Threat Roundup for August 3-10

Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Aug. 3 - 10. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by highlighting key behavioral characteristics and indicators of compromise, and discussing how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of the date of publication. Detection and coverage for the following threats is subject to updates, pending additional threat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.

The most prevalent threats highlighted in this round up are:

• Win.Malware.Dbzx-6628757-0
  Malware
  This is a variant of the Tspy family. It is able to execute after every reboot, making it persistent. It contacts domains that are related to RATs and are generally command and control (C2) servers to upload data, and receives additional commands. The samples are often packed and contain anti-debug tricks to complicate the manual analysis.
   
• Win.Malware.Emotet-6628754-0
  Malware
  This cluster provides generic detection for the Emotet trojan that's downloaded onto a targets machine. Emotet is a banking trojan that has remained relevant due to its continual evolution to bypass antivirus products.
   
• Win.Malware.Zerber-6629234-0
  Malware
  This is a malware identification for a ransomware variant of Cerber.
   
• Win.Malware.Startsurf-6628791-0
  Malware
  Strtsurf is a trojan targeted at collecting personal information, and sometimes labeled as a potentially unwanted application (PUA) in other coverage signatures.
   
• Win.Packed.Eorezo-6629326-0
  Packed
  This malware is known to enable the display of advertisements in Internet Explorer. It's also downloads several pieces of software and installs them in the background.
   

---

Threats

Win.Malware.Dbzx-6628757-0

Indicators of Compromise

Registry Keys

• <HKLM>\Software\Wow6432Node\Microsoft\Tracing

Mutexes

• QSR_MUTEX_HnRHWDxWQnveBdUtWT

IP Addresses

• N/A

Domain Names

• ip-api[.]com

Files and or directories created

• N/A

File Hashes

• 25430a357d53aec77dd1f119b838ceae79a22bb3a60c7a002cb7328b098546a7
• 54279416f864d374f33fe9a2fe2998db3976c4ff43e8b0da006548489a50bbdd
• 5ce812ebf77f6d63de37a1e3d261b9688d595aaeadaef3388f4214896bb64892
• 810fb35557e051a7be3f03b37247c90796595a2d5afa1b2c3034187de2a3f0bc
• 8f08bcadd3a44055a70dbae3308cf18c8d1824e424100eda03ddc71e9417fb5e
• 9435b87c7c91ac98f9f461aeaa6b1630e2270e2d2ccdf6a05d46fa02de91d1eb
• 9634a2afb40139e39da8c8ef0da8f5104229d7bb4c3b95faee5a4396713f528e
• a137c89d2c6f0ae74217724e1cb56aea726e285d0e6e98adfda16617ad51d176
• a2907c7011b20373fd47e03a0f4679fdd51b982b973bb37d1d45bfa4a618bc5a
• b3c6a0883d9ed8bcf1bf162c0ade8b16f2cd4ae890e30ba9e9540f4bdf5f5ba1
• ba5afe1245d10f72637d34a96bf6e365c2f4326da69dcd440beacf421b634133
• cd3a4783c2795a16c82518c56f955c9b56f415d59ef5bc77e143f6124123364b
• d0dbd75a4d8716ba7ca7d025ee1c772aa4ff554214a993b4b874a0a26dcf5a6c
• e2116a9a176ff765f1c5ec23003266bfe0f1592e46e41236482ad4c3520ea53a
• e2846881f6127d99222144e4ece509bd18522fdd7791bf84d7697b37ffa40919
• efc3e1b1d6c13c3624160edc36f678dd92f172339bfde598ad1a95b02b474981
• f7df8c9e36cf3440709111a33721e7ac7268a2a80057df08843ba95a72c222eb
• fdd4cce37fd524f99e096d0e45f95ac4dac696c8d7e8eb493bb485c63409c7b3

