Talos Roundup Highlights Nine Malware Threats Observed Dec. 31–Jan. 7
Summary
Talos’s weekly roundup covers nine prevalent malware threats, including Qakbot, Tofsee and Gh0stRAT, summarizing their capabilities and sharing sample-derived IOCs, hashes and detection coverage.
Key points
- The roundup covers nine threats observed from Dec. 31 to Jan. 7 and says its information is non-exhaustive and current at publication.
- Qakbot can steal banking and FTP credentials and spread across networks using SMB.
- Tofsee can send spam, commit click fraud and mine cryptocurrency; infected systems join its spam botnet.
- Gh0stRAT provides remote control, including keystroke monitoring, webcam capture and delivery or execution of additional malware.
- Upatre downloads and runs other malware, while Zusy targets banking information through man-in-the-middle activity and deceptive forms.
- Remcos is commonly delivered in malicious email attachments containing Office macros; Kuluoz is often spread through spam posing as shipment or travel notices.
- Talos provides sample-derived indicators, file hashes and product detection coverage, and cautions that a single IOC does not establish maliciousness.
Article Details
- Event Type
- Talos Intelligence published a threat roundup covering prevalent threats observed from December 31 to January 7.
- Impact
- The roundup describes malware capabilities including credential and information theft, remote access and control, spam distribution, click fraud, cryptocurrency mining, and downloading follow-on malware. The article does not report a specific victim count or confirmed incident impact.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | leisuremaintenanceltd[.]com | Domain listed among Upatre dynamic-analysis indicators. |
| DOMAIN | sure052[.]hopto[.]org | DarkComet indicator listed in the dynamic-analysis results. |
| IPV4 | 103[.]27[.]108[.]199 | IP address listed among Kuluoz dynamic-analysis indicators. |
| IPV4 | 109[.]68[.]191[.]186 | IP address listed among Kuluoz dynamic-analysis indicators. |
| IPV4 | 111[.]67[.]14[.]19 | IP address listed among Kuluoz dynamic-analysis indicators. |
| IPV4 | 123[.]126[.]45[.]92 | IP address listed among Gh0stRAT dynamic-analysis indicators. |
| IPV4 | 192[.]163[.]219[.]183 | IP address listed among Kuluoz dynamic-analysis indicators. |
| IPV4 | 198[.]57[.]205[.]18 | IP address listed among Kuluoz dynamic-analysis indicators. |
| IPV4 | 20[.]36[.]252[.]129 | IP address listed among Expiro dynamic-analysis indicators. |
| IPV4 | 204[.]44[.]192[.]76 | IP address listed among Upatre dynamic-analysis indicators. |
| IPV4 | 216[.]250[.]125[.]30 | IP address listed among Kuluoz dynamic-analysis indicators. |
| IPV4 | 64[.]91[.]226[.]48 | IP address listed among Kuluoz dynamic-analysis indicators. |
| IPV4 | 65[.]181[.]127[.]125 | IP address listed among Kuluoz dynamic-analysis indicators. |
| IPV4 | 67[.]198[.]215[.]214 | IP address listed among Gh0stRAT dynamic-analysis indicators. |
| IPV4 | 72[.]22[.]185[.]201 | IP address listed among Upatre dynamic-analysis indicators. |
| IPV4 | 72[.]22[.]185[.]208 | IP address listed among Upatre dynamic-analysis indicators. |
| IPV4 | 80[.]93[.]28[.]65 | IP address listed among Kuluoz dynamic-analysis indicators. |
| SHA256 | 00821b577f7436541761c9ba039087b88054ebdc64445a63940c62119ec0c368 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 00ebc35361fe5684426a5c8b7c3d35c6258dfef425183e2599eea3e6258d555a | DarkComet file hash listed in the malware analysis. |
| SHA256 | 01962cc2da397d3d22f0efa3266094b5f115743345082349ceda7607250e573d | DarkComet file hash listed in the malware analysis. |
| SHA256 | 01e16f0b3d9a51d8d5ec1d955e1acbbb17cbb29b7272634ea7941331135e07ae | Qakbot file hash listed in the malware analysis. |
