Talos Roundup Details Prevalent Malware Threats and Indicators of Compromise
Summary
Talos’ Oct. 15–22 roundup covers prevalent malware including Ramnit, GandCrab, Emotet, TrickBot and Remcos, with sample-derived IOCs, behaviors and Cisco product protection coverage.
Key points
- Talos says the weekly roundup summarizes observed threats and is not an in-depth analysis; IOC data is non-exhaustive and current as of publication.
- Ramnit steals financial login information and browser cookies; GandCrab encrypts files, while Fareit steals information and can install other malware.
- Emotet and TrickBot are commonly delivered through malicious email attachments or spam campaigns; Emotet documents may use Office macros.
- Remcos is a remote access trojan with command execution, keylogging, webcam access and screenshot capabilities; it is commonly delivered in malicious Office attachments.
- The roundup includes sample-derived registry, file, network and hash indicators for multiple threats, and maps behaviors to MITRE ATT&CK.
- Cisco lists endpoint protection and exploit-prevention detections for behaviors and threats including process hollowing, malicious Office child processes, Expiro and Zerologon exploitation.
Article Details
- Publisher
- Talos
- Report Period
- 2021-10-15 to 2021-10-22
- Scope
- Prevalent malware observed by Talos, dynamic-analysis indicators, product coverage, and exploit-prevention detections.
- Sample Size
- Dynamic-analysis samples by threat: Ramnit 17; Gandcrab 23; Fareit 41; Emotet 19; TrickBot 25; Xpiro 300; ZBot 14; Remcos 15; Tofsee 303.
- Key Statistics
- The roundup highlights nine prevalent malware threats; the information is non-exhaustive and current as of publication.
- The article limits displayed indicators to 25 file hashes and up to 25 indicators per category for each threat; an accompanying JSON file is described as containing the complete lists.
- The exploit-prevention section reports 32,784 process-hollowing detections.
- The exploit-prevention section reports 6,323 Crystalbit-Apple DLL double-hijack detections.
- The exploit-prevention section reports 2,308 CVE-2020-1472 exploit detections; these are detection counts, not confirmed victim counts.
- Recommendations
- Use IOC searching as only one component of threat hunting; a single IOC match does not necessarily establish maliciousness.
- Consult Firepower Management Center, Snort.org, or ClamAV.net for current detection and coverage information.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 00f242bc44c5248cc25b0d8acee2b061346cc4a5324e5054aa2b55142b0dbee6 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 011658ddb0669763ac08644873449d34c3f33d2002a0f844792005db0ce5609b | Tofsee malware sample hash listed by Talos. |
| SHA256 | 019bf0680df79bffa823f1a3918ea67d7ad10f0cbcc40e1a88d874d02b8d2dc2 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 01b9c80cbc23357ad02ef1fb05bd9d5e5916cc5ab808aa0def218fe519be8d43 | Fareit malware sample hash listed by Talos. |
| SHA256 | 02299de4f5af9a9cbad028b4d5764f0371c12109845e57e32c46595366efe539 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 02722c10dc58f9b2067404d008e18ad429396514cd037942600e108ed4febdbd | Fareit malware sample hash listed by Talos. |
| SHA256 | 02c5c3722753f5199e764a1a7401ef2169e4a04b120adfb3fcfa8fa8e573479c | Xpiro malware sample hash listed by Talos. |
