Talos Roundup Highlights Eight Malware Threats Observed Oct. 29–Nov. 5
Summary
Talos summarized eight prevalent malware threats observed Oct. 29–Nov. 5, including information stealers, RATs, a banking trojan and ransomware. The roundup includes sample-derived indicators and describes security-product coverage.
Key points
- The roundup covers Tofsee, Expiro, Shiz, Remcos, TrickBot, Formbook, LokiBot and Cerber, with indicators collected through dynamic analysis.
- Tofsee can send spam, commit click fraud and mine cryptocurrency; infected systems join its spam botnet.
- Expiro infects files and steals information, while Shiz and Remcos provide remote access; Remcos can log keystrokes, access webcams and take screenshots.
- TrickBot targets financial information and is often distributed through spam campaigns and downloaders; Formbook and LokiBot steal sensitive information.
- Cerber encrypts files, including documents, photos and databases. Remcos is commonly delivered in macro-enabled Office attachments, and LokiBot through malicious documents sent by email.
- Talos notes that the listed indicators are non-exhaustive, current as of publication, and should not be treated as proof of malicious activity on their own.
Article Details
- Event Type
- Threat intelligence roundup covering prevalent malware observed from October 29 to November 5, 2021.
- Impact
- The malware discussed can steal sensitive information, enable remote access and command execution, deliver additional malware, send spam, conduct click fraud or cryptocurrency mining, and encrypt files. The article describes observed threats and malware capabilities; it does not report a single confirmed incident or quantify victim impact.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0085bd626daf5156f1a672802339e9ebbbe8f6a66c3bb13515cb1c49981ecec8 | File hash listed for a Cerber sample. |
| SHA256 | 016f7f0db9174d5b1eee7c9d75ca4eca4144f2f8022788a09aa5cccc5d23cf3c | File hash listed for a Tofsee sample. |
| SHA256 | 02d105483ac313b266149efaa2e2335e71ff8806913ae7644f5fc10768d0e6fd | File hash listed for a TrickBot sample. |
| SHA256 | 03f403b32fc64427ca194b41d99460191d799bb0b78142eb649d673d6346bae0 | File hash listed for a LokiBot sample. |
| SHA256 | 04a4232005cd3a8d1ff7d68e62e60e182ead7f447d01fce4dfc8ab38c137de86 | File hash listed for a Tofsee sample. |
| SHA256 | 04e55f268a68c429344e533486adcd69d00863d415b40cd90f31f3753ede5fb9 | File hash listed for a Cerber sample. |
| SHA256 | 04f91e8e431e9a1fa07d70393a7a927062bc2342c4aaab91fca7309fa747ea14 | File hash listed for a Shiz sample. |
| SHA256 | 0554a16cf259d2cc672c5b008987219382e098f35b7bfb84c14c0d29930c8eb7 | File hash listed for a TrickBot sample. |
| SHA256 | 062b45c5f3c3ca89b1ffb4ba1dbc1bf00fe65bd359252c9d9c908176e46abb5a | File hash listed for a Tofsee sample. |
| SHA256 | 0638d514c06090c3c344d59abbb458ca9ccde4e7e581faad880c58a15b2b10b4 | File hash listed for a Remcos sample. |
| SHA256 | 0662cdf8f2b283940388af235c6eec863a9531833bbb584036931c769807ea57 | File hash listed for a Shiz sample. |
| SHA256 | 0933d6962abc588189455f5104bc9aa3185650fb1193ba5835c48fd041500b84 | File hash listed for a Shiz sample. |