| SHA256 | 01e87628396262c96d858c73b9bacb8bed8ff66c963454594f70d856930a4c96 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 01f9a0a5cc46be71f9d14f679a8dfbad9a82aa5727a1fdbca7802b2d4d890ca5 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 02241908fb5bb63858807d8b307cce9d6b03227958f3b401196239d8c6f19253 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 0297be18782977e4555405f89616c266f5f8e5640c49c4bda4785ffba10ae324 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 030362794d0bd7ae6d968d3e1889bbfeb66f58ee0db67704469eedf9094d7871 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 032550997e4a1487a526d92f0b3c42e3abe23784806d10b0e4f7ee0f180f4a5b | Qakbot file hash listed in the malware analysis. |
| SHA256 | 039e8d3046195c432e932e7c79e56d82eccc3f413e1e350540ac9339c69b9166 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 03c34a84b9a5218fdb8e4289b60f59ed82f0c31971b412106eeb11cf2aa0d9f1 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 04052884207b2ff302cdcc73fc8997278d4ca3d505b82a96d9f5c0ebe39c3327 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0483261bfc9791b6866efbc506390aadc901056a5e73c142b192f8336c596d03 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 04b27a851e607b2845e488e4e41a0d5e85187e11c1585e92392607751152927f | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0644c40a3bb058c6fb64f3d57c83624e1a90db440f0122ec5eda0c9798f53369 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 072b6c7647e7335b870392b325d44799c84bf99ea96dc904991e40656bf2c187 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 0870c2af5a5aae70c9aaf87156e8804411a42c06d6ffb06f25bc25a3bf4ed7ef | Qakbot file hash listed in the malware analysis. |
| SHA256 | 09d2a012e974436dc8d767368512e7b1ee5425d7d3d6ed2c9ba753a1335fcade | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0a783435ad220b4432e4b0e1af38af98e89d42aa3c9193e48ce1e5cc04251d0c | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0a80730a2ae557047a01cc6e827fe32a59013b03f6e58b2a2bfd1efea47d1a24 | Upatre file hash listed in the malware analysis. |
| SHA256 | 0ab99b6c5ad749a602354b6525fcbce76b109c12d25bd4983384cc141a60da55 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0ae852bbe8c30fa41de11c94daf008bc96c80be4230e91215b6c17c1f0a37fa6 | Tofsee file hash listed in the malware analysis. |
| SHA256 | 0aeb8bb69d4e8a6d4223693dc353f62430c0f4c16f1278f20042a9908a884420 | Zusy file hash listed in the malware analysis. |
| SHA256 | 0b769ae3a1ab07b3414b2fe5808b662237e8d3ea8d87c4550952f2adb4cfdfee | Tofsee file hash listed in the malware analysis. |
| SHA256 | 0b932135b31b8de131eabfc23bbaf57af505fc5c492b59486f66aa227c1e3ab1 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0b9942f06184d9d96c67f40f35d9e9a39fd1ffd404794f5bc269e35111c8a852 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0baf6ecbcbb90241bf60015cf14b95945ae4b82125743a6aa486fd83aaca54df | Qakbot file hash listed in the malware analysis. |
| SHA256 | 0c1cd086912d10be794a8d600a7e58cfd8af3d4c84b73663630f600ecee358ae | DarkComet file hash listed in the malware analysis. |
| SHA256 | 0c96d07fbeaf26651fd3522856bd547e3a0eb7d9d3071dfa263055afde6e19cd | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0cc22a85732d6748f0936c79e68c730bde531da31baebb6b1c8dd6e7f755a186 | Tofsee file hash listed in the malware analysis. |
| SHA256 | 0d16279827f8590217c26fcd71df64db85cbe59c9586957d55bd8608aaa47094 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0d43a3c205e8f0afab98b54c370837ceec490a11874a90d7589bd15e65f1901c | Qakbot file hash listed in the malware analysis. |