| SHA256 | 033bd1f617ca2e15357131d1f5fd4e505664bf46e3bb9dcb560c3bf8bf568a17 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 0495248ec28f2554c2714cca9555f31740bf67e7fc97b3cc5ac1cbd9efe72cb7 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 04bcabb185bce64e2f16947523abd4af7ad708d5ae78565f0eb73f5541054376 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 04f06f660267078a5a2c7048f404c2bd599de312f6311ae10a76f2020c6badec | Tofsee malware sample hash listed by Talos. |
| SHA256 | 0525137a6739f44efd5cac8c4d26ba402f4473f3d1413925ceb0b9e75b0b2b84 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 05fe3f283fdaaf87c10739474f229f4ff4e4fb3faf27a2599bcc0e877126e7e0 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 060a5186b5b2adc8371b4ce0cebb0e14c5b4e913d7d9e08c6af102c974bc0592 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 0668e8eb649e50f45514bba3828861883ea2fde549f4f029dd3f0d8a25bf85b1 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 066c9e3c5d45399cb40177bb57d9c9db1e350319622fa7f9013b54e3276ae612 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 069e7337c8444f925494eb65ffb787b3cc019e5c09611df002a87d2c10e65ce4 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 06b2bda5827d59b5e5a5d5b9216a73670074077a48560a0c80451fbd347f3af4 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 06e06de3bf171d6b15a7383d1618df129cf373abd7347214ce44d955eb664e2d | Tofsee malware sample hash listed by Talos. |
| SHA256 | 074e7d77e002d485117749e96ea50593d1de3d92d88d55039d0268d8bc41badd | Tofsee malware sample hash listed by Talos. |
| SHA256 | 07974318326ab72e13607dcaf36d63480a67d4a59d5250e0a3fe884c4b39f43c | ZBot malware sample hash listed by Talos. |
| SHA256 | 080e5a3a63eded752c945560de8d9c0ee483d4644475ef3f991a7f659f7c1089 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 081fcd78e960021a2bfa4bada708ef812431f771f0985424aac2aa9668ad2c22 | Fareit malware sample hash listed by Talos. |
| SHA256 | 082c3649e8e3c4ff25d5cdad50baafd3520bfd75f06e2ef9a3cbcee3525c490d | Tofsee malware sample hash listed by Talos. |
| SHA256 | 089b06dbe61e07ab888375ea270e089f43721ef3a3fc3afb4c35bf8032824195 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 08a06557350cd97da619cba9260a4d0281715b8eb8269586959cccc3fa20989a | Fareit malware sample hash listed by Talos. |
| SHA256 | 09073ace4e3cafdeb33a1ea6d792e6e759a2652f2eb71a17116a9850726638ed | Tofsee malware sample hash listed by Talos. |
| SHA256 | 09b4d0f1a784921aec9998689e809224f4f188672f232f02b4648aa70cd9fca6 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 09b8746d2fccfb3b2bfea13590abfd0bc199078465d04b18ff4d0cd3b119c5a4 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 0a7114a5b5480c036d22f76e0fd33db3f0c7191f3aeb8d096581b2f526f2b5a1 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 0a9f501b1ba5c895dd52b15dfc4bdd02400e8af17ae5bb0b8b0dc89cde3a0dc8 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 0abad4d1c7523a6632bd44cbd1743d46e76ec15ce086cb45d946deb9a1ce78a7 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 0abc363e5f395818891362bf2c0200ec52890c58b4bf84bcdedc5ec864942a74 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 0aff281c192e919ce8a4e2091a058aa3c8fab2379dd50d7dd7ac7217af4dc838 | Remcos malware sample hash listed by Talos. |
| SHA256 | 0beb0fb7155500ac10b732b1ceea7d825cbdf4d786f9abf4949375b358d6f875 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 0bf25e929d01e2970e95cad27b7d0cc88635e33d2f6afb4f3ac2a4e6281f3a4f | Xpiro malware sample hash listed by Talos. |
| SHA256 | 0c8ef73034f61f93ffbaeea97bb04d3c87b2bc4e91861e86b4d0e7dcef56aebf | Fareit malware sample hash listed by Talos. |
| SHA256 | 0cb5517715dfdf737e64fd70e2cd3ba381cb13cde4884d4b3fdd49917ede6366 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 0cff5fe927152407b13bb316bc73a6ff1660ed9795976250f3c04b4bd8a7c942 | Ramnit malware sample hash listed by Talos. |
