3dc6f0e865e4aee50a83467eec156c3d38ca856edffb75714cfec73d692965e
      • f9a769450b23e9b2e7dd54092f84b902cab433ed83ad9cd3aa7dbb915fe7c3a9

      Coverage


      Screenshots of Detection

      AMP




      ThreatGrid



      Win.Malware.Triusor-6911670-0


      Indicators of Compromise


      Registry Keys
      • N/A
      Mutexes
      • ---
      IP Addresses contacted by malware. Does not indicate maliciousness
      • N/A
      Domain Names contacted by malware. Does not indicate maliciousness
      • N/A
      Files and or directories created
      • %WinDir%\SysWOW64\URTTEMP\regtlib.exe
      • %SystemDrive%\System Volume Information\_restore{2DD8912A-F65A-4BB8-A47E-3B7997479CBD}\RP1\A0000192.exe
      • %SystemDrive%\System Volume Information\_restore{2DD8912A-F65A-4BB8-A47E-3B7997479CBD}\RP1\A0000193.exe
      File Hashes
      • 03aff9a48d8198ce8c40f2b0ad2a922bc0e80f598f66d97b75c12c89aec0bfce
      • 048d526df6efc4adc3b9e6ad2ef8936ba423fa5a8401a67365093206690a74f8
      • 05f6b95ebcb80d1d4fc67a3fa37b5575dcaefb5f19af24a22e1593e43a6828da
      • 0eb229b7c25a75faf6408b0b34a8e6318fd0de237399b20abea960cce1e74a33
      • 118a87e2a3491c374cbdf2a322a7c526fa4313774198ca094a2b9b5167010045
      • 134006bdec93b2bb61a839d95e006ac336c7bc139860200874ad9ac720fa1716
      • 13565a1b840b26a75e10d2860210c2eec745e738e967dfc992ce68498f05e37b
      • 14dc5638711af0d523fa82bed60f12e2072f18f6aad26c3d7118140778ba8111
      • 1c221eb1e17a85f205833b23ed2b6ab314715fe9c4742d189ba91ad0d9e56a7f
      • 2079a72947018cb8aee28ac29aae59049eb55eeae62b274dc4432d4e10ae4b2b
      • 27a45ef2fca67f3ad606ef9a321d2c06718b19906c13d2836976200cadbb8cdd
      • 280dd92b330515c2643f9608d93a4035eab996694423b6fca2e3bd95bd2e97a5
      • 299bbeb900d33999fb20b9c38b772590161e9f815de24049e066ab90e33dac34
      • 2b3b5caa2b92330216ec6bdd6bae21221b29086e128a3fb176f20525432042f9
      • 335900e28645a0958e3c97c62f5d4ded50e4f87a980a19c35269bbf433e006cd
      • 34c13a759df60c7ba1360a54f01bcdf791dac658fcaf10c57455b45ee4d016f5
      • 37710f05180b0678f4d3bd7672d4ca37d030ff452c19ef76e64142b96c960f9d
      • 3d7c4d54cee4d196a7cd556ce8e3b4689721d734119327337c9bc2744927484a
      • 42de9566d55d8f6ce77ba26caafae8185bd5dc3f1309c5b2bc9d733eafa84a9c
      • 436a31762430ce02a1bb023d82302fa21e4a00be29e9f1bac8547a78ec0ae5a6
      • 4888619469ca159498876d4e744005bb19e9d9dff35aab73d5ecfb5a706bc691
      • 4efa26b70dc73146483af6f5fe626d983d2a11d26f652938617dba46598b9e2d
      • 4f8339dfff27003cbe79b1be2527da1948c44d70ae08c7a54d3babadb5e3e147
      • 51881a2de30681cd4f4ebb00bd8512bb4a96448c1cb2d7756b686913c5e2d06a
      • 52b9af1d286700f44cf182dd18f521707ae9886caa8dbada02613f7d94c1bad8

      Coverage


      Screenshots of Detection

      AMP




      ThreatGrid



      Win.Malware.Lunam-6911603-0


      Indicators of Compromise


      Registry Keys
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
        • Value Name: ShowSuperHidden
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
        • Value Name: HideFileExt
      • <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
        • Value Name: SuperHidden
      • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED\FOLDER\HIDEFILEEXT
        • Value Name: DefaultValue
      • <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN
        • Value Name: PC
      • <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
        • Value Name: avscan
      Mutexes
      • N/A
      IP Addresses contacted by malware. Does not indicate maliciousness
      • N/A
      Domain Names contacted by malware. Does not indicate maliciousness
      • N/A
      Files and or directories created
      • %SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
      • \Autorun.inf
      • %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\avscan.exe
      • %WinDir%\W_X_C.vbs
      • %WinDir%\hosts.exe
      • %WinDir%\W_X_C.bat
      • \Rahasia_Ku.exe
      • \usb.exe
      File Hashes
      • 268360c9cb3592f64adf615a6cbd3f9dd799c3dbac53ebf42991400f95ef47ff
      • 2f0bb43a6456a418be91581203c6bae6c32ff2d6397b1ffabab8026e9182f0d9
      • 35d132fbcaded5414ae1a2b1b4ef24c6a8c4756a43149b3da77f6aef8a572213
      • 48acda29ed39adbddc39578160cdc8a01c4c50ead27fea48a8b9a6b42c43a1d3
      • 589367bc5cbad71d471ab9089c9afa2b48f6492f994b4e1f30e35d7c97529d85
      • 716d112abbcfc643dabaa7671862689c4f93c1ee42b5c2d7761335184c277dc2
      • 758af45b0efa214661c2f555f721d77fa378c91de8feec5f510116b701049000
      • 80aa6589cdf6d87c1edca15d9fd1759347b3a1d9e3536ad21edbb35c27a4a832
      • d0e0d54cde79126e6417b1b6650aee61d9bef995cb5eea17ea418e207c163f81
      • ea6acafa5950c15740e1b1f6a9975283b484e775318720bedc9b90f8f258e45b
      • f20e50dbe18dee4e864259f99ffc8b7b6c2a41e6a821093502746e1daf8efabe

      Coverage


      Screenshots of Detection

      AMP



      ThreatGrid



      ↧
      Viewing all 1925 articles
      Browse latest View live
      Search