| SHA256 | 0d650e473de170caf6cb66d90fa03f58bafb0a9011e99d76bf05d045d615e2b6 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0d715e6881533e18a77c86f1a950e50cff677e9cd3078b895ac8aec98352b3c9 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 0db8f23e7d335575756e93958fb75d716ad6d44f04e7bc0595540638fa3a7f26 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0e0a0b46185e77f645b74e18b696e65aeca2089851db1b11ca9dfe13ce5ea0e7 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 0e650fd74e9358b8fdedf27d05ebb2db7eafd903c3d16e0c3f3f7fa57ba531d0 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 0ef90630cc4c188568a6d41c6dffa382c70d5a0fa5cb33168fb22827886f8045 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 0f54fe7ea39aca5ea3adfc919a2eb1aa49e7eff8670463c58d0883c0260bad17 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 0fb28ad4d4f0fa49d50e1e771b93330ec9a0be4aa6a4b8a4b55844df94eaa25c | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 1108a10b143d94353cd0cad6bcc2f8bd57a9ea56945291fabcff56efe81ad910 | Tofsee file hash listed in the malware analysis. |
| SHA256 | 113b2ac10b0ea7a4a91b874d27c5f51545d81f561755cb1e29861ee7b76cdd78 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 11713306b39ec65d73b1edc64aaab89546e881b3aece4edebbc0f056e7b62487 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 124b3ea6d0e14ae41d0759bf0c34919f88417fcf4feccdd74de3bfbb56ed846e | Tofsee file hash listed in the malware analysis. |
| SHA256 | 12fb3b2deb9d723e2da17673475fe9e502f24b06b2cd194b1aa5d3f212f53058 | Tofsee file hash listed in the malware analysis. |
| SHA256 | 13b0ebb6ab2cd8ec71b7ad1b626d88db253300faabfadee288765cde290c91c8 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 1414657fa4d9190fe64fa69d9790a24e54757189bb1ba3a243ae7471bc4904c3 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 143688ae9ac7b8a95e0dc714ae4d2df925c399d2fe2a9d0bd5105e38eb929eb3 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 1447b894dcabff4299275bf3ebe64c963e2f90fe6f114d64c60e46a5ff99cee9 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 14733d3ff31310695f39dc6792befdd25f92de6ba0a98f76b11da6f5cb55ad89 | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 14e251578492927e95d99b39405db2ebfea8eccd9da372f14adfa5c5f0167a9d | Kuluoz file hash listed in the malware analysis. |
| SHA256 | 172a9b83bd59358801ff9c6523b373dc5347768dc11302ce536f03bd1dd596de | Upatre file hash listed in the malware analysis. |
| SHA256 | 1736547c85a4702779713a248ced337011f3a4c47639535e98e98177896397da | Qakbot file hash listed in the malware analysis. |
| SHA256 | 174867d04fa7f99695368904f0e4b83994e2c72b231e4e39cebec3648d3878ae | Zusy file hash listed in the malware analysis. |
| SHA256 | 1782c42db8c20a8dd5bbf950a2d6d42010da4fe35a80aef175a0f48ceac54717 | Upatre file hash listed in the malware analysis. |
| SHA256 | 17aebd0c16bd81bb37e7f0d398d909c50638b6d70b2181e4ac7ee35b6b23cfb6 | Zusy file hash listed in the malware analysis. |
| SHA256 | 17d57c8aa7536959e45dd55a6cae0b9b0c64c02f7a6b7545c2b5b1e350e70bd7 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 181ab75f2bdae575e5542a13b1522ad692f38af0856657dc9b976ef8582f647e | Remcos file hash listed in the malware analysis. |
| SHA256 | 18814124ba5985e9dfe57b3ce63e93c15a559e1d07dbaacb67ca461935d6d813 | Tofsee file hash listed in the malware analysis. |
| SHA256 | 1955cce2e7bc2519db00d207e78d56f229515999e01e8b5ab40ea7a9a7d193c1 | Tofsee file hash listed in the malware analysis. |
| SHA256 | 19c9226fa78491ea9c737c0641b2dc328ff4db05eb16e7cadc81ae3e4a87eae7 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 1a9573072e9afe029c6b702e4e0a29da0e71ed75c11b7f3a2c949047160f0bd1 | Tofsee file hash listed in the malware analysis. |
| SHA256 | 1af1f7f5baf654eeb7cf885d9a83354804dffb364bd450ab0e919cb87d963421 | Zusy file hash listed in the malware analysis. |
| SHA256 | 1b77f4ff31294559619df3adfbfccab8980992764e63377f70c9c5b96ee618b1 | Tofsee file hash listed in the malware analysis. |
| SHA256 | 1c2212536e3a873021f62a091baaf1d79bae8fb24c7dfffcc764978548ab24c1 | Upatre file hash listed in the malware analysis. |
