The commoditization of mobile espionage software

October 30, 2019, 9:48 am

≫ Next: CISO Advisory: Security Architecture

≪ Previous: Vulnerability Spotlight: Denial-of-service in VMWare Fusion 11

$

0

0

By Matthew Valites with contributions by Joanne Kim and Edmund Brumaghin

Executive summary

Mobile stalkerware has all sorts of wide-ranging consequences. The creators of these types of apps can track user's locations, see their social media usage and more. And they certainly open the door for abuse by governments hoping to spy on their citizens, parents looking to track their children or controlling spouses hoping to track every move their partners make. This class of software exists to surreptitiously get and provide this personal information, sometimes in real time.

Cisco Talos recently spotted a wave of vendors hawking this software, designed to spy on unsuspecting users. We observed apps across the globe — including activities in countries that have some of the worst human rights records — with vendors offering language- and country-specific services. In all, there were 87 vendors we discovered as part of our research, which we believes poses a serious threat to at-risk individuals. The stalkerware space is completely unregulated, and these apps are allowed to exist on many app stores for extended periods of time, with their creators even offering easy to follow tutorials online as to how to trick users into downloading these apps. This is an easily accessible, yet volatile, market.

Previous research by Talos shows adversaries, including nation-state level actors, using open-source mobile device management (MDM) software and fake apps to surreptitiously control compromised devices and exfiltrate sensitive data. Leaked data shows that five to 10 years ago, this capability would cost an adversary a significant amount of money. Today, anyone with an internet connection can choose from a range of commercial vendors providing identical capabilities for anywhere from free to $80 per month. It's even got to the point that prominent government vendors are reselling off-the-shelf "toy" software to track "unfaithful spouses," according to leaked emails. A flourishing marketplace exists for these dual-use applications that provide tracking, remote control, and interception capabilities. Operating on the internet with impunity, some of the most intrusive applications include the ability to covertly listen to active phone calls and enable the camera or microphone.

The basics

Most commercially available stalkerware applications are sold and distributed directly through vendor sites. Some vendors host their applications for download without authentication while others require signing up and paying for the service. Of the vendors selling or reselling spy software that we identified, only two were available through the Google Play store.

Nearly all vendors offer varying capabilities, some dependent on whether the target devices are rooted or jailbroken. In the table below, we compare a popular commercial stalkerware vendor called "FlexiSpy" with a government-level offering called "FinSpy." Most capabilities present within nation-state level software are comparable to those present within the most popular consumer-level stalkerware applications that we identified. Where the government options differ is in their live remote forensics and anti-virus avoidance. While Flexispy provides call interception, most vendors only provided call metadata. In 2014, the United States Federal Trade Commission (FTC) fined StealthGenie $500,000 for violating the Wiretap Act by selling an interception device. While live intercept may be too risky of a capability for most vendors to offer, geolocation tracking is a standard offering.

Some vendors provide premium multilingual installation support services to assist consumers with installing the software on the device. The screenshot below shows an example of an Mspy reseller offering a Spanish chat service. The ad states, "Spanish support, free consultation through chat." While presumably there to offer legitimate technical support, previous reports have shown the support staff often acts inappropriately.

How widespread of a problem is this?

Using passive DNS telemetry, we observed activity to these domains from 171 different countries in a single day. The darker the country in the map below, the higher number of unique remote IP addresses we observed. What's most immediately apparent is how global these applications are used. Brazil and the United States combined account for nearly 50 percent of the observed queries. Italy, the United Kingdom, and India round out the top five with less than 4 percent of the total queries coming from each country. Spying capabilities once restricted to certain nation-states have been democratized and are being used all over the world.

The next table shows the most queried domains from our sample data. The top domain is the API endpoint for an application owned by a vendor called spyhuman[.]com, who provides a free offering that includes geolocation capabilities. This application is supported on only six vendors' devices, yet claims the top spot for most-queried domain, and was observed primarily in the Middle East and Northern Africa. The third domain is for Cerberus security, which for five Euros per device per year, offers supposed anti-theft geolocation services for Android devices, including on Android Wear smartwatch devices. Also included in the top 10 most-queried domains is thd[.]cc, the domain hosting applications for another stalkerware app called mspy[.]com.

Spyhuman was the victim of an attack in 2018 that exposed collected metadata from remote devices. Be it the shaky moral ground of the businesses, or the sensitive data they contain, spyware providers have found themselves the targets of hackers. Four other businesses, including a parent company that owns multiple spyware companies are known to have been successfully breached. One of those companies admitted to a breach of photographic material (presumably acquired from targets by customers) that ultimately and indefinitely halted its spyware products.

Cross-referencing DNS data with data from the CATO Institute's Human Freedom Index, which attempts to quantify the state of global human freedom, we can see query activity to spy domains from the 10 lowest-ranked countries on the index. Egypt has the most number of queries at 6,750 from 179 unique requestor IPs, whereas Yemen has the most unique requestor IPs at 224 with 1,326 queries. We observed queries to stalkerware backend API infrastructure in each of these countries, indicating not just web browsing activity, but active use of these applications. That these businesses sell their wares in countries with known poor human rights records calls into question the morality of their operations.

What can be done?

Many of the vendors Talos researched publicly advertise their services toward parents monitoring the safety of their children, consumers who want to prepare themselves in the event of the theft of the device, or businesses monitoring employees' devices. And our research shows evidence of the latter. We see businesses intentionally whitelisting domains belonging to some of these vendors, ostensibly to ensure service availability when using the applications legitimately for enterprise device management. However, some sites overtly display suggestive marketing material that indicates a more nefarious use-case for the software, as can be seen in the image below. No longer solely in the realm of nation-states, anyone with intent and device access can afford to use these spy-like capabilities.

Detecting whether a covert spy application is installed on a device is, by intention, difficult. Additionally, at-risk individuals can leak metadata to adversaries even without these apps installed. With access to individual accounts, such as Facebook and iCloud backups, abusers can get sensitive information without installing spyware. The Federal Trade Commission has information for stalking victims on their site. Additionally, users who suspect they may be the victim of spyware can check a few things:

1. Rotate and use unique passwords for sensitive accounts, and use multi-factor authentication where possible.
2. Many social media services show account logins by device. Check for unauthorized devices.
3. Disable geolocation permissions on applications and devices as much as possible.
4. Keep devices and apps patched to prevent possible vulnerability exploitation.
5. Conduct sensitive conversations in person or use a new phone.
6. Protect your devices with a strong password/pin.
7. Use only official application stores to install software.
8. Factory reset or wipe the device.
9. Use stalkerware installation guides to determine if your devices has signs of being configured to allow installation of these applications.

Be mindful that this software can exfiltrate dialed phone numbers, application chats and SMS. If you fear you're at risk and must seek help, try to use a known secure phone.

---

CISO Advisory: Security Architecture

October 30, 2019, 11:02 am

≫ Next: Threat Source newsletter (Oct. 31, 2019)

≪ Previous: The commoditization of mobile espionage software

$

0

0

Security architecture and design is a vital function of a healthy enterprise. This function is fundamentally, about understanding IT architecture relationships, and ensuring security is a vital element of its implementation.

This is the second paper within the series of CISO Advisories, in this case addressing Security Architecture which articulates risks and ensures security standards are met within an organization.

Download the paper here.

Access the series introduction and index here.

Threat Source newsletter (Oct. 31, 2019)

October 31, 2019, 11:00 am

≫ Next: Threat Roundup for October 25 to November 1

≪ Previous: CISO Advisory: Security Architecture

$

0

0

Newsletter compiled by Jon Munshaw.

Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.

We’re scared of stalkerware, and you should be, too. These spyware apps are becoming more popular among everyone from nation-states to suspicious spouses who may be wanting to track their partner’s locations. These apps live in a gray area, where they’re not explicitly deemed illegal, but they can be used for illegal purposes.

How can you make sure your mobile device isn’t infected with this type of software? And why is it so popular? Find out in our new post from this week.

The second entry in our CISO Advisory series went up this week, too, this time focusing on security architecture.

We also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week.

Upcoming public engagements with Talos

Event: “It’s Never DNS…. It Was DNS: How Adversaries Are Abusing Network Blind Spots”  at SecureWV/Hack3rCon X
Location: Charleston Coliseum & Convention Center, Charleston, WV
Date: Nov. 15 - 17
Speakers: Edmund Brumaghin and Earl Carter
Synopsis: While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. DNS has become increasingly attractive to both red teams and malicious attackers alike to easily subvert otherwise solid security architectures. This presentation will provide several technical breakdowns of real-world attacks that have been seen leveraging DNS for a variety of purposes such as DNSMessenger, DNSpionage, and more.

Event: “Reading Telegram messages abusing the shadows” at BSides Lisbon 
Location: Auditorio FMD-UL, Lisbon, Portugal
Date: Nov. 28 - 29
Speakers: Vitor Ventura
Synopsis: One of the cornerstones of privacy today is secure messaging applications like Telegram, which deploy end-to-end encryption to protect the communications. But several clone applications have been created and distributed with the intent of spying on their users. In this talk, Vitor will demonstrate how the Telegram registration process became abused, allowing message interception on non-rooted Android devices without replacing the official application. This is another example on how encryption is not a panacea, and that side-channel attacks like this are a real problem for otherwise secure applications.

Cyber Security Week in Review

• The infamous Fancy Bear Russian hacking group may be targeting the 2020 Summer Olympics. New reports suggest the group has disrupted anti-doping agencies to varying degrees of success. 
• A major nuclear power plant in India confirms it was breached. A North Korea-linked hacking group gained access to the plant’s administrative network, though it has not yet said whether data was stolen. 
• A massive cyber attack took down web sites across the country of Georgia, along with the country’s national television station. Most of the sites were replaced with images of a former president of Georgia, with him holding a sign that reads “I’ll be back.” 
• A new malware family has been discovered on Android devices installed on more than 75,000 devices. However, the malware can reinstall itself even after its removed, including after a full device factory reset. 
• The WhatsApp messaging app now has biometric support for Android devices. Users can now access their profiles using their fingerprint. The feature had been available on iOS devices. 
• A new report suggests a cyber attack on Asian ports could cost upward of $110 billion. An insurance firm conducted a study, estimating what would happen if an attack hit 15 ports across Japan, Malaysia, Singapore, South Korea and China. 
• The U.K. has begun work on a new National Cyber Security Strategy, as their previous one nears the end of its life. However, this milestone has brought several critics to the forefront, including one report that says the original program only achieved one of its 12 stated goals. 
• A non-profit group is preparing to launch its free cyber security program for U.S. political campaigns. Defending Digital Campaigns announced its first group of services, including email security, encrypted messaging and security training for staff. 

Notable recent security issues

Title: Nation-state actors are behind new slew of mobile malware 
Description: A new report highlights how nation-state-backed APTs are utilizing the mobile malware space to conduct espionage activities on their own citizens. Security researchers at BlackBerry discovered new campaigns from actors linked to the Chinese, Iranians, Vietnamese and North Koreans. Among these attackers is the infamous OceanLotus group, which has launched a new attack that contains both mobile and desktop components. OceanLotus is deploying malicious apps onto mobile stores that “spy” on the user’s device.
Snort SIDs: 52004, 52005

Title: Denial of service in VMWare Fusion
Description: VMware Fusion 11 contains an exploitable denial-of-service vulnerability. VMWare Fusion is an application for Mac operating systems that allows users to run other OSs in a virtual environment, such as Windows and Linux. An attacker could exploit this vulnerability by supplying a malformed pixel shader inside of a VMware guest OS. This vulnerability can be triggered from a VMware guest and the VMware host will be affected, leading to a VMware fusion process crash on the host.
Snort SIDs: 50502, 50503

Most prevalent malware files this week

SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
Typical Filename: qmreportupload
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08
MD5: db69eaaea4d49703f161c81e6fdd036f
Typical Filename: xme32-2141-gcc.exe
Claimed Product: N/A
Detection Name: W32.46B241E3D3-95.SBX.TG

SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
Typical Filename: Eternalblue-2.2.0.exe
Claimed Product: N/A
Detection Name: W32.WNCryLdrA:Trojan.22k2.1201

SHA 256: 6b01db091507022acfd121cc5d1f6ff0db8103f46a1940a6779dc36cca090854
MD5: 74f4e22e5be90d152521125eaf4da635
Typical Filename: jsonMerge.exe
Claimed Product: ITSPlatform
Detection Name: W32.GenericKD:Attribute.22lk.1201 

Threat Roundup for October 25 to November 1

November 1, 2019, 10:31 am

≫ Next: Vulnerability Spotlight: Two remote code execution vulnerabilities in Investintech Able2Extract

≪ Previous: Threat Source newsletter (Oct. 31, 2019)

$

0

0

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 25 and Nov. 1. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. An accompanying JSON file can be found herethat includes the complete list of file hashes, as well as all other IOCs from this post. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.
The most prevalent threats highlighted in this roundup are:

Threat Name	Type	Description
Win.Malware.Trickbot-7367071-1	Malware	Trickbot is a banking trojan targeting sensitive information for select financial institutions. This malware is frequently distributed through malicious spam campaigns. Many of these campaigns rely on downloaders for distribution, such as VB Scripts.
Win.Dropper.Emotet-7365661-0	Dropper	Emotet is a banking trojan that has remained relevant due to its continual evolution to better avoid detection. It is commonly spread via malicious emails. It recently resurfaced after going quiet over the summer of 2019.
Win.Trojan.DarkComet-7365618-1	Trojan	DarkComet and related variants are a family of remote access trojans designed to provide an attacker with control over an infected system. Capabilities of this malware include the ability to download files from a user's machine, mechanisms for persistence and hiding, and the ability to send back usernames and passwords from the infected system.
Win.Packed.Zbot-7364099-0	Packed	Zbot, also known as Zeus, is trojan that steals information such as banking credentials using methods like key-logging and form-grabbing.
Win.Malware.njRAT-7363922-1	Malware	njRAT, also known as Bladabindi, is a RAT that allows attackers to execute commands on the infected host, log keystrokes and remotely turn on the victim's webcam and microphone. njRAT was developed by the Sparclyheason group. Some of the largest attacks using this malware date back to 2014.
Win.Trojan.Socks-7363151-0	Trojan	Socks is a generic worm that spreads itself via autorun.inf files and downloads follow-on malware to infected systems.
Win.Malware.Lokibot-7363866-1	Malware	Lokibot is an information-stealing malware designed to siphon off sensitive information stored on an infected device. It is modular in nature, supporting the ability to steal sensitive information from a number of popular applications. It is commonly pushed via malicious documents delivered via spam emails.
Win.Packed.Zeroaccess-7358361-0	Packed	ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.
Win.Ransomware.Shade-7357624-1	Ransomware	Shade, also known as Troldesh, is a ransomware family typically spread via malicious email attachments.

---

Threat Breakdown

Win.Malware.Trickbot-7367071-1

Indicators of Compromise

Mutexes	Occurrences
Global\316D1C7871E10	31

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
23[.]94[.]233[.]210	15
192[.]3[.]104[.]46	11
192[.]3[.]247[.]11	3
172[.]82[.]152[.]126	2

Files and or directories created	Occurrences
%System32%\Tasks\Download http service	31
%ProgramData%\мчваОнгшЬЛВчяй.dfxcsd	31
%APPDATA%\NuiGet	31
%APPDATA%\NuiGet\settings.ini	31
%TEMP%\<random, matching '[a-f0-9]{3,5}'>_appcompat.txt	27
%TEMP%\<random, matching '[A-F0-9]{4,5}'>.dmp	27

File Hashes

12e8006a018c424bcb76b7c97d880314c08f79d8951a545d92d73034f5778ec7 194f14146ed498074cb229f3941740463913e79bc4a08a765f2ffd490dfbbdd0 35030bca598f6d38bf753df2c51fa0b43a0189f44438728efd0b17027cb7d6f6 4a66279719169895ee353164bebd0d14aea7bd6588fe0d4cea242465b260a519 4e42cd765cf0ab37b5a1141d446607a672473d409a7da92a34a3add36ce1a8c7 4ea19a355329cbf55d60502bc479daae8664a0df0148b52d0096d0ea9df67626 5c49e59a65499989081ae896fd9748ef572315a3c064e63e246a670d1d292fe0 5efb96495538937fe47d41b0d7e98db37de61e6f593d349238286df075c1397c 686831b801833681a66bf8d26369358725d6eeb3d6a59dfba359d0cffc0a6879 6b63955ef70f2db59d37e4a9d1d8ea6160348a07075a63f3aba90344a4359870 6c59d5e1cbc381e8fabd6886b9202ccb8cb47fde6d197ef656ca9038d720562b 6d64abd7986e0caefe99c4c11f23ee79dc583b5ae8667b44b224cbc2ed5587db 71d6c8a2a0201af5013f6624738ca844095d6f50d7a31f105e60726d54589918 75cc6fafd3becff2a1dcb7e7a4b37542fe5fcd4f399d36ae5d5659336900b4fb 7acd91a84c5bea43ad99688a67760fd0826bc7d67b0de373292f06ecbe2d9297 81cb4e71e4327b1969f30625661c6e027c8e33cfc04be4acd20cbe3a913c236b 823e680c8c8b03a264a6cd347b84ee72913622f0bc675b18a0b3dbe0cb11422a 8d6e5a67290d22e5bb7e2beed6d83c67bb40455c3a2e27e802997aaa7f98760a 9123558e3b1d5f8041754f2bf41ed0f453d3a02da5979454f9f574efc6dc82ef 9373dd5aeea4258abed94cae3f4cf771b59714f6b7f31efb16394108cf3a9e2d 98dd50a96301fae6c07eafed51df1d5d1bd444a7920a076cc2a72bb483ae9542 a5dbee433d7d11dfff76b54e00c1879f969787f9b760908add1f89946381165e b9b992d27c996693b7d315b58a51a562e9c9286728fa162d0204fad15cc68a28 bd49f6d5e49f5dd45a38128ef576a86f1c447842d7a428ae08c7e33e321ed7aa c98366526022af2d7c17edf78d0bc5856aabebdf712f314574c6c9bc65454cd5

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

---

Win.Dropper.Emotet-7365661-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CHINESESONGS Value Name: Type	168
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CHINESESONGS Value Name: Start	168
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CHINESESONGS Value Name: ErrorControl	168
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CHINESESONGS Value Name: ImagePath	168
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CHINESESONGS Value Name: DisplayName	168
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CHINESESONGS Value Name: WOW64	168
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CHINESESONGS Value Name: ObjectName	168
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CHINESESONGS Value Name: Description	168
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\CHINESESONGS	168

Mutexes	Occurrences
Global\I98B68E3C	168
Global\M98B68E3C	168
Global\<random guid>	3

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
167[.]99[.]105[.]223	77
54[.]38[.]94[.]197	59
176[.]31[.]200[.]130	54
74[.]202[.]142[.]71	52
173[.]194[.]68[.]108/31	48
190[.]182[.]161[.]7	48
186[.]159[.]246[.]121	43
190[.]229[.]205[.]11	41
79[.]143[.]182[.]254	41
62[.]149[.]157[.]55	35
178[.]128[.]148[.]110	34
212[.]129[.]24[.]79	34
62[.]149[.]128[.]179	33
176[.]9[.]47[.]53	31
74[.]202[.]142[.]33	31
62[.]149[.]152[.]151	31
62[.]149[.]128[.]200/30	29
17[.]36[.]205[.]74	27
62[.]149[.]128[.]72/30	26
191[.]252[.]112[.]194/31	25
185[.]94[.]252[.]27	24
45[.]55[.]82[.]2	24
37[.]187[.]5[.]82	24
200[.]206[.]34[.]68	24
172[.]217[.]10[.]243	23

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
smtp[.]prodigy[.]net[.]mx	51
mail[.]aruba[.]it	35
smtp[.]infinitummail[.]com	33
pop3s[.]aruba[.]it	33
imail[.]dahnaylogix[.]com	31
smtp[.]alestraune[.]net[.]mx	31
mail[.]pec[.]aruba[.]it	31
smtp[.]pec[.]aruba[.]it	31
mail[.]outlook[.]com	27
smtpout[.]secureserver[.]net	27
pop3s[.]pec[.]aruba[.]it	26
mail[.]cemcol[.]hn	19
smtp[.]secureserver[.]net	18
smtp[.]orange[.]fr	17
ssl0[.]ovh[.]net	17
as1r1066[.]servwingu[.]mx	15
imaps[.]aruba[.]it	15
outlook[.]office365[.]com	14
mail[.]tiscali[.]it	14
mail[.]singnet[.]com[.]sg	13
mail[.]libero[.]it	13
mbox[.]cert[.]legalmail[.]it	13
mail[.]funfruit[.]com[.]mx	13
mail[.]caoa[.]com[.]br	13
smtp[.]outlook[.]com	12

