Talos Roundup Highlights Nine Malware Threats Observed Nov. 12–19
Summary
Talos's weekly roundup summarizes nine prevalent threats, including Tofsee, Dridex, Upatre, Qakbot, and Remcos, with malware behavior, IOCs, and detection coverage based on sample analysis.
Key points
- Talos describes nine threats observed from Nov. 12 to Nov. 19, 2021, and provides selected IOCs and detection coverage.
- Tofsee turns infected systems into spam-botnet nodes and can also conduct click fraud and cryptocurrency mining.
- Dridex, Qakbot, and TinyBanker target banking credentials or other sensitive information; Qakbot can also spread over SMB.
- Upatre is a downloader used in exploit-kit and phishing campaigns to fetch and run other malware.
- Zegost and Remcos are remote-access trojans with capabilities including keystroke logging, webcam access, and remote commands.
- LokiBot commonly arrives in malicious spam attachments, while Swisyn can disguise itself as system components and drop additional malware.
- Talos says IOC lists are non-exhaustive and cautions that a single indicator does not by itself prove malicious activity.
Article Details
- Event Type
- Talos published a threat roundup covering prevalent malware observed from November 12 to November 19, 2021.
- Impact
- The roundup describes malware capable of stealing banking credentials and other sensitive information, controlling infected systems, downloading additional malware, and using infected systems for spam, click fraud, or cryptocurrency mining. The article reports no specific victim organizations or quantified incident impact.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 00c56be75b8a97c4c31dc8d652d141bc106e8538ad700d39b6e859b7c5f8b9c9 | File hash listed for a Dridex malware sample. |
| SHA256 | 00c5b07cfc87a55db54bea8c27325a8ec057432db8bda93dd25a2da77abbb94b | File hash listed for a Dridex malware sample. |
| SHA256 | 0128fc57adbcd1dc02c2aeca60edbd9b2a549b77f32310cf1e2a237a4f8e38aa | File hash listed for a Dridex malware sample. |
| SHA256 | 0152d5c8d5c0d06cca2a1930478bd2e83f675937e6ee5586b5a80507ae81f3b9 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 018573336b21665049ee3c3b4b39c92d7c1427491d18c622b08ccfe0a4a94b34 | File hash listed for a Dridex malware sample. |
| SHA256 | 02130e6d41b8a55506b73b37fd6d77f1a9a187ecc293e888a1dc4a985c169db0 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 02471d9d3cdddcadff03d8243f584708a6ba28d77cc5da0efff45504b2bd1737 | File hash listed for a Qakbot malware sample. |
| SHA256 | 024cf002901eab3ab1585e4b0141a9774b2f0f1152e04a3e2fb0a3ba830c490d | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0271ae4e8886e896784b907049630773e5de7025c0748f1a710ec9dcbbac08d7 | File hash listed for a Dridex malware sample. |
| SHA256 | 02c4ff92d4a044750b2e91639bf4d8efce5648b96f2ecab7a6a2707eeda04fc1 | File hash listed for a Dridex malware sample. |
| SHA256 | 02c846c4dc7fc3c15b3206c389e08d6ecb39f19652622be5fb97752961058da0 | File hash listed for a Dridex malware sample. |
| SHA256 | 03223b1dbb25780ab9a3e8f34a71e1fb323e8be7bdfc886014ba0a267a837708 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0346c4df86cc086186c6d9592ebeb3b1a5eedca61b88b2ad9a761566cc3bcc76 | File hash listed for a Qakbot malware sample. |
| SHA256 | 03661bd679d1f3b37cc4239f6ae6c9d84d5bf033a6d2b99b85414e9143fb3c9e | File hash listed for a Tofsee malware sample. |
| SHA256 | 0372c4577e460311ff3ab589fca7377f9f7aec6f1c00006eacf470fdef8baee2 | File hash listed for a Remcos malware sample. |