| SHA256 | 1c274f2fd7723cb45f0291b2133f2039268620cc56350f282ad8df4745f162d9 | Expiro file hash listed in the malware analysis. |
| SHA256 | 1c93d8de51131599bec513a1575f24bd858a490dccc724239984f8bf4882034e | Qakbot file hash listed in the malware analysis. |
| SHA256 | 1cb5a596781b8b41d6e7e6c2ede7e021dc7557b6a9207b7e6c918dfe1baf5fce | Qakbot file hash listed in the malware analysis. |
| SHA256 | 1d50fb2a219b8ad5901474cf59f1598832d1d89b208729803272d7cbf9231623 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 1d7edf1e37ea7b11167eb318fcc1acb94070757ca25bd11e84be8c2d8fe0154a | Upatre file hash listed in the malware analysis. |
| SHA256 | 1e03d8aeed562585a2068fa2f6c89434eeb832c2b97a5b90c21ecaeec73a8660 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 1e9a1e783678319854c65d8d3c334744553db83acdaf9d91cfaf738ffdebc1d2 | Upatre file hash listed in the malware analysis. |
| SHA256 | 1f7192c63a108a20f5d9021ef852ac26700290e05f9080ca1c915a4a2095530e | Qakbot file hash listed in the malware analysis. |
| SHA256 | 200a9ad4c35e5b86a40203181239dd808540c6a1a4fcf482ff7cb815beb1524c | DarkComet file hash listed in the malware analysis. |
| SHA256 | 20212e75b0fc6545eb885e91a52c95566263ead049252e4ab3f6b9d304c43486 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 20359e35c0ecac74b431d40e0ab9b887947b00d14e1f6c65e093dc5e354e1e79 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 2075b7757cec5c14f3861042a302617c41deec3c5e181446259a9ae7cc64a45c | Qakbot file hash listed in the malware analysis. |
| SHA256 | 210b54b61ac8e02c786ece5df62a7fd47f5c86f958fbf9e19bd25c0a8f486b33 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 22ad2eb6af7ad4829e5e5ba2b57b74dfe9cc5f4df08659b978554450961ff153 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 2348e2111667d2f566f2bd35480eadb6e7abd2fe65961033cab774dd45a34ea2 | Upatre file hash listed in the malware analysis. |
| SHA256 | 23ab8e0e718a7829cd0e73e6b626fadac4cf3d1064809f97604c9833dccf3105 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 25eb013528689123dbad237eb7f7e2477c96e22a4bc604d8b0d54f161ebeb08f | Qakbot file hash listed in the malware analysis. |
| SHA256 | 263e898f8887a4b29bf9967e7cbbc4715ea4a66b542425ea35a7005b93eeabf0 | Expiro file hash listed in the malware analysis. |
| SHA256 | 279a0df573e692a0a7f8f525d48e5ddd83a47c3b7bb1f139189dd825f4ddd027 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 2912768470005f80a6ff8cacb72e52ed6c2a929f65685188f5d6381e5d60ec51 | Qakbot file hash listed in the malware analysis. |
| SHA256 | 292e736944678b2c8e12b02848803dc045fe3ad35ff9a2082a3efe6f629b0f40 | Expiro file hash listed in the malware analysis. |
| SHA256 | 2a7462cee6e834c3e5171bd94767fed3b58cc8e2d005d07cdb353d42594031ba | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 2abcd9a59f3c69b297ef985fed980703a92da4bc39fb2c5fea33fb8d607e59bb | Upatre file hash listed in the malware analysis. |
| SHA256 | 2bd6201844d5e8bb11de482f3af321aee77fea3843ef3bc56d41e3851c70b8c0 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 2c6355caaff8d1a6a22f194205c13c69c8ef9d42f8581fb582f52f885e3cc57f | DarkComet file hash listed in the malware analysis. |
| SHA256 | 2c6a238df36443e93bdac060a6b3123f4f474c3b7b15baa672f1b14ff22f5b7a | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 2c721d02e7bc49b5fa732bb8d04696b6268386b18e3b96237beba8d7f03a90ef | DarkComet file hash listed in the malware analysis. |
| SHA256 | 2df20feb158d1fd59acc38775a791ac1ee3093bffe2add9e568825b4e6700cb3 | Remcos file hash listed in the malware analysis. |
| SHA256 | 2e6633143345a549af8b11593e7c71311a8b8def13608c7b58dd3882dd35cdef | Upatre file hash listed in the malware analysis. |
| SHA256 | 305ff0ca1e7b01f179ae3d24b22b9d6658218eac9675288de1c2e088964c5c7b | Expiro file hash listed in the malware analysis. |
| SHA256 | 307ae88c9bfc701c47db16e952ac930a19d84fc53f6246444264a41ca53c0c1c | Zusy file hash listed in the malware analysis. |