*See JSON for more IOCs

Files and or directories created	Occurrences
%ProgramData%\xcsdwrsdk.dtxsd	91
%ProgramData%\dxcsdyjgbn.dfxcsd	77
%TEMP%\<random, matching '[a-f0-9]{3,5}'>_appcompat.txt	56
%TEMP%\<random, matching '[A-F0-9]{4,5}'>.dmp	56
%SystemRoot%\SysWOW64\chinesesongsa.exe	6
%SystemRoot%\SysWOW64\chinesesongsb.exe	3
%ProgramData%\Len350p.exe	1
%ProgramData%\uUgG1WJQ4usO.exe	1
\TEMP\PpoNLODk9uCChTGo9HH.exe	1
%SystemRoot%\TEMP\543E.tmp	1
\TEMP\h5xs_232.exe	1
\TEMP\R53Pew.exe	1
\TEMP\o86t6prpvay0ah3.exe	1
\TEMP\hw8ah6hmp5ku.exe	1
\TEMP\scsl_2153.exe	1
\TEMP\1p3gf.exe	1
\TEMP\xk3wdb8t.exe	1
\TEMP\067vnss8y_680.exe	1
\TEMP\ypb8jo5.exe	1
\TEMP\41v2241jicyu8m8.exe	1
\TEMP\8aklv68ynf.exe	1
%SystemRoot%\TEMP\2086.tmp	1
%SystemRoot%\TEMP\2096.tmp	1
\TEMP\wealxtx4234pz0.exe	1
\TEMP\RlwZ7vqPWQOoRg.exe	1

*See JSON for more IOCs

File Hashes

0299861a3cdc50a555b8d327b8cdbe9ebb3d286bd67d34fd78e82910ba0a69da 02e0225c00b4f47728a493dbad00964ff4e2f975312d2fdccb5fee836b8e02a7 04242859c480e5af73f938324355a7058c209a29bd90cdc9c03095da158aafb6 04edae27709686fe0eec70970a0bb0073e1e573ed64341705545068b789eda9b 068c2726caca44b77e7ee220fb4d181d086dbf433c76b588297477ac5689d572 0704a26d82961ffcc14aa5f1ca3df6be3cd09cd4a27580ecff7eea8f6b70f7e2 078d578cfbb4ea91813381500b1d4b56106bb4c73b30697b6f9cc6bc46727251 0b1bb755d31acfd314aa59b362818f89afee12840cffa7665b9a21c909249e73 0c15940c4c9a49103c2e0b33cb1488a8838aa905dddc2a53e841e5be07a1cfe3 0df437e357d886397345b7bcebd48a4404c6c923758ea30bd286fbf786531771 100ed9e984af228f4c63f6e389066f244a146a07a24a98b2ef5737484f8b9418 10cb59a28331f74a3eb14a688be158aa83ad848a29b42e9b5e69f210470004af 10dd8ab62c73328905f71435a19e2fbd4c0b3c0bfb9c62e499ce321cd455e03d 11b968a43e6f27e16c73887a56b9e04315caa0ea36ccce003411ebeb83bfb28c 11cec37f15cb1f81608912172d843502b3e74c3cf5a6002b1d186b08c561556f 12e8a80c47ac89a43c220db77cd56b746284d8fb08b0544d0b5642ff01d42c31 186d8fc5e47032b99b15b3e64d5df4427d2d89dd8a0fc08e720800f5715f1f69 19dec17408be3e2a980e50f038d4563911a0a3b315085db29b1cce06415902ce 1a24c713e52fc6072e7586ecd2ab3e858b03c893e463aae8c678c05c3b493be7 1ada1f15d5e4b2a7b67a8ee63ddb8ffbd15c2a2299977f3ff0f26f557e3d1ed8 1c80dd78b374786cd12cb3c466a69faef4b336b31b88259f735ae90a590151d6 217b0f8c66870cd11d7e6d22125e4afbb2ae711154a5ea7f56c40a02e7d6edfa 229b1494c66f15a919697f70307f34e082b77e53b4ec35b0425e5a1cac4665a2 23699f526439964cce4a8e8c9c5f27a4549bd7bb0293cae683e84730e20887ca 24d0044976a4122a3fcfedad6f66849eb0d1d9fa7fb7f7ad52bf0a9d97f394b5

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

Umbrella

---

Win.Trojan.DarkComet-7365618-1

Indicators of Compromise

Registry Keys	Occurrences
<HKCU>\SOFTWARE\DC3_FEXEC	25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: java	25

Mutexes	Occurrences
DC_MUTEX-6ZFK11A	25

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
mrsnickers03[.]no-ip[.]biz	25

Files and or directories created	Occurrences
%APPDATA%\dclogs	25
%APPDATA%\IDM	25
%APPDATA%\IDM\ichader.exe	25
%TEMP%\WTHTE.bat	2
%TEMP%\WTHTE.txt	2
%TEMP%\SXIJG.txt	1
%TEMP%\PTQEQ.bat	1
%TEMP%\PTQEQ.txt	1
%TEMP%\USQVI.bat	1
%TEMP%\USQVI.txt	1
%TEMP%\CQGTP.bat	1
%TEMP%\CQGTP.txt	1
%TEMP%\NKKWS.bat	1
%TEMP%\NKKWS.txt	1
%TEMP%\WAXFT.bat	1
%TEMP%\WAXFT.txt	1
%TEMP%\JRFQG.bat	1
%TEMP%\JRFQG.txt	1
%TEMP%\APQNW.bat	1
%TEMP%\APQNW.txt	1
%TEMP%\UVJWH.bat	1
%TEMP%\UVJWH.txt	1
%TEMP%\OSNVJ.bat	1
%TEMP%\OSNVJ.txt	1
%TEMP%\MUISJ.bat	1

*See JSON for more IOCs

File Hashes

0d35dc067583af9f8ec8aa97a0ffafc8a92c52145196755eff63f62fd545da80 4671622ecb23629041c6f808461e60b20692ba4920d7207442db3e0bb2f9cb43 560532abb05b4b9219c6206d02defb4ce74f0f07be27173257df016e2576e0c1 5b6a3069e1fdad0d43dea5e289a41ea3a76c2583990f070368394154339dc682 60fda48fabb1047741a46cb1989b1ed5a49fa8214955e328d9b9e0825bd06dae 76f99c94e4cb98ecb947dc0add432659cf9510cf0ff75dd532af16f68ca70612 7c15a840a3f2bd987e096d3810991e4f88fe65c9ba6efff2529c1608dfd39e34 7e18585cff88ab47bbdc0d2f9c76ade0d12cf1431983864c260ada790aee3afa 82648de7b9a19b4e1a23933f5c5a24991365fdd97bdb03d0cd95431f38df0b23 842e707c9400e589df5e4be6ec72454403fee00adb174c54b2f2dea3ac1d69d5 85faf6824e603e5bff1ec4e743bd944f2cfdca0098920cbf66467e4d24d8d919 87411b5aee6a4ca4f671b44e63cc9a8e0fc27ed2b43a843cfbe904c428420668 897e054816e7d69c51c73b843c0def266858d0f0eb50425930f975416210868c 8d8821ca5999ec65308100e8a4d7e3bdfe850783161c925789149394f1e071a5 91da6fab3b8e86ba31a0c36eb37787c5bd3723d2f452b59ec5ecac8431a721a3 937d56fae295a0647c6bcea2db66a1f33aefe91db3ab8bb04979ad745d5cd18d 94ac600212f0cb12d2dfb7f2e5a5814160226fa0cd2d545dd2ab32f3057fc92d 9a5b643414e9a3b2b0768123f6c2039c06ec39a1f647201cf284c1785809be2d 9db56c0d7979b0ec84776064129b1a2354d9d3b13f09cff625b106a230fc0caa a4d07da8c28394c58f19e8a7ffb8505386ef714efd4fe9f9d096462233cb7e87 a72e5af5e928da722ded5dee33dba92c9ff07b4c5a7cfdd083c60bc4c6ca6dd3 a7f813ece9b9f797ff84d1d13294892e499ba36e442a118f7f08a3499671e449 a9fc7d3f2b74b0640102d091bd79e5f98887e4bb43ad8bf153cd2e477b67dba6 b13881418dc9d5f70d4ed4da6188806132e6b9d4c7cfa45a6dd426203db5f797 b28117f5e719f5e2c419a9fd0569d40729442d1cff822b1644379986e29c9c50

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Win.Packed.Zbot-7364099-0

Indicators of Compromise

Registry Keys	Occurrences
<HKCU>\SOFTWARE\MICROSOFT\INTERNET EXPLORER\\DSP Value Name: ChangeNotice	1

Mutexes	Occurrences
-e2a38afdMutex	25
FvLQ49IlîIyLjj6m	25
FvLQ49Il IyLjj6m	21

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
204[.]79[.]197[.]200	25
212[.]83[.]168[.]196	21
199[.]2[.]137[.]29	21
62[.]112[.]10[.]15	21
13[.]107[.]21[.]200	13

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
api[.]wipmania[.]com	21
n[.]alnisat[.]com	21
n[.]jagalot[.]com	21
n[.]myadvsit1[.]com	21

Files and or directories created	Occurrences
%APPDATA%\Microsoft\Exoiom.exe	21

File Hashes

0cb65d9d8421292e933acf4b5f8aebbe69fcdad0948f8bf711ebf8be9ca23392 0d2b2655e40f10215b306fd47028cf2dffada53d808fec0784514f5a896746d9 11246d210b2edc49c14b00f14791a22b5f2ec12c1be96ce90d5177769a489869 11c83400744d7f64516e1854772373f91b105e66169ba15d5d110f0948bed825 17ca554b2e2a1a6b9412cc2c3e29d6c95e27a24305e879beb1ec3ec6b504d526 1ae7050f136ee52bc82af58ea180ba449e47f1bfde4c27956906ac1ff1913998 25328cbd1c4325abcc27a6a1553fbfe029ca98b10747c2adc5ecee08eef77bc2 25e261c4a20575828b3344d872bd99725fceb952acecf524fa6c3c1267a2e729 2ca7fa29437a2caca2c10c4c347f73d8bb4fed5698a2f78c91b949420fd2b015 306e30cefb63944763afedf2f77f7c9d51d0bcda5d53068c5b832bee4e9bb7b4 31cf80b70149972f55f5064158359386cd1a1e8e3426cd1b9fa922ac994c47e7 3908a42cf0243c333fbd9d5cee753db2e8e44b8e26daabd0336ab3faca57136c 3f1a2e83de8d62377f9c1db5326cedff42b0b3ab6581dd1c8c3a4a52b9498ce9 43d34611fc97e74ee6d88b3b1fddbfd6b97fec6dae41208856e6e0cfbc921007 4453c2ac6b30f16a9560439c542dc42a17c723caab95e63289aa239017d002c1 4664d6a94aeca4dbdd5ec72453be28be2697546f4effc2579b6330b00942011a 519eab7ecc913297fa56b498685eb13e06a9375ba3cd7108057952639f8945bb 5295c963140c0b6022b1c9bb91401d2042ffb715d5a0af394546e788124b058d 5d53c88240b8ac76a3de5ba303bfa805f9730abc2827f149716c5a3ef9776fab 664aec540c5ad508b5b86c695ebd6e302cd67d7833abe56516365273f735a0b6 68fe7ccc046a6eb48d4bb9b6acf26ca7a22a7379fed0663e83f89492f4bc001a 76d7eb8843a1031e6498584e781934f6546b513658e345081e85f5c2ccee3459 794509058dd3ca5f5e6e1e775c24cd46573c7ed556184f3b67e28abd053167bc 7de6b27ba23da2c1d1ddfc54926b8a770a7da00908516e377c68140ebefa44d5 81bb7e47f2f07cae53dfa7a78ae94625bc49945a99a147b06da9b30f887981f0

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Win.Malware.njRAT-7363922-1

Indicators of Compromise

Registry Keys	Occurrences
<HKU>\S-1-5-21-2580483871-590521980-3826313501-500 Value Name: di	21
<HKCU>\ENVIRONMENT Value Name: SEE_MASK_NOZONECHECKS	21
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON Value Name: ParseAutoexec	21
<HKCU>\SOFTWARE\E99E462D99AD204BDF7D672852A4E30A Value Name: [kl]	21
<HKCU>\SOFTWARE\E99E462D99AD204BDF7D672852A4E30A	16
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: e99e462d99ad204bdf7d672852a4e30a	7
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: e99e462d99ad204bdf7d672852a4e30a	7

Mutexes	Occurrences
e99e462d99ad204bdf7d672852a4e30a	21

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
104[.]22[.]2[.]84	14
104[.]22[.]3[.]84	9
95[.]185[.]232[.]120	1
98[.]124[.]119[.]29	1
41[.]141[.]118[.]138	1
197[.]26[.]141[.]153	1

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
pastebin[.]com	21
inforhack[.]ddns[.]net	3
shadowhakar41[.]ddns[.]net	1
osaam2015[.]ddns[.]net	1
x5pqt[.]ddns[.]net	1
server5319[.]us[.]to	1
aqwe[.]ddns[.]net	1
hx[.]ddns[.]net	1
snokeall[.]ddns[.]net	1
animeopening[.]ddns[.]net	1
mrzero007[.]ddns[.]net	1
sikipon32[.]ddns[.]net	1

Files and or directories created	Occurrences
%TEMP%\dw.log	17
%TEMP%\<random, matching '[A-F0-9]{4,5}'>.dmp	17
%TEMP%\svchost.exe	12
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\e99e462d99ad204bdf7d672852a4e30a.exe	6
%APPDATA%\svchost.exe	2
%APPDATA%\skype.exe	1
%TEMP%\8c0_appcompat.txt	1
%HOMEPATH%\svchost.exe	1
%TEMP%\dlhost.exe	1
%HOMEPATH%\Hex.exe	1
%TEMP%\Microsoft.exe	1

File Hashes

059e82f8093d6cc96a0c9b256b91f29a76a504b31e7b99e505f00f1a58fb0fc8 0e456becd300e714371a779408d0e06c9e2d607e4e64357eddfa044a52c16640 2a167630a36ac40de7c8734db7020485e6437e48f7df33254702cdd8970128c0 51e4acbcc40cd882aaad099ae740e95657b309933898ba1d7008c457f0d75cdb 6001923be2f05f19e5061ddf5975f4b8c11f0085328434d6b1926c5a2c6485b9 6d377ec90f4ba0dd424381e05b48c7ed6e92dacc5e8ee3a154c4b770eeb52587 76c67ae939c6a9d187a0bdea6aaa6327984cd3e8de004835eb067ce4ec94ca1e 79fb56495974b83bc55b641f7a242206a539fcc028f66587f9e3c01e954f60b1 82af8835172e86cb143531abfaaf49ba71f5f82087c47bde81982e7f9fb4857a 836067675ad71d653ef9e8cedd07df5e6d15a41e7bc54cdbbaee2fc7764d9d2f 842865c8e038c4cf4da7c65a2c42379548009ddfedf206ac768f4fc443f3fae4 8c8ab50a5fffa135df8e2f8414a7862659dfec13742a511f9ca7f07348f3a44e 8df49f96d2f23b361c482dc331569827f4de5948cb95b426bf51c5f02d7574e5 92451c9eaec9049c6d787ec783bfacbaa20c4b95380b7247b540419c9b326a15 b56bdfb6b099cfe281a29e3d1f1a08d7fb4d56c0495dad8db010cb207ca73d67 ca1bc558e24135a5d6b79621ad7c236f6ca50c552bbc7b13d8b0d6feecf0a330 d788fe230c34a048d3a9b81464e72b62804447c046fc160ab920fda1ab168d56 e060f062be14913686fec255fae67e79f0042507701289fe8347d15206462df6 e4545c9397b09fa28bfd369bdc28babaee10ec05546bcd674263c0d24244aa07 f17ae58c267b7d0601014165e804580d0044134dc04b1ca50811275df0793ded f6d6b6fae736e1fc4d9bbb52704a7c84cc8bf4981f18ea466793f5aaf545d38a

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

---

Win.Trojan.Socks-7363151-0

Indicators of Compromise

Registry Keys	Occurrences
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: ntuser	24
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: autoload	24
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SCHEDULE Value Name: ImagePath	24
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: ntuser	24
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: autoload	24
<HKLM>\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND	24

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
208[.]100[.]26[.]251	24

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
fewfwe[.]net	24
blinko-usa[.]com	24
satellife[.]info	24

Files and or directories created	Occurrences
%HOMEPATH%\cftmon.exe	24
%SystemRoot%\SysWOW64\drivers\spools.exe	24

File Hashes

0e9ce623b6d9979002c965f8d4b8379d16a3cdd71e64edfefb7b46546f760556 158b0aa2b4d23ab0c60e398eaffcc453d3b2135e9ac8501fc6fc8b0181f34916 19037ebfa382219b5a715a3190291091db8c4305cfcfb80ccf7ee6134f24ac2b 2c5f26e9971998e2989d69062df2b4947e52799f3b1e467eca922637cfc4b8a0 4772d7089ed885adeffe0c432f206e84a10038d93aea00713a0fef3ea204d61b 4ab819c524ad7e920bc7fedfce565676c6fdbc952e565bd42da7622456900f5b 4b39a3e4422ff108fbbeb5527524254eff540f48afcb882ef723c86760c01692 4d0b608d4816454ea7c615a51d24d20d25d3db7b424bea47956f3cf610c12a63 564cc6cf1fb9c7f23321ea597da0de78584f663faa3576cc25c876f0ced8539f 6451c75aa10348799759f004bb5f8cec4cab9ca59a243f74af6a92d994ff47ad 6bb0c35cf05218d0f843085b0da1dadead72bb6f3f08c72909c42875d177fac9 7299f47ff48a6286d1cd26a0b7d1e5233dd14af4cb7b1899538f9aa6661194ad 72ad21d29db21fd7519e226f0e50bd12a6c656b3ec14aed124555467373f09c4 748a55b6bb4144523e88a1a6795b22a445d30c142f06f869db1ea79ea879a6dd 8125c5f1f273ce5eafef48762c6886cb9df53a7dd5d41aad058afdab64256c9f 9814aae0363183ef5ae7d960da747db0dc5a644bae9e6f880c2b16f1b06f0de7 bbe846b00154658a2ce4701a08f085b806aebfebec60a5fc7b755bdb16f1db46 cec7f824501284e919c38d9161196136e527b67a8cb5066a2605995ec9833b94 cee25c0db7ab90aa3848e13013b2b02e82f101e473544ed802dc57242e54acfc cf8478480f7974884ce7a9d817b4ded724f2d1c77638273fbeaa3f086d1905ad d814df1c7a8edf3d4ce11091595ffd5d25b5a79de1891b39dc8ddfd8c00353c2 da967dec24f5455ed8910f3d7df93c60319fba735a29e2e09401db4b6b7a057c f713344d26bc5ad3d88efd93473acbbde824c4d4f0e1a70fb690d9bfe27a2bff f74c53738e554de22236498e91bef767351ac06a677eb2192ee09182eec203a4

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Win.Malware.Lokibot-7363866-1

Indicators of Compromise

Registry Keys	Occurrences
<HKCU>\SOFTWARE\WINRAR	3
<HKCU>\SOFTWARE\WINRAR Value Name: HWID	2
<HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003E9 Value Name: F	2
<HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000001F5 Value Name: F	2
<HKLM>\SAM\SAM\DOMAINS\ACCOUNT\USERS\000003EC Value Name: F	2
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 8PKXHTYXYR	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: KV1LBH_H1V	1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN Value Name: JPXX3LNHNHY	1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN Value Name: PHLL54I	1

Mutexes	Occurrences
3749282D282E1E80C56CAE5A	12
3BA87BBD1CC40F3583D46680	11
8-3503835SZBFHHZ	4
6M1O492E903A660D	4
S-1-5-21-2580483-1060168328224	2
Global\ee9ec621-fa96-11e9-a007-00501e3ae7b5	1
S-1-5-21-2580483-6362420053499	1
S-1-5-21-2580483-19562420053499	1
S-1-5-21-2580483-13882420053499	1
S-1-5-21-2580483-11682420053499	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
104[.]247[.]73[.]132	10
62[.]149[.]128[.]45	2
198[.]54[.]117[.]200	2
47[.]91[.]169[.]15	2
198[.]49[.]23[.]144/31	2
172[.]80[.]15[.]9	2
185[.]149[.]23[.]24	2
45[.]43[.]35[.]96/31	2
213[.]186[.]33[.]5	1
50[.]63[.]202[.]52	1
91[.]195[.]240[.]126	1
23[.]20[.]239[.]12	1
184[.]168[.]131[.]241	1
52[.]58[.]78[.]16	1
81[.]88[.]57[.]68	1
183[.]90[.]245[.]41	1
162[.]213[.]255[.]220	1
162[.]211[.]181[.]225	1
213[.]239[.]221[.]71	1
198[.]54[.]117[.]218	1
173[.]247[.]243[.]182	1
203[.]238[.]182[.]106	1
103[.]75[.]189[.]246	1
77[.]72[.]0[.]138	1
69[.]16[.]230[.]43	1