| SHA256 | 09798abd4f801a9705ea91c9fe3bc45698581182e15e45fc226a77c57385dccd | File hash listed for a Tofsee sample. |
| SHA256 | 0a41e5c1a46e76a6c1502a6bd039fbcdece4e005e0a2e1dfe90d3f7d3e528fe1 | File hash listed for a Tofsee sample. |
| SHA256 | 0adad073bf947a35c072e9c20c507d1c23f44b304300f6eb9f9b58cdf518a10a | File hash listed for a Tofsee sample. |
| SHA256 | 0b842217f0d63a6d0f1d3a95387925771a8643dbd4de736f1522389e026cae5f | File hash listed for a Shiz sample. |
| SHA256 | 0ba194872139ac85544213acbfd22b2cfb7642d1c486fd8ac66b5a3cea945744 | File hash listed for a Remcos sample. |
| SHA256 | 0c6cda02f0e9fa4918cda8e5c2a37fea0b8e42b5cc3d14cf22cd7fc9bc09d89c | File hash listed for a Shiz sample. |
| SHA256 | 0cbedf858fbd020acaffa48d12555bc1e994cce29dd331595f4e3203328de0fa | File hash listed for a Cerber sample. |
| SHA256 | 0f1c0bf8e36fb46cdb5294338bf70b3e6b02ff696fa8978f6ad9b67e466cdf80 | File hash listed for a Shiz sample. |
| SHA256 | 0f2ad4e29b437dd164af3d6424e72607b866105f07d621ac5d1198266e6954c3 | File hash listed for a TrickBot sample. |
| SHA256 | 0f3e8740d9a93b2edb1ae56aa28cdc4cd4f22e8f47eb6df0825ce96c9349513e | File hash listed for a Shiz sample. |
| SHA256 | 0f9e878a61fc55fe29307a20621a5aa9a808da08fa5943c121a8300513b2cab3 | File hash listed for a Shiz sample. |
| SHA256 | 10835bc265400c7f33720d8ba9f7c6e6543c0ed871fd254436b245fa27d01283 | File hash listed for a Cerber sample. |
| SHA256 | 10e264ab095c3cfb9584e75dbe655f195eeeb719d9b2c1b81d70bf5500e12d83 | File hash listed for a Tofsee sample. |
| SHA256 | 10fead5c5e63b2da718c7ad176ad4a1ca992ee19a8798c648e9eebe373f11729 | File hash listed for an Expiro sample. |
| SHA256 | 11f5506c22eef1b12411321de9244af7283a2f04b6797b7f6f5a75c38407c405 | File hash listed for a Shiz sample. |
| SHA256 | 1253539181bdeb698e2612a4bfdb9e152bef83dfb9411fcff578930a8f1222e6 | File hash listed for a Tofsee sample. |
| SHA256 | 125461a8f5acca9fd1b36bd24b15f5db641a44467520dc47a7159b8976e25c2d | File hash listed for a Tofsee sample. |
| SHA256 | 125608d7d07f55cca855f2ebce7a3e519c33a4a64878db723cc16491fdce8cdb | File hash listed for a Tofsee sample. |
| SHA256 | 1283dd2dceb3b131e5d2f2d0a86ea8994d60eb91796c5e3f70beb3c68de47721 | File hash listed for a Tofsee sample. |
| SHA256 | 12fa15bc01b40464733a40f470cee3e010a8b447b87e0a89aa1906ddef931041 | File hash listed for a Tofsee sample. |
| SHA256 | 1342077811316fa66f11d7970706df218ccad26f2f3748d485a2499e85d4fab9 | File hash listed for a Cerber sample. |
| SHA256 | 13573f98478916fb97b844eccb4881209c86d2c3f593bbd5833365c8bbfb7c05 | File hash listed for a Tofsee sample. |
| SHA256 | 138cd8289dd247e0d64379da4f81053fe045b145e09fbe24ca46b219fb8a33a5 | File hash listed for a TrickBot sample. |
| SHA256 | 13dea4be00642b3c334c30ccbcd1a7dd109df154be09679ce01f903bca5349fc | File hash listed for a TrickBot sample. |
| SHA256 | 152b8c286512f28b0aed6c46367b1618f8bc300ee9a171855e82ee6b68393c5e | File hash listed for a Tofsee sample. |
| SHA256 | 15c20587aa400eab84217f8eb3488305598da3a63c5cc3482dcbb17ee1b25bb7 | File hash listed for a Shiz sample. |
| SHA256 | 15eb56af5d04ad3bad00b4193e5ee9e8b786b3d8d419291b33ca4fa8090a2f5b | File hash listed for a Remcos sample. |