| SHA256 | 31b0f36ddce0eed570dcaf34e950856695ab0e487b4d6f7d0e29dcd57a296f13 | Upatre file hash listed in the malware analysis. |
| SHA256 | 32524ea5235bca3898a25d8a957caf807706ff7ba6f90ded68eaada47669223e | Upatre file hash listed in the malware analysis. |
| SHA256 | 32a06f0808a79accc801ae855fd37a8e16158708d94017fb297e73394dd5dec9 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 336e70f824c8b75b7af305a30d7a30951230f7b9620db472f5b9e3b6b498ac65 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 343fcc60e38c1029dd47987989013c25c9f94777a3fde06d55fdd7f18687da50 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 34711eb40ed68a7c4bb0aa5854dd83cf4dc5b241ac51c4b911cd61e16bc0dc67 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 34bbf8f00daf0369aa27ba7894041ae6aa5e34464b40e3a73194d507322f6abf | Expiro file hash listed in the malware analysis. |
| SHA256 | 35b0477ded22ab5b75de86f81cabae2f38557e8b99ee7d8c15feb71329d5afcb | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 39b18030395e6fedf7fafa9a4dd9a4cc4f0b39b73bc77ba29d6ba9878d16ceaa | DarkComet file hash listed in the malware analysis. |
| SHA256 | 39f305a03168b3cca7605f3f99424437f1e328703a7c7ffa6db12342402e1f7b | Remcos file hash listed in the malware analysis. |
| SHA256 | 3a6a64646baea4c118e22d54ebaac75368c7fd200acf29776769700e05142569 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 3bf006d46763841336b120412e60f7775fae2a413dcac49b4d459c93a978e9e2 | Upatre file hash listed in the malware analysis. |
| SHA256 | 3d8d8a0358fae0ed84f2c888be7debc97bf358920a7ef5be45a59e01dde2c96f | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 3e02ce8274df79e15cf45c17435356238aaa13f7ae64cc7d26794b9bc60dcdc9 | Upatre file hash listed in the malware analysis. |
| SHA256 | 3f38e55e17238844b9cffed80231074f946373717e2df5b308133fb3baab3294 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 4013176e317de33e6128d8b1dcc307c785dd3d2c7cdf7c863b6d9c38cf78a76c | Upatre file hash listed in the malware analysis. |
| SHA256 | 404d69ad873e280aab7c640312c0cc54e39bd77daf1b91f4b9b617a8ad752449 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 40c70bfe876c3cd2aae6b334885a34f5311cccd4ef1f00035935b83e4ee58e1d | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 40e16a252191a91c05f512645219a524542f4926d1cbd3707f593f18e002ec43 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 429fa9f299eb2a772aa2a110007b50c95300b495d052ce68aaecac5e40734f44 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 4384740f417019f446c16a1b3753290aff90fe68163ff934971731d10f81d1f1 | DarkComet file hash listed in the malware analysis. |
| SHA256 | 44f6f2bb5311838d857aa4e0271d1f1292ad116d5428185249b827b744023a45 | Remcos file hash listed in the malware analysis. |
| SHA256 | 46033bd204315a883f599a40dc6e27c86af574e05af915d39915f3840f8c07d3 | Tofsee file hash listed in the malware analysis. |
| SHA256 | 488463853079ebd42263015cb085617c657598e5321583460b1b1dc2fca7684a | Zusy file hash listed in the malware analysis. |
| SHA256 | 4c9df4e198cfbbe3d19a2254614da33e5ac2658ade06f068c733b5118393cfac | Tofsee file hash listed in the malware analysis. |
| SHA256 | 4d6aeee0e6a13420ccb4948646a9709b4a43bc8adcfdb682b881d88d2deac641 | Zusy file hash listed in the malware analysis. |
| SHA256 | 4eb73b5a36004c90aeb8c6ffe9b05e906495642fc4db52dff1a7e32459b650ea | Upatre file hash listed in the malware analysis. |
| SHA256 | 4f1f60abc469669a8dc15a8e7c4d226a1bac5588f81c5a66eabed97081f15202 | Upatre file hash listed in the malware analysis. |
| SHA256 | 52c4868c8228abdd13a5776e89db2f076d4e06b04282ed1b24e9c4360dbb3078 | Upatre file hash listed in the malware analysis. |
| SHA256 | 53d477955586161565830662f46dbaddd969633d0f60245273667b6acd592dd6 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 549c81447bbf0374a09494e50c310ad4a642816f0d079a21cd447a49e59b09fa | Expiro file hash listed in the malware analysis. |