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
devhaevents[.]us	10
www[.]nadidetadllar[.]com	3
28080[.]com	2
www[.]peizi33[.]com	2
www[.]zgtmn[.]com	2
www[.]neurofoodmarketing[.]com	2
www[.]dc-eas[.]com	2
www[.]wls11[.]com	2
www[.]the-conference-buddies[.]com	2
www[.]parapuglia[.]com	2
www[.]wemovieblog[.]info	2
www[.]browneyedbakerfun[.]com	2
www[.]zjko2o[.]com	2
www[.]cryptogage[.]com	2
cn-list[.]info	2
www[.]xn--u2u404a[.]ink	2
www[.]stvple[.]com	2
www[.]ledean-pauvert[.]com	2
www[.]ms-field[.]net	2
www[.]2zh4m[.]com	1
www[.]66463dh[.]com	1
www[.]moveoptimizer[.]com	1
www[.]onmyoji-kouryaku[.]com	1
www[.]1399pk10[.]com	1
mindslaver[.]com	1

*See JSON for more IOCs

Files and or directories created	Occurrences
%APPDATA%\D282E1\1E80C5.lck	12
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2580483871-590521980-3826313501-500\a18ca4003deb042bbee7a40f15e1970b_d19ab989-a35f-4710-83df-7b2db7efe7c5	12
%APPDATA%\D1CC40\0F3583.lck	11
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1258710499-2222286471-4214075941-500\a18ca4003deb042bbee7a40f15e1970b_8f793a96-da80-4751-83f9-b23d8b735fb1	11
%TEMP%\bill file.exe	11
%APPDATA%\D1CC40\0F3583.exe (copy)	9
%APPDATA%\D282E1	7
%APPDATA%\6M1O492E\6M1logim.jpeg	7
%APPDATA%\6M1O492E\6M1logrc.ini	7
%APPDATA%\6M1O492E\6M1logri.ini	7
%APPDATA%\D1CC40\0F3583.hdb	5
%APPDATA%\6M1O492E\6M1logrv.ini	4
%System32%\Tasks\Attractableness	3
%ProgramData%\hellderbind.exe	3
%ProgramData%\HELLDE~1.EXE	2
\Documents and Settings\All Users\hellderbind.exe	2
%SystemRoot%\Tasks\Attractableness.job	2
%TEMP%\A1ED.dmp	1
%TEMP%\8D7A.dmp	1
%TEMP%\bin.exe	1
%APPDATA%\-L951SVT\-L9logim.jpeg	1
%APPDATA%\-L951SVT\-L9logrc.ini	1
%APPDATA%\-L951SVT\-L9logri.ini	1
%TEMP%\52843.bat	1
%ProgramFiles(x86)%\Dmdvpl4r8\IconCacheebvhjrz.exe	1

*See JSON for more IOCs

File Hashes

0b1ec867f89cabea9e5a4750f7c7ba76ba255b417341b13351bde26733827d5e 124f01bbbcc20d33191c4d2bb756d7b4be9fd98b1c18dd0bafc2f5a1a0119a7c 1536d75683e29eb947bd08c622687c23e96b0a5b7192650d2c0e0b71b523f53b 3199c726488205e1e39d826666ddb14e567283dc1912b94688bf80623e3bb8b1 46d599a3253021c45a373cd9f324d1fe9b97a28a9b2ca57685621557296a736f 4a7483bd09d881a0c9b94077d2fa308eebcd44988dabf866b481c9dfd4d211da 68e514e18e7353c018dd48e6f237e5f7c57def18a357156ffca7dd3826ee7426 72b2e6a534b504d1e5871293956412bf8b198ae71139312592755bfe8a5cbfab 7a675a25cd30dc40dba8e32cbdc499089dcbc5a994150d8466497f14619ae6ba 8e89f43a20be6022d88e7ba6821a91e5f2ade5882ba8de7e86e449ba497e56cc c4294beaabec49ed4dede08037b48667ac91dbf9eb4cff60e987b1906d7e35f1 ca5eeac3a04231f26f71646ec3f62c867d42fef71dcd677cb4e2a01a986a80eb d0a46670613cb3711bb0c690f75768640e6867b53ee2866f1952bb3b39436f59 dbe53d918accbf4b75025ad3b525ebce8547c913808ef547e8b9d67114113b1c f966a33cbaba9b97cb874d8b8d17544c856db7544c7bb2a09d3d2535a8e28fd5

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

Umbrella

---

Win.Packed.Zeroaccess-7358361-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: Start	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: DeleteFlag	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: Start	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS Value Name: Start	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: Start	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: Start	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS Value Name: DeleteFlag	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: DeleteFlag	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: DeleteFlag	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BROWSER Value Name: Start	21
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Windows Defender	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: Type	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: ErrorControl	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS Value Name: Type	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS Value Name: ErrorControl	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: Type	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: ErrorControl	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: DeleteFlag	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: Type	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: ErrorControl	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: Type	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: ErrorControl	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BFE Value Name: Type	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BFE Value Name: Start	21
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BFE Value Name: ErrorControl	21

Mutexes	Occurrences
Global\82f0e161-f7c1-11e9-a007-00501e3ae7b5	1
Global\a280e5c1-f7c1-11e9-a007-00501e3ae7b5	1
Global\d6367241-f7c1-11e9-a007-00501e3ae7b5	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
83[.]133[.]123[.]20	14
212[.]253[.]253[.]254	9
218[.]144[.]173[.]167	8
98[.]248[.]140[.]174	7
76[.]119[.]18[.]160	6
82[.]130[.]158[.]137	6
24[.]222[.]83[.]135	6
1[.]161[.]150[.]169	6
65[.]36[.]75[.]132	6
50[.]7[.]216[.]66	5
166[.]82[.]93[.]190	5
36[.]2[.]141[.]192	5
184[.]90[.]23[.]168	4
72[.]189[.]202[.]136	4
37[.]19[.]241[.]169	4
31[.]134[.]253[.]187	4
110[.]226[.]47[.]156	4
74[.]88[.]57[.]193	4
184[.]38[.]240[.]175	4
5[.]43[.]242[.]139	4
152[.]7[.]6[.]164	4
190[.]105[.]127[.]197	4
98[.]69[.]146[.]176	4
86[.]124[.]234[.]155	4
80[.]116[.]95[.]189	4

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
j[.]maxmind[.]com	21

Files and or directories created	Occurrences
%System32%\LogFiles\Scm\e22a8667-f75b-4ba9-ba46-067ed4429de8	21
\@	21
\L\eexoxfxs	21
\systemroot\Installer\{0f210b53-2df0-43a6-b654-d5b43088f74f}	16
\systemroot\system32\services.exe	16
%System32%\services.exe	16
%SystemRoot%\Installer\{0f210b53-2df0-43a6-b654-d5b43088f74f}\@	16
%SystemRoot%\Installer\{0f210b53-2df0-43a6-b654-d5b43088f74f}\L	16
%SystemRoot%\Installer\{0f210b53-2df0-43a6-b654-d5b43088f74f}\U	16
\systemroot\assembly\GAC_32\Desktop.ini	5
\systemroot\assembly\GAC_64\Desktop.ini	5
\$Recycle.Bin\S-1-5-18	5
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f	5
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f\@	5
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f\L	5
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f\U	5
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f\n	5
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f	5
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f\@	5
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f\L	5
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f\U	5
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f\n	5
\RECYCLER\S-1-5-18\$ad714f5b8798518b3ccb73fd900fd2ba\@	3
\RECYCLER\S-1-5-18\$ad714f5b8798518b3ccb73fd900fd2ba\n	3
\RECYCLER\S-1-5-21-1258710499-2222286471-4214075941-500\$ad714f5b8798518b3ccb73fd900fd2ba\@	3

*See JSON for more IOCs

File Hashes

0698b0699a2832438d3d40b9b254a1db6997650030a4f1baa9d83b195ddcefee 2a4480ab660655f0667496d06a8a6c4ca40795ea673a1d8be36c185fcd5843a2 2ff6a5a8fb138d625121b218c791129fdac013f6cea1fc4cac9a8f986a43a17e 61fe63c712ac33630cca861ad8bc3283d9e591a61184cf0c2e40e1712880e858 68073e04dff2910046705b41823a3d2e22de0b80722b2e0642f8bbad2251f31b 6c0cfbb2a0f755be5e73f9eebf0af5a66a8a9ccd9f064742275c45911aa4ba05 73efae80e8a1433ecce908d9d89a7e0dee9689f9e41a43858b7dd020ad98bdbb 81af3ef292ab1ca88658434c67ba4433727b2fa52c6170689cc7e6987d52e994 82c17d05d449adc7970c6d923a00567228d2f92d784e17e46fd40fb5f75fc96c 852ca255c72851fff39129f7e4ad946e28c1c3adfe73f099d034b511d0d4f0ab 8bed5fd8ee4415d50e0fcfa15697455737ec30e371b9cf59998f16b9df82d655 8ff205742a2e987be8743877e3832f704a3d8a428adeaa809a62a2da3d98284f 90971a6f3936154d1d42143075a74343307211738f60fd8dc2704b9b1092b9eb 91b52463d52c11f45b8bc6e833560f374b3c23943ef83a596de4c9c263e25601 945e8db2a3e172c1b4def44a627f31ec3d92027c2302ae6ca8426995a0d2f330 97ab941d4e212453c834739eecc62dc6b23a2737b7e99fdfd5e5bc2b1e677070 97b0052c9b458793345d76e6a445608f464eb17c15a4a3e1ac62ecc2b5e19c70 9abab9e192eba949efed12bf34d82b796b872954a8928695c6c2eb539d7a9994 9b57296d2b3a6e2d71d279e2f72a0c5764076e60db0decd1c933cea1ec68abbd 9be01433e0553992428c321e8ddb794697837e4266ebfcde8957190f175300d0 9bef202996bca3127c622f5b26c98bbe35ae6ef0aeea22f071517a4545c5daac 9c0d8b542bc6d349355dc8bff3d9f3436ec63033777b6ae2b7350b82a31f0b64 9c73a69c0eec3b51b0ede9d6ffdb4079c8f8ecab122dace2625d32f5a81794b1 9f6076a9aeff4a57d098390ff61e60b6a954ee545b8945fca5d39f4907de0e84 a0c2956a0dd44d0e177af551a6b3c0990a6d163f2d8e36a1b4370c667bf7bdd2

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Win.Ransomware.Shade-7357624-1

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32\CONFIGURATION Value Name: xi	12
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Client Server Runtime Subsystem	12
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32\CONFIGURATION Value Name: xVersion	12
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32	12
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32\CONFIGURATION	12
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32\CONFIGURATION Value Name: shst	11
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32\CONFIGURATION Value Name: sh1	11
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32\CONFIGURATION Value Name: shsnt	11
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32\CONFIGURATION Value Name: xstate	11
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32\CONFIGURATION Value Name: xcnt	11
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\DEBUG Value Name: ExceptionRecord	11
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32\CONFIGURATION Value Name: xmode	11
<HKLM>\SOFTWARE\WOW6432NODE\SYSTEM32\CONFIGURATION Value Name: xpk	11
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\HOMEGROUP\UISTATUSCACHE Value Name: OnlyMember	6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER Value Name: CleanShutdown	6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{509D0DCA-5840-11E6-A51E-806E6F6E6963} Value Name: Generation	6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{6DD1DC5F-5840-11E6-B80E-00501E3AE7B5} Value Name: Data	6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{6DD1DC5F-5840-11E6-B80E-00501E3AE7B5} Value Name: Generation	6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{3F37BA63-EF5C-11E4-BB8D-806E6F6E6963} Value Name: Data	6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{3F37BA63-EF5C-11E4-BB8D-806E6F6E6963} Value Name: Generation	6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963} Value Name: Data	6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{3F37BA64-EF5C-11E4-BB8D-806E6F6E6963} Value Name: Generation	6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPLETS\SYSTRAY Value Name: Services	6
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\NLASVC\PARAMETERS\INTERNET\MANUALPROXIES	6
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CD BURNING\DRIVES\VOLUME{509D0DCA-5840-11E6-A51E-806E6F6E6963} Value Name: Drive Type	6

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
76[.]73[.]17[.]194	5
131[.]188[.]40[.]189	5
208[.]83[.]223[.]34	4
171[.]25[.]193[.]9	4
86[.]59[.]21[.]38	3
193[.]23[.]244[.]244	3
194[.]109[.]206[.]212	3
154[.]35[.]32[.]5	3
128[.]31[.]0[.]39	3
83[.]142[.]225[.]126	1
137[.]74[.]19[.]202	1
195[.]154[.]237[.]147	1
81[.]17[.]17[.]131	1
198[.]16[.]70[.]10	1
5[.]9[.]116[.]66	1
62[.]151[.]180[.]62	1
193[.]105[.]73[.]80	1
176[.]31[.]103[.]150	1
194[.]59[.]207[.]195	1
146[.]185[.]189[.]197	1
144[.]76[.]143[.]137	1
87[.]193[.]208[.]14	1
98[.]128[.]172[.]233	1
87[.]121[.]98[.]43	1
141[.]157[.]13[.]229	1

*See JSON for more IOCs

Files and or directories created	Occurrences
\README1.txt	12
\README10.txt	12
\README2.txt	12
\README3.txt	12
\README4.txt	12
\README5.txt	12
\README6.txt	12
\README7.txt	12
\README8.txt	12
\README9.txt	12
%ProgramData%\System32\xfs	11

File Hashes

26da7d57ec1798ddcdc4f016f4eb0752a6e1ecd5481091dc523ea01175093d8d 2a68d908566be84208cdb2f8f7d91e333690f9caee7e3f2e910483612c5a5046 5d7a85f85865277795519e6e7b5f656cf9904ed6dcdbb6d901482c47594cea7b 68daf44d57a4d13701eb66b637a00cc6931fb913515a7c95dec3a318c0365968 6f387364a1ebaebef7dc40f5bc1bf8200206b140e27050ff3f41fe6fb46c6b7f 7699113e80abe023018877fd18e3b39a29b26a21cd7dfcef06cbe9c0f9595cff 9714f035f6458b4496dd0e1362eded1eca6214ee35768b1e2f615124671b52e3 985418b9d311ec5b3f386204c2f65342856b90c5617fcbb1bf50bf1ae13ec3f1 b7005d089d4e060ea4528dbca67236924bb2310c0b214d3f74e0961effda7da4 b9bd26c9291c769620dd003b63619c10b741495bbef133d488dc877634cda0bc d48ef74859fc77868492c43758d01f618c2af1d007e570d3848fe1d5a246e10c deaa2c5a65617ca09fd4d84a268febc8ecdd660307a5fe576bbd10833d045de1

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Exploit Prevention

Cisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits. These exploits use certain features to bypass typical anti-virus software, but were blocked by AMP thanks to its advanced scanning capabilities, even protecting against zero-day vulnerabilities.

CVE-2019-0708 detected - (57939)

An attempt to exploit CVE-2019-0708 has been detected. The vulnerability, dubbed BlueKeep, is a heap memory corruption which can be triggered by sending a specially crafted Remote Desktop Protocol (RDP request). Since this vulnerability can be triggered without authentication and allows remote code execution, it can be used by worms to spread automatically without human interaction.

Atom Bombing code injection technique detected - (2838)

A process created a suspicious Atom, which is indicative of a known process injection technique called Atom Bombing. Atoms are Windows identifiers that associate a string with a 16-bit integer. These Atoms are accessible across processes when placed in the global Atom table. Malware exploits this by placing shell code as a global Atom, then accessing it through an Asynchronous Process Call (APC). A target process runs the APC function, which loads and runs the shellcode. The malware family Dridex is known to use Atom Bombing, but other threats may leverage it as well.

Kovter injection detected - (410)

A process was injected into, most likely by an existing Kovter infection. Kovter is a click fraud Trojan that can also act as an information stealer. Kovter is also file-less malware meaning the malicious DLL is stored inside Windows registry and injected directly into memory using PowerShell. It can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2. It spreads through malicious advertising and spam campaigns.

Excessively long PowerShell command detected - (354)

A PowerShell command with a very long command line argument that may indicate an obfuscated script has been detected. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.

Process hollowing detected - (313)

Process hollowing is a technique used by some programs to avoid static analysis. In typical usage, a process is started and its obfuscated or encrypted contents are unpacked into memory. The parent then manually sets up the first stages of launching a child process, but before launching it, the memory is cleared and filled in with the memory from the parent instead.

Gamarue malware detected - (137)

Gamarue is a family of malware that can download files and steal information from an infected system. Worm variants of the Gamarue family may spread by infecting USB drives or portable hard disks that have been plugged into a compromised system.

Installcore adware detected - (95)

Install core is an installer which bundles legitimate applications with offers for additional third-party applications that may be unwanted. The unwanted applications are often adware that display advertising in the form of popups or by injecting into browsers and adding or altering advertisements on webpages. Adware is known to sometimes download and install malware.

Dealply adware detected - (93)

DealPly is adware, which claims to improve your online shopping experience. It is often bundled into other legitimate installers and is difficult to uninstall. It creates pop-up advertisements and injects advertisements on webpages. Adware has also been known to download and install malware.

PowerShell file-less infection detected - (46)

A PowerShell command was stored in an environment variable and run. The environment variable is commonly set by a previously run script and is used as a means of evasion. This behavior is a known tactic of the Kovter and Poweliks malware families.

Fusion adware detected - (29)

Fusion (or FusionPlayer) is an adware family that displays unwanted advertising in the form of popups or by injecting into browsers and altering advertisements on webpages. Adware is known to sometimes download and install malware.

Vulnerability Spotlight: Two remote code execution vulnerabilities in Investintech Able2Extract

November 4, 2019, 6:57 am

≫ Next: The latest on BlueKeep and DejaBlue vulnerabilities — Using Firepower to defend against encrypted DejaBlue

≪ Previous: Threat Roundup for October 25 to November 1

$

0

0

Piotr Bania of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.

Cisco Talos recently discovered two remote code execution vulnerabilities in Investintech’s Able2Extract Professional. This software is a cross-platform PDF tool for Windows, Mac and Linux that converts PDFs and allows users to create and edit them. Other features include PDF signing, redactions and annotations. An attacker could exploit these vulnerabilities to execute arbitrary code on the victim machine.

In accordance with our coordinated disclosure policy, Cisco Talos worked with Investintech to ensure that these issues are resolved and that updates are available for affected customers on various operating systems.

Vulnerability details

Investintech Able2Extract professional JPEG decoding code execution vulnerability (TALOS-2019-0881/CVE-2019-5089)

An exploitable memory corruption vulnerability exists in Investintech Able2Extract Professional. A specially crafted JPEG file can cause an out-of-bounds memory write, allowing an attacker to execute arbitrary code on the victim machine. An attacker could exploit this vulnerability by providing the user with a specially crafted JPEG file.

Read the complete vulnerability advisory here for additional information.

Investintech Able2Extract professional JPEG decoding code execution vulnerability (TALOS-2019-0880/CVE-2019-5088)

An exploitable memory corruption vulnerability exists in Investintech Able2Extract Professional. A specially crafted BMP file can cause an out-of-bounds memory write, allowing a potential attacker to execute arbitrary code on the victim machine. A user could trigger this vulnerability by sending the user a specially crafted BMP file.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that Investintech Able2Extract Professional, version 14.0.7 x64, is susceptible to these vulnerabilities.

Coverage

The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rules: 50864 - 50869

The latest on BlueKeep and DejaBlue vulnerabilities — Using Firepower to defend against encrypted DejaBlue

November 4, 2019, 7:43 am

≫ Next: C2 With It All: From Ransomware To Carding

≪ Previous: Vulnerability Spotlight: Two remote code execution vulnerabilities in Investintech Able2Extract

$

0

0

Update (11/04/2019):

There have been several public reports of active exploitation of CVE-2019-0708, commonly referred to as “BlueKeep.” Preliminary reports indicate that the vulnerability is being exploited by adversaries who are leveraging access to compromised systems to install cryptocurrency mining malware. At this time, there has been no evidence to suggest that the exploitation is due to the emergence of a new worm, and it is likely being done as part of a mass exploitation campaign, similar to what we have seen in previous instances of mass exploitation campaigns. Existing coverage for BlueKeep continues to be an effective way to mitigate possible exploitation attempts. For additional information related to protecting against attacks leveraging BlueKeep, please refer to the blog posts here.