| SHA256 | 160b00953ef50a50f115a5e1e29faf08d9f34198280df55bda66fd8c154eb76b | File hash listed for a Tofsee sample. |
| SHA256 | 173256731ccf58460e223bac2eafd0f62f81b3e562fc9ee37625b9c603e3fbfa | File hash listed for a LokiBot sample. |
| SHA256 | 17357a25014eb9981fd44462e8445b481b4d961b7ed1204b86572b3b12b7217d | File hash listed for an Expiro sample. |
| SHA256 | 175f4dbb1e0afa10f100ac6d961f249058559cb8d7605adff11393ada7cb645a | File hash listed for a Tofsee sample. |
| SHA256 | 1790f9cbe4ed673828770b1009712e6909b3194290469a1c334a002fd9aa3815 | File hash listed for a Shiz sample. |
| SHA256 | 1798ef38a8a03ba6b3a408d4aa72f0b4df542f9b7d47cb0842a29a3aa0f1eac3 | File hash listed for a Tofsee sample. |
| SHA256 | 187c81e2db643c99c75b95a646f9635d5dece15eaedb671c7743caa802f2f103 | File hash listed for a Tofsee sample. |
| SHA256 | 1966429bfc1e9134d6226bce7666d987da9c606d9828d92174bbdc02e40c9039 | File hash listed for a TrickBot sample. |
| SHA256 | 1a8e73f191343894a2ff5c1f13a8cd0a29135bbd1b81f52212f28f6a50a8dc41 | File hash listed for a Remcos sample. |
| SHA256 | 1c1a3d9d84c62f336842f59036d4a60ac23e00748b48822ca0c23acdbdd9aa38 | File hash listed for a Tofsee sample. |
| SHA256 | 1c8044345a2bea4eaaebf8e61b0fb378e940944c0c1fb712bac3a07ca95fc39e | File hash listed for a Formbook sample. |
| SHA256 | 1cae2c61a36a26906a5bbfd85a8c496437a394f1b0768ac2c3bceb145e1962d1 | File hash listed for a Cerber sample. |
| SHA256 | 1d6cac17381e03728882db8d50bef577b65ba46cacd96f12ba3953cd3a50dbc9 | File hash listed for a LokiBot sample. |
| SHA256 | 1e0de5782d379b8bd2b29194b0240d325fb9e9b969eb46441d8644bc54ddbcfa | File hash listed for a TrickBot sample. |
| SHA256 | 1e36c2085f60d512890107d51ea1ba549414026f72fef067be9c209d6b0ec793 | File hash listed for a Shiz sample. |
| SHA256 | 1ea753ece3d0ce52306ad167ddaabef9a739fd2c056a4d0b6be5104438ebf6ee | File hash listed for a Remcos sample. |
| SHA256 | 1ebbf519c65821916d1d6b0b19941d2b5bd8aa034baebb3f35e2b2fcbf9cfc6b | File hash listed for a Tofsee sample. |
| SHA256 | 1ef2998bb08d46eec2661851d56797a2125f369d56116ceb4a6120c033b24130 | File hash listed for a Tofsee sample. |
| SHA256 | 1fbcd93405a9f95bd57cf41bf0694042f90051669bfb547192303f22b88bfcbd | File hash listed for a Shiz sample. |
| SHA256 | 210202282c617ec43a285f39b42507ef0a23075c393d424e88b0cd9cede1790b | File hash listed for a Tofsee sample. |
| SHA256 | 216d9c0080c435c8b2bb79b9f80f4582be20297e1a2e0df6f01d43a6c6732ca0 | File hash listed for a Tofsee sample. |
| SHA256 | 21c317f718a5a3afe1fc316d0a4d5e55575d7f7b8694f171942bf658254f7519 | File hash listed for a Tofsee sample. |
| SHA256 | 23bb39887b18379102bfffcad17fbbfd27e7ea1bde0170d7d1e4955dad1df199 | File hash listed for a TrickBot sample. |
| SHA256 | 23c8721a7117f3b42b9e6fad0c7ca903b8e3129cbe820b8f6cee34d22655523a | File hash listed for a Cerber sample. |
| SHA256 | 24205c177a537ed399ce06f6a9ffc388f53edf9e7dd998f25e6c1a805ba96cde | File hash listed for a Cerber sample. |
| SHA256 | 25584513100af73fbe0603f1c28a5d884951416cb6424893483c26576b894677 | File hash listed for a Shiz sample. |
| SHA256 | 25aefdb28717eb2a9d819f551863f71ce47d03aec38706af8c7b97b7a615a218 | File hash listed for a Shiz sample. |