| SHA256 | 0d0e5dc20240ceceb5a0b05eacf1b8b487740e6c5c90d9c8934ae7183048b783 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 0e3db161751946523aeccd553b666e7e5524885b463ee04124065835dcc6f53d | Xpiro malware sample hash listed by Talos. |
| SHA256 | 0e3f0782a244e2d5c6a4157bf48bbf2be3002f20039d7358221c376634767f5f | Xpiro malware sample hash listed by Talos. |
| SHA256 | 0e6cfeb5410e04e85319aefb89a2042ae74437d49ac8f8239eec199309216bfe | Xpiro malware sample hash listed by Talos. |
| SHA256 | 0e8d0355f7931e398be43ac49540458001b634beb51f02b37757bf51ee65da57 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 0eb6f8335e6aeb57fd17cc34c6fb00548837093741461342672406677b9defb8 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 0f00a2e458640c2a271ae4f6ab1a770ba961de752b51ba6819319a380ac5fc91 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 0f06cbb5221543def460036b32c7f51e02be78f0bd24203811c2a7e1c5780b02 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 0f11dffd9fb6953507a1a42e631725ecfdf731ec199cba6306559cd43cc596bf | TrickBot malware sample hash listed by Talos. |
| SHA256 | 0f1af419562afec3780872de1d127835022e124da0d0fa465c390703a32478a5 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 1013f8e04f61bec2cd8c7780e66ddf724cde0124371b78e3c222065a8690dcf0 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 109bd40265a4aa5ff6db3bcc0059b0364e0b58ceec59fd7e467d55ea42516b14 | Fareit malware sample hash listed by Talos. |
| SHA256 | 11045cab7fff44d58d71b788c797dafda423cd72e4d1741154601ae9ffcdd579 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 112644019aa9049574dbbee6581c8756eb33f53f9c73aa8b0eee66be8ba7abae | Ramnit malware sample hash listed by Talos. |
| SHA256 | 11506f818ef7327b7c10bf71698bc6315110b06f822788be2f505a4242b475c0 | Tofsee malware sample hash listed by Talos. |
| SHA256 | 116fb95465708fbc2a897e20181ae61543c8a07df08431940c22605e2752569d | Tofsee malware sample hash listed by Talos. |
| SHA256 | 11bb23bd4691b1f9bf3df9eb9a7b9314bd093415eda051753f1c018dffa237d2 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 11de8d1f1d1a9233c3a114ebc33e0eec38e0b23eb6440d2c300560732dbc2c17 | Ramnit malware sample hash listed by Talos. |
| SHA256 | 126444ca53c5cee76d16c6d2506568c9fde305a107b5df5aa9b5143a0e3804a3 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 1340eafe83ac4a4d6b8f3226b583bbd5edd7af45a30c00fad1521a39dd5bb9d4 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 138b5e0e7edeed2696c82ae1ef71f4c4ffebf48a6589dcd9e8741c9b3af28153 | Fareit malware sample hash listed by Talos. |
| SHA256 | 13a4a7f38a8e849815b34cbe654ca73728d26faedf456a3818ce1705d15217c6 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 13d6aae7db9cb703fb07542815bd732ee8911a28de3c8c244c3c515fa4effdfe | Xpiro malware sample hash listed by Talos. |
| SHA256 | 13f54c056fce03f8e1a6fb069c057a9a65c05ca8f20e48301aef4912b0ac3316 | Fareit malware sample hash listed by Talos. |
| SHA256 | 14a41d2df64f28c8abfc6ac2ad4e19a8fc7fc21171b61c38d9b9058a4e913bb1 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 14f49ad45b8742af26bc4123061127edb2044054fe3871cebc4bdd6eea6ee97f | TrickBot malware sample hash listed by Talos. |
| SHA256 | 157ebe4d71a8cebbce89e00bbac423bade5c8f090b0b00670ead7cdd10d9b5b5 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 15c30a22113a5b3bf858d2f165d2e3f419193d481c20e8776be3b3c3f897b856 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 1617cdeef819ffb40d3abe9419aaad3d463be7bdcbd54371dfd6522678f3a94f | Fareit malware sample hash listed by Talos. |
