Talos Roundup Details Prevalent Malware Threats Observed October 8–15
Summary
Talos’s October 8–15 roundup highlights nine prevalent threats, including credential stealers, remote-access trojans, spam malware and ransomware, with sample-based IOCs, behavior details and Cisco product coverage.
Key points
- The roundup covers nine threats, including Zbot, Tofsee, NetWire, LokiBot, Remcos, Fareit, TeslaCrypt, Cryptbot and a password stealer.
- Several threats steal credentials or other sensitive data; NetWire and Remcos also enable remote commands, keylogging and surveillance.
- NetWire and Remcos are commonly delivered through malicious email attachments containing macro-enabled Office documents.
- Tofsee turns infected systems into spam-botnet nodes and can also conduct click fraud and cryptocurrency mining.
- Talos collected indicators through dynamic analysis of samples and supplied hashes, registry artifacts, created files and network indicators.
- Talos says listed network indicators do not necessarily indicate maliciousness, and the IOC lists are non-exhaustive and current as of publication.
- The roundup describes Cisco product protection and detection coverage; it notes TeslaCrypt files could be recovered after the developers released the master key.
Article Details
- Publisher
- Talos Intelligence
- Report Period
- 2021-10-08 to 2021-10-15
- Scope
- A non-exhaustive roundup of prevalent threats observed by Talos during the reporting period.
- Key Statistics
- Nine prevalent threats are highlighted.
- Dynamic-analysis sample counts ranged from 11 for Fareit to 49 for Lokibot across the nine threat breakdowns.
- The post lists up to 25 file hashes and up to 25 IOCs per category for each threat; an accompanying JSON file is described as containing the complete lists.
- Recommendations
- Do not treat a single IOC match as sufficient evidence of maliciousness; IOC searching is only one part of threat hunting.
- Consult Firepower Management Center, Snort.org, or ClamAV.net for the most current detection and coverage information.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 022a2cb6f5838cb49260a8b177499bda54bd7ed92ec5e290fdd47624c650af9b | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 03708a2eeb1d04275ab963ae965504701c3eeaf1e3188363533038e3edb5b84e | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | 0412ae653465f4f1d04e6488ed21d8bac7fd5fc327d5e4b26392b03e58c7138a | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 05a7b78c6b8c171f82b3a2e1ac43d3b8aa78d107f79556d170df3102482db73c | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 05b295f76210a5c35f81b1401e3dbaec82f586af2bdda6097e3018b3b5a582f8 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 06fc89139134d666ecb63b8d8424369b2e430ec8c1ab3627604bec9ec290e84f | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 0860b556bb282f9f9746caa2c6f5f23e2eb5b4b8362b1d9deeeb39a0d785b7ad | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 0932df20b7fdba719fb12c42cf8e753c3a1991a03659d9016acfd350fce2e532 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 098897160bb68ec7517929378d806c33427b23fa993d29ac1be9480c7c51b013 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 0b795bf7b80a397a0ff158f3133b372875057d88d1a33c589a2e919e05615a6c | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | 0be94df5efaa043004cf38f490e43cdd89de6efe46494e78343bdc35a82fdb72 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 0cb01840fad8fc67e35e605ef678c8736a01f2e26dbc8de5c5ca9cd41b8ed504 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 0d3fb154fd7e60a3dfe9427c3fdd15e7ae236a628100325ec951c76528f260f1 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 0f08d946632bbac50e9513f48b6227a1f246c7bac4f33f937f0e3adb50f5b6c5 | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 0f2f5e145bd63005b2457bb741e475e6f34627b8b0e66b12e924a152a4b177f8 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | 0f4ad6c9e4dff4a6573c348536c4786f422cfafe9e32a2ff51f4a67ec0ac840c | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 105b9704073855b7ea84cd814fc8cf0a8a5fbbbe2e5d757731e0157f2cda2a24 | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | 129223119c92e31c9f9d47c61f2301f0b568b240b9180361a57e42dcf52cb3dd | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | 14b59ddcec314d8a8827718c8c2ab1813e94fdbfcb9a9c2c83f8c9ca6f9ba607 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 16ab66fb13e33162cc1fff06910e9dfe519047e57f8db7e9168ffcac8dfc2023 | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 16d1712c08aa27e463bd85001dac5bf25e1acbb3fa243093d11c3eec07f9e749 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 1905fe04658a3f434b10af04ee702dd473ac62fcd5fb0d3084a2af056d7de155 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 1d1275c73beab966955c8b12aa9abf544975cb2b10d3960136654a125058be29 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 1dc77c4895fa4fe576e81336ec8497d4cac887c75fa9f3bdae54302f51f394e2 | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 1dca4fd969ab57d61313673b99bc108a5cd618890ee204ef305d24276b307ad4 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 1e0402ee6bffcfe8bc2fe71b72deba5e06e472710f73b6994becfcf3054fecdc | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 210501712b0477ab9961cb03d568016a71fcef37dd3c37753ebd5a101806c914 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 224b7c63bdf72f9846fb62b03d24c40e1ee77b8d0e4cc24f85aa5bf458a32c7d | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 226242c64be090bfcb938be1a68441d3d9234a7bc26ce586c65f39e1263acfcd | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 229efecf5666e40cfecd81a99219077332e33416a6b884417c9bdc7bda0060e6 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 23e0aeb3ffb49ed80b16ac75f6a722fcfc238ab1db044293f6b6085ea8f445e3 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 26fe21adb4ee339f55e93c486902ad4c669ddc3dc5a65e838b7ffbe9c821fba6 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 27fabcbad58433e7359c62e483c137cb7f2cb24986c9fcf32a225d5d24ba541a | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 2930f3604cf11da9d8a4d2a751b420deaa12e540ab13b7d1f54431a9b51f333c | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | 296dee6aaacf6487f012fd18d41a77d57b9e6fa2bc7d30389962ea7e2baa32c3 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 29f7d6ea06b162f3958d90e90f4dca764d61c4a59345014cc82580e6dece68ad | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | 2af4a58ee4988b8e75c4e204220ff35feda0f4a4155d1392adad97a2f6fcbf78 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 2cdb0d0750ce70881719d471cb73f63affeb75e541d59f1a5a2cf906c0772d86 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 2ce622d500cacf5a2cfce7f8ab41b0942a991a8a4fce32fc7d8984e5ff4eac77 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | 2ce7ad2edfed9bf00a5df059bc2e83d4e5570765d1ce3b512926a32ba458b1b6 | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | 2e2f8ba4f8c92ec3265704f714281786914843eb63688392c5f36c53545f1156 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 2e450e37398fdf1f7b490b36ae8cdd028834d1920d88c0f6ebf58a77bbac36a3 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 2f89de6cbb7627c7126e1d9d3c52caae9db40dba49d8da8aace4af95f4b51f43 | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 306c15b9bf889cb4d73188a8659ba31823297c790afb69c20c203c888e16166f | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 30efc5f88fdb54d1c5c45291406c90bff9fe92f88cd9c338b7f1dc511bdc4994 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 318659e42020f1797d332c189c9eb7eb514748e4b4328a8307fbda3ee0cf5406 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 32d069cf8562d57c41b2fc2a3bc8f0c8ef1f7a3e1e216bf329a6778111351415 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | 32d9664ea2a9feb4c3c9c7411e1e3ef2193bb65497520b46a2604013988f7124 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 32dc3fd796aeb1f0850a7cb6bdfd78d87cb3c6bac47c6f95bd2ec788f8048e38 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 34d9bd87c62de80966f17159843d5fbd4b73cbb73920f5b4d583093d88e91c8d | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 3647324458d4da70731307298684c543bb3a87da0a016a4c5ecf1aa306dacff0 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 36d9b2a3ebc3169cc671a8da349859fa1f89e86cc1bdb0455f61df2701377096 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 38ae7ce2ca376b00c6a49911902c6256b74e78611977e538b522596a502d06ba | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | 3993ddb32e898160739dc00cbffd22590c3fc3977cb9e45faf87979f0d2c1ba0 