Note: This post was originally published on 09/03/2019.

This blog was authored by Brandon Stultz, Holger Unterbrink and Edmund Brumaghin.

Executive summary

Over the past few months, Microsoft has released several security updates for critical Remote Desktop Protocol (RDP)-related security bugs. These bugs are significant for IT infrastructure because they are classified as "wormable," meaning future malware that exploits them could spread from system to system without requiring explicit user interaction. These vulnerabilities could be exploited by an attacker sending a specially crafted request to the target system's Remote Desktop Service via RDP. We have seen how destructive these kinds of attacks can be, most notably WannaCry. We highly recommend organizations immediately apply Microsoft's patches. Cisco Talos released detection coverage for CVE-2019-0708 and also enhanced guidance to help organizations facilitate inspection of RDP sessions here. Microsoft published additional security updates last month to mitigate two additional remote code execution vulnerabilities, CVE-2019-1181 and CVE-2019-1182, affecting several versions of Microsoft Windows. These bugs are referred to as "DejaBlue" due to their similarities to BlueKeep.

Once again, Cisco Talos started working immediately to reverse-engineer the RCE vulnerabilities. Protections for both CVE-2019-1181 and CVE-2019-1182 now exist to keep your systems secure. SID 51369 for SNORT® correctly blocks exploitation of CVE-2019-1181 and CVE-2019-1182. In this post, we'll run through the details of how to protect against this "DejaBlue" exploit and walk through the steps to protect your environment.

Remote Desktop Services remote code execution vulnerability (CVE-2019-0708)

This vulnerability was originally published in May 2019, and is often referred to as "BlueKeep." It is a pre-authentication vulnerability, meaning that an attacker could attempt to exploit it without first having to authenticate to the affected system with valid credentials. Microsoft released a security advisory regarding this vulnerability and has repeatedly urged organizations to apply the corresponding security update to systems to mitigate the threat of attacks targeting it.

Significant research has taken place over the past few months with many researchers working to successfully develop an exploit payload. Working remote code execution exploits have now been developed, although none have been publicly released at this point. As such, organizations should ensure their systems are updated as soon as possible to ensure that their systems are no longer affected by this vulnerability. In situations where security updates cannot be applied, organizations should leverage Network Level Authentication (NLA) functionality available within Microsoft Windows and limit exposure by restricting access to RDP servers from the internet.

Remote Desktop Services remote code execution vulnerability (CVE-2019-1181, CVE-2019-1182)

Microsoft published additional security updates last month to mitigate two additional remote code execution vulnerabilities affecting several versions of Microsoft Windows. Similar to what was described for CVE-2019-0708, these vulnerabilities are also pre-authentication and do not require any explicit user interaction to successfully compromise affected systems. Microsoft released guidance bulletins for CVE-2019-1181 and CVE-2019-1182 and recommends that organizations ensure their systems are updated as quickly as possible. In addition to installing the security updates, the bulletins specify that enabling NLA on affected systems could be used to provide partial mitigation as this will require attackers to authenticate to RDP servers prior to being able to reach the exploitable condition.

Using Firepower to defend against encrypted DejaBlue

Like BlueKeep, protection for DejaBlue requires RDP decryption. The following is a guide on setting up RDP decryption with Cisco Firepower. Since DejaBlue targets newer versions of Windows, this guide specifically applies to Windows Server 2019. For older versions of Windows, refer to the guide we previously wrote for BlueKeep.

Note: This procedure requires an inline Firepower device that supports SSL decryption. For more information visit Cisco Next-Generation Intrusion Prevention System (NGIPS).

Steps for RDP Decryption:

1. Determine the certificate used by the RDP server.

In Windows Server 2019, RDP TLS certificates are configured in the Server Manager.

Click on "Remote Desktop Services" and then "Collections." Click on "Tasks" in the upper right hand corner and then select "Edit Deployment Properties."

Click "Certificates."

Under "Certificates," click on "View Details" under the Certificate Subject Name.

Note the certificate Thumbprint. This is the TLS certificate used in the RDP deployment.

2. Export the RDP certificate and private key:

Open "Run" and then type "certlm.msc."

Locate the certificate that matches the thumbprint from Step 1.

Right click on the Certificate. Under "All Tasks" click on "Export…"

In the Export Wizard, click Next.

Click on "Yes, export the private key."

Make sure "PKCS" is selected.

Click on "Password" and then enter a password to encrypt the private key.

Type in a file name for the PFX file and click "Next."

Finally, click "Finish."

You have successfully exported the RDP certificate and private key.

3. Configure Windows ciphersuites for Firepower.

Open Group Policy Management.

Right click on your organization's group policy and click "Edit."

Navigate to: Computer Configuration -> Policies -> Administrative Templates -> Network -> SSL Configuration Settings. Click on SSL Cipher Suite Order.

Set the option to "Enabled" and paste in a set of Ciphersuites Firepower supports for static key decryption:

TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA

Click OK. The RDP host should now be set up.

Now to prepare the RDP certificate and private key for the Firepower appliance.

4. Prepare the RDP certificate and private key for Firepower.

For this step, you will need the OpenSSL tool and the PFX file exported in Step 2 (rdp.pfx, in this example).

Extract the RDP certificate from the PFX file:

$ openssl pkcs12 -in rdp.pfx -clcerts -nokeys -out cert.pem
Enter Import Password:

This command will ask for the import password — this is the password we typed in on Step 2.

Extract the RDP private key from the PFX file:

$ openssl pkcs12 -in rdp.pfx -nocerts -out key.pem
Enter Import Password:
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

The above command will ask for the import password again, as well as a PEM passphrase. Remember this private key passphrase, we will need it when we add the RDP certificate to Firepower.

5. Import the RDP key into Firepower.

At this point, you should have the RDP cert "cert.pem," as well as the encrypted RDP private key "key.pem."

Navigate to Objects -> Object Management.

Select "Add Internal Cert" on the top right.

Name the certificate (e.g. the server name) and either paste in "cert.pem" or browse to the "cert.pem" file in the "Certificate Data" section. Do the same for "key.pem" in the "Key" section. Click the "Encrypted" box and type in the PEM passphrase from Step 4.

You have successfully imported the RDP certificate and private key. Now to create a SSL policy for decryption.

6. Create an SSL Policy

Navigate to Policies -> SSL

Select "New Policy."

Enter a policy name and description with default action "Do not decrypt."

Once the policy editor has loaded, select "Add Rule" (top right).

Name the rule and give it the Action "Decrypt - Known Key". Click the "with" field and select the certificate you imported earlier in Step 5.

If applicable, select Source and Destination networks or leave them as "any."

Click on the "Ports" tab and input the TCP port 3389 (if appropriate for your environment) under "Selected Destination Ports" and click "Add."

Under the "Logging" tab, enable logging at the end of the connection if desired.

Click "Add" and then "Save" to save the rule.

Additional SSL documentation is available here.

6. Enable the Intrusion Prevention Rule for DejaBlue.

Navigate to Policies -> Access Control -> Intrusion Prevention.

Edit the desired Intrusion Policy.

Filter for Snort ID 51369: "OS-WINDOWS Microsoft Windows RDP DecompressUnchopper integer overflow attempt."

Click the checkbox and select Rule State -> Drop and Generate Events.

Click "Policy Information" and commit changes.

7. Configure the Access Control Policy

Navigate to Policies -> Access Control and edit the relevant Access Control Policy.

Under the "Advanced" tab, edit "SSL Policy Settings."

Select the SSL Policy we created in Step 5 and click OK.

Ensure that your Intrusion Prevention Policy is selected under "Intrusion Policy used before Access Control rule is determined" within the "Network Analysis and Intrusion Policies" section of the "Advanced" tab.

Under the "Rules" tab of your Access Control Policy, ensure you have an appropriate Intrusion Policy set for any "Allow" rules.

If appropriate, enable the Intrusion Prevention Policy for your Default Action, as well.

Save and deploy changes. Verify RDP connectivity and functionality.

---

Firepower blocking the encrypted DejaBlue exploit:

Conclusion

Just as CISOs awaited the arrival of a dreaded BlueKeep worm, DejaBlue appeared on the scene to reset the clock. If exploited, an attacker could use DejaBlue to infect many machines quickly and spread malware. The WannaCry ransomware attack from 2017 is the most extreme example of how dangerous this could be. Using the steps outlined in this post, Cisco Firepower users can protect themselves from DejaBlue and BlueKeep.

Organizations need to take additional steps to ensure that services like RDP and SMB are not exposed unless explicitly required, but this does not eliminate the need for patching. This is yet another example of why patching is one of the core fundamental concepts in information security. Vulnerabilities this severe appear periodically, and organizations need to be prepared to respond in a variety of different ways. Patching takes time and making sure that you have detection and prevention in place can require varying levels of difficulty.

C2 With It All: From Ransomware To Carding

November 4, 2019, 8:33 am

≫ Next: CISO Advisory: Security Architecture

≪ Previous: The latest on BlueKeep and DejaBlue vulnerabilities — Using Firepower to defend against encrypted DejaBlue

$

0

0

By Warren Mercer, Paul Rascagneres and Vitor Ventura.

Summary

Cisco Talos recently discovered a new server hosting a large stockpile of malicious files. Our analysis of these files shows that these attackers were able to obtain a deep level of access to victims' infrastructure — all of which allowed us to identify several targets of these attacks, including one American manufacturing company. Talos notified these targets of the attack.

We found a great variety of malicious files on this server, ranging from ransomware like the DopplePaymer, to credit card capture malware like the TinyPOS, as well as some loaders that execute code delivered directly from the command and control (C2)

The data found on this server shows how malicious actors can diversify their activities to target different organizations and individuals, while still using the same infrastructure. The tools we studied paint a picture of an adversary that is resourceful and has a widespread infrastructure shared across different operations.

Targets' profiles

While performing our analysis, we identified at least two targets based on screenshots and memory dumps.

Target No. 1: Based on screenshot

The first target we identified is an aluminium and stainless steel gratings company located in the U.S. This identification was made based on the screenshot from the HPE Data Protector management interface. The screenshot shows the domain name (which we have redacted), thus leading us to the company's name. This screenshot demonstrates that the level of access the attackers had on the victims' infrastructure.

Screenshot from HPE Data protector manager.

This screenshot contains some important information for the adversary. On one side, it shows which servers are being backed up on another shows which ones are important to the victim.

This, in conjunction with the ransomware located on the server, indicates the intent of deploying ransomware on the infrastructure, showing a manual and targeted approach more advanced than the simple execution of malware.

Target No. 2: Based on the LSASS dump

We identified a second target due to a process dump we found on the server. The dumped process is responsible for managing credentials on Windows (lsass.exe). Using a tool like Mimikatz, it's possible to retrieve credentials from the process dump.

The content of the dump showed us the hostname and Windows domain of the system and the "support" username. To perform the process dump, the attacker had high privileges on the system. This would help him to perform lateral movement. Which suggest a manual and targeted approach to this target.

The dump was uploaded on the server on Sept. 24, the same date as the login time stored in the memory dump.

Samples

DopplePaymer samples

The majority of the Windows binaries available on the server are DopplePaymer samples. This malware is a ransomware, an evolution of Bitpaymer documented by Crowdstrike. We identified seven different binaries. The oldest one was uploaded on Oct. 5, with the most recent originating from Oct. 20. As previously documented, the ransomware needs to be executed with a key in argument. We identified how the key was put in argument by this actor. A WinRAR self-extracting archive (SFX) is used to extract the ransomware and execute the following command:

Path=C:\Users\--redacted--\DesktopSetup=C:\Users\--redacted--\Desktop\p1q135no.exe QWD5MRg95gUEfGVSvUGBY84h

In our example, the key is 'QWD5MRg95gUEfGVSvUGBY84h'. The hard-coded path proves the attackers either had prior knowledge of the target's infrastructure prepared the package in the target infrastructure.

This variant uses alternate data streams to partially hide its data.

The remaining behavior and ransom note are consistent with the previous documented variant.

TinyPOS sample

On the same server we also found a TinyPOS sample. This malware is installed using a batch file.

The batch file creates a scheduled task that will be executed every 6 hours and is executed has Local System.

The script deploys a scheduled task:

The PowerShell contains the TinyPOS code, which is defined as an array of bytes written with hexadecimal values. The PowerShell script creates an execution threat using the TinyPOS previously copied into memory.

TinyPOS is a point-of-sale malware which is directly developed in assembly. This sample exfiltrates data to the C2 hardcoded in the sample: jduuyerm[.]website.

The data going out is obfuscated using XOR operations with a hardcoded key of 0xcaef3d8a. The malware exfiltrates the hostname and the local IP of the infected system. It searches and parses targeted processes memory to retrieve credit card information, which is usually stored in tracks 1 and 2 of the magnetic strip of the credit card.

The adversaries uploaded tinyPOS on Sept. 26.

Svchost sample

This sample is a simple loader. The loader code is packed and obfuscated using XOR operations. The sample will load an offset of itself and perform XOR operations until the beginning of such offset matches the pattern 0x90909090.

Once the pattern is found, the decoding starts using the number of iterations needed to find the pattern as the XOR key.

The packed code imports several functions among them are the winsock32 module functions, connect(), send() and recv(). Using these functions it contacts the hardcoded C2 sending message that starts with the byte 0x0C.

Afterward, the loader will read 1,024 bytes from the server, until all data is read. The data received has a header of 12 bytes. The message is obfuscated using a XOR operation, the key for this XOR is at the 0x4 offset of the message. Before the sample calls the received code it will check if the last byte of the obfuscated code is 0xC3. This represents the opcode RET, which allows the loader to get the execution control back from the payload it receives from the C2.

Additional binaries

We identified additional binaries on the server. The tools are used by the attacker to perform tasks on the compromised infrastructure. We identified:

• Mimikatz: A tool to retrieve Windows credentials from the memory
• PsExec: A tool to remotely connect on Windows system. The attacker probably used it to pivot inside the infrastructure by using the credential previously retrieved.
• Procdump: A tool to dump process. The attacker probably used it to dump the LSASS.exe process to then use with Mimikatz.

Potential infection vectors

Fake tech support

The TinyPOS C2 server is jduuyerm[.]website and the IP 185.254.188[.]11.

The IP resolved the following domains:

• techsupport[.]org[.]ru from March 21, 2019 to Oct. 7, 2019
• www.techsupport[.]org[.]ru from May 19, 2019 to Oct. 1, 2019
• techsupportlap[.]icu from March 13, 2019 to April 2, 2019
• techsupportnet[.]icu from March 12, 2019 to April 1, 2019

Two domains were available during the campaigns described in the article. The attacker likely was planning to carry out fake tech support scam to attempt to compromise infrastructure. This would likely be carried out by asking employees to execute specific commands or attempting to download the malware provided by the attacker.

VPN access

From the April 16, 2019 through Aug.18, 2019, the IP resolved to aefawexxr54xrtrt[.]softether[.]net. SoftEther is a powerful VPN platform that offers many features, such as a dynamic DNS service that could allow an adversary to evade detection based on ip addresses. SoftEther also prides itself on being able to "punch" through most firewalls due to only using HTTPS-based traffic. We haven't found any software that would allow the screenshots found. In theory, if the actors can open a VPN back to their own server, they could then RDP into the systems, bypassing all firewalls in between. Softether seems to be the perfect solution for this.

SoftEther says it is a VPN that "has strong resistance against firewalls than ever [SIC].Built-in NAT-traversal penetrates your network admin's troublesome firewall for overprotection. You can setup your own VPN server behind the firewall or NAT in your company, and you can reach to that VPN server in the corporate private network from your home or mobile place, without any modification of firewall settings. Any deep-packet inspection firewalls cannot detect SoftEther VPN's transport packets as a VPN tunnel, because SoftEther VPN uses Ethernet over HTTPS for camouflage [SIC]."

Conclusion

This server pulls back the curtain on an active threat actor targeting and compromising different companies. The attacker is not only limited to ransomware, even if it covers the vast majority of files available on the server. The adversary can steal credit card information via a point-of-sale malware and remotely managed compromised infrastructure. Based on the victims in this case, we can conclude that this attacker wants to target medium-sized companies in the industrial space. During this investigation, Talos notified potential victims to ensure they could remediate and ensure they were not under a current attack. This is a good example of how an attacker can be diverse during their use of infrastructure and their use of different tools, techniques and procedures (TTPs).

IOCs

Network

Jduuyerm[.]website
185.254.188[.]11.
techsupport[.]org[.]ru
www.techsupport[.]org[.]ru
techsupportlap[.]icu
techsupportnet[.]icu
185.212.128[.]189
aefawexxr54xrtrt[.]softether[.]net

Samples

d4be15adbbe135d172d5e0afcd191ae740df22de5d3beac98e188a3cf01a036b WSDB.bat
a78bacb79d5d229aa8d6c574d1d8386664918a520beebc655975b04a61da1308 WSDB.ps1
e410b949d128ffb513af037355fe777b5b40799001a312843e405070308a3f36 WSDB.xml
3de852ed3bd3579cd9875108e121ba6fd68a66f8f6948cce072e8013ad1955ea c32_217061.exe
fa7c7db9d33e1f4193bfe460d1a61096d75315212042a62bb3a30b3077511610 c64_217061.exe
0273d96cef6683e3fb205b8e841579b44bae16ff1e3ab57647b1a9d2947db5c7 file.exe
bc919680471fd1b631e80c37e83aeb6877f13f4ed47ae22100cf4d60e27a93a4 mimikatz.exe
b9a8710e55bb2d55bbeed9cebb83ac2f18f78818f0c05f18c96f766c8c47e2d9 no135.exe
f658ddcf8e87de957a81bb92d44ce02913b427e8bccbe663669ee2613d355555 p1q135no.sfx.exe
16f413862efda3aba631d8a7ae2bfff6d84acd9f454a7adaa518c7a8a6f375a5 procdump64.exe
89f8af1eb52f31b011982d7a1ecc1eed25af6c14bf5f317568a3450db5db7247 q108.exe
dcb76dc106e586c6f8bfa82832a66f525a9addb5450912004e92dd578ff2a60a q121k.exe
04d0824f70be3666d79b2a49b85cf6b60b566d7b8cc9efd31195644514fb0cb1 q135.exe
08499612bcf7ccb250438ce8f6eed616511e27c762d66132fef93296007984ac q137k.exe
0273d96cef6683e3fb205b8e841579b44bae16ff1e3ab57647b1a9d2947db5c7 svchost.exe
619f0c489beac9a792b9b42fa6529b3faf4329692fb52d17123ef69733868845 zap32.exe
98a4f69eff1f91f63fb74420ee4c16be508aa203d04f66e98b1dcb554def61ee zap64.exe
b1e883222f3205db59ff812c6f6097291df12b1784c9e64eef674ab3a173c07a q159.exe

CISO Advisory: Security Architecture

November 5, 2019, 9:01 am

≫ Next: How adversaries use politics for compromise

≪ Previous: C2 With It All: From Ransomware To Carding

$

0

0

Security architecture and design is a vital function of a healthy enterprise. This function is fundamentally, about understanding IT architecture relationships, and ensuring security is a vital element of its implementation.

This is the second paper within the series of CISO Advisories, in this case addressing Security Architecture which articulates risks and ensures security standards are met within an organization.

Download the paper here.

Access the series introduction and index here.

---

How adversaries use politics for compromise

November 5, 2019, 8:23 am

≫ Next: Beers with Talos Ep. #65: Please welcome to the show… Talos Incident Response

≪ Previous: CISO Advisory: Security Architecture

$

0

0

By Nick Biasini and Edmund Brumaghin.

Executive Summary

With the U.S. presidential primaries just around the corner, even malware authors can't help but get behind the frenzy. Cisco Talos recently discovered several malware distribution campaigns where the adversaries were utilizing the names and likenesses of several prominent political figures, chief among them U.S. President Donald Trump. We discovered a series of ransomware, screenlockers, remote access trojans (RATs) and other malicious applications that play off of Trump's likeness, as well as former presidential candidate Hillary Clinton.

Some of the applications are designed to coerce victims into paying ransom demands, while others could be used to gain backdoor access to systems and provide attackers the ability to operate within organizational networks. In many cases, it is clear that the authors of these applications were motivated by their political beliefs, which were reflected in the software that they created. In this post, we'll analyze several of these examples and provide a look at the types of malware they deployed.

There is a wide array of threats that adversaries are willing to deliver through any means necessary, including leveraging political themes and overtones. This is one of the reasons why organizations need to be diligent in protecting their environments through various technologies, applying best practices, and taking a thorough defense-in-depth approach when implementing various security controls. Additionally, ensure you have an employee information security education program that exposes users to the variety of lures that can be leveraged by adversaries to deliver these threats.