| SHA256 | 5535c38614da6a5d19f18ecf4bfae1a839e133bb7ef263f613ae5cf069fdbde1 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 57c947a131966a2e297e8e0d237f67984cc22fa8672b879b893afe60c6a383e6 | Expiro file hash listed in the malware analysis. |
| SHA256 | 594971e3c6eccf37a499985467286e0ac176f20ede2c87fd2c6d0ada3964429d | Tofsee file hash listed in the malware analysis. |
| SHA256 | 5a7434856e1ebc9505c879344c548105bfb31ddfe5a3931e90436ad90405db6a | Tofsee file hash listed in the malware analysis. |
| SHA256 | 5bcd32596530cafb7239bf7f768f1fe361ea4199c2358b8f14300143f0a6468e | Expiro file hash listed in the malware analysis. |
| SHA256 | 602ba48eef6e4a667c0ed7e7fb8d050a569d90dc3abd0bb7c7be8a09133787db | Upatre file hash listed in the malware analysis. |
| SHA256 | 608963dd078baa521fc0b70284d48745d223c1077b30e299abe2a7592bcc1fe0 | Upatre file hash listed in the malware analysis. |
| SHA256 | 61fdc16290150fcd7ec2e0cfed8b3fc564313d3cf6d9f5cbd138edb5e777f2b6 | Upatre file hash listed in the malware analysis. |
| SHA256 | 62e545097ed02c498f94adeef634bf3cddeb829421e5f511acfdd59ce68fb445 | Upatre file hash listed in the malware analysis. |
| SHA256 | 66064ce541047d9ffc659bdb5cd891032739040eb63b1f2c71dafa69251e5cb0 | Zusy file hash listed in the malware analysis. |
| SHA256 | 69119f039ccdb064b7bcdf48bc150061028dd2c79aa99519810388d49d3956ab | Upatre file hash listed in the malware analysis. |
| SHA256 | 69a46f75ceb96cf6dbabc145ef2de4f2e0869915bd5fd902ade2891b3f14ce3d | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 6a4512becd91eb633c6618f6ea5ff11ad6b848377148515c979dc172c761ea79 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 6b894476e61687cdee381dcae921eb71f37c856e931d81cbc11227ac2f615993 | Expiro file hash listed in the malware analysis. |
| SHA256 | 6bbffe220f31d756c56484b7c8bdde65587b14f96670bbc269d6528645b6f726 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 6e12fe6cfea60ea1a62a27c4f58531ce95dc13d43b616e340cd406cd510b5307 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 6f58f8cff540be89791a7ce777c897b84d4980dd7e543ba7f0d1c62725a1239e | Upatre file hash listed in the malware analysis. |
| SHA256 | 708c9ce952229721ca3dbd0335314c130e1f8b14fd5ad4dfe345c53caff8e218 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 75d0e8c3cad8908948055ae798fe413ee9d0bd1b50865be47869ea8308cb3909 | Zusy file hash listed in the malware analysis. |
| SHA256 | 77648eecce4bc3c7ba51115391fddcaf87b85eaaf39d7f52e8db67a265467d0a | Remcos file hash listed in the malware analysis. |
| SHA256 | 77a45e959977fcfa67a86a6c9ad0ebf73850aa3a755daec14097990cb736ca68 | Upatre file hash listed in the malware analysis. |
| SHA256 | 780c2bd0e4bbae90adb2f77a06097431cc8774770a7dba4e84011969f7e1d5dc | Expiro file hash listed in the malware analysis. |
| SHA256 | 78af44d3e04c6f2ae327dcdc5d9dd515aeef9a5303accf728907f329df4ad1b1 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 7b9a940f9dfe586dffe998ed13ad540c037ec3eccbdf804e5375fd580c1cd14f | Zusy file hash listed in the malware analysis. |
| SHA256 | 7bac8ccfe2f46e859101851ba7fa3750c345fc3b2bdce2f99f6abd32c7a6e888 | Zusy file hash listed in the malware analysis. |
| SHA256 | 7caa4a9307034a4315d31c23a9b8311274e9b822a15a724eb18363e74eada362 | Tofsee file hash listed in the malware analysis. |
| SHA256 | 7dafa943159f67d6b04e09723f320ae809d81df97e69ee03a49a8c3d37ad2011 | Upatre file hash listed in the malware analysis. |
| SHA256 | 7eaa0aad3ddf0d6e124581b1aa4c2b9762f576e8637493dd122ec2e9c670ca9f | Expiro file hash listed in the malware analysis. |
| SHA256 | 8888b3c34cdb5a777c09746d0bc4be2578480f73b201ada7f7144f008afce606 | Expiro file hash listed in the malware analysis. |