| SHA256 | 25d65ddd388d8054ae9bb720d77e450a7c3f73ca2e3c6f889756f0796c2b0956 | File hash listed for a Shiz sample. |
| SHA256 | 26acfec03c1e62b822951bab77a14215a91a8b8037cf217e208f384d3a5babc3 | File hash listed for a Shiz sample. |
| SHA256 | 26da34606d0d85b84546b147312b8e8edb7c9ae82626d7cfa0a8c24336895908 | File hash listed for a Shiz sample. |
| SHA256 | 277f49c73d1bdb401b884446af8079fd978180237450b6b2ea7d0fa5fdeae53e | File hash listed for a TrickBot sample. |
| SHA256 | 28833224084ac9b028cb83334ab7d8595c6b98d0486de0d7efc0ade9c3370d47 | File hash listed for a Shiz sample. |
| SHA256 | 2927806517447a4d9a2ce7155db74b86e3a0c5a0662a8eba5c49f2ca76ef52cb | File hash listed for a Shiz sample. |
| SHA256 | 298b36734b89ad5870f63024776b22a00a56e42e258bdf83dd09d9bcd7c5ddc6 | File hash listed for a Cerber sample. |
| SHA256 | 2a79298f607fb0bab9a707ab721cef13475425f798697d2c6983852eb721dd2e | File hash listed for a Shiz sample. |
| SHA256 | 2b4769bedbb68c7d16ce8a24d11a71501251c087381e74fb442b3d18608f0593 | File hash listed for a Shiz sample. |
| SHA256 | 2f0cbda2d3909186b4bfad72bae2aa2b37132c7f077378efebe683d946db1504 | File hash listed for a Shiz sample. |
| SHA256 | 30115765f6834c4e1dae38aee7d469710d012350844890ce6da6a0e3a0a6a3c6 | File hash listed for a Remcos sample. |
| SHA256 | 307a6c1bce8bb09f91cb6aa33209e5554c37658a0bd088721c6bde45f63e1ac2 | File hash listed for a Cerber sample. |
| SHA256 | 31b5a22b7f24374158a0f0efa300d17630c7f88ffcd5fb8626b076cacdd964a8 | File hash listed for a LokiBot sample. |
| SHA256 | 32066c0958d4e12e233bf8f51a041edc20190ee63721eb371407c588f7ba1794 | File hash listed for a Shiz sample. |
| SHA256 | 324e4fa910d84930f2e838e55a0279ca6b299a737a9817f67e847affb79f295b | File hash listed for a LokiBot sample. |
| SHA256 | 3388b024c98ac0c78499f3a0012473d9085ef05b10b9ccb9045af090a2596ea8 | File hash listed for a Shiz sample. |
| SHA256 | 347df449a6a471ada6c093e0ef87a3f2f86b90b28a2bbe101c2ac28cfcdab970 | File hash listed for a Cerber sample. |
| SHA256 | 35c5cacc06512a970751ac9a23237d803051bbc1cb4e0132dbb456a94471de4e | File hash listed for a TrickBot sample. |
| SHA256 | 360a5bae39929248684c319d768bcbcd87a8a1907e9926336b7a7d0c22cd17bb | File hash listed for a LokiBot sample. |
| SHA256 | 3690ed1fbc4eb8447a288a3bb28041e88fa1f8ff9c3ad020229edb3fb2f35cb1 | File hash listed for a Remcos sample. |
| SHA256 | 393c48d1152773df832af27f58231b1ed12bbbc57f47eb8b7ed321e0417c9eaf | File hash listed for a LokiBot sample. |
| SHA256 | 423cdcd1d7d15c47c9171c55ec1eac9307ec21ca16432184fda784d4a34b7aec | File hash listed for an Expiro sample. |
| SHA256 | 42ff5709a31263f210f7ca563e5f97cbca01998983fd6f70054c1061271ed83a | File hash listed for a TrickBot sample. |
| SHA256 | 46291ade9c6253f5e077451717c987b3dbbc4ff5083eb803775b0567bd1bd82b | File hash listed for a TrickBot sample. |
| SHA256 | 4710004f42ea6b49fee46a55ab95efc147d814b8239ef160a19e2b244967733a | File hash listed for a TrickBot sample. |
| SHA256 | 4bce1b74cc45d0e5afe829b23fe3f684697006d4acb4262c57f0a20adecaed4a | File hash listed for a Remcos sample. |
| SHA256 | 4dc16dae8f47287845279752dc52bbd24a61573e5cfba83180dc6de2a0b5ab85 | File hash listed for a Formbook sample. |