Initial malspam campaign

Research into these campaigns originally began with a malspam campaign that attempted to deliver malware to victims. The emails associated with this campaign purport to be related to banking fraud and are made to appear as if they were sent by the director of Global Risk for credit card company Visa. Below is an example of one of these emails:

Compressed archives are attached to these emails containing RTF files. The RTF files contain information related to fraud prevention.

When opened, the RTF documents are responsible for retrieving a malicious PE32 executable from an attacker-controlled server using Dynamic Data Exchange (DDE). In this particular case, the executable is called "trump.exe."

The PE32 is then executed, initiating an infection process that is related to the campaign described in detail here.

Political rabbit hole

Pivoting off of these campaign, we began to look for other IOCs that utilized political references. We developed a list of various names, terminology and iconography that has generated headlines across the political spectrum over the past few years. We then began a search throughout various malware repositories and discovered that not only were political names and iconography surprisingly common, but the results produced a wide variety of threats and was almost a microcosm of what we see on the threat landscape daily. Several examples were even indicative of potential nation-state malware distribution campaigns. We found so much malicious activity that we are going to break several examples down by category and mention a couple of key examples of each type of threat. This isn't designed to be a composite look at the political malware landscape, but an indication of how wide and deep it could potentially be.

Fake ransomware/screenlockers

During our analysis of samples obtained from various malware repositories, we discovered several examples of fake ransomware and screenlockers that featured iconography related to prominent political figures, such as Donald Trump. These samples didn't always encrypt the data properly or at all, but nonetheless, they could lead users to believe that their data was lost. Victims could also be tricked into paying a ransom demand in an attempt to regain access to their data, generating revenue for attackers. Below is an example of one of the Donald Trump themed ransomware variants we encountered.

In this particular example, the sample produced several errors when executed and, after some work to fix various issues, it appeared to start encrypting the files. However, it was preceded by a negative number and did not, based on an analysis of the system, encrypt anything. It's not uncommon to find a large number of various types of "ransomware" or screenlocker malware.

As we continued to dig through samples we encountered other, politically themed, locker malware along the way, this time with a Russian twist.

As you can see, this is a screenlocker themed around Russian President Vladimir Putin, titled "Putin Lockware 2.0." As with most screenlockers, the malware simply removes the icons, taskbar, and task manager on the victim machine and displays the application window displayed above in full-screen mode. These steps are performed in an attempt to make exiting the application difficult for victims and maximizes the likelihood of a successful ransom payment.

It then directs the user to communicate with the adversary through some means, in this example email, at which point they will demand money to provide the code to "unlock" the screen.

The final locker that we found was yet another Trump-themed locker. This one required the user to take explicit action, in this case, clicking a button displayed in the application window. When executed, the user is presented with the following lock screen.

After the user attempts to click the close button, the background changes again to:

Finally, the user is presented with the final lock screen, called the "Donald Trump Screen of Death," implying the system has been locked by the president.

There are two things that stand out here. First is the fact the adversary didn't provide the user with a way to remove the locker malware and therefore has no avenue of monetization. The other is that if you clicked on the screen, the locker was removed, and the system appeared to operate normally. Below is a quick animation of the full process.

Remote access trojans

While we were hunting through this data we came across multiple different, politically themed RAT campaigns. Among those that we saw delivered were Neshta, which utilized a theme around North Korean leader Kim Jong Un. Additionally, we found an NjRAT campaign that delivered an unusual decoy image. This same image was used as the icon for the executable, aptly named "Papa-Putin.exe."

Finally, we came across a RAT that was being delivered via a Word document titled "12 things Trump should know about North Korea.doc." At first, the document appeared to not function properly, as it took several minutes for the document to open on an analysis system. After further investigation, it was determined the slow opening was related to the executable and DLLs that were being reconstructed from data present within the document itself, which finally opened, revealing the following document.

It appears that the malware being delivered was Konni RAT, which we discovered in 2017.

Malicious Excel spreadsheets were also being used as lure documents. We identified the following spreadsheet containing an embedded SWF file that was being used to infect systems with ROKRAT.

Another Excel spreadsheet titled "Trump_administration_economic_indicators_on_China_investments.xls" contained malicious macros responsible for infecting systems with PoisonIvy, a RAT that has been leveraged by various adversaries, including well-resourced cyber espionage groups in the past.

Crypters/Packers

We also discovered a crypter featuring iconography associated with Trump. Crypters are commonly used to attempt to evade antivirus detection by encrypting or otherwise obfuscating the malicious code associated with malware binaries. Below is a screenshot of "Trump Crypter."

Process injectors/Malware loaders

In addition to the various crypters we found along the way, we also encountered several injectors and loaders. The injectors we found referenced both former President Barack Obama and Putin. Both provided the same basic functionality of injecting code into processes to help obfuscate the nature of the malicious activity. Below are a couple of screen captures of the injectors with expected features allowing the code to be injected.

Finally, encountered another Putin-themed piece of malware, which in this instance, was a loader. These loaders, not be confused with malware loaders like Brushaloader, Jasperloader, and Divergent, are used to obfuscate code and are similar to the Heaven's Gate loader we wrote about earlier this year.

Miscellaneous samples

One thing of note from this investigation is that not everything we found was overtly malicious. During our investigation we came across a large number of "random" politically-related software applications, ranging from the absurd to the disturbing. One of the more humorous examples was a piece of software that allowed the user to make former presidential candidate Hillary Clinton dance.

Clicking the "Funky Moves" buttons will cause the tiny Hillary Clinton pictured in the application to perform a variety of funky dance moves. An animation showing interaction with the application is below:

Unfortunately, not all the software we found was humorous — much of it bordered on disturbing, including references to violence around political figures.

The next odd piece of software we found, called "Trump's Cyber Security Firewall ™," appeared to be focused on hardening Windows systems in a politically motivated way.

This application was built on top of the PSExec utility from Sysinternals, and featured multiple functions available to users. After some initial triage, it appears that when users click the "Build the wall!" button, the system does some basic hardening, including activating the system's firewall and then requests a reboot. The config tab, shown below, also includes application installation management capabilities, as well as password management and some user-based exclusions. Also of note is the ability to enable debugging and remote desktop access.

The final tab, "tools," had a couple of cryptic labels that could be interesting: "Trump's Top Secret Email Decryptor" and "CIA Identity Detector." However, both of these functions are benign, with Trump's Top Secret Email Decryptor simply providing basic file information like MD5 hash and file ownership and the CIA Identify Detector simply displaying group membership for the groups present on the system, as shown below.

There didn't appear to be any malicious intent in the design of this app, instead it appears to be an application written to allow system administrators to complete some tasks they typically would encounter on a frequent basis when managing Windows endpoints.

We also observed a group of explicit programs during the investigation. These apps utilized adult themes and referenced the alleged acts of multiple presidents. These ranged from extremely graphic, to jigsaw puzzle-style "games." Despite indications otherwise, we didn't find anything overtly malicious about these apps.

Conclusion

As this investigation has exposed, adversaries will go to any lengths and use anything they deem advantageous, from pop culture to political references — everything is fair game. This is applicable not only to the adversaries delivering malware, but also the miscreants writing tools for adversaries to leverage including crypters, injectors and loaders.

One of the unexpected aspects of the investigation was the presence of lures that dropped malware associated with multiple nation-state attacks in the past, showing how even advanced, sophisticated adversaries will use any means to achieve their nefarious goals. We were also struck by the wide array of different malware from ransomware and screenlockers, to adware and remote access trojans, and everything in between.

Finally, there was the peculiar side of this research, which led us down a path to find both humorous and disturbing software that was created by unknown authors, for purposes unknown. Most of them were benign, but demonstrate how there are weird people everywhere, and some of them write code that is then submitted to malware repositories and multi-engine scanning platforms.

Regardless, what started as a regular task of analyzing a malspam campaign led us to find hundreds of politically charged pieces of software that at least had indications of malicious capabilities, even if in the end, some were not.

Coverage

Ways our customers can detect and block this threat are listed below.

Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware detailed in this post. Below is a screenshot showing how AMP can protect customers from this threat. Try AMP for free here.

Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), and Meraki MX can detect malicious activity associated with this threat.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

Additional protections with context to your specific environment and threat data are available from the Firepower Management Center.

Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Indicators of Compromise (IOCs)

The following IOCs have been observed as being associated with these malware campaigns.

Hashes (SHA256)

The following file hashes have been observed as being associated with malware, please note that we are only including the hashes of the malicious files we found:

6a60cd318d1bbae691afa685e1b21799fa62c2581231309bc4d6d2a88270fbeb (Trump Crypter)
057635f414ae4f9febeca5e6325c9d0e3c3b2e4119e6e6032ea13744e031df01 (Putin Hook)
47ffdd88735c5c9d20370b4a0b6b4aaabeaaa13b40ac488ecca788d5e7ee491f (Putin Locker)
2bb693e06f54026a74b07fec0aa7c61bbfeb31124be2e5642f6afd83922f28f2 (NjRAT)
c12da1253c554b1b952eb3fa45818e267c2ccccf2147981ac3c31bbcb5d84c23 (Putin Injector)
b01718fd2c768e9564fb087ab560f91b85cfd46eab25987ca15c6ba01848e09f (Obama Injector)
545a0756449ee6ef221b397308ceca8c81e63d4eb914406a525c9ef7f009cce8 (Neshta)
60fff84d43d1a18494d44b9bdb9776a71f6cc30373c8fbb663877ab7e28a7581 (Donald Trump Screen of Death)
4cea9dbc941756f7298521104001bc20cb73cfdda06a60a9e90760188661f5e4 (Donald Trump Ransomware)
df2ea575168063c53454b5f07f2741d728276309049a5b8906948cbc653fea71 (Word Maldoc)
d7ef08aabb432d58ddc6a5a6c286c3b729c9085a987e46a6a82652fff4461ef2 (Excel Maldoc)
1b7d1e76d23cc48e3d3546902ec46c77c891453ce997adebe9a353774cc94efd (PE32)
bf1a40987d0040ba0672cce074e583132b1a9f559692cd597e8319d94eebca81 (RTF Maldoc)

Beers with Talos Ep. #65: Please welcome to the show… Talos Incident Response

November 5, 2019, 8:05 am

≫ Next: Talos, Cisco Incident Response team up to offer more protection than ever

≪ Previous: How adversaries use politics for compromise

$

0

0

By Mitch Neff.

Beers with Talos (BWT) Podcast episode No. 65 is now available. Download this episode and subscribe to Beers with Talos:

If iTunes and Google Play aren't your thing, click here.

Recorded Oct. 25, 2019 

Today is a bit different. We normally keep things pretty neutral on this show (not really), but today is all about the new service Talos is launching: Say hello to Talos Incident Response. Amy Henderson from the Talos Intel and Interdiction group joins us as we discuss the full circle of threat intelligence — from global visibility to hyper-local context, and how IR allows those to feed into each other. Listen to the announcement as we discuss what IR is, what it means in general, and what Talos brings to that equation. We hope you are half as excited as we are because that is still pretty dang excited. Lastly, Craig isn’t with us today, but you get to decide his fate for being dishonest with you, dear listeners. We will give you justice.

The timeline:

• 01:00 — Roundtable: Someone on this show lied to you #UnauthorizedShenanigans
• 15:00 — The announcement: Say hello to Talos Incident Response
• 23:30 — IR is more than nerds parachuting out of the sky when you’re in trouble...
• 35:30 — ...but sometimes, it is… better ways to fix the worst day ever
• 44:00 — Closing thoughts and parting shots

Some other links:

• Talos Incident Response landing page
• Talos IR launch blog post
• Cisco Security Full Launch Press Release
• Talos whitepaper

==========

Featuring: Joel Esler (@JoelEsler), Matt Olney (@kpyke) and Nigel Houghton (@EnglishLFC).Special Guest: Amy Henderson (@AmyHendertweets) Hosted by Mitch Neff (@MitchNeff)

Subscribe via iTunes (and leave a review!)

Check out the Talos Threat Research Blog

Subscribe to the Threat Source newsletter

Follow Talos on Twitter

Give us your feedback and suggestions for topics: beerswithtalos@cisco.com

Talos, Cisco Incident Response team up to offer more protection than ever

November 5, 2019, 8:00 am

≫ Next: Vulnerability Spotlight: Code execution vulnerabilities in LEADTOOLS

≪ Previous: Beers with Talos Ep. #65: Please welcome to the show… Talos Incident Response

$

0

0

By Sean Mason

Over the years, I've had the honor and privilege to work within some of the greatest security teams on the planet, working alongside such passionate and talented people at Cisco makes delivering this announcement perhaps the greatest honor yet.

The best security organizations on the planet excel at preventing, defending, and responding, which boils down to one key aspect – an intelligence-driven approach to security.

Several years ago, Cisco Talos intelligence started to support Cisco’s Incident Response Services group, with IR feeding highly contextualized data back into the Talos Detection and Response efforts. This was key to building a market-leading, albeit standalone, incident response service offering at Cisco.

Today, we are excited to announce the next step in the evolving relationship between intelligence, research, and IR – Cisco Talos Incident Response.


As things stand now, every incident response Cisco engages in, anywhere in the world, has dedicated Talos Intelligence analysts attached to it. This ensures we capture what is happening in the real world, build protections based on what we learn, and share back our intelligence to the incident responders so they can help frame our customer’s incident in a global context.  Truly this is a win/win for everyone.

Talos has spent a lot of time over the past few years building trust with our customers by supplying highly technical security information, driving timely protections based on that research and being transparent and forthright in our communications. IR has worked with Talos for a long time, and both parties feel this new partnership expands the capability of IR to deliver on those values.

This new partnership also boosts the strength of Talos’ intelligence. Effective security should be intelligence-driven and, more importantly, Incident Response should be driven by intelligence. With Talos’ unprecedented levels of visibility into the threat space and quick response time, incident response will be stronger than ever.

Now that Incident Response resides within Talos, they have access to the global intelligence that Talos has curated. This will allow them to help customers understand events affecting them from a global context. Customers under attack will better understand how others have responded to similar attacks, what has worked and, just as importantly, what hasn’t worked.

Additionally, all Cisco customers will now more quickly benefit from the findings from Talos Incident Response. Rather than having to interface as a separate team to Talos, the incident response capability will now have access to the same tools and communications platforms the rest of Talos has, allowing for new findings to start protecting all Cisco customers within just a few short minutes of discovery. If a customer requires a specialist to support them, incident response is now inside the very heart of Talos, enabling them to find the right talent.

Talos’ mission statement is “Protect our customers.” As of today, Talos is better positioned to do that than ever before. Talos Incident Response provides several types of proactive services, in addition to emergency IR services, including: consulting engagements directly with Talos analysts and researchers, table-top and cyber range exercises, readiness assessments, and much more. If you’d like more information about Cisco Talos Incident Response, please check out the new IR web page here or contact your Cisco sales team. We also have a special edition of the Beers with Talos podcast out discussing this change.

Vulnerability Spotlight: Code execution vulnerabilities in LEADTOOLS

November 6, 2019, 9:02 am

≫ Next: Threat Source newsletter (Oct. 31, 2019)

≪ Previous: Talos, Cisco Incident Response team up to offer more protection than ever

$

0

0

Marcin Towalski and Cory Duplantis of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw.

Cisco Talos recently discovered multiple vulnerabilities in the LEADTOOLS line of imaging toolkits. LEADTOOLS is a collection of toolkits designed to perform a variety of functions aimed at integrating documents, multimedia and imaging technologies into applications. All of the software is produced by LEAD Technologies Inc. LEADTOOLS offers prebuilt and portable libraries with an SDK for most platforms (Windows, Linux, Android, etc.), that are all geared toward building

applications for medical systems. Various pieces of LEADTOOLS contain vulnerabilities that could be exploited by malicious actors to carry out a number of actions, including denial-of-service conditions and the execution of code remotely.

In accordance with our coordinated disclosure policy, Cisco Talos worked with LEAD Technologies to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

LEADTOOLS TIF ImageWidth code execution vulnerability (TALOS-2019-0876/CVE-2019-5084)

An exploitable heap out-of-bounds write vulnerability exists in the TIF-parsing functionality of LEADTOOLS 20. A specially crafted TIF image can cause an offset beyond the bounds of a heap allocation to be written, potentially resulting in code execution. An attacker can specially craft a TIF image to trigger this vulnerability.

Read the complete vulnerability advisory here for additional information.

LEADTOOLS CMP-parsing code execution vulnerability (TALOS-2019-0891/CVE-2019-5099)

An exploitable integer underflow vulnerability exists in the CMP-parsing functionality of LEADTOOLS 20. A specially crafted CMP image file can cause an integer underflow, potentially resulting in code execution. An attacker can specially craft a CMP image to trigger this vulnerability. 

Read the complete vulnerability advisory here for additional information.

LEADTOOLS BMP parsing remote code execution vulnerability (TALOS-2019-0892/CVE-2019-5125)

An exploitable integer overflow vulnerability exists in the BMP header parsing functionality of LEADTOOLS 20. A specially crafted BMP image file can cause an integer overflow, potentially resulting in code execution. An attacker can specially craft a BMP image to trigger this vulnerability.

Read the complete vulnerability advisory here for additional information.

LEADTOOLS JPEG2000 j2pc parsing code execution vulnerability (TALOS-2019-0916/CVE-2019-5125)

An exploitable heap overflow vulnerability exists in the JPEG2000-parsing functionality of LEADTOOLS 20. A specially crafted J2K image file can cause an out-of-bounds write of a heap buffer, potentially resulting in code execution. An attack can specially craft a J2K image to trigger this vulnerability.. 

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that version 20.0.2019.3.15 of LEADTOOLS is affected by these vulnerabilities.

Coverage

The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rules: 50824 - 50827, 51930-51938, 51447, 51448

Threat Source newsletter (Oct. 31, 2019)

November 7, 2019, 11:00 am

≫ Next: Threat Roundup for November 1 to November 8

≪ Previous: Vulnerability Spotlight: Code execution vulnerabilities in LEADTOOLS

$

0

0

Newsletter compiled by Jon Munshaw.

Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.

The only news we’re going to cover this week is the biggest news we’ve had in a while. Tuesday, we announced that Cisco Incident Response was becoming part of the Talos family. We’ve been working together for years, but now we’ll be closer than ever, so Incident Response can benefit from Talos’ intelligence, while their boots-on-the-ground experience will only add to Talos’ portfolio.

Check out our announcement blog post for more information. The Talos Incident Response at-a-glance also provides an overview of the services IR provides. And the new IR page on TalosIntelligence.com gives you an easy way to contact IR, should you need their services. 

We also have a special edition of the Beers with Talos podcast, where Amy Henderson of Talos’ Threat Interdiction team joins us to talk about the benefits of this new relationship. 

Upcoming public engagements with Talos

Event: “It’s Never DNS…. It Was DNS: How Adversaries Are Abusing Network Blind Spots”  at SecureWV/Hack3rCon X
Location: Charleston Coliseum & Convention Center, Charleston, WV
Date: Nov. 15 - 17
Speakers: Edmund Brumaghin and Earl Carter
Synopsis: While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. DNS has become increasingly attractive to both red teams and malicious attackers alike to easily subvert otherwise solid security architectures. This presentation will provide several technical breakdowns of real-world attacks that have been seen leveraging DNS for a variety of purposes such as DNSMessenger, DNSpionage, and more.

Event: “Reading Telegram messages abusing the shadows” at BSides Lisbon 
Location: Auditorio FMD-UL, Lisbon, Portugal
Date: Nov. 28 - 29
Speakers: Vitor Ventura
Synopsis: One of the cornerstones of privacy today is secure messaging applications like Telegram, which deploy end-to-end encryption to protect the communications. But several clone applications have been created and distributed with the intent of spying on their users. In this talk, Vitor will demonstrate how the Telegram registration process became abused, allowing message interception on non-rooted Android devices without replacing the official application. This is another example on how encryption is not a panacea, and that side-channel attacks like this are a real problem for otherwise secure applications.

Event: “Signed, Sealed, Compromised: The Past, Present, and Future of Supply Chain Attacks” at CactusCon
Location: Charleston Coliseum & Convention Center, Charleston, WV
Date: Dec. 6 - 7
Speakers: Edmund Brumaghin and Earl Carter
Synopsis: This talk will discuss the common techniques we’re seeing in supply chain attacks. Supply chain attacks are a broad topic, but one that has continued to evolve and mature over the last decade. Nick and Edmund will walk through what a supply chain attack constitutes, the history of how these attacks have evolved, and where we see this attack technique moving in the future.