| SHA256 | 03ff99c37593464b21f927202b7fbc8a8cf6c51d3dbf16b6629041bffb39d670 | File hash listed for a Tofsee malware sample. |
| SHA256 | 044749da64b80959065e408320eb67977b235b8b362252941430e8344ba61a9e | File hash listed for a Qakbot malware sample. |
| SHA256 | 0449d9f16e8e63053fc06111f28ba376f2e953e4932740956d4d5f5f0b93e825 | File hash listed for a Dridex malware sample. |
| SHA256 | 04561ccae16e084d76acbb44d1be25c2ba86d8afac8a3fca29660eaca2b34f83 | File hash listed for a Tofsee malware sample. |
| SHA256 | 048ac3d6dde904a9cd940dbded0661543d67f1989c4759bba3473b6488fb742f | File hash listed for a Dridex malware sample. |
| SHA256 | 049ca8c6d474ea5f0dccf8c50ff896f0895ab1627ee1bd5b0eedaae0f7dff7e9 | File hash listed for a Qakbot malware sample. |
| SHA256 | 04a54dfcd4f17142d1c2fc996c8f91f718f12246fd33a84a5ab173218bd75361 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 04e985937414b777fb7d3a111f779bf426ecceabd324d3e2d12513f2b64e99df | File hash listed for a TinyBanker malware sample. |
| SHA256 | 055e85a43c1213f04242f2049e87d2f053bdb9c98c707871c886c14469bbc72a | File hash listed for a Qakbot malware sample. |
| SHA256 | 056743f877809fc9a7f12d580f81c4d1ed9722fd0073a0760c2008fb776556ac | File hash listed for a Zegost malware sample. |
| SHA256 | 058639bd1a564123137f573a3f6bd134f4261c9a5ce4d7b699a5d6c0db9b5234 | File hash listed for a Tofsee malware sample. |
| SHA256 | 05cd2d4b1000a54e88991d0a30330639c567bcdb1e223ecf64121566b2f32a08 | File hash listed for a Dridex malware sample. |
| SHA256 | 05d8473ad7a9760b9e830f2037e6aa13e1c7a1a5e9804914c0718a5cbf661a9f | File hash listed for a TinyBanker malware sample. |
| SHA256 | 05d8a45d257cb54eb9640c096f7ae10a28111d353379353267896c2e39995710 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 06895e0aa757526a1db8e28108d920f38c251dd2ff82f6f3966887cce4d07607 | File hash listed for a Dridex malware sample. |
| SHA256 | 06fa0b6539625919a50fb0223421e414576efc2143970fdd95f40a746a0f16f7 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0706bba2838df983529471cd69631f33d12e1b485cba344dc57322e117ebe655 | File hash listed for a Dridex malware sample. |
| SHA256 | 07127ef10acd4df0d25492749f5bbe4fae1dd12b86afccf49a7bac4d90c0ef2c | File hash listed for a Dridex malware sample. |
| SHA256 | 0725215db69f3c4a41069943a7402995f3b0b46e8a9b37324a70691393748faf | File hash listed for a TinyBanker malware sample. |
| SHA256 | 076b70fa87b74066746272ea95f54eddb566c52fc9a51a2d72e7d8c72ca76bb5 | File hash listed for a Dridex malware sample. |
| SHA256 | 078c5d0f5b5997edc94a9499f51361584f50ff59aad1791b2205fc2f26d056b8 | File hash listed for a Dridex malware sample. |
| SHA256 | 0792380989c44bb9aec90cafc957f7b7d21f81eb3f1cedc96d02d546b4a290f0 | File hash listed for a Dridex malware sample. |
| SHA256 | 07d4e4a403cbb13e9cb4d9e5b93accfca6a3177ab814a56bb7eaa133236a1a09 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 082fd3d3e84f4fc56f39e33daef815ec8c7391610e82b06bfe6dec0ad3e9f899 | File hash listed for a Remcos malware sample. |
| SHA256 | 088451cbf7fa6fe94d903a59a379881ebf5a277c3176163ded900de8b931b256 | File hash listed for a Zegost malware sample. |
| SHA256 | 08b255c47d50951554b95bc1f5bb39ca47571e0e3a1278751df3ca496538faf3 | File hash listed for a Dridex malware sample. |
| SHA256 | 08b3fce3fa87f642dbd2b25620c3f0ac8de16d93445a3d9cedb88e523ae3352e | File hash listed for a Dridex malware sample. |
| SHA256 | 08ba0d4d3dd007bff46ae0542a2c98ba60628eba77cb7744389ee48c7c79c5fb | File hash listed for a TinyBanker malware sample. |
| SHA256 | 091eee5c447ee8704e7794a2fb4439b9bb708f456224c6ed6a865f1b7475d7fb | File hash listed for a TinyBanker malware sample. |