| SHA256 | 8a834f4e2a840c91d06290c8dd64bc17b003706829c208c439d8270ce683d18b | Remcos file hash listed in the malware analysis. |
| SHA256 | 8c9b2c8c4f8ba33d638615bc3377ad4ef8f5eb8e508b532a0fd3eab1f960779b | Tofsee file hash listed in the malware analysis. |
| SHA256 | 8ca2f44a3e92a7a6ac1d5f67d8faa2bb811ace96513e8f489b3ea206f27b3971 | Remcos file hash listed in the malware analysis. |
| SHA256 | 8d329c068bd720cbc781d32f5b18037ad52fef296ce6bcbe14a462c9f1071661 | Remcos file hash listed in the malware analysis. |
| SHA256 | 8e4d4e4453d0fc449144b7bc95236b7e26383fd1c040cebc4733778721cbc89f | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 9084355a3acbb14e2cb5f8f5f200040c3b07b7c6d923b39ac1636c29342cadcd | Expiro file hash listed in the malware analysis. |
| SHA256 | 9577670a22f61939447e571eeddd6dc9cb3591d6249b227ec65a2290a9cef45c | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | 960f3d585fa14c93d343d662d6e89f3d26ef3a7f6974a910a89e98054ed06ec0 | Expiro file hash listed in the malware analysis. |
| SHA256 | 98c8ac6434ebca027b504274f032810f113141869f0723d9ee14b41ce5687cec | Remcos file hash listed in the malware analysis. |
| SHA256 | 9d3875d4f8f4645d713a08e1b4beffb9ef3997892d75376e9d508b44a1f1e272 | Zusy file hash listed in the malware analysis. |
| SHA256 | a0a1660a5d388b79ccc34f357754f088c8740109bc2347cb53d2ae06d5c6587e | Zusy file hash listed in the malware analysis. |
| SHA256 | a311dff286a0997be3a75a8bd3c09381c7b9be77c397636ce96fff38f4789224 | Zusy file hash listed in the malware analysis. |
| SHA256 | a3446721087c18519f408f50d7775d8033d9a8e3267b7dabb21141e81d06a7d4 | Expiro file hash listed in the malware analysis. |
| SHA256 | a45b2a2c438ec83610c82eef0912a80dac39658d975f5a9aef3fd5b207f1e93a | Zusy file hash listed in the malware analysis. |
| SHA256 | a5b72bd2367be139b7c97f9599e49007e3dd1d49eec4693cfdd45f99580c1f34 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | a7341a6fd6ca44a43982558461f1e3309fb9fab6fd17103f648247ecc16a8e74 | Expiro file hash listed in the malware analysis. |
| SHA256 | a81b000c8092297045fc9e4747c27c633a3b25555a51f04785a136dd1a4f689a | Tofsee file hash listed in the malware analysis. |
| SHA256 | a8e39f0c32e61bb63d407b62042fa2e63602ee3efda145acdb939644850dac31 | Remcos file hash listed in the malware analysis. |
| SHA256 | a8f8da85066d1c19257135bd264d5373ebb151fe330d16fedb093d441ecc1989 | Remcos file hash listed in the malware analysis. |
| SHA256 | aa3f81e3e9437fc2e214b7b5a445b7b04a7696848b6224833a75b829e1daf2c1 | Zusy file hash listed in the malware analysis. |
| SHA256 | aaa9bc6679655f6295e6e278acf2cb47d05d42e7a466c4a1a96f4cd1b7e52a2b | Expiro file hash listed in the malware analysis. |
| SHA256 | b66e3af15e2855c1080b841af82e7885086993933b494ba7d2ce73d830a85429 | Zusy file hash listed in the malware analysis. |
| SHA256 | b687a09b8ed0ac267b1fce38d1859e1a2e920beabeba8436c76d82ddc3324f3f | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | b9355ca00910baf8db38b01ae66a211b5895a061ee27d715de210c3ba915bece | Tofsee file hash listed in the malware analysis. |
| SHA256 | bcf64b263f8c0756d94a325b3a726f7eeb167b53c512d1dd973fd60f960b3853 | Tofsee file hash listed in the malware analysis. |
| SHA256 | c23f82d2083cc69a7510f4ae7d321c3d5a22ae58132eb2461111986d9b7c61c9 | Remcos file hash listed in the malware analysis. |
| SHA256 | c493f6064d4e5a6f5ba15457d4c4801376ed77cae36b71e988c3fc9d86dad1fb | Tofsee file hash listed in the malware analysis. |
| SHA256 | c4d175ee93dac83fb8046a40f24a848a15a55040de3c30caa4126b194cde077f | Tofsee file hash listed in the malware analysis. |
| SHA256 | c798a56771dd93d5cff37370f67394767a6027cf491a85e4997f9629386bb789 | Tofsee file hash listed in the malware analysis. |
| SHA256 | c9e2a16f1eed9770131953d73fe95c274827195dbb6ed2b31bceed993d433e65 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | ca34ecd3ed96a2c89785ca8661fa814fd3dd0ea5b5c3abf12c468de1ceb56996 | Zusy file hash listed in the malware analysis. |