Cyber Security Week in Review

• The first public exploitation of the BlueKeep vulnerability hit over the weekend. Security researchers noticed the attacks in honeypots installing cryptocurrency miners, far from the worst possible outcome from these kinds of attacks. 
• The U.S. and Taiwan held cyber war exercises this week being touted as the first of their kind. Taiwanese officials say the two countries focused on attacks that could come from North Korean-linked adversaries and other nation-state actors. 
• The head of Russia’s State Security Service recently said at a conference Russia and the U.S. have resumed cooperation on cyber security. Russia is maintaining contact between their security experts and the CIA, FBI and DEA in the U.S., he said.  
• Google is teaming up with three private cyber security firms to scan the Google Play store for malicious apps. Malware authors have been able to create ways to bypass the traditional protections Google put in place to stop malicious apps before they are posted on the store. 
• Two former Twitter employees were charged with spying on behalf of Saudi Arabia. American prosecutors say the two men used their privileged access to gather information on Saudi political dissidents.  
• Voting machines in one Indiana country reportedly switched users’ votes, one of a few reports of malfunctioning machines on election day in the U.S. Several voters reported that the touchscreen machines would not select the candidate they wanted to choose, errors that are backed up with video evidence. 
• Apple released updates for its Catalina operating system and iOS to patch several critical remote code execution vulnerabilities. The U.S. Department of Homeland Security urged users to update their devices as soon as possible. 
• Malware authors are starting to unleash a wave of politically themed malware. Talos recently discovered malware families using the likenesses of U.S. Donald Trump and Russian leader Vladimir Putin in a series of ransomware, RATs and screenlockers. 

Notable recent security issues

Title: Use-after-free bug in Chrome could allow complete system takeover 
Description: Google Chrome is urging users to update their web browsers as soon as possible due to a critical use-after-free vulnerability. The company says it will be releasing updates this week to protect against exploitation of the bug. The vulnerability, identified as CVE-2019-13720, exists in Chrome’s audio component, and could allow an attacker to execute arbitrary code or enable full remote code execution capabilities. 
Snort SIDs: 52068, 52069 

Title: Two remote code execution vulnerabilities in Investintech Able2Extract 
Description: Cisco Talos recently discovered two remote code execution vulnerabilities in Investintech’s Able2Extract Professional. This software is a cross-platform PDF tool for Windows, Mac and Linux that converts PDFs and allows users to create and edit them. Other features include PDF signing, redactions and annotations. An attacker could exploit these vulnerabilities to execute arbitrary code on the victim machine. 
Snort SIDs: 50864 - 50869

Most prevalent malware files this week

SHA 256: 7acf71afa895df5358b0ede2d71128634bfbbc0e2d9deccff5c5eaa25e6f5510
MD5: 4a50780ddb3db16ebab57b0ca42da0fb
Typical Filename: xme64-2141.exe
Claimed Product: N/A
Detection Name: W32.7ACF71AFA8-95.SBX.TG

SHA 256: 3f6e3d8741da950451668c8333a4958330e96245be1d592fcaa485f4ee4eadb3
MD5: 47b97de62ae8b2b927542aa5d7f3c858
Typical Filename: qmreportupload
Claimed Product: qmreportupload
Detection Name: Win.Trojan.Generic::in10.talos

SHA 256: 6b01db091507022acfd121cc5d1f6ff0db8103f46a1940a6779dc36cca090854
MD5: 74f4e22e5be90d152521125eaf4da635
Typical Filename: jsonMerge.exe
Claimed Product: ITSPlatform
Detection Name: W32.GenericKD:Attribute.22lk.1201

SHA 256: 46b241e3d33811f7364294ea99170b35462b4b5b85f71ac69d75daa487f7cf08
MD5: db69eaaea4d49703f161c81e6fdd036f
Typical Filename: xme32-2141-gcc.exe
Claimed Product: N/A
Detection Name: W32.46B241E3D3-95.SBX.TG

SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5: 8c80dd97c37525927c1e549cb59bcbf3
Typical Filename: Eternalblue-2.2.0.exe
Claimed Product: N/A
Detection Name: W32.WNCryLdrA:Trojan.22k2.1201

Threat Roundup for November 1 to November 8

November 8, 2019, 2:31 pm

≫ Next: New partnership brings together Talos’ visibility with IR’s unmatched response capabilities

≪ Previous: Threat Source newsletter (Oct. 31, 2019)

$

0

0

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Nov. 1 and Nov. 8. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics, indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. An accompanying JSON file can be found here that includes the complete list of file hashes, as well as all other IOCs from this post. Additionally, please keep in mind that IOC searching is only one part of threat hunting. Spotting a single IOC does not necessarily indicate maliciousness. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

For each threat described below, this blog post only lists 25 of the associated file hashes and up to 25 IOCs for each category. As always, please remember that all IOCs contained in this document are indicators, and one single IOC does not indicated maliciousness.

The most prevalent threats highlighted in this roundup are:

Threat Name	Type	Description
Win.Dropper.Remcos-7376444-0	Dropper	Remcos is a remote access trojan (RAT) that allows attackers to execute commands on the infected host, log keystrokes, interact with a webcam and capture screenshots. Remcos is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Dropper.Kovter-7376187-0	Dropper	Kovter is known for its fileless persistence mechanism. This family of malware creates several malicious registry entries that store its malicious code. Kovter is capable of reinfecting a system, even if the file system has been cleaned of the infection. Kovter has been used in the past to spread ransomware and click-fraud malware.
Win.Dropper.Emotet-7375156-0	Dropper	Emotet is one of the most widely distributed and active malware families today. It is a highly modular threat that can deliver a variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails.
Win.Malware.Trickbot-7374019-1	Malware	Trickbot is a banking trojan targeting sensitive information for select financial institutions. This malware is frequently distributed through malicious spam campaigns. Many of these campaigns rely on downloaders for distribution, such as VB Scripts.
Win.Malware.Phorpiex-7373816-1	Malware	Phorpiex is a trojan and worm that infects machines to deliver follow-on malware. Phorpiex has been known to drop a wide range of payloads, including malware that sends spam emails, ransomware and cryptocurrency miners.
Win.Malware.Zbot-7373691-1	Malware	Zbot, also known as Zeus, is trojan that steals information such as banking credentials using methods like key-logging and form-grabbing.
Win.Malware.DarkComet-7371375-1	Malware	DarkComet and related variants are a family of remote access trojans designed to provide an attacker with control over an infected system. Capabilities of this malware include the ability to download files from a user's machine, mechanisms for persistence and hiding, and the ability to send back usernames and passwords from the infected system.
Win.Packed.ZeroAccess-7370742-1	Packed	ZeroAccess is a trojan that infects Windows systems, installing a rootkit to hide its presence on the affected machine and serves as a platform for conducting click-fraud campaigns.

---

Threat Breakdown

Win.Dropper.Remcos-7376444-0

Indicators of Compromise

Registry Keys	Occurrences
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Snk	8
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Snk	8
<HKCU>\SOFTWARE\XLR4615DFT-CRBSFT Value Name: exepath	6
<HKCU>\SOFTWARE\XLR4615DFT-CRBSFT Value Name: licence	6

Mutexes	Occurrences
Remcos_Mutex_Inj	8
XLR4615DFT-CRBSFT	8
Global\0e3e6d21-fc20-11e9-a007-00501e3ae7b5	1
Global\96ab2081-00fe-11ea-a007-00501e3ae7b5	1
Global\d24f50c1-00fe-11ea-a007-00501e3ae7b5	1
Global\77238861-00fe-11ea-a007-00501e3ae7b5	1

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
179[.]33[.]68[.]255	4
179[.]33[.]152[.]127	3

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
proyectobasevirtualcol[.]com	8

Files and or directories created	Occurrences
%TEMP%\install.vbs	8
%APPDATA%\System32	8
%APPDATA%\System32\Snk.exe	8
%APPDATA%\Runtime3	6
%APPDATA%\Runtime3\1627.dat	6
%TEMP%\<random, matching '[a-z]{4,9}'>.exe	5

File Hashes

01f18d1d2a28f1fa3df286d745ebe04521031af989db17818db42f6118417f60 1c74e101e6c49184a2766afafc33ab421900927ca39bfb8afc6e0c29c1d4bc4a 2993970ed0df750fb8ead03397e7d209d50c790ccea889f8cd3a57a3257d229a 2a0933719e5f6762061641d337324fe2b9778e13ac4785dfce00b10e3134a7de 3a725a79cc91e882a52237eda542e29d44734c64fce0edd924e1fee62e69bead 44a4d693d208abf527c5d286fdb45791d6bc97fbda6857f2d952a659a39f02fd 46eb980bd84f49f16aab9a9af815caedfffe92ddf0db272b330f6a9b625716cf 5752b25814c46d5084fa204ab381a18ebfb75fd0229ddac048fc673607ae52c1 622bb6dc7e751fc9352e7a23c9bc3ccd2e1855f6d5c37656516a54fe63ae6230 70ee3b93a10475214f534c162c6923ccdff92873709e2912ffd208ad12d447fb 7df44706454b41154f074f55a4bb5c42942a7e4a2dd244dd3d979dd28f81c602 99f7c0b78dac66e3fb5c571c466004e97ef6a75662ed2b1a7e49d17f85fa66f0 a6f8cd54dcd6a563c2195964cf1a65ce0d558ef753d0d9d25618cf5bb24332d9 b1b18b3fb4c4da002c4f8449042569a53be13971036b2b15bccb8a31392e8ce8 d78ec2e34df6a80321bac318055f095f49f244117f0307e3c59aa7326f834ca7

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Win.Dropper.Kovter-7376187-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE Value Name: DisableOSUpgrade	25
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\WINDOWSUPDATE\OSUPGRADE Value Name: ReservationsAllowed	25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: ssishoff	25
<HKCR>\.16A05D	25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: vrxzdhbyv	25
<HKCU>\SOFTWARE\XVYG	25
<HKLM>\SOFTWARE\WOW6432NODE\XVYG	25
<HKLM>\SOFTWARE\WOW6432NODE\XVYG Value Name: tbqjcmuct	25
<HKCU>\SOFTWARE\XVYG Value Name: tbqjcmuct	25
<HKLM>\SOFTWARE\WOW6432NODE\XVYG Value Name: xedvpa	25
<HKCU>\SOFTWARE\XVYG Value Name: xedvpa	25
<HKLM>\SOFTWARE\WOW6432NODE\XVYG Value Name: svdjlvs	25
<HKCU>\SOFTWARE\XVYG Value Name: svdjlvs	25
<HKCR>\7B507\SHELL\OPEN\COMMAND	25
<HKLM>\SOFTWARE\WOW6432NODE\XVYG Value Name: lujyoqmfl	25
<HKCU>\SOFTWARE\XVYG Value Name: lujyoqmfl	25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.101 Value Name: CheckSetting	25
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{E8433B72-5842-4D43-8645-BC2C35960837}.CHECK.103 Value Name: CheckSetting	25
<HKCU>\SOFTWARE\XVYG Value Name: tnzok	25
<HKLM>\SOFTWARE\WOW6432NODE\XVYG Value Name: tnzok	25
<HKCU>\SOFTWARE\XVYG Value Name: usukxpt	25
<HKLM>\SOFTWARE\WOW6432NODE\XVYG Value Name: usukxpt	25
<HKCU>\SOFTWARE\<random, matching '[a-zA-Z0-9]{5,9}'>	21
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Value Name: Blob	7
<HKCU>\SOFTWARE\YNRVKCYV3 Value Name: kwS6y5	1

Mutexes	Occurrences
EA4EC370D1E573DA	25
A83BAA13F950654C	25
Global\7A7146875A8CDE1E	25
B3E8F6F86CDD9D8B	25
408D8D94EC4F66FC	20
Global\350160F4882D1C98	20
053C7D611BC8DF3A	20

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
48[.]35[.]9[.]231	2
24[.]6[.]47[.]86	2
53[.]51[.]100[.]34	2
103[.]72[.]170[.]215	2
100[.]65[.]74[.]134	2
214[.]157[.]80[.]109	2
53[.]189[.]39[.]167	2
171[.]50[.]101[.]82	2
186[.]88[.]125[.]16	2
103[.]3[.]144[.]29	2
191[.]63[.]106[.]220	2
132[.]142[.]20[.]146	2
185[.]144[.]48[.]120	2
74[.]188[.]12[.]194	2
151[.]185[.]129[.]250	2
123[.]193[.]218[.]247	2
7[.]184[.]47[.]209	2
11[.]19[.]158[.]101	2
89[.]73[.]101[.]218	2
104[.]7[.]70[.]162	2
111[.]104[.]240[.]101	2
187[.]41[.]98[.]16	2
39[.]158[.]228[.]212	2
67[.]110[.]140[.]230	2
87[.]88[.]172[.]42	2

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
cp[.]aliyun[.]com	2
netcn[.]console[.]aliyun[.]com	2
help[.]dreamhost[.]com	1
api[.]w[.]org	1
gmpg[.]org	1
panel[.]dreamhost[.]com	1
fonts[.]gstatic[.]com	1
www[.]cloudflare[.]com	1
httpd[.]apache[.]org	1
www[.]dreamhost[.]com	1
apps[.]digsigtrust[.]com	1
apps[.]identrust[.]com	1
cacerts[.]digicert[.]com	1
www[.]wdos[.]net	1
www[.]wddns[.]net	1
www[.]wdcdn[.]com	1
www[.]wdlinux[.]cn	1
community[.]cambiumnetworks[.]com	1
www[.]cambiumnetworks[.]com	1
x[.]ss2[.]us	1
www[.]wdcp[.]net	1
docs[.]atlassian[.]com	1
www[.]atlassian[.]com	1
staging[.]theplaylist[.]net	1
www[.]10dang[.]com	1

*See JSON for more IOCs

Files and or directories created	Occurrences
%LOCALAPPDATA%\39b03\6a5cc.16a05d	25
%LOCALAPPDATA%\39b03\7cbdf.bat	25
%HOMEPATH%\Local Settings\Application Data\2501\1ffa.41d68	20
%HOMEPATH%\Local Settings\Application Data\2501\aae7.bat	20

File Hashes

07f6d9e83f537600594c31b3602732e673876773d011ad3827d3b4bfd90263b3 09decefe05efe8d4de76c83d2d25b3688a7aa8a5b64a66d9beda52f1cb84d3e1 1034ec321ee9aacbac4c6eb13c9b7c337ee203f7690c75b03be96f45e7131854 1b027ad776520157003006129c70ffcb5a6df709784553abffc39e231cc35ba4 32ef3ff9e7f8879fac649e0bd47c943c5c9ae41f92ee11223bcdf3e735fcdd4d 4bfd91dbacfc04dd91dd43c00209141b6b33b3ce7d7fce5a40a39190e1020044 535870f540ccf5fa55b7d45b46e12c7f6cca475d7d1ed53a825bf4a74a8deaad 568ed4d9b0ecc820f370f364a9135cb99fe5cc61b953156c8abf2d8b4455ea35 5dc8da99651c7a508063c24d05724b8ce59ad6ae5a7b71d3acf27aa9a46937e0 6159c80c21256280b87b9be98bce4ce08a62712a5472ce88ab91ec58a889a998 670d2eef908fdaccbad25d40f7fc35deaa8a27667c8ae9c64c3c8c3f7b47715f 699f6b25a4d720eec442dab827192c5c3089da861c3c891f08c327918e0034c3 6e99630d9605ab0cdd26b273edc288e70b9b927fbd10bb4c531bdbaedb832842 716ca25938088e90d7529d396391ea45971e7716244684b7e431b46fae5d2f88 72301c500af238cd544b8208e3c5ea02d562143ab58a4fc7d429fb6dbdb5433a 77e117c5483524cd6bf8dcfa0b072d93644f71f15931b8f65be912dd2d4e0ac3 7803321e0e650f836a0260bd38dcac456e0bf822bd7d9159a03f509700f274a9 78bff6ee1f123cf5394c52b22f8bf282258684dc065d6fb3a6f7f11bb0dbb44c 7f9c7a64e9d7e46b31d842401064701c4cbaeee2d231b80e5221bc9b6dcad91c 886db07fb244827ecebfb8a0c807fc418d4e75699fe59d0a33203b2cacc30e08 94107471babcc12730005b1e70af6f59559229a0d2d325c18f88e8990c54a73b 9c3bc6fffc73ce25bd3f178daf44625b1ee681c7593ceef31e76fb5a2387ecb5 9d5304e56d130aeef6505442550c7cf49e3710f2ab7f31a7dd7db4a151fc5862 9f8721f77785853fded20778388a436d3ddc74a5200265a95ce7e168318b5f6c a1885a9e550677d9bdfbfa79590d9025c006940e540a795ab3700d3e960dc3e0

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Win.Dropper.Emotet-7375156-0

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SPOOLERIPSPS	115
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SPOOLERIPSPS Value Name: Type	115
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SPOOLERIPSPS Value Name: Start	115
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SPOOLERIPSPS Value Name: ErrorControl	115
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SPOOLERIPSPS Value Name: ImagePath	115
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SPOOLERIPSPS Value Name: DisplayName	115
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SPOOLERIPSPS Value Name: WOW64	115
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SPOOLERIPSPS Value Name: ObjectName	115
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SPOOLERIPSPS Value Name: Description	115

Mutexes	Occurrences
Global\I98B68E3C	115
Global\M98B68E3C	115
Global\M3C28B0E4	42
Global\I3C28B0E4	42

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
173[.]194[.]68[.]108/31	74
189[.]189[.]21[.]214	60
17[.]36[.]205[.]74/31	59
74[.]202[.]142[.]71	53
185[.]94[.]252[.]27	50
45[.]55[.]82[.]2	50
37[.]187[.]5[.]82	50
190[.]120[.]104[.]21	40
172[.]217[.]10[.]83	38
23[.]229[.]115[.]217	38
74[.]202[.]142[.]33	37
45[.]33[.]54[.]74	37
54[.]38[.]94[.]197	33
62[.]149[.]128[.]200/30	32
74[.]202[.]142[.]98/31	29
74[.]208[.]5[.]14/31	29
172[.]217[.]3[.]115	28
191[.]252[.]112[.]194/31	28
74[.]208[.]5[.]2	27
176[.]9[.]47[.]53	27
196[.]43[.]2[.]142	27
193[.]70[.]18[.]144	26
220[.]194[.]24[.]10/31	25
50[.]22[.]35[.]194	24
173[.]201[.]192[.]229	22

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
smtpout[.]secureserver[.]net	69
smtp[.]prodigy[.]net[.]mx	54
smtp[.]alestraune[.]net[.]mx	37
smtp[.]infinitummail[.]com	33
secure[.]emailsrvr[.]com	32
smtp[.]dsl[.]telkomsa[.]net	30
imail[.]dahnaylogix[.]com	28
smtp[.]orange[.]fr	28
smtp[.]mail[.]com	27
smtp[.]office365[.]com	26
mail[.]cemcol[.]hn	25
smtp[.]1and1[.]com	24
smtp-mail[.]outlook[.]com	23
smtp[.]mail[.]ru	22
mail[.]aruba[.]it	21
pop3s[.]aruba[.]it	21
correo[.]puertotuxpan[.]com[.]mx	20
smtp[.]zoho[.]com	19
smtp[.]techcommwireless[.]com	19
zmail2[.]tikona[.]co[.]in	19
smtpout[.]asia[.]secureserver[.]net	18
smtp[.]mail[.]me[.]com	18
smtp[.]qiye[.]163[.]com	18
mail[.]outlook[.]com	17
smtp[.]aol[.]com	17

*See JSON for more IOCs

Files and or directories created	Occurrences
%SystemRoot%\SysWOW64\spooleripspsb.exe	2
\TEMP\694.exe	2
%SystemRoot%\SysWOW64\spooleripspsa.exe	1
\TEMP\L6WtzMgB.exe	1
\TEMP\wdEnqutV.exe	1
\TEMP\pzcc3lk.exe	1
\TEMP\p1cvp.exe	1
\TEMP\ux68b0c6lxc0fow.exe	1
\TEMP\z825f3w9uh.exe	1
\TEMP\gcb5of4v1tlz.exe	1
\TEMP\ezxnt4.exe	1
\TEMP\39v3vti54d.exe	1
\TEMP\tdr3z0u10.exe	1
\TEMP\yqr4645h3g.exe	1
\TEMP\70vol09busiw7g.exe	1
\TEMP\2bn1wg8bam49.exe	1
\TEMP\afoly3.exe	1
\TEMP\yumjilsuex5ce.exe	1
\TEMP\2gb7kk6.exe	1
\TEMP\f80gj19dm6pg.exe	1
\TEMP\itb9yhf.exe	1
\TEMP\sd0ew7kemxl.exe	1
\TEMP\9b65hy6s.exe	1
\TEMP\5q1otsijpw2d6rr.exe	1
\TEMP\002109r7ga.exe	1