Coverage

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Malware.Emotet-6628754-0

Indicators of Compromise

Registry Keys

• N/A

Mutexes

• PEMB2C
• PEM944
• PEM80C
• PEMA10

IP Addresses

• 67[.]68[.]235[.]25
• 187[.]192[.]180[.]144

Domain Names

• N/A

Files and or directories created

• %WinDir%\SysWOW64\TO5sH5uBMit.exe

File Hashes

• 0406ad0fe90d371b02742e6821486abbfbf2bbd72a7593e8ddb650f0b97673b3
• 0604aa87706cb7890075b494f026c88b2f03b621367f1bb62a87f5c5deb87870
• 086af92d83279f5792c15a762a70e158de54b67c1a96bfc14c4ad52a24468f32
• 10f13af2a3591efa3d58c47bb0635e3a653e14ec7726493bb4595b4dd8cd51cb
• 127c316e7a10579e61369d6a8154e3e34726209b3cc075ddd6d9875c439c583e
• 1fc9fda1b0c868dc7cb0cf6d8867b7aefc202436fe9e41cba5b2b35bb1ce9e9f
• 23ba67cf24c95f3bfd36b66f822feb3d2fd0f72617921550fee034a1b7b8cc74
• 27e37ac7cc8b48573a8345223399ce6b0ab9432ee977acf02c09bcf64cf6622d
• 2bf1192e5200b6f8d25586908b05912a5fa6e06e87540dbb914200446a3deb10
• 2ee83958eb1e8cb622ca833c38e51b53548d299b6574e5b7203741a2d27963f5
• 2fca527cf8ebf4576e982118e22dfe3fd8e445749a5403dafed36089666f2357
• 30bbfb79d26a172975e9482204f06423eff6948b1732384e7b6d23f9932ec08d
• 30bf6e1a41dea6e4024853f9b7a6a878e4f5e4141dba4b0fe7686159925fe6cf
• 42fca9d196c668747b74f80ca996aee9ae38bed96956b42436949a8d4d33ecf1
• 45e6356ca3b373da3a80a72a1b64f1254f4426949598b8877abd6de99e379166
• 4ac5db87bc83dcbf1399f4fc0fede3c5ecee5b8ef2a2500fd79b1588ef033429
• 4b2f6d80bf78ad165c2f07d914cb4137ba31918f3f8f03f812b20715c3451f56
• 4d7d9d73dad989590860178530dd8848d9b79a23f1cb379bc1ca5545cb196eca
• 4e81241256ab4adb5bb96b21633d95773cc34ee72e499659064db0d32046dabf
• 4ea92195bc159e268c7a348f2649010cb01a3e67c315d2f0b8115eaf2c879692
• 5639d3af9cf530a057aebf3cbf92061b58539b2c311491a26d8f404a211d66bb
• 59644dcd34cce275ff5d72c022fa76ac42a422b038d816909281e01e392d3b40
• 599e4e8130e4a1f3f3777c6f9f088cc03c2781f4e802e0e16e417a43ec58c518
• 5eef8b5433ebc22e4c9ea3c1462d525192a4bda8d20be4e7b09fe7d03fb9d119
• 6238c7a704baa8771812e4f3452acb042c6475913db4cd57cfaf17a7454d4d22

Coverage

Screenshots of Detection

AMP

ThreatGrid

Win.Malware.Zerber-6629234-0

Indicators of Compromise

Registry Keys

• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: FlashPlayerApp
• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER
  • Value Name: Run
• <HKCU>\SOFTWARE\MICROSOFT\COMMAND PROCESSOR
  • Value Name: AutoRun
• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  • Value Name: DefaultConnectionSettings

Mutexes

• shell.{381828AA-8B28-3374-1B67-35680555C5EF}

IP Addresses

• N/A

Domain Names

• N/A

Files and or directories created

• %AppData%\Microsoft\Windows\Start Menu\Programs\StartUp\FlashPlayerApp.lnk
• %AppData%\{6F885251-E36F-0FE6-9629-63208157D7A2}\FlashPlayerApp.exe