| SHA256 | 092e6378795dd567ac7495375cabcf3795be1d823811acdb1b9b0af61b1d64ea | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0932aaa00a764aa6d3113693b9654c4441583e4d49ea90ec73275508bb215895 | File hash listed for a Dridex malware sample. |
| SHA256 | 0933a738a103b254128b8e0a352ddb3afa4acd752406e10a5e9474c4609fdfd0 | File hash listed for a Qakbot malware sample. |
| SHA256 | 094f7515eec3b7958f8870589089edbfa0ef1cf575c7d6b3a43da7d0d1abe0b7 | File hash listed for a Tofsee malware sample. |
| SHA256 | 098c59f8090d155304ae9f000d0d442278018f58725b574eeaa32300e6c6d074 | File hash listed for a Zegost malware sample. |
| SHA256 | 099bc2166751be0f1690e75cc33d7b9ffc85318b069579e2e749dcc6aff452de | File hash listed for a Dridex malware sample. |
| SHA256 | 09cc3d05903f47c0c69f37fa15812e062f31c4c1e98d65e0c807fc58eda586ef | File hash listed for a TinyBanker malware sample. |
| SHA256 | 09d2c82f3816ef0f20252289447e675302966f18e825d0fa13cd7c876e5ad7db | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0a4220ff6e26174493dc89e8ce9823c35cb0af7e48dbc7eac717183232fd0111 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0a8b700f63c4516e584ef3762f5109e92a528bf000a78723802cae3f5790661c | File hash listed for a Dridex malware sample. |
| SHA256 | 0ab53d2da3d1b31efa4bb64595b596c6ecd7d386a9193f03f96159c31fe75a67 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0ac08ec59b3610af16afbf87aaa629c39a6d78d9360e00032ed62176e09fc537 | File hash listed for a Tofsee malware sample. |
| SHA256 | 0ac9a15582fb14dcdb18de2a428f1d8147f3b3b8b3906d7adef32090c42250cc | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0b450950159922441449fee72487658e4720841220be7a788c1b0a8e9c3e75d3 | File hash listed for a Dridex malware sample. |
| SHA256 | 0b70de76004db86c01b75593e161565d6ae43b38c2c857701afca405d69257f1 | File hash listed for a Zegost malware sample. |
| SHA256 | 0bb4318b35cf03d1fbb546210ced6943e656a262cc433a4f712f0c4e7959ddc3 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0c09505192aa61064497384e242b1c8a11c24396d8f132d41c287db178d8d74f | File hash listed for a Zegost malware sample. |
| SHA256 | 0c5a8db4f2159f532266687b45dafe944bf4dfd20a9a28cbfd66217e714bb68c | File hash listed for a Dridex malware sample. |
| SHA256 | 0c87062d9098501109ab98b9a8eac04868551cf6e999d0754a59a753deed6ae5 | File hash listed for a Dridex malware sample. |
| SHA256 | 0c91483ff5f9991910798e9f3ee633abf2ef31da4ff9b8f57ca41e0c8297a9cb | File hash listed for a Dridex malware sample. |
| SHA256 | 0cb114d910520eb9a9d84bd2ba07136d78032c000931a45eea79ef43654395ca | File hash listed for a Tofsee malware sample. |
| SHA256 | 0d08ba828b1c630c7d24b4d4201af7dbc5057d4988777fc9d05105209a97ce17 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0d6992399eb5f9d14ed5c9df45d343a2905678e90b28cd8f20cdc0c5ff30f0db | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0d7705a73e45863f1569c3a8ea81c9c955ae954edc5878115074a1b0ea3e6535 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0da4b432e1e786acd0d17f5fd99160c3cf86cebae5ab638a558f72ef892988a8 | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0db36e990567b1eaa724cb4362faab0e10a53e7b69907d80bb45d99248b1c3fb | File hash listed for a TinyBanker malware sample. |
| SHA256 | 0fe1d8a8c3c163fd49babeb66546d53f4571c9f22f9a83de63a254ae5d18d9e4 | File hash listed for a Lokibot malware sample. |
| SHA256 | 0fe5e2ebd89b261c45afb1c109239a9d1454eaefed7f33cfdf9d03d3be797447 | File hash listed for a Qakbot malware sample. |