*See JSON for more IOCs

File Hashes

02fc8369a88b82e3f3071515dacd5d66dac4a7bbc30c0273ce94f1d1c17016c2 0358ed9153522829b222680b6308ca2bfbb9af02f7577527d290bd6b5a45741a 05813a34ed66ce894edfe1283dcbb4aac108a27a9d100cd1beda364c3a9a14d8 05cb5ec98746d64d138330942f339979762f3d9e2103176927e5298aab38b44d 068c95ddf6682151bfac5a348f3cdc83dd28dbb3636945893c40919e5c2529f6 06bee1b52d91c40d92e37313f5a41dd75ccfe06f4081c8d82cc150de85afa8fc 07ee440c02863990aa804fe41894616f5a660a07cea93bf9f4e21b379637cd04 08a60b24edee93c10a2f7f88f771cada9d5fdb220e236ac7685bc5467187cc7d 09b5cd03af0aeff661f64799a67a1e4b68fe95ed8c19f33b9f79c6ba891e1961 0aef359713281304cb60b92f7f9a4f046e7ae0902809830a306e683830c0621e 0cc6fb091ca3119744ef99cc1a75bf093351962ede75fe01d9689ad6e611eed7 10f54c55d5df2aba0a5f86addb10e2b6022040f9e30541e865e823456526d181 1360747298f09ad4a3231036c557fddae2e65e0544fa2bcd42847fd13793eeeb 15683fc25f400427b06f471235d0080d9b340760e1cf0e53b402cc3f92724904 179dcfe6679c7d9e7527dbc7280807c7abe2ab8b6cd74671ca3a240bdb9f9b13 197b6142da885afd536a49e192dd6259abdb324bd3a278850c74b54d3ad819a4 1ad1ff05930f27ef4b349c7a612235d1632ef7ceaa1a17adf7c7b3a97b40ca4d 1d92855b93ac6e841ca7afe057ceef7c6a52eb1aa511c47c523d25c7f542785b 2089c98c6d15a5c669795eea5a310ec83cbf7614be2aae5bc1ed1721e406360d 2175ae9fcf2321d5855a81146a650a9fe69d622a3d0303076fbfe32ddc645bd1 2275693f9a5b245d54030abaaa757f799c369df22b26cce4a8df84d1497b682b 23f18138a5aa4ff7284e25faa8490b14706170a7980b73a2cb69527fa19a9655 25da27f6d266e9986c93a48d93be82632fdfc607416d42e183c27b404591a808 26213f98dda98e08963a7a2934a6eadb665121a23aa14493cc45f5c6b23e7099 2a80f80c219f9554c9779e86c47a51a27858a767bb7b1c45b1d52055f6b9a30a

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella
WSA

Screenshots of Detection

AMP

Umbrella

---

Win.Malware.Trickbot-7374019-1

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER Value Name: DisableAntiSpyware	26
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: DeleteFlag	26
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND Value Name: Start	26
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION Value Name: DisableBehaviorMonitoring	26
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION Value Name: DisableIOAVProtection	26
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER	26
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION	26
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION Value Name: DisableOnAccessProtection	26
<HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION Value Name: DisableScanOnRealtimeEnable	26
<HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Value Name: Blob	11

Mutexes	Occurrences
Global\316D1C7871E10	26

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
72[.]22[.]185[.]208	17
72[.]22[.]185[.]200	9
116[.]203[.]16[.]95	5
216[.]239[.]32[.]21	4
216[.]239[.]36[.]21	3
82[.]146[.]46[.]153	3
107[.]173[.]6[.]251	3
78[.]155[.]207[.]139	3
216[.]239[.]34[.]21	2
176[.]58[.]123[.]25	2
177[.]124[.]37[.]208	2
201[.]184[.]69[.]50	2
179[.]189[.]241[.]254	2
36[.]66[.]115[.]180	2
177[.]36[.]5[.]7	2
185[.]86[.]150[.]130	2
149[.]154[.]70[.]202	2
195[.]123[.]246[.]188	2
185[.]117[.]119[.]163	2
172[.]217[.]12[.]179	1
104[.]20[.]17[.]242	1
185[.]248[.]87[.]88	1
80[.]173[.]224[.]81	1
103[.]122[.]33[.]58	1
177[.]107[.]51[.]162	1

*See JSON for more IOCs

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
ip[.]anysrc[.]net	5
myexternalip[.]com	4
ipecho[.]net	4
api[.]ipify[.]org	4
ident[.]me	2
checkip[.]amazonaws[.]com	2
www[.]myexternalip[.]com	1
icanhazip[.]com	1
api[.]ip[.]sb	1
wtfismyip[.]com	1
ipinfo[.]io	1

Files and or directories created	Occurrences
%APPDATA%\wnetwork\settings.ini	26
%System32%\Tasks\Windows Network	26
%APPDATA%\wnetwork	26
%APPDATA%\WNETWORK\<original file name>.exe	26

File Hashes

0997acfd174ab60400f87700683b13a8e30003187a1ac95f8e03e7ef42722ed0 16a4034a84ee8568cb2f8eb5dadabc4602c0a8e8868f73672d50dfbf1a7f4d58 1b4e99fdce2dd1e3fec9d2544d998991b7db608fc546f3fcd095116c74abf5a6 1d004310b4da6128d37fbbc500fd2edaaac340ad0c02a6d955bb865b6bbf5a36 22a575f49efea2455bba405158a36e037ffb74a54d19a3594b9b91496235b94a 33174b58598cbfad8263865a35541f8cb45fb8c6bfef793fe8cf959386a01f5d 3614608cb133bd6ee5c664d32a70a4f6daabd51c5aa3e8305481a2c8e8e5e050 3be01a7decf86e147148172f9fd49a1dddb0fc61fa19f1f513200bef005d5621 533fbff0ab14351994eda4fdbfd54521f69b26aea55f1f4cbdc0a766ea665475 63fc0be214ba24b78e8af0c3fcc739bc65f2c93f47f2c0fd5fc36fab7c3b1ee9 6664ecbb04496f8769bd64664cc927aa5b3da2d8db2c90c74f9115d13611f2ee 690160e08d961b5eb173e8d83489182ff1bc593fbacc1ccef29d34b2c123f852 6f9d90e562dbc99bf48c6da0f62acca06483e4cc237f823fd420972e4cab8acb 84b2e1dadf6434fbd682ad5443c07fd584e9ba90ca78cff4e34453da08f9b1a0 8a8e4c0576135b4d7e53e8d371cbaa3044d04aa7487b5165d3a25c7ceb98ef40 8b3ce83864c0fe181a9dc5fc05db1ed0f5b8fa8afb21bf47e13cb42012f99d37 90343d4a110021355c361ba1187512cd992644f1f563451014c330b6100c31bb 918b82b76908de34fc26f1addda953604c608071d2e960aa7ac024dac36b445a 93c68821eea7086225918c163c8480f2f49f3a6b155a221af7211c795ce6b32e 977cc7fd45f54546066ab08ae04f31876d2347948b2631a011756f2a45f8588e 99aad62bb62905258fd7b9ee63811f16c0cb686dc86b49e5f33e0d465d2ecc0b a169e851112a15be3a17a6059e50cfedccd2928a7a2afde40aa21a13bbb31dd5 a77f072f98bba728809627c5cce0408dffd1e6277a5febf654f11c8e5a63f6c7 a94fb77c70d6d08e50aa251e619f7f6a2bd0983322677a5f0b38ba3cd2c46abb aa2709ee07f4479a85e0d64e8f4f08c87ff747fe658f8e93e30713ab6d46724c

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

---

Win.Malware.Phorpiex-7373816-1

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST	13
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Microsoft Windows Service	12
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Microsoft Windows Service	12
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST Value Name: C:\Windows\system32\rundll32.exe	3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY	3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\PIXEDFU	3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\PIXEDFU Value Name: Impersonate	3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\PIXEDFU Value Name: Asynchronous	3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\PIXEDFU Value Name: MaxWait	3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\PIXEDFU Value Name: DllName	3
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\PIXEDFU Value Name: Startup	3
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: pixedfu	3
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION Value Name: FFC6F26321	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: BCC6F26321	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value Name: *BCC6F26321	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: 00FFC6F26321	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION Value Name: C6F26321	1

Mutexes	Occurrences
.:-Tldr-:.	10
A9MTX7ERFAMKLQ	3
A9ZLO3DAFRVH1WAE	3
AhY93G7iia	3
B81XZCHO7OLPA	3
BSKLZ1RVAUON	3
F-DAH77-LLP	3
FURLENTG3a	3
FstCNMutex	3
GJLAAZGJI156R	3
I-103-139-900557	3
I106865886KMTX	3
IGBIASAARMOAIZ	3
J8OSEXAZLIYSQ8J	3
LXCV0IMGIXS0RTA1	3
MKS8IUMZ13NOZ	3
OLZTR-AFHK11	3
OPLXSDF19WRQ	3
PLAX7FASCI8AMNA	3
RGT70AXCNUUD3	3
TEKL1AFHJ3	3
TXA19EQZP13A6JTR	3
VSHBZL6SWAG0C	3
chimvietnong	3
drofyunfdou	3

*See JSON for more IOCs

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
92[.]63[.]197[.]106	10
66[.]199[.]229[.]251	3
216[.]58[.]206[.]81	3
141[.]101[.]129[.]46	3
141[.]101[.]129[.]45	3
172[.]217[.]7[.]174	2

Domain Names contacted by malware. Does not indicate maliciousness	Occurrences
ofoanefubehauufdu[.]ru	11
osgohfoeaugfoauef[.]ru	8
dio[.]shojnoc[.]com	3
dia[.]shojnoc[.]com	2
ieguaoeuafhoauedg[.]ru	1

Files and or directories created	Occurrences
\_\DeviceManager.exe	12
\.lnk	12
E:\.lnk	12
E:\$RECYCLE.BIN	12
E:\_	12
E:\_\DeviceManager.exe	12
%SystemRoot%\T-580580975794906058	12
%APPDATA%\winsvcmgr.txt	12
%SystemRoot%\T-580580975794906058\winsvc.exe	12
%HOMEPATH%\Local Settings\Application Data\pixedfu.dll	3
%LOCALAPPDATA%\pixedfu.dll	3
%TEMP%\323221246224071.exe	2
\$Recycle.Bin\_HELP_INSTRUCTION.TXT	1
%HOMEPATH%\AppData\_HELP_INSTRUCTION.TXT	1
%APPDATA%\_HELP_INSTRUCTION.TXT	1
%HOMEPATH%\Desktop\_HELP_INSTRUCTION.TXT	1
%HOMEPATH%\Documents\_HELP_INSTRUCTION.TXT	1
%HOMEPATH%\Downloads\_HELP_INSTRUCTION.TXT	1
%HOMEPATH%\Favorites\_HELP_INSTRUCTION.TXT	1
%HOMEPATH%\Links\_HELP_INSTRUCTION.TXT	1
%HOMEPATH%\Saved Games\_HELP_INSTRUCTION.TXT	1
%HOMEPATH%\_HELP_INSTRUCTION.TXT	1
%PUBLIC%\Music\Sample Music\12EAEF0D255F4C3289F8C16727C42FE6.BACKUP	1
%PUBLIC%\Music\Sample Music\20410F1A046679B6EE5BB84B050B5D6A.BACKUP	1
%PUBLIC%\Music\Sample Music\CD5F520B00FF264246AA4685031109F6.BACKUP	1

*See JSON for more IOCs

File Hashes

01800a0b77486384e49b910debe10f7cee0b315bcf58fde71697f0dd4ec3540e 2032430a872c8bf354dcd1d6ae0f7aca4d02f5b4f0dcfa43ce3d1f795c8c9c72 43503180b734d83a724db448cd4d94b1b4a3096dabec6b9411af061337af8c35 5cf483ced208bc37ee1e71346a22615c88ee294a8b3b411b5d11e77571e2e4fd 7aa31bf90f13024bbcb547c126115b112b17a130fc8169712351c418f93516ca 86d2c77b7dc01092d3591f95f99a7ba79c06e06e83759b7965d18032102a823a 8e56d2ba3bf9e86c66e0eeafe453a8c36f692b4f22edb9e96fecaaef8e894d51 94179eab10b3a394790f3bfd5cf10c5bcabb16cd534997f6361064ac5e686342 af69f159ac7741ff8c72ea41fe76436512c84f7de6870caa6268ca28ac87aabd c6365099edb25124ad0ac0ffbe5a246d3d27a15c42e5bebb3a6a5994797611ef ca4a36212c31444ed2f0c173c0fb9a2ca43a8cfdf2ba7663b3eea52e150a02f3 cea3556aa39780fa88283ac4b89f75bb9e0070fc870f8c2f2940d74c124999ca d70bed520eccb3afa3ebaac4a1644e1b603e407c386a5a3dfeee864acc8be52d e1ef644770cf7cb312df7b2112a140386e246e6bb8c5fb607707e08bc1ad31ad e96f931910f1f64cadda65519f52c5ccd2311cd9d4aa705815b28a21559a4f18 f00fe52b605c93783f69f8ff95605484c73600a0c4ef33336b565e3adfd7bf8b f22b9841d6cfca96f89543e43f6dce478dbed764c3083b7a2dce8ba42e8a2b34

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA

Screenshots of Detection

AMP

---

Win.Malware.Zbot-7373691-1

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS Value Name: LoadAppInit_DLLs	48
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS Value Name: AppInit_DLLs	48

Files and or directories created	Occurrences
%System32%\Tasks\aybbmte	48
%ProgramData%\Mozilla\thfirxd.exe	48
%ProgramData%\Mozilla\lygbwac.dll	48
%HOMEPATH%\APPLIC~1\Mozilla\kvlcuie.dll	42
%HOMEPATH%\APPLIC~1\Mozilla\tfbkpde.exe	42
%SystemRoot%\Tasks\kylaxsk.job	42

File Hashes

0008d767954ff4cd48317862040f44a8550279d2f80730db9d8c9a6c3e6f69f7 01b1b04fd8af635ddc5953b9c3bd87d510c38476477f201fa59b6ac1ebc89265 02e089e46e5d3a515394aec09a6f8a37cb8be989730bc9a7c29660bfe8f2e1aa 0878a61c44c6f24ea9b7455e663c9ae1f059f5581067957564af8cc90d7bead1 08c3aed6e3b36b219a22d80947cb02a1da27cdd955dcab8938f366c938641d99 0a586547643e008b351990181c6434a4ad1b1d91e2d8cfd2dcc654459e415652 0be41d1d76850b8b1bd55121ecb12c43b20493e7ef00a83d366092998b126a66 1142bde6260aacc7770f40931f1b10a3d72e479e482536590df5c8af3fe7cdb2 11f76ef08d086a6e3f87466f8a77c7bc63dd754dbd5aaf27deaf4e78abe46c4e 12ccd85f6d507d2b558259c0e987c1c0d104dddd62af38b6597c21055bb35f7e 13235beb6e3d194b599cc7cb1eb82ced9cad5ee17ddac09ae13942aed2b4ff14 143471cc5a4f7299a4009841fb1b92ec52bec2f78b426281d0bacc02946855b7 171fdd6c8d3e43050ab23eb0327fd74094ec7d813c5fb4f2f5668a6650e5088a 1be73946fc11127b9587440b45b8ba9452273c1b47698060562f5d6b0c914514 1ed93147bbaf222006509898c620b1cb65866d1f57d12c7f69a0db49cb459730 20a5e8c87d9d5f9c4f212c8324e1c51941c2c92e4193bb460454451c43763c65 23a1c96747d375ef9098389078a48ffe53305fce872ae8d056697aa1f4aee4bf 23f6e421ea4cdb20ba4d0f1b94100847dd67537fa438d0b0579579bca2aa9e64 249534c79cd24e2d4f756ee051f5fa3da34a85ac4d60b24afc19d0d01b03f446 24cfdb52074fedadb316ec85968e36576f44660b618edc8582c4a9d1134a4344 25bac99d7d11cb4a6da8d9a1742da2e31bc59751ed7d557677a11c5ec251a149 285c4a1f783602c538395337b0724f384806f308be12fef1654f77f667762412 29286b6965a37a18bb510f2ceff996456133395c0af62e2d87e58c86877b7a5b 296d4d39691aa73e5392b57a1dff3cf34f7f1e3548ab38d22e7c1bcceb30fc11 2bf03d005dc768b24c4a27218e41c5781902edd872f934d24c02958fd172fbc0

*See JSON for more IOCs

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Win.Malware.DarkComet-7371375-1

Indicators of Compromise

Registry Keys	Occurrences
<HKCU>\SOFTWARE\DC3_FEXEC	16
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE Value Name: EnableFirewall	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: DisableTaskMgr	1
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE Value Name: DisableNotifications	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: EnableLUA	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER Value Name: AntiVirusDisableNotify	1
<HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\SECURITY CENTER Value Name: UpdatesDisableNotify	1
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: Start	1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\CURRENTVERSION\EXPLORERN Value Name: NoControlPanel	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM Value Name: DisableRegistryTools	1
<HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM	1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\CURRENTVERSION	1
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\CURRENTVERSION\EXPLORERN	1

Mutexes	Occurrences
DC_MUTEX-F54S21D	10
DC_MUTEX-<random, matching [A-Z0-9]{7}>	6

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
88[.]67[.]72[.]218	5
189[.]24[.]196[.]171	3
187[.]14[.]155[.]193	1

Files and or directories created	Occurrences
%TEMP%\dclogs	12
%TEMP%\tmpcmd.bat	1

File Hashes

198fd0be4b6734556acf2ac56b3caff28d402ef10c0875180ab02a62d320b9c1 3201cfb883cd1c3b8f13b639a40cd08b3a701df41d6488228b586d7909a6f9c3 384fb4c37f5649edff99a8ce89b65b66a74fffe0e27dc8ad0abc6b949391e7e6 386a72805830c4e97a5970ab2c50e973394d2f0c2d89f1be33219a79ae988ab5 3ca6b7c42876362f7c1b27c86e45f5d95443a385ffa01226ab25cea998176219 42b444b7738492be745183895147d005f825dfa44c4b2cb1e256f6a146e3fa63 54f3ab508247399214721d27e61b5f9be1797cf54e1f80590a6075f1086df697 6283cb17aa670de5710f160fe411ba49cd8d6f12ec96141c787311f03d3dbfa0 7175a539ad4450790dcb7fc70b3a83c8fb85001b2fca89e5bdef6b106175c586 7d82900300161ba47eb3ec68e9ebea0f55986a33affff5bbe43e0dd5fee2d907 a7b843e8ece17f12410ed58e1de94c03126d74192d3732dae6071aefb6b190f2 b18d500a121437df8d1170fdf315b8dbe53d0f69214963a665c484bc47a1d3cd b7cfcc21847f1be733342c7c635d30152e3cbc7ac456d44faeb3d0d61933f02d d4c3d0934d55956d694a8097bcd0b69c4743e681ab1985e689d71827514fdd63 dcfc58bbe29cd4d7634c21ac390cca9c3f12becaf8584ac3d3a90da2cd329585 fbaf7fd94f82e6f9dc6de640564350f00b0901763249e14ad29748a79bc41a43

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Win.Packed.ZeroAccess-7370742-1

Indicators of Compromise

Registry Keys	Occurrences
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: Start	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS Value Name: DeleteFlag	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: DeleteFlag	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: DeleteFlag	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\BROWSER Value Name: Start	8
<HKCR>\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32 Value Name: ThreadingModel	8
<HKCR>\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32	8
<HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value Name: Windows Defender	8
<HKLM>\SOFTWARE\CLASSES\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\INPROCSERVER32	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS Value Name: Type	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS Value Name: ErrorControl	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: Type	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: ErrorControl	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\IPHLPSVC Value Name: DeleteFlag	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: Type	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WSCSVC Value Name: ErrorControl	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: Type	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC Value Name: ErrorControl	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010 Value Name: PackedCatalogItem	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009 Value Name: PackedCatalogItem	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008 Value Name: PackedCatalogItem	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007 Value Name: PackedCatalogItem	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006 Value Name: PackedCatalogItem	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005 Value Name: PackedCatalogItem	8
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004 Value Name: PackedCatalogItem	8