File Hashes

• 25f8455b83b98f38809af120e35c3eda189a05538f7aa2d527a265520bc3c75e
• 342a9470e5d3dd522c17cf0a5bc588d87a84689d90362c0b18c320385b2e908d
• 41ebdf1d4a210f395d5ee32bf55c6b07ee1e0a0bdf939bd081f6d751323c643c
• 54be105a129d959359107d7dff6b379cd366e32bf7be9ac9a06bc2141d3ca7fa
• 5dce0e7e0a1807d2804f28c5d5afd4ac282a022acd1945786bd118e1caf4050c
• 5fe244200c9367e1b132ccc13df6daaba5479d2491db8fe95658f43981567c5a
• 6292ddf51023ccca84211ed4f33944b4c3df1b694d102d90d3dd2a5a080ed2b9
• 649c52d7b9a58837e6ccd308665d63971e424d29480c44448ddbef15e91649a6
• 6dd74f0816f8b24a6f93c2dae0c69d33689e4baba632605d138216d9c7aab2ba
• 7322fb7767b733ef5a279720f581d54edae9ea4af69d39aaa3e79fc443e2bb33
• 76be26ac77aa81a5fb7d78135adb05b579cecc2173ffef5f5ab6b484e37f9e6e
• 793b978af24469a77490ea609de0142ff817e557ad78a688dd5d65c2fe49a8db
• 7c0e65092e8786d9052bbd74f4dc7b26567e150efb25d1503c4bfd9b3895b8ab
• 8815e1daad1f9cb4ff4243ff485218e3a0be93e2afef07048852ba79fdd9294e
• 8e84fbc38403f1516447b73b73b5051777314089f0d1fefcfae004b1ef615641
• a0e3bd64d556ce80b85b7d328bb61beeaf2da297dc09058211150617d6a83b8b
• b6b3b53b1001b6de24797a89d61bd825760574ab4cb60f7a5971115acb53c8e4
• ef66d0161200d413bb8a577a517fe03f325f2fd2f0df778f6297a8658ca0abc8
• f25d03efc63cba1a262034382f809aaa5918f218b965164897df0c989a08dd04
• f8ee14337fe367aded0aee32c6c84ce404eaef53a6f75d86c6c08235f55ec303

Coverage

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Malware.Startsurf-6628791-0

Indicators of Compromise

Registry Keys

• N/A

Mutexes

• Local\MSCTF.Asm.MutexDefault1

IP Addresses

• N/A

Domain Names

• lip[.]healthcakes[.]men

Files and or directories created

• N/A

File Hashes

• 00cc9438408d1b22b0afc57e3b233ff62774cbcb92e58b392403d8c794d988ed
• 118e08c379b0035cef2a155d59d97c6e8cae94b6f46c5e77f58d84c88c689d2c
• 1f270dc860158d63bb400e08f12bce40a9a50494368ea6e44cfd89f7e0dc23f4
• 3e49b3e58eec40b735124509bafcf434904f5945c9d65a5a860b0950850a979d
• 4348a4b50eba73d6eb5d0d254241d0e44fc63c975b589ac5276d6dc5cf8bab13
• 4a1c1cf9c70b127cc514fa6cdbb0e286ee33bf19f6ff41ca02951c9947dac55e
• 4ae8cf675d6517b7989391fc653e8ddc96aa81cec4802e7e66de30adf0e96d2e
• 527eac30113eb365330ec5c35591fe9ae69d4e1beca8b0ae24666e97d8773e36
• 53366f90f59348b8de81bdc04652200d2dcf8bad5cfc46a533c3b20cd0e200b2
• 5f98685ee9098a31ced944840670772bb972db31ac5d1690974e59f566d1adae
• 61e7c5b6a7f1608cf0bf728d15f8cdfc0f9f5c7c3748ee28452cfa2a496e54cc
• 70ebc88b9a71c661b68325dd92d0945ea1927e4d115da217640a4efefcf0c730
• 722e86b32635a1cace77ceee414761f28e386743fd2c513650e55814179bdac5
• 91bb8eb10e0aa88ea1e33d1ec23893d5a45e01e8ab69081b96835b4aff3b906a
• 97645bb27e056b282a0aa46dbbc79ed03bdc29c6f96e369d7537ee2bb1c8dd6e
• 9b36f0e70d5f7b4795b1278e052356484d4f2374f49563195f224ade6ce08c71
• ac86cafcc7062a389e25a4e26dd15df7ce2e64b7a6890bf5712189ab9ec81c8c
• c3883ba74230604d38a638a1b8d0673cc3c91e01b482e6b83a6e6bbd4edd3b10
• c56e3ca164803c5668cf0b8228c97626c486f5a7063d4b3109840137b67c8f98
• c82eaf2f1f156b95b43b2a984867e486911f6ceb329daea6ac9a6c53fae42685
• ca544eaedd654782fa6b7a130bdc58869c2124a59754ed1baf9a5c00fafae12a
• d4ab2cc67c707cab8f7aab0fde94b50670f1b787b049f45564fe5368205ed642
• eac8c3c76e954d8e2be7a5d1570643b4ce6a856e8143faf6263ad50cf53aceb2
• f0a9c1c2fc19b4abd905e8a2f187f94e74dfe1e7de2d9a5328b13893b301488d
• fb2aa3891cc9383631ddcca4076ae800d67d701a7ffb83d48240cc1d72372175