| SHA256 | 1672f8ebf942084f8f81542c5811097cb9f06aee42a6401028bdbbd618fe0d6e | Xpiro malware sample hash listed by Talos. |
| SHA256 | 169f3a85b71c5239e03d47850d3fff5fac61f80ede3987fb4deba645446a13ef | Fareit malware sample hash listed by Talos. |
| SHA256 | 16f3f4c7541732748f5214a2e1ce407c3c1247798a5b52522a1bf7af14b52b0d | Xpiro malware sample hash listed by Talos. |
| SHA256 | 170f54318a5984774331059eb0bc5e6f3675f52ef6e8c2ff55d0d2a5aba7efa6 | Xpiro malware sample hash listed by Talos. |
| SHA256 | 1757a503668b6bf98ea5c08cf5212e0f8250e096fad6f53b9200e15ec1d8bdbf | Fareit malware sample hash listed by Talos. |
| SHA256 | 17aa577d8e35cc608cdc1f4e7aa0ba65bd33c3e2a085057abc5f9faa064c6552 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 1a0189f6a4c31bc00909c850265c928120d57c8768d1e091662b642f35c08268 | Emotet malware sample hash listed by Talos. |
| SHA256 | 1a932426f2605138840adbf25336bf1cb17bd6cc301692f7b0fba27633805321 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 1acc8b1d75558ce9b2e26459cbcd04f4c3d8ae0857413cdd4a400bad7abfbeeb | Fareit malware sample hash listed by Talos. |
| SHA256 | 1d078548bd0831296225c4d7288e871ff82140b8f0236e0ae52b6c1e5627d21c | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 1d79ed0a029c3477658c315842c72919df37d257ee00c3220c9a4fd0c3c612d7 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 1e21aa520a7b0a3e3291b5f3e4e87f0e4fb485b282794cdf5896da0cbc171b09 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 1f2bfb0c83b338414cfd8eb9ab443e4fd80ebc34207a3d971a2a3f039a26e709 | Fareit malware sample hash listed by Talos. |
| SHA256 | 1ff11b2c92356f67a73be857da3e70f6e7c0372d74fb6bb92f3ad30b1935ade6 | Ramnit malware sample hash listed by Talos. |
| SHA256 | 229d33d05887ac47da1ebffc1ccab24d6e144354aaccb2f581122f765e49a12c | TrickBot malware sample hash listed by Talos. |
| SHA256 | 2430a8a6aa26af7e7b60e5ea352b5fedf22e6c9363b08c96cf0306a0d4acc78c | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 2491c98d653600dac554683495f47b5c9abad6e2e716e0f2957d193a60811aed | Fareit malware sample hash listed by Talos. |
| SHA256 | 251a875fe9b9dc844e4481483df7e5439dc45f809d7f47eb758128767265ecab | Fareit malware sample hash listed by Talos. |
| SHA256 | 261ec70d82a94532d0456e3ba8586d444efea4f682e3bec02da012d0de274256 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 26b0264ee22e62cff4f7a10c7f0e63131a80ff52598ed5bd2b7e5eb74545115d | TrickBot malware sample hash listed by Talos. |
| SHA256 | 2856c0a6e898dcd55aab504b12c2767cc7534370d0e3e4010db124ce55c2d2d9 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 2a2fb5aa93881a45a3f5a7fb7143d8e3517aace4b4d554c76ceae4d0d9c67e6d | Fareit malware sample hash listed by Talos. |
| SHA256 | 2abefbea404a0c5a4ef316486cf70004bac7c4c83d26298c30c844a4df4375ad | Fareit malware sample hash listed by Talos. |
| SHA256 | 2b3f36dc99d593b4155347d3b8a8eec235fbcd8ce32500acd6f51088e2b3e8bd | Fareit malware sample hash listed by Talos. |
| SHA256 | 2b446e36ec7c3082024d9ba8522e1582f786714698859ed3cf817fe64ab9bb27 | Fareit malware sample hash listed by Talos. |
| SHA256 | 2b57524c9a1f4974898faec82ea984a843afc3a1a6994c1bf54fa4d4fd7e0317 | Ramnit malware sample hash listed by Talos. |
| SHA256 | 2bd04fbaecec78937aed3c326d1a0b01a43f1049ffc4ffc0757e245c7e8d88f1 | Fareit malware sample hash listed by Talos. |
| SHA256 | 2d88b90cd635a3b205415d43f6ad728d577fab6baac8f3cf37a3085fadb34bc6 | Fareit malware sample hash listed by Talos. |
| SHA256 | 2da4d4f44256d73fd912a1dff69de2ebebfe02b69c3a2926c7698dd0b64e1abb | TrickBot malware sample hash listed by Talos. |