| SHA256 | 4deb2cd7552e5f48d97d32aeb777b9a51b708a525832b1fa877b91cd78945df1 | File hash listed for a Remcos sample. |
| SHA256 | 4e785f03946f770582bb6bee35036b4c81eae14bb5a6240e2af5d1577eac529e | File hash listed for a TrickBot sample. |
| SHA256 | 4f1dade52ca6707976732a24a7122f72c980993c01d4b83ab83c995579c8787a | File hash listed for a Cerber sample. |
| SHA256 | 4f88fcf537adbb598d8335dd88dba85c97ed666930084bf718502938eb75bc42 | File hash listed for a Formbook sample. |
| SHA256 | 503abe4f4457f9e0ef5e6bafcb1d3c07a53ab4cbc6dd7a5502efb0bf51752ea0 | File hash listed for a TrickBot sample. |
| SHA256 | 5081f1c6d6d0875f379607a33e46d2dc27ce5c75b560df0f622e61d91aa68897 | File hash listed for a Cerber sample. |
| SHA256 | 511bd9125a95cbf8f4a4aab0dfc9b1ee4118c4beb80811ce197c76a2dd16504d | File hash listed for a Remcos sample. |
| SHA256 | 5378ed0d2b83cd84c1d289b93c75ca5d6ebc2eb2de53c381f6304024a7d5543d | File hash listed for a Cerber sample. |
| SHA256 | 59d9cadb7d581dc34188de42f93596c2928d354290b504cb71ed43dfcee62f94 | File hash listed for a TrickBot sample. |
| SHA256 | 5f95fd5e52582a6590fe9111c7cda76d46174e9061d697b1d3a647d1feea8abc | File hash listed for a Cerber sample. |
| SHA256 | 5fabc722c8b7c25ddd274453f8510b03c72d639ec1ef6a9541cfb6c3e4de9b13 | File hash listed for a LokiBot sample. |
| SHA256 | 609ff2be98c9dccc051d46e776e2ba480cb81e447cea240331390965fe4b37b1 | File hash listed for a Cerber sample. |
| SHA256 | 626a90f43277d782b8e4a0b18576cad6dc33e3f547caea386cabe8971ec6f7b6 | File hash listed for a LokiBot sample. |
| SHA256 | 62f268943ee600f2fd8334efe27a5123567c3077413cc593c3c90e71ff6e1540 | File hash listed for a Cerber sample. |
| SHA256 | 64c068cd1fcfe8f86c6379b81428c890c350890437cddde3d8c5dd382b8d6021 | File hash listed for a Remcos sample. |
| SHA256 | 65c88e70c8c39e359162e03b9a1891f7102b7a8f222692baf88cc2b7a93e4bbe | File hash listed for an Expiro sample. |
| SHA256 | 672f4709ac1b3b7738d6233e7e4d56510139db30a915a055c32e85dab8ca5a55 | File hash listed for a Formbook sample. |
| SHA256 | 6b93224c145b221ac786bf10b1471af61722e45bbd41a029789170ea7f1c0751 | File hash listed for a Formbook sample. |
| SHA256 | 6dcb6a88682940fd059ebdd87d98ac64eb8924ae08b78ceeba1a087375857b25 | File hash listed for a TrickBot sample. |
| SHA256 | 6fafa62e3aff870e9ce357d44d4a14d3685581b95a6fdae336b3997f95128870 | File hash listed for a Cerber sample. |
| SHA256 | 70d685d975aef0fc0dbc447107328b2ba3c39c1c6aad518d884d2bb4d68bc293 | File hash listed for a Cerber sample. |
| SHA256 | 715a947394afb031f2dc3ef04df77d05512d82177b932d658d7a8d303d99b4eb | File hash listed for a Cerber sample. |
| SHA256 | 71a0771f80052557006cdda3c4c223e88269368324e07b5e58de7736f37ad985 | File hash listed for a LokiBot sample. |
| SHA256 | 727db4fa156692175943bef3ef7dbaa0cee2773ba328a96bf738921fbd0140fb | File hash listed for a Formbook sample. |
| SHA256 | 74772f49ffb1f3e3721d843ceaf749baf84afe5f353a909f4be2d4ff8bf2dad1 | File hash listed for a TrickBot sample. |
| SHA256 | 74b3f69c29894846d7ec06c91762a7b533be45f8a8f9194ecce2385d3f6a55b0 | File hash listed for a TrickBot sample. |
| SHA256 | 775c5331f79d9a38c78734389b786e015f3cddc01686398a63109b32931c730c | File hash listed for a TrickBot sample. |