| SHA256 | cc15221bb779b96813ba6e125bcd5b668d43d2cdc1b21f6ea8c0bb054bb75a19 | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | d0fbdaba4ff55a8a55a13a68154a77a5eafed027798b7bcc52ea7ef79b6a326c | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | d16d0152fdb6250c3c036a065ccabac5ea4c11f75c37b6cfc2d97e7840c35f6c | Gh0stRAT file hash listed in the malware analysis. |
| SHA256 | defd887bca57c8169f8b613e0368f63627cc65437abd9e094d8b0587870c2f29 | Remcos file hash listed in the malware analysis. |
| SHA256 | dfd3d7688d88fa9552a28af2f5b76b5cafb5fff87407b8ec0b15fa751edd91ec | Zusy file hash listed in the malware analysis. |
| SHA256 | e23667ff62e045397bb2a402df274edfefc6bf1a25d2e246f0472e2dc859e30c | Zusy file hash listed in the malware analysis. |
| SHA256 | e29d07c397855222a340994afe624e659864eead2b6eed5654360ecfd94f8495 | Tofsee file hash listed in the malware analysis. |
| SHA256 | e2e0fcbe61bd5439f825ed3f7f997ecae0e7674a154654b2c3f76b87f2bf190c | Tofsee file hash listed in the malware analysis. |
| SHA256 | e34a312ed5d22190d1b4240a8bcd83086b220fdeded228ab825697d6df3de176 | Zusy file hash listed in the malware analysis. |
| SHA256 | e46e6196ab59cc732a35998900b6008b6629b515c7666d83ee053cc3c2ef8aa4 | Remcos file hash listed in the malware analysis. |
| SHA256 | e9b23d0f2b89494469738f1eb971603cc10a1600965e327928821bf3d1d38729 | Zusy file hash listed in the malware analysis. |
| SHA256 | ecfc7d6cf284dc8cdd7fd02e7193319c0ec75e3c0e38be530c21bc0c01d36728 | Remcos file hash listed in the malware analysis. |
| SHA256 | f440562aed34967e7be0c63bd0dbc6e9faf85eac7af8a95327c0a8e93749a410 | Expiro file hash listed in the malware analysis. |
| SHA256 | f58667964733c487833e7d7e506db5c1dbf21a0f0aef3a93fee6be52cf47a12f | Remcos file hash listed in the malware analysis. |
| SHA256 | f6b99c6e972a798bd45d6140020735992a2f6de18f7b09776f3503c883fd88d8 | Expiro file hash listed in the malware analysis. |
| SHA256 | fb25f0ae22545094cbea3ce5996365c81c7565bee6b78ce60ad1a1d2da60d613 | Expiro file hash listed in the malware analysis. |
| SHA256 | fcac3792d1de7bac9a6dc38dfffa35717cec2ac4d867210a647ab0a2d49035b9 | Remcos file hash listed in the malware analysis. |
Malware
AsproxKuluoz, sometimes known as "Asprox," is a modular remote access trojan that is also known to download and execute follow-on malware, such as fake antivirus software. It often is delivered via spam emails pretending toDarkCometWin.Dropper.DarkComet-9932930-1ExpiroExpiro is a known file infector and information-stealer that hinders analysis with anti-debugging and anti-analysis tricks.Gh0stRATWin.Trojan.Gh0stRAT-9928675-1KuluozWin.Dropper.Kuluoz-9933836-0QakbotWin.Trojan.Qakbot-9924229-1QbotQakbot, aka Qbot, has been around since at least 2008. Qbot primarily targets sensitive information like banking credentials but can also steal FTP credentials and spread across a network using SMB.RemcosWin.Dropper.Remcos-9933257-0TinbaZusy, also known as TinyBanker or Tinba, is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" andTinyBankerZusy, also known as TinyBanker or Tinba, is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" andTofseeWin.Malware.Tofsee-9933691-0UpatreWin.Downloader.Upatre-9934126-0XpiroWin.Virus.Xpiro-9932984-1ZusyWin.Packed.Zusy-9932471-0
Products
ClamAVFor the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.CloudlockCloudlockCWSCWSEmail SecurityEmail SecurityFirepower Management Centerthreat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.Network SecurityNetwork SecuritySecure EndpointSecure EndpointSecure Malware AnalyticsSecure Malware AnalyticsSnortanalysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.StealthwatchStealthwatchStealthwatch CloudStealthwatch CloudUmbrellaUmbrellaWSAWSA