| SHA256 | 305f5b199884b6571519e42d5e585edea3706490b134b5910b5bed1608b28f72 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 32efc1239add3205962c8ca13dda0383fcf68e3ebcae2949aa0450bf76d2980e | Fareit malware sample hash listed by Talos. |
| SHA256 | 33d7dc13223e357149634b28f27ddd0b0462a497b5753097fdb60e42bf815800 | Ramnit malware sample hash listed by Talos. |
| SHA256 | 34dd1729b31e10844399d2dab9f67bae01bb1234c606023699b6444e06c74cb1 | Fareit malware sample hash listed by Talos. |
| SHA256 | 36a19b86e0c791010967268165dccfa1262fae7458cb4fcca30d4d5ff5f23e1e | Fareit malware sample hash listed by Talos. |
| SHA256 | 37b9ce88b9f4178c98d3e462f2088a1b272d0518af479d169b3bca1d6fe17dd7 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 39417c43c256acb5c2c740720b6a749f5438d6cac43f3da26e123eabb4140395 | Fareit malware sample hash listed by Talos. |
| SHA256 | 3af93f1e00d2f87da3925b64e9b0b0ea4a587a3d023a32ab5976e5581da75167 | Ramnit malware sample hash listed by Talos. |
| SHA256 | 3ba38323c281787a5175d7772cbf0139026f6843a0147b63dd1b18145fc0474d | Emotet malware sample hash listed by Talos. |
| SHA256 | 3c67aa6195c01224331078ee11769900e21dc2b04f34539ae4f0bd4d59746e8a | TrickBot malware sample hash listed by Talos. |
| SHA256 | 3dab93e1326fd1b6f530a11825b2e1e2c48ae0d683d12db5cb04c9642bd99a94 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 3e80a75d18a80f11b37c670b3eda9a4bb8dcc105563f29f6f658d543c5fe3948 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 413299bb192b28b7cfa3077df0d7fd46a0a10db0652b1078469ff1fff78e735c | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 425014117ff678b36c5a5642107f8accf4bf46bb0af334851b74582f35097489 | Ramnit malware sample hash listed by Talos. |
| SHA256 | 448113f0563590c58482efcd3c794b8755727eb2cdd7a3297c396844193f286c | Emotet malware sample hash listed by Talos. |
| SHA256 | 468596e8587d45e0cd8ba0562e6746696342c82a2100e8bbe2af3dc80057c23b | TrickBot malware sample hash listed by Talos. |
| SHA256 | 478d3a96d340d6a2b90d801b9f1b90fc76b1d2bb8c3bc0a15b0cea09e41f1a75 | ZBot malware sample hash listed by Talos. |
| SHA256 | 4a90c0d95b34f54bd38bdc83e548298373289dae63b93de0eb1d92787d3157bc | Remcos malware sample hash listed by Talos. |
| SHA256 | 4b71e43a74b174645077ff438f8025e144a4d294e46f2d45d9f73f0b17eff9d0 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 4d8dcf848fda478f1ffd1d72800df4b1ba1acb33d26a4f865b7baa4dc6db96a1 | ZBot malware sample hash listed by Talos. |
| SHA256 | 513aab85abf3fa899ff620f88c0c9434183d2aaa11f07f57a26bd5ee59a2342c | ZBot malware sample hash listed by Talos. |
| SHA256 | 54fb872b3ffae19e49b48dec775ecde27fe0c526ae0ab976473ad8e944971c4d | TrickBot malware sample hash listed by Talos. |
| SHA256 | 577220b7e683ef541124bb21d840fd1b40b3b37d92369ebc12164917da0a5304 | ZBot malware sample hash listed by Talos. |
| SHA256 | 57c85664edd6e29f641505f6c82f8d6efd3b73ac1429899c7653c55fbed30ec2 | Emotet malware sample hash listed by Talos. |
| SHA256 | 5b00857f744180bcd3256effb4e9f11bc9aae28919a4b5209280851d810ae4ad | TrickBot malware sample hash listed by Talos. |
| SHA256 | 5e43e28751139969586701890375598315e7dd420d15a6f9ed1f91c1bc576f01 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 627993dfeda20a7b373910ba2358f108e08f7e09370b45dee5a88010bd4d7d37 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 63565fa45140ccfa1499e9090a1a907d6ece160de9c90fccc1328e00e9ca7d20 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 6b0adce9ecdf4f6ffa0757c0fefe6a5c5a34eed8d8be31e7fb6edf8bf1c7066f | Remcos malware sample hash listed by Talos. |