| SHA256 | 7762c920f5aeae107917ca16b0a336a382a1db8da1bf3bdb9d6a7f264b7960d9 | File hash listed for a Cerber sample. |
| SHA256 | 794e8844531d9ea6f37755360d429ed93827c79e77c7b5bf76ad08b4108549dd | File hash listed for a Formbook sample. |
| SHA256 | 795e415e33b3a05b0a05ac6ea20cd35484a9fde5e1e0053c579fc9c205f627f5 | File hash listed for a Cerber sample. |
| SHA256 | 7d3de42d191a1d5144d6ac2e63c8fb2be695d727ed1c6d42cc853e6566752b8a | File hash listed for a Remcos sample. |
| SHA256 | 823d4b9f6ef806e376b2ad3167373226cc98e379b453108676f57341bb19402c | File hash listed for a TrickBot sample. |
| SHA256 | 83ddd4dfb18009c5f2a566caaf1ddcc2e7817d68b8034d241c03dfa0e2c0f595 | File hash listed for a Cerber sample. |
| SHA256 | 866e6a5726ac586d1e09e2e1fc2dd34e738f3fcc15f598135e861f1c6d18ff11 | File hash listed for a LokiBot sample. |
| SHA256 | 8e2884fd370a1ad78a9ca16464c8a7c38ed3fc9d75faf21833175725e45ce4ad | File hash listed for a Cerber sample. |
| SHA256 | 9473ad59481f78b51f11d1577ff892294dd38ba9aec8c7eb8be6bef21f0e0df9 | File hash listed for a LokiBot sample. |
| SHA256 | 96e88a52bedfff7b7270c805e1e3e3069a3d4111210a6f568d37e9a9e0ebc88d | File hash listed for a LokiBot sample. |
| SHA256 | 98e51501b084abbd93a92f14bb01eabdda161b54940bbeb5eb296e20e99c398f | File hash listed for a Formbook sample. |
| SHA256 | 9a7fef02695a530298116ab323751fdfbcfa5d90604a3d57c07355cea6478df9 | File hash listed for an Expiro sample. |
| SHA256 | 9bfba44070ba59790b4a053b9869eca016b500660d6b0849abf0acb2085e2c19 | File hash listed for a TrickBot sample. |
| SHA256 | 9c40045e4cbcdbb4e471da75ebfb077b0d12408a88aa1e925c6ba19fac1c8165 | File hash listed for a LokiBot sample. |
| SHA256 | 9d1fc6d9a736aabd552e46eeca17073382264a261b80b38a51e9244c7f9045be | File hash listed for a TrickBot sample. |
| SHA256 | a118f0a92d575020353fefe21d2ed28ce02602a14b8aa04723846924d33c65e7 | File hash listed for a Formbook sample. |
| SHA256 | a280dde5cc8e380d57fb6ec9cb725dbe7cc2280c7487daf131c1bc7899177c74 | File hash listed for a LokiBot sample. |
| SHA256 | a2dc32e9bae7701954dbff1d1a08d70b2ef790722d2c36d125ee9598e8080b9d | File hash listed for a TrickBot sample. |
| SHA256 | a43e700d308ec72f30fd4098b7d4113b83c244d3679f4b59f26f7f309ebefdcc | File hash listed for a LokiBot sample. |
| SHA256 | ab8ce041e1aebd8028334fc076fe5dfb8c8ca7e057f75e856392f4cab449f8af | File hash listed for a LokiBot sample. |
| SHA256 | aebbab96f77fcb10285ed70e083e224cb62cbffbe19c9bf5983bbe14935b619b | File hash listed for a LokiBot sample. |
| SHA256 | b04e08fbd45bee67a058b15628e924595f9510d84b8100902ebb39e4ac2768f5 | File hash listed for a Formbook sample. |
| SHA256 | b3ec5ff38b55a4301b8b4505aca5bee8f2409805eb4bee5594bf506bfe57b9b1 | File hash listed for a LokiBot sample. |
| SHA256 | b4f85b9bdb00281bad25634e199c2ab8d2fda045832b6b87aa677e4019f6e2bd | File hash listed for a Formbook sample. |
| SHA256 | b7bcbf864fdf20b862d293bf7dc91d05dafc8d22fbb195597fd675e6d2b5a46d | File hash listed for a Formbook sample. |
| SHA256 | b975c7e1bd3e03de91c55dad66174c35f3e2d4416a9cd8f6ede8f7510eae296f | File hash listed for a LokiBot sample. |
| SHA256 | bb1317ced122d23448353be57ded7530347445fc3f14994ec293169a9dc628b9 | File hash listed for a LokiBot sample. |