Coverage

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Win.Packed.Eorezo-6629326-0

Indicators of Compromise

Registry Keys

• <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  • Value Name: 6518673

Mutexes

• Amazonassistant2018
• Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_2c8
• Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_2c8
• WmiApRpl_Perf_Library_Lock_PID_2c8

IP Addresses

• N/A

Domain Names

• www[.]wizzmonetize[.]com
• ionesystemcare[.]info
• www[.]rothsideadome[.]pw
• www[.]usatdkeyboardhelper[.]pw

Files and or directories created

• %ProgramFiles%\WJTLINYZUI\cast.config
• %LocalAppData%\Temp\DaGXhZc6w\Nursehealth.exe
• %System32%\Tasks\One System Care Monitor
• %ProgramFiles% (x86)\OneSystemCare
• %SystemDrive%\TEMP\config.conf
• %LocalAppData%\Temp\U8R09Z5FM2\OneTwo.exe
• %LocalAppData%\Temp\U8R09Z5FM2\up.exe
• %WinDir%\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new
• %ProgramFiles%\WJTLINYZUI\GCOMQP0KN.exe

File Hashes

• 002d9959f5e7417cc2cbc657243f2dab82fac3d2e94fa2d0c8e45eda10889b08
• 03c948623cf78efe90258d894ab0e793bca7009bd73d0be0f652575f81bda621
• 0f8d729821902252b7f7a1c0d51004d3770356969e7181548126f13f1e2ebf2a
• 1e64134ff7358ea6e632fd2377532491235cf089f33095a72552e150088b42f1
• 1eed9456e69a80cb4e8444ad0356d71e09a073715f92e51afa008e80d2a0352a
• 26f928ef89fde0e3e3fa996073c7c0bba00c2cbfe280de338de15367f4c8f76b
• 2b0c6557b39ad8cca97ea6975aa3f4a8341774461b1bacab05d04ab20a9463eb
• 3a5ac5c5ee7985367349d84d60be2c5f94f876c56cf73acbae6fc680ebbdb3c6
• 47bcf1f1bca23a36e291a0ac4cb8d1cd59c0c80d6a8e3b2cc3d646284cc531d5
• 4ae3efb9a9cca68c098dcdba33d2aef39888cf229cd02be64cbf59a0b68dae30
• 5112edf0351d70ad31152f67e8996c9c4ad062f0023cfd43b4baecb8aa7b16b4
• 52544303a89f2c4e3eedd64c000504a2ef4c920c20361961fc81cae3f520244f
• 55e181f0e0e88efccf6534949ad8dd93a179e2b94b71e76a9e7db4d938ea2bd2
• 56982cc1f4b4e92aea28a30684bdfc752122eb78fc545ccc3f4169a1597233cc
• 5c3982a206d40ec00b2029d4bdde1bb37192341583e803556872b97a609411ae
• 61ee5c724a4c9408e9c8120eabac1babea8e91bf5719b02c78ce129f68239ff6
• 63cc723ad7e85798e9126f5cc933c48d0e3cdfa7504579ef0b0b3cced9cb19c8
• 65a0bb3fd94ec888696598703ed111471bd47962278a5f1006e7e0716bd5b58e
• 71d6d1ed9a5bd71e8dbd03a91151a2965ac12198fa1825366bf19c4b14106cb7
• 71e3009284ae35a3087ef041162a2ada636b388738033ea62faefc2bbfca9dfc
• 7e17ee126754a9306b4ffcf536f384abe5c718672807de1e27e7c7f3846d9e74
• 85b36ab50aeb452822886815076c7c90c30273854496dde7fd3473e62119f672
• 877b9a03f0b8763c265ecbc4be76ffafc9eb26c4b618c2827ce1e200797ca876
• 885718a7bd95c44d14dec7f0efa101147b671e60a7ecac2622ac86061dab17f2
• 9583c8f1f3c9982a45ed56fbc30f8be06708cfaa8557aa7f5b6117847018cd4f

Coverage

Screenshots of Detection

ThreatGrid

Umbrella