| SHA256 | 1056066b9615159420a6ae506355a3381e5ef74c407f6c2f65561d7ec7dfa9f3 | File hash listed for a Lokibot malware sample. |
| SHA256 | 1094247cfc3c21cc1d92530ceec27ff222b2726c0adc1f3f3729718c096c9a1b | File hash listed for a Remcos malware sample. |
| SHA256 | 11a47bb801f89c5e6442c9b9e82d78d9b9d096b69cf2e6da50558a218093bc5e | File hash listed for a Lokibot malware sample. |
| SHA256 | 126cf0521408c2ce45a01cb73023434dc8c243f863e76cc7bc311322b29039dd | File hash listed for a Tofsee malware sample. |
| SHA256 | 12fb7e94cc6314b8b7b5344a7f0175442afa789060152def17e49fbf5d1e7b4e | File hash listed for a Tofsee malware sample. |
| SHA256 | 151670dc1d668f2c83d8f565cdd1d11b7b6df66fd00b98b7335760b5c8a8f372 | File hash listed for a Remcos malware sample. |
| SHA256 | 152bb3966e37ea1bf0c9568b3b69a39a3672b1dca7a26cc6cb7f55244c064db8 | File hash listed for a Lokibot malware sample. |
| SHA256 | 162567bee7eae64e98a37dd94b912469d72e0b9ead239dc8bf062381ea5573d0 | File hash listed for a Tofsee malware sample. |
| SHA256 | 1753c24e29239337ee07f54f63e0c64c289c04d25da9655dbb4be3ecf66ef5c7 | File hash listed for a Qakbot malware sample. |
| SHA256 | 1777dff35999261600036f0264141d62e1c4f88cef8dd97a89bcc64e2bf68075 | File hash listed for a Tofsee malware sample. |
| SHA256 | 19a533118e27402e50b47828c630d3f7175981802d6dce5cfc68f428810d1960 | File hash listed for a Tofsee malware sample. |
| SHA256 | 1bbc90ce190a6dded22f8b6a4d2495651ec47f0c6e24ba56c3b2c6fea90c7f56 | File hash listed for a Remcos malware sample. |
| SHA256 | 1c156bc2ad07bb6bca80a8fcb725fa3b895421d05282fd41853d7e64da2fb7c8 | File hash listed for a Lokibot malware sample. |
| SHA256 | 1d000a8745f2ce790a1cc6c3160e71c81cfb1e2d5c1d6436afd4071917a319d5 | File hash listed for a Qakbot malware sample. |
| SHA256 | 1d8038e402b39171ee64d171c12c60bf897492db478656fea9c77b9c2106fcc2 | File hash listed for a Tofsee malware sample. |
| SHA256 | 1f82fad5fa5478fc222b676a42293ec8d0a466f2f8e204038fd6363ea831d0bc | File hash listed for a Tofsee malware sample. |
| SHA256 | 1ff810a2b3984f81e1add9b3480634e3064fa42d03a6f1f96409ca233aa69795 | File hash listed for a Tofsee malware sample. |
| SHA256 | 1ffd2e18fa97e79e28c5e6fadf238f8c00fd1098713cd0938b985dba32bf888d | File hash listed for a Qakbot malware sample. |
| SHA256 | 22bb5e661f68e754d3b3cfcfea3bf8b31470a66bbd4b29024541c321e88ca1f9 | File hash listed for a Tofsee malware sample. |
| SHA256 | 23144366530195e784561504154be9c14aef2b6b6eab0580e85172456f15952f | File hash listed for a Lokibot malware sample. |
| SHA256 | 2518da58891ef13fd1618081eabdf3cbf2caf3cde8b74b10d79d32541fd36be3 | File hash listed for an Upatre malware sample. |
| SHA256 | 25994f330617747ddfe70838edaf7ec1e73b7ea39263334af740c7244203656b | File hash listed for a Tofsee malware sample. |
| SHA256 | 2599a91668040817a390943c079d8fcaac9777ba3d924400746b4af539bed865 | File hash listed for a Qakbot malware sample. |
| SHA256 | 266e287d8c6a97d2ff9d6c70c39f89e26a6c8b5d60c0cd59a3dc89ed1b1c5f60 | File hash listed for an Upatre malware sample. |
| SHA256 | 26b847b9d63e7293e69bc8e98737441b4ee86b9f03bbec2ee7fd8d00fb1586d8 | File hash listed for a Swisyn malware sample. |
| SHA256 | 272ea7fadeb59c9ab60818c5245d00cb2bcc912a68750c4fd79124920d55112f | File hash listed for a Tofsee malware sample. |
| SHA256 | 284384858ebe55331e9079c24a941b5cf696f9edd9618b1a8141a0fdac003bda | File hash listed for a Qakbot malware sample. |
| SHA256 | 28eeb792434fc67834c4d3b7d73342449a01c79afc9d09a05eca9f7dce19182d | File hash listed for an Upatre malware sample. |