| SHA256 | 70168a578e3833fa1260aa12c087c05f00c1b07652e2c31c07e6b6b80e3762ca | TrickBot malware sample hash listed by Talos. |
| SHA256 | 71ce1cb774f2b46d872ab7f14f913d09c2cbe875cfbe8b3841c01df7daa392a4 | ZBot malware sample hash listed by Talos. |
| SHA256 | 72a22f8ea82307a0635e07ede2129068341af94259266cea73d10f3ee8eba7b8 | Emotet malware sample hash listed by Talos. |
| SHA256 | 7560718d9a009c139ca44a4fd04564fbc9541d74d345104da12bf7a1c7833b3b | TrickBot malware sample hash listed by Talos. |
| SHA256 | 787d592049f8eed9c9ee846c9067a640e89fa19617b03670a97a913738d337f4 | Remcos malware sample hash listed by Talos. |
| SHA256 | 78d84c752ad22c00b38e3006e7eb09837105832847d667294f25db4e0c77ac27 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 7a4c932a221ca312726ee34cd1650e6d1eac557c63b5c9101bc31a9754125b45 | Remcos malware sample hash listed by Talos. |
| SHA256 | 7a8c9c545c038a238397e1f0a6c4872f6111f201aa5576f9f7326695f9cb6980 | TrickBot malware sample hash listed by Talos. |
| SHA256 | 7d0916701369a96486377258ccdff9b1d2eb59da8966ab2055c3b8902ba6b512 | Ramnit malware sample hash listed by Talos. |
| SHA256 | 7f597cf518ae615103b777bacb08f4c7093dccca0c14c6a7d146b5f3cf8a305b | Ramnit malware sample hash listed by Talos. |
| SHA256 | 7f5d60027bb12e660a72f61ed8c68e2efd9b1dfcb2f9999efb74007fd6d76a6c | ZBot malware sample hash listed by Talos. |
| SHA256 | 83ac076244f4900abf50fb3aa34228a13fb120b001d6f17536ee326cca59b7e2 | Emotet malware sample hash listed by Talos. |
| SHA256 | 85e489bb8ee05fed0b809dc2b8229a8a613bb3bea34a8aaa66a295e3ab9327e7 | ZBot malware sample hash listed by Talos. |
| SHA256 | 85f6deea4e649e82c5a0c3dea0d9aeb4a9e997394bc9653810e8244d472ed5ea | Ramnit malware sample hash listed by Talos. |
| SHA256 | 88e41b2db7e3a032472be09c6b1fa871501c0a2cab0117dbb01eafb347163157 | Emotet malware sample hash listed by Talos. |
| SHA256 | 8a4132a7f18132622fd17a947521fc28ebad39edad15e5d394c9e22460540822 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 8adf74dc287c0d13b8966daac4767bdb3686d8e1ca85d57905cedc370a640abe | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 945b8493a18cb0ade1ad24c37b6afcc442d8ddfacc0ee8d64701696af4cceffd | Ramnit malware sample hash listed by Talos. |
| SHA256 | 97d7e64fe2b669273c0773559e2e329c341a818dafefc5a965cec7cd8553be8f | Remcos malware sample hash listed by Talos. |
| SHA256 | 983e5ffc7b37bac5d8ae035a849b6808156decd2a3d6b1fdd0c81d68738d5b75 | ZBot malware sample hash listed by Talos. |
| SHA256 | 9a6ff649815ddec7f5ce9f33aa61a6db5434b345f59e375ed50342fc5bf97a92 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 9aac9eea26b498da61c89648d8c61cc56e3a6dd8b9b646aefb7a1947f5aaa160 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | 9ab325109a23d5a58b29058c273394571aa8f7aa92d7e5843907131545c276e7 | ZBot malware sample hash listed by Talos. |
| SHA256 | a2067e35b12b83ddae55145931870302de477b5ccce82a5e86ea7bf8e057d8d7 | Remcos malware sample hash listed by Talos. |
| SHA256 | a238d13c75820008e2ecaaaedd56e12459f1ac1b12ab1c213f64e450caf54562 | Emotet malware sample hash listed by Talos. |
| SHA256 | a2539269c2b9200d7baed9f0dfc25b59fd4713a641d79fd9bd13272c7e1296ca | Remcos malware sample hash listed by Talos. |
| SHA256 | a29b9e61399684cf8c5e23934e842c0be6e283e1c5025a5ac3bcad8771a94eed | Gandcrab malware sample hash listed by Talos. |
| SHA256 | a2ae4b6520be8dcf4bc256d2c9b8e4f4ffc1e8e366c2dd1e30b4007c7a2db6a7 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | a3a6c166f16b5ce943b3b4df39f5806f1aef0807acc7bb4eddb3811425d3f4a7 | ZBot malware sample hash listed by Talos. |