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | 399bde9e2eacd20b6304443d5694311376ffc199a53373caa5be5704260388a0 | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 3b123ccf9b71071283d19a3508e29c2fdcea95d235501b45f466e1b36464c940 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 3cfe8e7b07ba2f578cf713fdf0679b8200350fea26dedf49c3e8287f4ba27b95 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 3e05f082c6d538dbe9cf4a855cca7c48e2945de4fd0ebc2efc2df112812fcb34 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 406f17dd277c82957844f527c305aedeb35f191316f8f7f446de2bd2b61318a7 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 417b02147a4e2c55f7bcb8528b0d4f518e0b66bf0297d99afeaaa29dde4b4396 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 435597b4851952338f1cea3ff0921e83d7d6ba526b6162c45b0701b247c749ee | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 44390f488bf5485b3eea9afea88adbf1899e4016f7999b1ea147c5a4d2f5be12 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 47d596618ac6f3e42a481a4f1b83618f6e63f06273ab3aeac5c55642bb597e85 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 48afbdfad9120c807565d8b5bc059b48eb46da249a49e23034cec0239d0275f4 | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 4901044317c39e936e5dd8a8b3adced74b24678cbc0c63bd335a919bca53c786 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 4c2fbaa5ce4e314c380861ccd3fc4ce32a8da8cbe1ee687ac9f1ed401bd1aa84 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 4ce2ce82a2f96f28971d0d34c7b7302bfa540b0087e550d64bba470173866c42 | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 4e984dbad4076087c12a33c0a45ee198eb219ceb25e63b30bb5f44aafcc9dc65 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 4ea4c184c38296c29f041118524781d9b21331d72e966512cdd2f7b168b98321 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 4eb76e2435962519e254c6340d610b29e58bdc310df2b1e2b090bb70efa3ec09 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 4f51f71233d3419b614829f6ccf6428e5e0e0fadfee8b0f8e43e5fb2d81a19ba | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 506a3f315ca523aeb00110c0c7aa95a28a324d8eb665535b4dfb5bb7f5769d1a | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 50eb9ee080ec53eb7f28421437461c87fd5c3c8dfb886951fc716c21e055b7dc | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 5171f07405ec0bf0a9efe5db173bfe5488e20eebaa3c6487826bffa3a7a4d31c | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 518820ad0bbf4bed36c43b8eae49ea6253b8745b2755aca589a3f6ddb00db511 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 521e74284712326ad8acdb1dced9220abdc8d5cc80882ed9db621ed64a47944b | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 543b4dcac214eeaa006469df0697a9259a745a3c4c65b6bc64dd7639104a473b | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 5441f7781ac766e5d41e1c0a47b5840e6ea29a2b1b589d7610351b406d0d2f4f | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 5696b51d3466d90dc619bcd3942d9648577a87e59de4e5d89ec2ccd11cd94e48 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 56be72e50d0c5d1d2bac4591430834b9026321043fd05cfcbea0a8be9fa9b108 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 57bdc5098f339386a61494dc55866d940962ec5549b12646360dc3be8da40bb3 | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 5862134fc6f0e8c499763918f32b4e83f3eb1451e20b26aac3125c7b72bdc5d9 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 58c3e7d4d7db837100d6aafc739066ed0b913cec9562e104c04eeec28adceb96 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 59e7b8479490aa1c94ce8f99a2752836c395388eaf55edb3e048fffd00a40975 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 5a7069de34bc25503f1697122ece6e7c4ed8126f91bf54e14ff71376238e111e | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | 5aa3c6fed81b079e11da4b83d5af438649d54eaa97c3a58a5f2521ffefe4ec79 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 5ab39930697efa755d80a8731ac9b00090de4a2063133969d879183bc109ccd8 | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 5b480b41bc60e4b4ce885c794023fba833c2ebce5404a803d1ccae3c06967157 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | 5c093a78cab8e5e07047ac3377d57a5ae0266d1a098de01ee4193c7e31c706f0 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 5c110becd3b774f8c0a249398a01a3e92f04c0a9881a700a45fe94016f55428f | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 5d796aa204229a3ac9e7d37b1e27618541af33ce3a34b1a43298bfc85807efcf | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 5dc3e14513b09a5bfe3569e6df3e69cf5b5252c079ae7ae7d5291a226e728b49 | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 5e0b61bdee810750efc77fdc4f089c3125a588b01994d470d59e5b83d514ab91 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | 5e2ac43c4a2bf2a555a4af963036b824cd0f4b41a02655a20427ceccc65caaa8 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 5e5515ea30e8d86c7c31f01b223aadd4213f3b56faf7578ba375846df189eb01 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 5e8eb7511596acb43df64b54ba844024783bbb2a38cb458799cb939800ffb2eb | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 5ec89712a5ca3c6097def18ec885b2aa771ca0708d4a98ee2603c255fbd18a52 | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 5fb8d8a4fe8087758141af18cf014ba8ff05974521bcfb1ae7f831d8b4624cb7 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 610917410ad66c33d27504568bcef08caebfc3999f6baa2b83a13212d50aae09 | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 614d040ab4a282da5a66381e58230d81962cb2f5551cb8b13ed6e5c212eb32cd | File hash listed for the Win.Packed.Tofsee-9900223-1 threat. |
| SHA256 | 637cebab33df49e938eedf24c0e9c37a36aeb84b861d6bd59ea28db466b7f54f | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 641ffdc5e6da4b2e32f6591e3e43f0edd71fb8483fe098a22cd90ba2f8df8203 | File hash listed for the Win.Dropper.Lokibot-9900252-1 threat. |
| SHA256 | 6477663119f215e6f17f65697146f48e043a513b9bc38323ee71379bc669054e | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 67a5551fd8a916862fe5fafd3220dd4e7b24e3006b56e5816ce3de90718bf98b | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 6ca78e8e4072c5de888c5f6f84752f136a6886b9246f9b172fb5a7f59aa39d26 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 6cf9dcdc0ec7de7595858e857eb31c91ced6602247f110c34ad34143c7db54c0 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 6d10b98d537d39c0b756ad4c015c132d54d7fe1e79d9fd47bf50e2fa29eb5c4b | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 6dcd3d0919c8536128cf6e34cca0e5d3b5e574404dcf82ec463e123e2f4b5f45 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 6e9e6f46101684f027120ad7ad467587899924d49387c7feab1f792342575e4b | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | 71968d577cc9a2e571373a4cacbdeb6f7385274e482326be2fd407c6ad1a1db7 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 74c4ab4ddbac32a33caa989cf83a4809534409e8671ccc03c79dc52a85407acc | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 756a97af1cbb171ed55725b2d188944498476bc589c562af3c0c9110b4aec4d2 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 7590c06c2c654eecd955d5921120287e5423dc2cba57d451d980a9f4b74cb3ad | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 75a540fa5ca0d41da3b672a41a32f21d81a5afb3b4a4d5f2e4236840c0fa1e11 | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 76e8b95cf47146e70798803063acbf44856ac829dc74bc58cedb8ca759ce8971 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | 7af790e5adaa5a59a673f749247873fac5ad35d8455623dfd9ea5581d36d93ae | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 7d3ac2f7d9298e566d1fdf08900e2fa5924c15e22d76d4fdde12bd464161a42a | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 7d589381584c0634a9ff5bbd915aff2f2756affce71d719dfb2e968df4dca929 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | 7e1f66c8b71a7cbed0d3bed0f2267af1a441418a8fbed41416cff4505a41190d | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | 7f0e59ae48c2ef18fee133de5820fe5e3c776db50019cb365826ea66bc7fa391 | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 7f7493bd79fd3e7ca293581ca2129c6c45e9617050dd921a0c75fc53d408cf89 | File hash listed for the Win.Dropper.Remcos-9900255-1 threat. |