| SHA256 | 2a2c37a66a9942674f1287a5515453b1ba1452a2d47d5d0c4f8e76aeff6f451a | File hash listed for a Tofsee malware sample. |
| SHA256 | 2a3e8af2709e32cadf791deceffe0143b731f3bb569b0038ad509ae7e394c759 | File hash listed for a Lokibot malware sample. |
| SHA256 | 2aa74e8aa589bf82e32e808be028fb01fec3478a5bff7bc00a7add8210327a30 | File hash listed for a Swisyn malware sample. |
| SHA256 | 2bbe321c937a867e6afaeef1fe6b905b57b379f1a79c704b0e9b7ecbae63671f | File hash listed for a Tofsee malware sample. |
| SHA256 | 2e5434fd79a56b69e6eb19b2018422b682af4e884430ca7741fa94a69ebb755c | File hash listed for a Tofsee malware sample. |
| SHA256 | 2e698bd82d0de901ff9ecfb2b917a906cbfd7eff6e99ed2b5ff51d38a20ccc0d | File hash listed for a Tofsee malware sample. |
| SHA256 | 2eca8e105b24220bc33db857541a618716786b9ad31165e5022560be7fc49a22 | File hash listed for a Tofsee malware sample. |
| SHA256 | 3027eae72de359da55affc80dbb872a37a3d8508c7f0f554b833f8226fe1572c | File hash listed for a Tofsee malware sample. |
| SHA256 | 3033f680a38184d6a9239ab6838c3e9524bcc1b33fd642a89a14374693c90cae | File hash listed for a Tofsee malware sample. |
| SHA256 | 309f5a1cdff1f76f711cb645546f565e33a85578454a3db55d552f4a2da31de6 | File hash listed for a Qakbot malware sample. |
| SHA256 | 30a3ceab8c39bca0efbe80393e1742e874a3acbb1643c9c90e02a920c852e38d | File hash listed for an Upatre malware sample. |
| SHA256 | 313c24d3cec6479c43178abc2a6ac0cd329946a4df241cd663f895654699a9a7 | File hash listed for a Qakbot malware sample. |
| SHA256 | 318cba380f44c1e50e5790af83bb687ca4f8376fe3a70b99cd1972ad8d62aade | File hash listed for a Qakbot malware sample. |
| SHA256 | 32dcdbac829f1b6607c1581488a6cf95541fba686f5f81c23b9e1e79761a971b | File hash listed for a Remcos malware sample. |
| SHA256 | 332eb007a5e9b3e603bcd8546505d6df1b480ab032f772f5a24730c4cc6edfc5 | File hash listed for a Lokibot malware sample. |
| SHA256 | 36869a1815743cf14459abb724875420e6fc50434bc3a21afc9e6c7193eceea7 | File hash listed for a Lokibot malware sample. |
| SHA256 | 3a313dc1c76508f2922fd0a39d7b3dfef483db53269112a752447334ac6cb776 | File hash listed for a Remcos malware sample. |
| SHA256 | 3cc8a5d01c2700633580b4b2613fb7199081aa3242d1dcbcda273e582f018fbf | File hash listed for a Remcos malware sample. |
| SHA256 | 3d1428a033a496233c9fb75ab2b752afbe42f2bbf016df0213a666d5699da298 | File hash listed for a Lokibot malware sample. |
| SHA256 | 3dcc4eb394443b54be23c25fec161ea925a303a42e082bf3fa42246ec781a494 | File hash listed for a Remcos malware sample. |
| SHA256 | 3fc0249dff863f528fe5e4cd17b0a5de1d8228d4e5aa3a154b5bf1806b4e1da0 | File hash listed for a Remcos malware sample. |
| SHA256 | 422a0f8315b7feafd2cf278a5033f1b19ae24a7dece95494785ee19507774bf8 | File hash listed for a Swisyn malware sample. |
| SHA256 | 4422d6000e7305ac7b5a274881300a536080c9c554783505397b7b40a591c9df | File hash listed for a Qakbot malware sample. |
| SHA256 | 46affed62fd1b09409e959b462bba34befdc744370b442ecc2ac8a74281d1bf9 | File hash listed for a Swisyn malware sample. |
| SHA256 | 482187ac5805a6583bb4c0a8eb8fb9e874a0a919f65feaa864545960c4e2a7ec | File hash listed for a Qakbot malware sample. |
| SHA256 | 4a639194833c2aa93ae24d698e401c5a2c491c2113e2a8b02065f9bc63e3087e | File hash listed for a Lokibot malware sample. |
| SHA256 | 4bfab196ae66dbdb3eb4908bbeca38876f92e154e7d20d9094ba94cb0db5466a | File hash listed for a Swisyn malware sample. |
| SHA256 | 4c74cffab002987f5d4e6fbf9e4d04189f379acac3cc2ec59eb8f0e54e574509 | File hash listed for a Qakbot malware sample. |