IP Addresses contacted by malware. Does not indicate maliciousness	Occurrences
180[.]254[.]253[.]254	8
166[.]254[.]253[.]254	8
135[.]254[.]253[.]254	8
117[.]254[.]253[.]254	8
119[.]254[.]253[.]254	8
134[.]254[.]253[.]254	8
206[.]254[.]253[.]254	8
222[.]254[.]253[.]254	8
182[.]254[.]253[.]254	8
190[.]254[.]253[.]254	8
184[.]254[.]253[.]254	8
197[.]254[.]253[.]254	8
66[.]44[.]141[.]253	8
183[.]254[.]253[.]254	8
158[.]254[.]253[.]254	8
204[.]254[.]253[.]254	8
230[.]254[.]253[.]254	8
71[.]17[.]221[.]85	7
217[.]209[.]16[.]149	7
84[.]40[.]68[.]14	7
75[.]64[.]4[.]243	7
24[.]145[.]85[.]120	7
83[.]233[.]106[.]6	7
24[.]176[.]111[.]7	7
24[.]92[.]71[.]93	7

*See JSON for more IOCs

Files and or directories created	Occurrences
\systemroot\assembly\GAC_32\Desktop.ini	8
\systemroot\assembly\GAC_64\Desktop.ini	8
%System32%\LogFiles\Scm\e22a8667-f75b-4ba9-ba46-067ed4429de8	8
%SystemRoot%\assembly\GAC_32\Desktop.ini	8
%SystemRoot%\assembly\GAC_64\Desktop.ini	8
\$Recycle.Bin\S-1-5-18	8
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f	8
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f\@	8
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f\L	8
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f\U	8
\$Recycle.Bin\S-1-5-18\$0f210b532df043a6b654d5b43088f74f\n	8
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f	8
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f\@	8
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f\L	8
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f\U	8
\$Recycle.Bin\S-1-5-21-2580483871-590521980-3826313501-500\$0f210b532df043a6b654d5b43088f74f\n	8
%ProgramFiles%\Windows Defender\MSASCui.exe:!	8
%ProgramFiles%\Windows Defender\MpAsDesc.dll:!	8
%ProgramFiles%\Windows Defender\MpClient.dll:!	8
%ProgramFiles%\Windows Defender\MpCmdRun.exe:!	8
%ProgramFiles%\Windows Defender\MpCommu.dll:!	8
%ProgramFiles%\Windows Defender\MpEvMsg.dll:!	8
%ProgramFiles%\Windows Defender\MpOAV.dll:!	8
%ProgramFiles%\Windows Defender\MpRTP.dll:!	8
%ProgramFiles%\Windows Defender\MpSvc.dll:!	8

*See JSON for more IOCs

File Hashes

1d2d42263d68f09b1946be33971dcc04706ccc597993007b59806c3a23f1ffac 4f59080cc3450aab4dbfae69f1223e79069e3c315bac2df45ea845a68439bcde 559ecb68cce08a6d1d5b27d96295fc81ddc3df2edf1dbf3d765a9831262402c5 907c8629bcd73adf85f6163bacf17831830f0410f7e9840a146b364fb0bb2945 9117e953fe785d1b5c2f350921bd8ec6e14f1e34c0a26059c66c4abfb98e7a55 a026a103b42e4fd2a1b1b21931983d477e53b94210900f2a464cf71dd4868f27 b05d35fe02909b09b6a2c347f619430495530617f209ddba7b357db26cd154d1 d038daa7418565e12cd449a5c13d9f36eef7c3cf76c7739db4f41df68649837f e8a06267aade079e638ab09d0ca9b2697079be1292c237846f93bf802d9c8746 ec683faba46071aa2c11667714ee9d1abbbc1b4a6d6d024b77fc97e497eb5673

Coverage

Product	Protection
AMP
Cloudlock	N/A
CWS
Email Security
Network Security	N/A
Stealthwatch	N/A
Stealthwatch Cloud	N/A
Threat Grid
Umbrella	N/A
WSA	N/A

Screenshots of Detection

AMP

---

Exploit Prevention

Cisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits. These exploits use certain features to bypass typical anti-virus software, but were blocked by AMP thanks to its advanced scanning capabilities, even protecting against zero-day vulnerabilities.

CVE-2019-0708 detected - (47418)

An attempt to exploit CVE-2019-0708 has been detected. The vulnerability, dubbed BlueKeep, is a heap memory corruption which can be triggered by sending a specially crafted Remote Desktop Protocol (RDP request). Since this vulnerability can be triggered without authentication and allows remote code execution, it can be used by worms to spread automatically without human interaction.

Atom Bombing code injection technique detected - (522)

A process created a suspicious Atom, which is indicative of a known process injection technique called Atom Bombing. Atoms are Windows identifiers that associate a string with a 16-bit integer. These Atoms are accessible across processes when placed in the global Atom table. Malware exploits this by placing shell code as a global Atom, then accessing it through an Asynchronous Process Call (APC). A target process runs the APC function, which loads and runs the shellcode. The malware family Dridex is known to use Atom Bombing, but other threats may leverage it as well.

Process hollowing detected - (244)

Process hollowing is a technique used by some programs to avoid static analysis. In typical usage, a process is started and its obfuscated or encrypted contents are unpacked into memory. The parent then manually sets up the first stages of launching a child process, but before launching it, the memory is cleared and filled in with the memory from the parent instead.

Kovter injection detected - (196)

A process was injected into, most likely by an existing Kovter infection. Kovter is a click fraud Trojan that can also act as an information stealer. Kovter is also file-less malware meaning the malicious DLL is stored inside Windows registry and injected directly into memory using PowerShell. It can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2. It spreads through malicious advertising and spam campaigns.

Installcore adware detected - (99)

Install core is an installer which bundles legitimate applications with offers for additional third-party applications that may be unwanted. The unwanted applications are often adware that display advertising in the form of popups or by injecting into browsers and adding or altering advertisements on webpages. Adware is known to sometimes download and install malware.

Excessively long PowerShell command detected - (90)

A PowerShell command with a very long command line argument that may indicate an obfuscated script has been detected. PowerShell is an extensible Windows scripting language present on all versions of Windows. Malware authors use PowerShell in an attempt to evade security software or other monitoring that is not tuned to detect PowerShell based threats.

Gamarue malware detected - (89)

Gamarue is a family of malware that can download files and steal information from an infected system. Worm variants of the Gamarue family may spread by infecting USB drives or portable hard disks that have been plugged into a compromised system.

Fusion adware detected - (43)

Fusion (or FusionPlayer) is an adware family that displays unwanted advertising in the form of popups or by injecting into browsers and altering advertisements on webpages. Adware is known to sometimes download and install malware.

Reverse http payload detected - (33)

An exploit payload intended to connect back to an attacker controlled host using http has been detected.

Dealply adware detected - (31)

DealPly is adware, which claims to improve your online shopping experience. It is often bundled into other legitimate installers and is difficult to uninstall. It creates pop-up advertisements and injects advertisements on webpages. Adware has also been known to download and install malware.

New partnership brings together Talos’ visibility with IR’s unmatched response capabilities

November 12, 2019, 9:12 am

≫ Next: Vulnerability Spotlight: Remote code execution vulnerability in Microsoft Excel

≪ Previous: Threat Roundup for November 1 to November 8

$

0

0

By Jon Munshaw.

The threat landscape has evolved into a complex, challenging environment for organizations everywhere. A talent shortage, combined with an increase in incidents, has led to a generally weak security posture among most organizations. Defenders’ backs are up against the wall. Organizations around the world now realize that sitting back and waiting for an alert or receiving information from law enforcement about an incident in their environment brings stiff fines, increased scrutiny, lost intellectual property, data privacy concerns and lost business.

Cisco Talos announced last week that it is bringing Cisco Incident Response into the Talos family. With this new partnership, Cisco Talos Incident Response hopes to use Talos’ actionable intelligence and unprecedented visibility to assist defenders to answer threats faster.

Talos IR fully integrates Talo's threat intelligence output into all our IR services. This enhances the services provided to clients based on the latest malware campaigns and up-to-date and actionable notifications on emerging threats.

Talos Incident Response provides a new approach, capitalizing on our unmatched visibility, unique and actionable threat intelligence, and collective, global response capability, together in a full-spectrum offer.

Talos Incident Response has greater visibility form the largest combined set of telemetry, threat traps, and partner intel data available anywhere. Unmatched visibility gives us more streams of intelligence. Ties between Talos IR and Talos Research teams allow for further integration of local context from our responders back into our global threat intelligence feeds. 

Conversely, the Talos IR teams on the ground have direct access to the closely guarded sources of Talos research, creating actionable intelligence for clients during any incident. This line of sight helps protect all Cisco customers and the internet at-large as we’re able to place the threat intel from one client into the Talos engines that feed millions of security products.

Cisco Talos Incident Response customers not only understand their response capabilities better, but have direct access to the largest threat intelligence, research, and response team in the world without delay when it matters most. Talos Incident Response gives customers immediate access to Talos incident responders, researchers, and analysts. Talos IR fully integrates that threat intelligence output into our IR services. This enhances the services provided to clients based on the latest malware campaigns and up-to-date and actionable notifications on emerging threats.

Laser-focused local response from Talos IR is fully integrated with the global response capabilities of Talos. While immediate value is realized by our Talos IR customers, there is also reciprocal value realized internally by our researchers. The scale of Talos allows for our researchers to deploy "boots on the ground" in certain situations to gather data needed by the entire industry for further analysis. By closing the gap between IR and intelligence, response is faster with even greater efficacy.

Cisco Talos Incident Response significantly strengthens customers’ network defenses. Using the latest intelligence and best practices, it introduces a process that engages all layers of defense and provides a comprehensive range of capabilities.

Talos Incident Response provides a full suite of proactive and reactive services to help you prepare, respond and recover from a breach. With Talos IR, you have direct access to the same threat intelligence available to Cisco and emergency response capabilities — not to mention access to more than 350 threat researchers for questions and analysis. Let our experts work with you to evaluate existing plans, develop a new plan, and provide rapid assistance when you need it most.

If your organization is experiencing a cyber-related incident, from a breach of confidential data to a worm impacting operations, Talos Incident Response can mobilize quickly to respond to the incident, mitigating immediate concerns, containing the situation, and architecting a long-term strategy that addresses root cause issues. Using the latest intelligence, years of experience and best practices, we build a custom response plan that isolates the attacker, scopes the incident, ascertains root cause, and allows your business to recover as quickly and effectively as possible.

Want to learn more about Talos IR? Check out their new page here and an at-a-glance paper here.

---

Vulnerability Spotlight: Remote code execution vulnerability in Microsoft Excel

November 12, 2019, 11:07 am

≫ Next: Vulnerability Spotlight: Remote code execution vulnerability in Microsoft Media Foundation

≪ Previous: New partnership brings together Talos’ visibility with IR’s unmatched response capabilities

$

0

0

Marcin “Icewall” Noga of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.

Cisco Talos recently discovered a remote code execution vulnerability in Microsoft Excel. Microsoft disclosed this bug as part of their monthly security update Tuesday. This vulnerability exists in the component responsible for handling the “MicrosoftÆ Office HTML and XML” format introduced in Microsoft Office 2000. A specially crafted XLS file could lead to a user-after-free vulnerability and remote code execution. Microsoft released a patch for this vulnerability in this month's Patch Tuesday security update, which you can read more about here.

In accordance with our coordinated disclosure policy, Cisco Talos worked with Microsoft to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

Microsoft Office Excel WorksheetOptions code execution vulnerability (TALOS-2019-0886/CVE-2019-1448)

An exploitable use-after-free vulnerability exists in the mso.dll of Microsoft Office. A specially crafted XLS file can cause a use after free, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that Microsoft Office Professional Plus 2016 x86 and Microsoft Office 365 ProPlus x86 are affected by this vulnerability.

Coverage

The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rules: 51123, 51124

Vulnerability Spotlight: Remote code execution vulnerability in Microsoft Media Foundation

November 12, 2019, 11:07 am

≫ Next: Microsoft Patch Tuesday — Nov. 2019: Vulnerability disclosures and Snort coverage

≪ Previous: Vulnerability Spotlight: Remote code execution vulnerability in Microsoft Excel

$

0

0

Marcin Noga of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.

Microsoft Media Foundation’s framework contains a remote code execution vulnerability that exists due to a use-after-free condition. This specific bug lies in Media Foundation's MPEG4 DLL. An attacker could provide a user with a specially crafted QuickTime file to exploit this vulnerability. Microsoft disclosed this vulnerability in this month’s Patch Tuesday. For more on the updates here, and see the Snort rules that provide coverage here.

Microsoft released, read Talos’ full blog

In accordance with our coordinated disclosure policy, Cisco Talos worked with Microsoft to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

Microsoft Media Foundation CMP4MetadataHandler AddQTMetadata code execution vulnerability (TALOS-2019-0912/CVE-2019-1430)

An exploitable use-after-free vulnerability exists in the mfmp4srcsnk.dll of Microsoft Media Foundation. A specially crafted QuickTime file can cause a use-after-free condition, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that this vulnerability affects the 32-and 64-bit versions of Windows 10 Media Foundation MPEG4 Source and Sink DLL, version 10.0.18362.207 (WinBuild.160101.0800), version 12.0.18362.1 of Windows Media Player and version 44.18362.267.0 of Microsoft Edge.

Coverage

The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rules: 51673 - 51680

Microsoft Patch Tuesday — Nov. 2019: Vulnerability disclosures and Snort coverage

November 12, 2019, 11:58 am

≫ Next: Vulnerability Spotlight: Denial-of-service vulnerability in Intel IGC64 graphics driver

≪ Previous: Vulnerability Spotlight: Remote code execution vulnerability in Microsoft Media Foundation

$

0

0

By Jon Munshaw.

Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday discloses 75 vulnerabilities, 13 of which are considered "critical," with the rest being deemed "important."

This month’s security update covers security issues in a variety of Microsoft services and software, including the Scripting Engine, the Windows Hyper-V hypervisor, and Win32. Cisco Talos discovered one of these vulnerabilities, CVE-2019-1448—a remote code execution vulnerability in Microsoft Excel. For more on this bug, read our full Vulnerability Spotlight here. We are also disclosing a remote code execution vulnerability in Microsoft Media Foundation.

Talos also released a new set of SNORTⓇ rules that provide coverage for some of these vulnerabilities. For more, check out the Snort blog post here.

Critical vulnerabilities

Microsoft disclosed 13 critical vulnerabilities this month, nine of which we will highlight below.

CVE-2019-0721, CVE-2019-1389, CVE-2019-1397 and CVE-2019-1398 are all vulnerabilities in Windows Hyper-V that could allow an attacker to remotely execute code on the victim machine. These bugs arise when Hyper-V on a host server improperly validates input from an authenticated user on a guest operating system. An attacker can exploit these vulnerabilities by running a specially crafted application on a guest OS. This could allow a malicious user to escape the hypervisor or a sandbox.

CVE-2019-1390 is a remote code execution vulnerability in VBScript. This vulnerability could allow an attacker to corrupt memory in a way that would enable them to execute remote code in the context of the current user. A user could trigger this vulnerability by visiting an attacker-created website while using the Internet Explorer browser, or by opening an Office document or application that contains an ActiveX control marked "safe for initialization."

CVE-2019-1426, CVE-2019-1427, CVE-2019-1428 and CVE-2019-1429 are memory corruption vulnerabilities in the Microsoft Scripting Engine that could lead to remote code execution. The bugs exist in the way the Microsoft Edge web browser handles objects in memory. A user could trigger these vulnerabilities by visiting an attacker-controlled website in Edge.

The four other critical vulnerabilities are:

• CVE-2019-1373
• CVE-2019-1419
• CVE-2019-1430
• CVE-2019-1441

Important vulnerabilities

This release also contains 62 important vulnerabilities, one of which we will highlight below.

CVE-2019-1020 is a security feature bypass vulnerability in the Windows secure boot process. An attacker could run a specially crafted application to bypass secure boot and load malicious software. This security update fixes the issue by blocking vulnerable third-party bootloaders. An update also needs to be applied to Windows Defender.

The other important vulnerabilities are:

• CVE-2018-12207
• CVE-2019-0712
• CVE-2019-11135
• CVE-2019-1234
• CVE-2019-1309
• CVE-2019-1310
• CVE-2019-1324
• CVE-2019-1370
• CVE-2019-1374
• CVE-2019-1379
• CVE-2019-1380
• CVE-2019-1381
• CVE-2019-1382
• CVE-2019-1383
• CVE-2019-1384
• CVE-2019-1385
• CVE-2019-1388
• CVE-2019-1391
• CVE-2019-1392
• CVE-2019-1393
• CVE-2019-1394
• CVE-2019-1395
• CVE-2019-1396
• CVE-2019-1399
• CVE-2019-1402
• CVE-2019-1405
• CVE-2019-1406
• CVE-2019-1407
• CVE-2019-1408
• CVE-2019-1409
• CVE-2019-1411
• CVE-2019-1412
• CVE-2019-1413
• CVE-2019-1415
• CVE-2019-1416
• CVE-2019-1417
• CVE-2019-1418
• CVE-2019-1420
• CVE-2019-1422
• CVE-2019-1423
• CVE-2019-1424
• CVE-2019-1425
• CVE-2019-1432
• CVE-2019-1433
• CVE-2019-1434
• CVE-2019-1435
• CVE-2019-1436
• CVE-2019-1437
• CVE-2019-1438
• CVE-2019-1439
• CVE-2019-1440
• CVE-2019-1442
• CVE-2019-1443
• CVE-2019-1445
• CVE-2019-1446
• CVE-2019-1447
• CVE-2019-1448
• CVE-2019-1449
• CVE-2019-1456
• CVE-2019-0721
• CVE-2019-1373

Coverage 

In response to these vulnerability disclosures, Talos is releasing a new SNORTⓇ rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up-to-date by downloading the latest rule pack available for purchase on Snort.org.

These rules are: 46548, 46549, 52205 - 52209, 52212, 52213, 52216, 52217 - 52225, 52228 - 52234, 52239, 52240

Vulnerability Spotlight: Denial-of-service vulnerability in Intel IGC64 graphics driver

November 13, 2019, 6:59 am

≫ Next: Vulnerability Spotlight: Command injection bug in Exhibitor UI

≪ Previous: Microsoft Patch Tuesday — Nov. 2019: Vulnerability disclosures and Snort coverage

$

0

0

Piotr Bania of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.

Intel’s IGC64.dll graphics driver contains a denial-of-service vulnerability. An attacker could exploit this bug by supplying a malformed pixel shader if the graphics driver is operating inside a VMware guest operating system. This type of attack can be triggered from VMware guest usermode to cause a denial-of-service attack due to an out-of-bounds read in the driver.

In accordance with our coordinated disclosure policy, Cisco Talos worked with Intel to ensure that these issues are resolved and that an update is available for affected customers.

Vulnerability details

Intel IGC64.DLL shader functionality DCL_INDEXABLE_TEMP denial-of-service vulnerability (TALOS-2019-0845/CVE-2019-14574)

An exploitable memory corruption vulnerability exists in Intel's IGC64.DLL graphics driver, versions 26.20.100.6709 and 26.20.100.6861. A specially crafted pixel shader can cause an out-of-bounds memory read. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that the Intel Graphics Shader Compiler for Intel Graphics Accelerator, versions 26.20.100.6709 and 26.20.100.6861, are affected by this vulnerability if the user is using VMware Workstation 15 (15.0.4 build-12990004), with Windows 10 x64 as the guest VM.

Coverage

The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rules: 50295, 50296

Vulnerability Spotlight: Command injection bug in Exhibitor UI

November 13, 2019, 7:04 am

≫ Next: Hunting for LoLBins

≪ Previous: Vulnerability Spotlight: Denial-of-service vulnerability in Intel IGC64 graphics driver

$

0

0

Logan Sanderson of Cisco ASIG discovered this vulnerability. Blog by Jon Munshaw.

Exhibitor Web UI contains an exploitable command injection vulnerability in its Config editor. Exhibitor is a ZooKeeper supervisory process. Exhibitor's Web UI does not have any form of authentication, and prior to version 1.7.0, did not have any way to specify which interfaces to listen on. Exposing Exhibitor is dangerous for the ZooKeeper ensemble because Exhibitor allows the changing of the ZooKeeper configuration, and also provides a UI for viewing and modifying keys and values stored in ZooKeeper. This could eventually allow an attacker to manipulate Exhibitor when launching ZooKeeper.

Per Cisco's vulnerability disclosure policy, we are publishing the details of this vulnerability without a patch from Exhibitor after a set deadline.

Vulnerability details

Exhibitor UI command injection vulnerability (TALOS-2018-0790/CVE-2019-5029)

An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded by backticks or $() can be inserted into the editor and will be executed by the Exhibitor process when it launches ZooKeeper. An attacker can execute any command as the user running the Exhibitor process.

Read the complete vulnerability advisory here for additional information.

Versions tested

Talos tested and confirmed that versions 1.0.9 through 1.7.1 of Exhibitor Web UI are affected by these vulnerabilities.

Coverage

The following SNORTⓇ rule will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.

Snort Rule: 49239