| SHA256 | 80b426a7370624982647bfe534eddfffdf0bc7c5961009f6390be519ace9dd49 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | 83a3651c76005cc7db6b8c38c3ce46b78c8b688237f298ffd5b21ff70755011a | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 88a1ad8026566ae6d5ad0f11bbfa3b67d08866f261a96ead17a97aa4e7a02bd6 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | 894d4ba6d8232d91019f1cb563be4723bc41bb68dcb29c30c6292556c3cfa016 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | 8b538787662cd5dd0aecb06520f43a7fc2f638acd7299e652168dece1ee44a19 | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 95067347907987c71203d0645155a22f725c87b2bcc882b8bcee2f89f8f6e51f | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | 9681de2bf9bd956b5f290a58289efe3b67bafc50eacdc18ee660d70fed1a2e70 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | 973e111c802eaa32a828ed58e298c5a8efdcd8dba08b24a0e2f14c4766095b21 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | 9c512a0e999eb8b28fa2517d0cac29c5784e225cd3c70416c68d018f7c95b1cc | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 9e0c82ff4f7cba5681b2961e93054f80aa9cad6fe8a1c8efada8682135b2fcbe | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | 9eabb24bf7de07062560284a4a709980608646d67ddacde158cb652d9e04b80d | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | 9f224c5fb5bdbb3e5ec7766377e702922921f1239fc33202e93d985f780311a3 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | a0b2c7f633b19cae26651472228c38a38ce2732ee537860794cca12a6402ad95 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | a3ad4554c582908654304ad34c10e5a00cfbe0c06d28117b17fb4acabc8fea72 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | a59720e7db0f1edc4434365ae7efc1aa2bf820cb8705441f61c177cb001a70c1 | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | aeeb3b332819c870791ca9af32ffe698d6b1fc7353a7c4f90448ce687630d528 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | af0b12ff1e123364beea9e42b5978b176bbfde2a7c9c186b895d214be5eb943c | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | af44c034319285e5e80e688360ae7546f628d983311a88b607c190380a8d1ef4 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | aff7ee708fec6078948284d581319940a1b98da77e455ae89df9775d61207e1c | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | b08403ecf17daa804a05d806e4c08e3d743665de738668f4ec5decd77f99c149 | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | b104e819789c544c85751c7b9f41fd8b19eed851c03b9a7f4f7e3984fd8e1932 | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | b14f9b96e395a34cb150c5bea059cf07a70eb843c3ca8047a2b45c98399e5ff8 | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | b34d982450dc9d794f9cf3a03bd08e71472e2d165c2c97f07bf175a4b89f356b | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | b4c185a664015106c0fc76273c780b1444ffa291dafda278e71c1d7e14d4f01f | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | c1b8c297c96d78e1b93a7451b1a6b086f8d9c73385a30919b41d3871be33cc5f | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | c21d16c98ba7e278cadb033ce10ef94e098007ece1a24624b36580b32f83ced7 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | c2e4131d9c50ae218478930758889fa1baae4176dda4d7580959098004258b13 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | c6d175058f82a22e571297f3a65482fce8a9ce022f3dadac37b0132258622849 | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | c81ada1843071c17fbc30d0f486eff38c32e8e99bc20dd9233affb37b82a4556 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | c8ff40b80526c837436a03a09a3540458e8167c84f97f0f4cdd3961b01630b51 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | cae4544fb037757d0aabcdc24453b469b93e4fd3ddf64333bee68888cff998bf | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | cc04e1f5ca1df70aa70bb91d7985e985f7325833da2d3cb7d98847607743d9a7 | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | d070ba7763258fc643ac23b3148e773c28470d3c07736ee8cd86a8cc171d7c81 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | d4f1a84eedf38127edc741771c3f1edbad8d4fb02fce8a79c4b90bc0a68ad849 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | d57cfdba7d7bd8960781096927de972b1e2848353cb95115091cbb8e067901e0 | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | d7851cbcd4bb0cf7cb3c9bd4f5ab893bf94fa520ccc838cf79a9dd4f0485bf71 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | d83a1c7282f419d9b80292ab8be338b84143fc5b4ca97fb17285721f9aee0065 | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | d8c0c6009138939fa0d5a1a373e85cc05b8e9c18d83c33f6821d6be92fcca734 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | d970e6c91a2894cf8bd7ca454cd9e173a25c199cf1be60977b76cd96029bd060 