| SHA256 | 4ddc18dad4a0a87f154381ae9b8abfd6bbf4421a2a4e07fbe71303c62e46bbff | File hash listed for an Upatre malware sample. |
| SHA256 | 4e09b8baf48d1342c0c3cac68be48e92afcef53ce8c0bbb6551fb8a0536c0d3b | File hash listed for a Swisyn malware sample. |
| SHA256 | 4ed4964fa9cb3a000a7d2e6dec5947922206b204f74eddefe0854b64b34c9756 | File hash listed for a Qakbot malware sample. |
| SHA256 | 54ba2cac83253cb5c7944bb31fbac74df60ca8beb12641efedb244a6167eeebe | File hash listed for a Remcos malware sample. |
| SHA256 | 56cd903f43c846053545e27d271ca3b3135fd64aba2f50be236e7a8e26d6aed7 | File hash listed for a Qakbot malware sample. |
| SHA256 | 579a390afb6a62b1d5d385667d49ddc18cfc15e943610a79e0d6c8a28fd8037b | File hash listed for a Qakbot malware sample. |
| SHA256 | 58d40bff4b7b704cc78cee0f656f2e8d9cb6de7a3afd3c181014393d1766217b | File hash listed for a Zegost malware sample. |
| SHA256 | 59a5fb406458285dd568918fea5b9f04cee62550035c57fdf27b03266e7f6ae1 | File hash listed for a Swisyn malware sample. |
| SHA256 | 5c98a566572aa8532090280a89cb499331c3808a83a342d38c92101a061071a5 | File hash listed for a Qakbot malware sample. |
| SHA256 | 5cfe8fb7502b34427c8b740f2917f0d807685f7be24805557b6287d3c1ab6824 | File hash listed for a Qakbot malware sample. |
| SHA256 | 5d338499e8b23b51b4bc4fc33784c9dc745e19d7203bd728cd407d9f670840eb | File hash listed for an Upatre malware sample. |
| SHA256 | 5db41ab963a3599f59e3710604affea88cf52bca4efbcbd23148bbce8f3b0ff4 | File hash listed for a Qakbot malware sample. |
| SHA256 | 5e28c3f2f8fa2c3a5bfda0f20a1a637aa6440cffb9cfc23301c08d76de31ce97 | File hash listed for a Swisyn malware sample. |
| SHA256 | 5e74d541ba789c4d131af74135ddac5095bca2dc03967f9d23e00a386ab24f33 | File hash listed for a Qakbot malware sample. |
| SHA256 | 5e9a31d75ac34406d3551f3cf340cc8ae91bde19720588ce28cc95c05d6ffe81 | File hash listed for an Upatre malware sample. |
| SHA256 | 62d50e6a1e1c32805af7250d425eecea8db2130b894b9575c1980de3db848142 | File hash listed for a Zegost malware sample. |
| SHA256 | 66aa17f56b7a862938665619e4bc608c5497f8cc1c7d604a2d2173ada3036f40 | File hash listed for a Lokibot malware sample. |
| SHA256 | 6c8187f7e23ea225ac2beaf7b472c858ed87f9387bdb6bacdaa145fc453fe869 | File hash listed for a Lokibot malware sample. |
| SHA256 | 6cf3404ffd23fda2f1d2339562cabd005cf5dd1630f31495c5a23bb18a6d6a63 | File hash listed for a Remcos malware sample. |
| SHA256 | 707f625b7ebaea58d697abc08d25c1eb28048b908b04933f337586c7f892ffe8 | File hash listed for a Zegost malware sample. |
| SHA256 | 7091d272340a28bde1fcbb0fabd56865047d1d603bd063a6f392c7bb4fee09fc | File hash listed for an Upatre malware sample. |
| SHA256 | 767aed3a76b866809e653d6c691dffa705821ed1d3afd4f001d77b851c4228d7 | File hash listed for an Upatre malware sample. |
| SHA256 | 7766fb1e75654cec291a852ae8db9a446f06ef1eb4a306845b7a3ae4d8e8df07 | File hash listed for an Upatre malware sample. |
| SHA256 | 77958a1bccfabdcae62f07b7c0eb76a9defacb5356d7f66c2763522027cdc084 | File hash listed for a Lokibot malware sample. |
| SHA256 | 79630eb2a9b6a615c56c660166709d45aeb443adb96ce06581b6cb6a21a17b8e | File hash listed for a Zegost malware sample. |
| SHA256 | 7a304dc213507863958e88b90bff3d9bfbc334ed92e21f708916ec6dd3c72212 | File hash listed for a Remcos malware sample. |
| SHA256 | 7b22d5c3ee0290477032f5022db7ecc1d326af2ccaf1de8413a8373e5c3eaba1 | File hash listed for a Lokibot malware sample. |
| SHA256 | 7d3ce9002a213217798da5624bf8f667ad972fba1ea5f076e520f095299c27a4 | File hash listed for a Lokibot malware sample. |