| SHA256 | c30119aa801e8225a001a6e0a68960e77b278259c49b948440806f71ce1bdae5 | File hash listed for a Remcos sample. |
| SHA256 | c5209d3ef6131477df386baba66bba2f086d6d6625cb4164bb6e25af5c5b05f8 | File hash listed for a Formbook sample. |
| SHA256 | cb02d8cd06b60bdfa3c81212ddc7464d7f0267b3f670b9462b9ee2a6fa47f6a1 | File hash listed for an Expiro sample. |
| SHA256 | cf6c364b597f437f9eca4702ebbe9e8e649c79b7face2b04afaae4eb6a83943b | File hash listed for an Expiro sample. |
| SHA256 | d0a474ecce534b8ebc89fd05112692af4c6b6e948a72ee0b3a28f45ccd3095cf | File hash listed for a LokiBot sample. |
| SHA256 | d3734658794b114956b89eed4855b01b3fb2ed70f5825c3d388847db02913da6 | File hash listed for a Formbook sample. |
| SHA256 | d4c4cf88609523920f8b06fd04a9422e7d1ea56001c698a78ab236fc67e98656 | File hash listed for a Formbook sample. |
| SHA256 | d7cba0f9d81b66b68aae18b632473067fb4b20f540bbde54878f08ccac1dab61 | File hash listed for a LokiBot sample. |
| SHA256 | d88c900359615b46fe1e2361268ba54d8f95696bade0644b35202bafc1ebc8c1 | File hash listed for a LokiBot sample. |
| SHA256 | d89398f1dd0e31d0b8931b9fd135cdbf91d82fcdf0ae925904cbfbc5e3687f2e | File hash listed for an Expiro sample. |
| SHA256 | d9ba3ad58d7e437a966010e62cc58651a3ff2d0219013a40abd10d412763893e | File hash listed for a Formbook sample. |
| SHA256 | dda12f2ca191f8bc096987db988f1a56b9808b4efcae83cda5966a4dbce92453 | File hash listed for a Remcos sample. |
| SHA256 | df553fd479a2b4a17be627bcab912cdfba37e5b8b9b7a675ae8fd528160b0128 | File hash listed for an Expiro sample. |
| SHA256 | ebb5d5b111e05511c5098832a5a71b82bf2b2fdd7f4c49bf8a84f1cbfc7a499a | File hash listed for a Remcos sample. |
| SHA256 | f365cc666f3715d3b981f0cb97c8e3e60a0c7708d43d39915fd1868c7876ff82 | File hash listed for a Remcos sample. |
| SHA256 | fbbb95ba11ceaedd432bdefbcc3f6e0a667b248f307d09daf7bb8597b4c81b92 | File hash listed for an Expiro sample. |
CVE
Malware
BazarLoaderSeveral different malware families, including Qakbot, BazarLoader, Hafnium and Maze use this techinque.CerberWin.Dropper.Cerber-9905750-0DealPlyDealply adware detected - (785)ExpiroExpiro is a known file infector and information-stealer that hinders analysis with anti-debugging and anti-analysis tricks.FormBookWin.Dropper.Formbook-9905387-0HafniumSeveral different malware families, including Qakbot, BazarLoader, Hafnium and Maze use this techinque.LokiBotWin.Packed.LokiBot-9905395-0MazeSeveral different malware families, including Qakbot, BazarLoader, Hafnium and Maze use this techinque.QakbotSeveral different malware families, including Qakbot, BazarLoader, Hafnium and Maze use this techinque.RemcosWin.Dropper.Remcos-9905709-0ShizWin.Dropper.Shiz-9905047-0TofseeWin.Dropper.Tofsee-9905031-0TrickBotWin.Dropper.TrickBot-9905314-0
Vendors
Products
Cisco AMP for EndpointsCisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits.ClamAVFor the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.Firepower Management Centerthreat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.Secure EndpointSecure EndpointSecureXSecureXSnortanalysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.