Talos Roundup Highlights Emotet, DarkComet and Other Malware Threats
Summary
Talos's Nov. 26–Dec. 3 roundup highlights eight prevalent malware threats, including Emotet, DarkComet, Nanocore and credential-stealing Trojans, with sample IOCs and product coverage information.
Key points
- Talos describes Emotet as commonly delivered through malicious emails containing Microsoft Office documents with macros.
- DarkComet and Nanocore are remote access Trojans capable of surveillance and remote system control.
- Zbot and Zeus steal information such as banking credentials; Ponystealer targets credentials from more than 100 applications.
- Noon samples collect and upload information from victims' machines and establish persistence.
- Vobfus spreads through external drives, uses autorun.inf for execution, and can download additional malware.
- The roundup includes selected file hashes and behavioral IOCs from dynamic analysis; Talos cautions that a single IOC does not prove maliciousness.
Article Details
- Event Type
- Threat intelligence roundup describing prevalent malware observed from November 26 to December 3, 2021.
- Impact
- The described malware includes threats capable of stealing credentials and other information, providing remote access, delivering additional malware, and establishing persistence. The roundup reports behavioral observations and sample hashes; contacted IP addresses and domains are explicitly noted as not necessarily indicating maliciousness.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 017e4463cfea82299117b714946be4cc7609d404e36219f6ce848029fff0ddd1 | File hash listed for a Nanocore sample. |
| SHA256 | 08db2ec0fb9b9052029230826baf4681a399f11512b3a7669ac38095c374d7bf | File hash listed for a Noon sample. |
| SHA256 | 16fd5d50ba2ac6cdad97657cb62aa77b71e90315fca245bca42c066611e5e1d5 | File hash listed for a DarkKomet sample. |
| SHA256 | 17fc9d8aa08c99cac3428269f4fee32581a3e7c075c3a523b26a5b4ce4da5e70 | File hash listed for a DarkKomet sample. |
| SHA256 | 1b291ff6a640512771e486d08099128d65aa22d88d97997688b26317f282ec53 | File hash listed for a Ponystealer sample. |
| SHA256 | 1c99a1320f004f656bf430e020e1cdbb0e7f7760cab74abba0e92180b0ae0335 | File hash listed for a Zeus sample. |
| SHA256 | 1cf2b88aae1e141e1791b3914d18b048b2617ce86265fcb10fea0840a08c0599 | File hash listed for an Emotet sample. |
| SHA256 | 3a543a6d9df51952d2b3b08c67771f705e950eb0ce7ce7e90918decc55aea0ee | File hash listed for a Vobfus sample. |
| SHA256 | 3a8322bed57d7a37a256fe87bcb37b810ac5d5b747a5647acc91f012e61e54a5 | File hash listed for a Zbot sample. |
| SHA256 | 3b67bb28abb7e791bcd7d5223e9799b6c04449002594138c6c7db8ae046478b4 | File hash listed for a DarkKomet sample. |
| SHA256 | 407f0c771bd93e70bd172fb6271aea77be8db9c47fe339f7c8847058c27100c1 | File hash listed for an Emotet sample. |
| SHA256 | 4b3351257f81139ff08e3ea250279ec3efee399dcc96ef3791ca2589e04f9c58 | File hash listed for a Noon sample. |
| SHA256 | 5a7ea3648dcc1b648aab3bad91d05df3719d775f184b34bff0c4b1937cf0ed37 | File hash listed for an Emotet sample. |
| SHA256 | 5abfbd891f64ca1431f5c10ba24c8a721087d9f32c7900e45601a69ab6d770d9 | File hash listed for a Zbot sample. |
| SHA256 | 5ae35711082470231fc5c60ec23ffb09591d01510338d44edbda772ad1ca18da | File hash listed for a Ponystealer sample. |
| SHA256 | 5b11fb527233df7f8294cd3b91ca06f94f6a44e841a067f625340309ec66b1de | File hash listed for a Ponystealer sample. |
| SHA256 | 5bcadc4552152bd55e4f470154c02fbc53fbd15801f79677591e63b43eea53a7 | File hash listed for a Zeus sample. |
| SHA256 | 5f51af011bf39c1903696f8a8478e67ea365affb8f8a79d321ee2ff30f132fb9 | File hash listed for a Zeus sample. |
| SHA256 | 61e30ba6304ab7ae641d26b7118eaf9346f055ab5eafa0995e99f82d4ef9fdf0 | File hash listed for an Emotet sample. |
| SHA256 | 675cd37b67f1014ce4eb06169a02f4ec177803ccd853f9ecc0926f91ce4a46c0 | File hash listed for an Emotet sample. |
| SHA256 | 67dbe5f4a3ee536d6c2676788d77ee22e1ac6a605897db745e88882a03f44b09 | File hash listed for a Nanocore sample. |
| SHA256 | 6887a0687741fd333775f3b9d78dd41bab1b23fbd4e7830e61df37ecb18e592d | File hash listed for an Emotet sample. |