| SHA256 | 7e5f4967788d1818a5c578ed8302ddddf76b4177b123deb472d531b7e6158893 | File hash listed for an Upatre malware sample. |
| SHA256 | 7e64709cb86a58132d712f270d5672cd189bac61209b5ea91bda06ef57b27f38 | File hash listed for a Lokibot malware sample. |
| SHA256 | 7f7cf8bc35996c89e1a8eb117715108463a72944825e06d8ffb3c1caaf2aa3b9 | File hash listed for a Swisyn malware sample. |
| SHA256 | 8115607710c35c78eda8dd16d73cab92e2c857d8c91eb1422fcc1b3f06835a4a | File hash listed for a Remcos malware sample. |
| SHA256 | 818ad6b8fdbe2c74aad5f00844bcefe12259205d65b64fe2152c0c614bd681b7 | File hash listed for a Zegost malware sample. |
| SHA256 | 83abc3d26ce461e8fbedade06fb4cdc677e24696cca810303ff44f51c53d71e0 | File hash listed for a Remcos malware sample. |
| SHA256 | 8696ff9c6dbc3fdb2b3293420f4d346b34fd32668741c011378145caf355df55 | File hash listed for a Zegost malware sample. |
| SHA256 | 8836aa61a44b8893b6bba6d04631da4b5957a38f13b9d32035124ed5231e43a3 | File hash listed for a Lokibot malware sample. |
| SHA256 | 88dd2f9c19b141ccf06cc2763744a02e7bf109032419f7c2259ff1ed3ef51a63 | File hash listed for an Upatre malware sample. |
| SHA256 | 89af046207b6e8103c091abe389f0545ffb71b5c076356e1b0fc7923270815a1 | File hash listed for a Zegost malware sample. |
| SHA256 | 8edd01d75148a887772176f839a4038ea335c12aa486deb791b6775598c848b1 | File hash listed for a Lokibot malware sample. |
| SHA256 | 8ee5d734b9a336408f96ed0cc22b4274060891785bbe7ced078ecc5b1aee4aee | File hash listed for a Lokibot malware sample. |
| SHA256 | 8fbe58e4b659519adeb576a644c7cddb460578e69806a8097a76b2f3f6fb3c16 | File hash listed for an Upatre malware sample. |
| SHA256 | 903d8b66bbfddff7b694f75e35190e382e033f1d4ff7f0ee771d2c57f39ad0ac | File hash listed for a Zegost malware sample. |
| SHA256 | 9041ba3c4fff8950dce32365909de45ede11a78e51e37de04a8c2dc6a879a205 | File hash listed for a Zegost malware sample. |
| SHA256 | 9236489821b3520b81cc7ec439cd4d2cd6cd7d508e533276007b03088cfa72e1 | File hash listed for an Upatre malware sample. |
| SHA256 | 9831b9805ab6c01c33b96b866dbbefa0264f182344cedf562acac24b41091f3e | File hash listed for a Lokibot malware sample. |
| SHA256 | 9f07b7d90dc159c18619741bbbe05a2eb512a53865ba5101ba9f5668ec01c427 | File hash listed for a Remcos malware sample. |
| SHA256 | a02ae4b1dc4990a6a728ffd0dc9432cc1b8d27b48abdfdc999d79712eb90b937 | File hash listed for a Swisyn malware sample. |
| SHA256 | a2a17e33d42492410d1a769fd8502ce19acb3723373d487b546c4f1357c64fa6 | File hash listed for a Lokibot malware sample. |
| SHA256 | a4456199681d999d43ea0b47faa1004720e7263975dc78845d127af687345cf1 | File hash listed for a Zegost malware sample. |
| SHA256 | a50fc8cfea747c35e62bc8639a07a33d4d184278e3f9cea036e1c54d9a4d5fdd | File hash listed for a Remcos malware sample. |
| SHA256 | a642fd427995eaa92a2a5297fb781f97b76b8201eafdd25ceb095d47f623b314 | File hash listed for a Zegost malware sample. |
| SHA256 | a88a88b707fef354c6dc029a0ea9f95a616371d80702b2fdf756bca6d02fc6a4 | File hash listed for a Remcos malware sample. |
| SHA256 | a94fae2dfd754d3896a8c4ae025945755abcd4964e1df2335928b807744a390d | File hash listed for a Zegost malware sample. |
| SHA256 | abb25beca1ee50fb9eda2443005900bbe8996d3949d7f7a2e42883c6ccf9fdfc | File hash listed for an Upatre malware sample. |
| SHA256 | aea3f2428d0445780edc933f539feb1b06ddda6d6babde5045f7ac7698aae2ad | File hash listed for a Zegost malware sample. |
| SHA256 | af28f875488f17679ca3886d16f53eccc3d0a610f8904ce047dbd3581a9d904e | File hash listed for a Remcos malware sample. |
| SHA256 | af67aa98f71ce8f9f4b467bc6f280b9c86147bbbfe0125bb0e6c75f4dd0ec7db | File hash listed for a Remcos malware sample. |