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | dba87f9c4f743944d3cc41746cc5c0804a2e0e7c5db2376809068c78f55d5ec8 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | dc157362e9c0469b3d8909770c5879a1e5cbaa6ae5e0d8203c536cbce6131901 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | dc5d43376b8ce662043dffe0e84a1009bcfb711c87f206bfbe1add9ca71c35cf | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | dc90b17949b1004ea70d7bbf2ec150015f4b2bef9bc1ce588a1aee3a802b4515 | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | df7d13b02692189c7b78ce1155b8cce48f9bdad966eb31d9a4dd0eb277221e3e | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | e3b995145da9f749ff132292c0c9db031dc83599c092ba247c5faacbd1e0b63e | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | e3daf05d3602f2d2602bb6d2e9a9d4a24624f882897e14d82ebf0f9bdd9626d5 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | e5155d78bb1801c688da91dda5d55a4b745e2b137b98fefb9a130b7ff20081ff | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | e56a7b6c398eb2069552234566ff0cb3239502a1fabf2ae7d856958a0782ba4e | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | e60be7a47db3d2bad1615c32cc2fff36ef52befa1c1ee614ad7f02d56a6ce2ad | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | e6be86d707caccb0be7b1423fee7ca7ad9268e90b22f53c94c5bf3edac66c8fb | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | ed746deddbbe7a23a1e388211e47ccc40a0595ce3409a919fd5f73308abd9ec2 | File hash listed for the Win.Packed.Passwordstealera-9900629-0 threat. |
| SHA256 | ee908ab8413736089d1569e8035c2a8e1486894745579dbd1382425dcfe6fc1b | File hash listed for the Win.Dropper.NetWire-9900023-0 threat. |
| SHA256 | f02cce39d4f9a1fb9a2c146cf3b8add1213d2051f941c558a0626aab5c1073d0 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | f0e6bb54691ec2494c402bdb78853d52ce0e5a314917f03f7ec99823d53256e4 | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | f2bee2cd800b05408cd918ca8dad8076d9435f0ee4ade64642780359e5b5abc8 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | f7987035d0f332dd2b81377dacb1bd02f4e4fcf7ef2f29ecc8e8554b6972aa64 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | f808cd63e98047562f39e22011d2d14213897d71b50a483326747382fb9b7897 | File hash listed for the Win.Packed.Cryptbot-9901331-1 threat. |
| SHA256 | f990804b3c6544b0f6e0ab590af585a9057f7bfc8e84e206c21dbaa1d9671a77 | File hash listed for the Win.Ransomware.TeslaCrypt-9901319-0 threat. |
| SHA256 | fbdd7b15af60287fbd839399f50d9add20b13dc4265bf10be803c7c72d777fb3 | File hash listed for the Win.Trojan.Fareit-9900344-0 threat. |
| SHA256 | fd3395c065898fc2bc1a809652b3e88b90e498ae34f1caa8a65d9c725348239a | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
| SHA256 | fe1b587eb2ff65101b410ce28bd23489f411a6208a6aca45e0df5c9910709c67 | File hash listed for the Win.Trojan.Zbot-9899961-0 threat. |
CVE
People
Malware
CryptBotWin.Packed.Cryptbot-9901331-1DealPlyDealply adware detected - (2084)ExpiroExpiro Malware detected - (7379)FareitWin.Trojan.Fareit-9900344-0KovterKovter injection detected - (663)LokiBotWin.Dropper.Lokibot-9900252-1NetWireWin.Dropper.NetWire-9900023-0PasswordstealeraWin.Packed.Passwordstealera-9900629-0RemcosWin.Dropper.Remcos-9900255-1TeslaCryptWin.Ransomware.TeslaCrypt-9901319-0TofseeWin.Packed.Tofsee-9900223-1ZbotWin.Trojan.Zbot-9899961-0ZeusZbot, also known as Zeus, is a trojan that steals information, such as banking credentials, using methods such as key-logging and form-grabbing.
Vendors
Products
AppleCrystalbit-Apple DLL double hijack detected - (7792)Cisco AMP for EndpointsCisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits.ClamAVFor the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.CloudlockCloudlockCrystalBitCrystalbit-Apple DLL double hijack detected - (7792)CWSCWSEmail SecurityEmail SecurityFirepower Management Centerthreat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.Microsoft Officeremote desktop, and read data from connected USB devices. NetWire is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.Network SecurityNetwork SecuritySecure EndpointSecure EndpointSecure Malware AnalyticsSecure Malware AnalyticsSecureXSecureXSnortanalysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.StealthwatchStealthwatchStealthwatch CloudStealthwatch CloudUmbrellaUmbrellaWSAWSA