| SHA256 | a4af6f5ce43a514fddb746a73bcade17e4cfcece2e0831dab896ff41c284cfb0 | Emotet malware sample hash listed by Talos. |
| SHA256 | a6855b6a9bf3bf51dee19aef1b5ab480936c60b3014f5653dd9e0fa31a4d7b34 | Emotet malware sample hash listed by Talos. |
| SHA256 | a80dbd2ecbe537c84836ca90539aa0250493350baa433e5db0f4c5b02262d83b | ZBot malware sample hash listed by Talos. |
| SHA256 | a86c13560165038405df594a8047e304210fa069cc990c9dad0470187f488bc2 | Remcos malware sample hash listed by Talos. |
| SHA256 | ab6dc52e9af197e5065310e3f10de1a478aa9fb9e603c3cb22538981130361a6 | Emotet malware sample hash listed by Talos. |
| SHA256 | ad8167d8b0da62a12c472f88c3001e37dcdbd4fe6b75868b8a6def2486d5e498 | Ramnit malware sample hash listed by Talos. |
| SHA256 | af14cb02399aac0cf30d710f7517ca6e435cd5dbf1bf9856c8ea09ffda25b13e | Ramnit malware sample hash listed by Talos. |
| SHA256 | afbecf94557d0ed854e8b06a3da6e73f901fae83ba200c013e684c777c307da1 | Remcos malware sample hash listed by Talos. |
| SHA256 | b03e6c6b6838bdac6f934561de491fd2c90b7420984e10320f72df861bff2cc9 | Emotet malware sample hash listed by Talos. |
| SHA256 | b44eb5ef1127b377412280cd01950324c63591f8a9bd754363872cf7d2f3955d | Remcos malware sample hash listed by Talos. |
| SHA256 | ba737e1ebf646e8f57c06b87219a1a2298d1e4824aa4610366bdd17a8a9fa5a3 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | baf537b78eb15c577a4be5197878b00499220b4fae5eae120f358acb0675c73c | Ramnit malware sample hash listed by Talos. |
| SHA256 | be37e0004ee4966d5dd3fb3b14129c36bb0ba4eda9b20fb9e17c2d2a29c79e68 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | c00c0aff84c3007407e20cddf48084d0d9a901a48bd42e7fdaba52c3fef29ccb | Emotet malware sample hash listed by Talos. |
| SHA256 | c172f7be213d14c5baf25f44467236abbe45a368996b88178c11dee6a9621720 | Remcos malware sample hash listed by Talos. |
| SHA256 | c23190d9c4b457c457fad80fe8842e47026a4a1efddebcc674ff9477b3cd3942 | Remcos malware sample hash listed by Talos. |
| SHA256 | c60a64f8910005f98f6cd8c5787e4fe8c6580751a43bdbbd6a14af1ef6999b8f | Remcos malware sample hash listed by Talos. |
| SHA256 | c7636ddb181d56f21b5f1e7c64fdcbbbc66e4b674e210abbdab0023e71076e21 | Emotet malware sample hash listed by Talos. |
| SHA256 | ca047344b42f570e61735f6eafe18b774004663c04ec832157a22c04e942b5e1 | Emotet malware sample hash listed by Talos. |
| SHA256 | d304cdcb5bfce6f0ec28be4e62d0b2acd22ef2cd16773a294354a2adbaba6a7f | Gandcrab malware sample hash listed by Talos. |
| SHA256 | d33d6382b76ae22be57533b508459702550a60c62377e4ae3c5d81c9d1211de4 | Ramnit malware sample hash listed by Talos. |
| SHA256 | d6e414b97f7bade136dfd270bb20ee7e03cd0174a63ae4d629bd3f3399d3285f | Ramnit malware sample hash listed by Talos. |
| SHA256 | daaa56b96f4a391029cfbe2e60eec2f455d97e06f5c11211f6d6856473f3af38 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | dd1bedf6550c029e3feb4176589b82a538cf312ea987b825ca71d0ecad7dd5fa | Emotet malware sample hash listed by Talos. |
| SHA256 | de7a6ea1415783ecdb64a0bb705701da43128e721abdccf11c7a1ef728cfb8fe | ZBot malware sample hash listed by Talos. |
| SHA256 | e394c0c4b7a88ae480e7bceb1547f25a6556f805034f2136e7decea7b21e3ebf | Emotet malware sample hash listed by Talos. |
| SHA256 | eb7157fbba3c2de316e329f1863a6afdcb6c28a0af399e1b25d74ed28f7ab928 | Gandcrab malware sample hash listed by Talos. |
| SHA256 | ed47d81840428cf3b41a0a79c915fab7068693510a55da3098779682b66e2784 | Emotet malware sample hash listed by Talos. |
| SHA256 | ee3e9ea017c0a74ba2086886022a53b63ea366abf6c8feac890b26e88cd1bdca | ZBot malware sample hash listed by Talos. |