| SHA256 | b0c4ad2f219316707e5ba2ca5380b88cd959a094f023896eb49af56ffbb7f628 | File hash listed for a Lokibot malware sample. |
| SHA256 | b4c74c0a33b127033fa1d807c13740a943c23cf3a3a20c9b0491968c63112fa6 | File hash listed for a Remcos malware sample. |
| SHA256 | b4d659a674e65676717546af3415ab83acac64c2efd955a9957dffe08b0a87c8 | File hash listed for an Upatre malware sample. |
| SHA256 | ba409fc54cca92cc4958838eae1c5f6125cd985d624c809c3881f0b497025aa4 | File hash listed for a Swisyn malware sample. |
| SHA256 | c03b1078cfa67fff8fc51ef2f1289dcb770670ff762022276c40508837088972 | File hash listed for a Remcos malware sample. |
| SHA256 | c1865ac0794651beb93b78e76ed50017b3d7f9d473a74b9cf1b084ce115945dc | File hash listed for a Lokibot malware sample. |
| SHA256 | c276321536a7284a91e06a8806e021bd16b2e170d1079e9da95d358000ab0681 | File hash listed for a Zegost malware sample. |
| SHA256 | c360b92d595969784cd29b5c3279839791457b892ca4dd5b908045ec30a00cc9 | File hash listed for an Upatre malware sample. |
| SHA256 | c442281d6e2578135f143863f6963ee054fb57b7acf432b4473719523930cc48 | File hash listed for a Zegost malware sample. |
| SHA256 | c9046bcedd1fc7234f6e7866701b0102b84f8534b7777de9cb1ad0167874c2de | File hash listed for a Lokibot malware sample. |
| SHA256 | cc8fe1ca09dfd51e97425bf48482ccb4802feb995087c675c8ee53ff7598d891 | File hash listed for a Zegost malware sample. |
| SHA256 | d4da3ff1cc052027bab7ad61dbfc0e5a1b76b638568824de0a2c0c37d5d52133 | File hash listed for a Swisyn malware sample. |
| SHA256 | d7f219ba7d6878ea3ae04c18c5cba9e7adeb857ba14c39414dd79913ade54053 | File hash listed for a Remcos malware sample. |
| SHA256 | d7f8f77dd1fb4538f7008d669e13e058fc4c5f07ae8352920b6475e4a4600907 | File hash listed for a Swisyn malware sample. |
| SHA256 | d826a201446c0767ceee153350aab548ed53eb1090ebd0c749e50f5ac9a58ae7 | File hash listed for a Remcos malware sample. |
| SHA256 | d9646a5d9e2ac0eb2a28dfd33d900d0b7559d4879854fc454c74ab9f59ea934f | File hash listed for a Remcos malware sample. |
| SHA256 | dd8d0388f80224596d5885cfe87035f5519b2c875d76e755beae4ff0fd4004ed | File hash listed for an Upatre malware sample. |
| SHA256 | f05e7098dad1b969ce36bdfc6bee90907476c7b3e68fc0a1443c546086853a28 | File hash listed for a Zegost malware sample. |
| SHA256 | f52c43c64cf6fc509d6dad3f76c18fe31873d3b110711bdc2963b743f7035e37 | File hash listed for a Zegost malware sample. |
| SHA256 | faee50ead3e4795a1606ca880c3a0b56af562ca8d92c91d07df20d447bcff174 | File hash listed for a Zegost malware sample. |
Malware
DridexWin.Malware.Dridex-9908803-0Gh0stRATfootage from the webcam, and uploading/executing follow-on malware. Zegost appears to be derived from Gh0stRAT, which is a well-known remote access trojan that had its source code leaked, thus significantly loweringLokiBotWin.Packed.LokiBot-9909484-0QakbotWin.Trojan.Qakbot-9908979-1QbotQakbot, aka Qbot, has been around since at least 2008. Qbot primarily targets sensitive information like banking credentials but can also steal FTP credentials and spread across a network using SMB.RemcosWin.Trojan.Remcos-9909797-0SwisynWin.Trojan.Swisyn-9909323-0TinbaTinyBanker, also known as Zusy or Tinba, is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" andTinyBankerWin.Dropper.TinyBanker-9909392-1TofseeWin.Packed.Tofsee-9908326-0UpatreWin.Downloader.Upatre-9908308-0ZegostWin.Malware.Zegost-9909329-1ZusyTinyBanker, also known as Zusy or Tinba, is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" and