| SHA256 | 6b13b8d682d852b45fbbb1c2427e56076e9fd389e1191ee9b35a9b9d0a6ae568 | File hash listed for an Emotet sample. |
| SHA256 | 747ccb42faa8c7f1c97f4fe3518e68dedfd63900197b0336f53e5bd1461f5a3b | File hash listed for a Zbot sample. |
| SHA256 | 7c1f1d57d82cb57799c7d0ebaa7ce0c231fbe1ab29f052f94ccdf0c674385507 | File hash listed for a Ponystealer sample. |
| SHA256 | 7f0e528f9a870f6b7ac18d5aedca145dc2faf633cf9f6a1235ee3e563f8999a3 | File hash listed for a Noon sample. |
| SHA256 | 805dfd2e228c7d832a4e761532c0c1b937a2732eca88122340d3981f95ca0827 | File hash listed for a Zbot sample. |
| SHA256 | 83bd22db707b355135348bb20fadeabb132781027164e78e01490722da255b78 | File hash listed for a Noon sample. |
| SHA256 | 8c4fa6b225ecffd0811ca8a4380491a9ec375a1a40ca0bde1f6e793f41b1887b | File hash listed for a Noon sample. |
| SHA256 | 8ee24fc050ec0fc975441f98712c3386bb8c32fba13cda47ca6f9ada8e5f6b4c | File hash listed for a Zeus sample. |
| SHA256 | 90cfecaa03130aae7d0fb6c8d37cc5bc674693868be632cee100bd4689766d28 | File hash listed for a Zbot sample. |
| SHA256 | 93a1f7ba9908cbfea72a24dd155754d5ddf521a45c3735aa15e62f65cbaecb55 | File hash listed for a Zeus sample. |
| SHA256 | 99b4aeb9ea62e889ec22fa44fdd410ea5cc138cecc9bddbf82b5a2a12d6ef723 | File hash listed for a DarkKomet sample. |
| SHA256 | 9d1e941eedd7a6a442e885c10ef844ca4b1ffdbf0b7c061cc11f91f5b28c81bb | File hash listed for an Emotet sample. |
| SHA256 | a35d3a135daf833155ea33feba1252fd197da2980d4e6ffb817f67987bd7380e | File hash listed for a Zbot sample. |
| SHA256 | a92b197a2682b97ffb2a11a67bdd986fc2a2543a3c455b6f24172df8be010af7 | File hash listed for a Zbot sample. |
| SHA256 | ab73322cbf2d7b93c8643be65fffd1249fc5b9d644e37936b69925a7ced64f35 | File hash listed for an Emotet sample. |
| SHA256 | b797fa3840166d3444c3f860b2663aecef32f5fea834735429a09b404e8a358e | File hash listed for a Zeus sample. |
| SHA256 | c034132940163b6ac4be7ca63aa004bd07964dd3d3d0f1a0714bee89e07b7999 | File hash listed for an Emotet sample. |
| SHA256 | c2c3d65dceecbc8b67d4c03c6a8fd426f6ee1d1fb391beba2c9189197b818f66 | File hash listed for a Nanocore sample. |
| SHA256 | c2e477543265bc5733eef0be5cbbe433824066f2fc03c94ada2ae75046fb69e1 | File hash listed for an Emotet sample. |
| SHA256 | c91bc6434e2f82910b1e6107d459e0c2b6b32cb62eda25bef0bfe0bc9236de58 | File hash listed for a Ponystealer sample. |
| SHA256 | cac08ec0903f399e1650b8ce73bfaa72c6cb235a9472375db6f153a99d074d3d | File hash listed for a DarkKomet sample. |
| SHA256 | cf39ba4cae7bfe2bca412bb58130f0e3d610aaa1540a2991a5f1346a0c9d0d32 | File hash listed for a Noon sample. |
| SHA256 | d457c1084a7c288f4791a3a6733b27af0209f023f87446f0384abadf66a2ce71 | File hash listed for a Vobfus sample. |
| SHA256 | dbede3eb210f3ac5a9f5691a35a9eb568e56537d0471e097fa396731d4a0bbf7 | File hash listed for a Noon sample. |
| SHA256 | e3443324e3aab23a1ad0c7918862744a2614fad85aa702aab1fd8abea01a26c7 | File hash listed for a Noon sample. |
| SHA256 | e85ef6ce609d239ab83e9b5e6087c0abaf0055ecac0b8e3dba832233e10ebadf | File hash listed for an Emotet sample. |
| SHA256 | efbac5a893d3d06941b5b93703b74cdd62faea6cc0f0e09332a6122225f7e016 | File hash listed for a Zeus sample. |
| SHA256 | f07612364bbd203ff93512679f46c4cb83eda3e6452a2d56f4a0191eaea84aae | File hash listed for a Noon sample. |
| SHA256 | f55b13230edc9e93d209f709e21740657f63a54251bdf345abda1d24b62d5cf7 | File hash listed for an Emotet sample. |
| SHA256 | f72fdbb2158d5250e8def872ae285c6b0183bb7c6c5804728252c71bbc8a0536 | File hash listed for a Vobfus sample. |
| SHA256 | f8ac56b0353b483941529bac80767353c499be61fc5a6d76fe1a2a11a058bc8a | File hash listed for a Noon sample. |
| SHA256 | fa0094afa2d08c83f24c8e4d8386c503528e4fa75fbd9aecd84baed67d93019f | File hash listed for a Zbot sample. |
People
Malware
DarkKometWin.Trojan.Darkkomet-9912346-0EmotetWin.Malware.Emotet-9910766-0NanoCoreWin.Trojan.Nanocore-9912485-1NoonWin.Malware.Noon-9912872-0PonystealerWin.Malware.Ponystealer-9912671-0VobfusWin.Worm.Vobfus-9913252-0ZbotWin.Trojan.Zbot-9912583-0ZeusZbot, also known as Zeus, is a trojan that steals information, such as banking credentials, using methods such as key-logging and form-grabbing.