| SHA256 | f15086bd98d7efb31e620bb7d950743b456b24ad299ce6b732b87d3920076ced | Gandcrab malware sample hash listed by Talos. |
| SHA256 | f40fdb921a0d2b21f65896eeaebf2b0984f6efccd791bbc0e9004180938fa3ef | Gandcrab malware sample hash listed by Talos. |
| SHA256 | f4118279309f7f0386a7e597bedb9206e4c8596511238ec6b553102c635b6e6c | Emotet malware sample hash listed by Talos. |
| SHA256 | ff846b96e943fe0006577be6b3ed30bfad73a0791457933ab5efb69e83d08ae2 | Remcos malware sample hash listed by Talos. |
MITRE ATT&CK
T1055 · Process InjectionKovter injects malicious DLL content directly into process memory.T1055.012 · Process HollowingThe exploit-prevention section describes detected process hollowing, replacing a child process's memory before launch.T1056.001 · KeyloggingZbot and Remcos are described as recording keystrokes.T1059.001 · PowerShellThe article describes malicious PowerShell commands and Kovter's use of PowerShell to inject registry-stored DLL content into memory.T1112 · Modify RegistryKovter stores its malicious DLL inside the Windows registry.T1113 · Screen CaptureRemcos can capture screenshots.T1125 · Video CaptureRemcos can interact with an infected host's webcam.T1218.010 · Regsvr32The Squiblydoo detection describes regsvr32.exe executing script content hosted on an attacker-controlled server.T1486 · Data Encrypted for ImpactGandcrab encrypts documents, photos, databases, and other important files.T1496 · Resource HijackingTofsee includes modules for cryptocurrency mining.T1539 · Steal Web Session CookieRamnit can steal browser cookies.T1566.001 · Spearphishing AttachmentEmotet and Remcos are described as commonly delivered through macro-enabled Microsoft Office documents attached to malicious emails.T1574.001 · DLLThe Crystalbit-Apple detection describes a DLL double-hijack attack chain abusing legitimate applications.
CVE
People
Malware
DealPlyDealply adware detected - (1352)EmotetWin.Dropper.Emotet-9902435-0ExpiroExpiro is a known file infector and information-stealer that hinders analysis with anti-debugging and anti-analysis tricks.FareitWin.Dropper.Fareit-9902448-1GandcrabWin.Dropper.Gandcrab-9902378-0KovterKovter injection detected - (653)RamnitWin.Dropper.Ramnit-9902254-0RemcosWin.Dropper.Remcos-9903276-0TofseeWin.Trojan.Tofsee-9903049-1TrickBotWin.Dropper.TrickBot-9902436-0XpiroWin.Trojan.Xpiro-9902727-1ZbotWin.Dropper.ZBot-9902454-1ZeusZbot, also known as Zeus, is a trojan that steals information, such as banking credentials, using methods such as key-logging and form-grabbing.
Vendors
Products
Cisco AMP for EndpointsCisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits.CloudlockCloudlockCWSCWSEmail SecurityEmail SecurityFirepower Management Centerthreat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.Microsoft Officehighly modular threat that can deliver a wide variety of payloads. Emotet is commonly delivered via Microsoft Office documents with macros, sent as attachments on malicious emails.Network SecurityNetwork SecuritySecure EndpointSecure EndpointSecure Malware AnalyticsSecure Malware AnalyticsStealthwatchStealthwatchStealthwatch CloudStealthwatch CloudUmbrellaUmbrellaWSAWSA
Tools
Grandsoftis spread through both traditional spam campaigns, as well as multiple exploit kits, including Rig and Grandsoft.RigGandcrab is spread through both traditional spam campaigns, as well as multiple exploit kits, including Rig and Grandsoft.WiresharkIt can detect and report the usage of monitoring software such as wireshark and sandboxes to its C2.