Talos Roundup Details Malware Threats Observed August 20–27
Summary
Talos reviews prevalent threats observed Aug. 20–27, describing malware behaviors and sample-based IOCs for families including LokiBot, Remcos, Phorpiex, and Tofsee, alongside detection coverage.
Key points
- Talos says the roundup is a non-exhaustive snapshot, with findings current as of Aug. 27, 2021.
- The analysis covers nine threats, including information stealers, downloaders, droppers, a RAT, and a worm.
- LokiBot steals sensitive information and is commonly delivered in malicious documents sent through spam.
- Remcos can execute commands, log keystrokes, access webcams, and capture screenshots; it is commonly delivered in macro-enabled Office documents.
- Phorpiex spreads and delivers follow-on malware, while Tofsee turns infected systems into spam-botnet nodes.
- Talos provides sample-derived IOCs, hashes, behavioral observations, and MITRE ATT&CK mappings; the full IOC set is available in an accompanying JSON file.
- The article notes that IOC matches alone do not establish maliciousness and that detection coverage may change as analysis is updated.
Article Details
- Attack Vectors
- Lokibot is commonly delivered in malicious documents sent through spam email.
- Remcos is commonly delivered as a macro-enabled Microsoft Office document attached to a malicious email.
- Upatre is used by exploit kits and phishing campaigns to download and execute malicious executables.
- Ursu is spread via email.
- Tofsee uses infected systems to send spam that infects additional systems.
- The roundup reports detections involving process hollowing, malicious Office processes starting Windows utilities, long PowerShell commands, reverse TCP payloads, DLL double hijacking, and regsvr32-based execution of script content hosted on an attacker-controlled server.
- The roundup reports detections of attempts to exploit CVE-2020-1472 and CVE-2019-0708.
- Defensive Notes
- The article says Cisco AMP for Endpoints exploit prevention blocked the described exploit activity through advanced scanning capabilities.
- The roundup lists product protection coverage for AMP and other named products; coverage is subject to updates and further threat or vulnerability analysis.
- The article cautions that a single IOC does not necessarily indicate maliciousness and that IOC searching is only one part of threat hunting.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0021b7e732d7e3db7ee25920a26a5f51cc59339311144297394ce38c3f464321 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 03c5c143049d9a01b94885b6fa6d65de0bb4c6fd233d15f271fbb8141db12e6c | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 04ac26dd0305cd3b14a9b6a099b43f51e1069014ef856727808aa6d5e6a88ce3 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 07244660fda51f3a48e6746d749de4d4871252ff2281bd78a36c3d2b3a1228b0 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 0795dc3c5c11184d86f07da6c903de40dcffb9dcbdafcc9a92203b2f22da532c | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 07ad48c31139e1e1d10aaf5e253a7799cb6995efd7051e1de7f7e897a37ce225 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 0a172b69f7a773e7a1465fcba6dc36c17889a91ba57e9261b94d36acbdde550e | File hash for a Win.Packed.Phorpiex sample. |
| SHA256 | 0b81758cfd73125072515cfd1a7a11a42e2a3bad368d0e88dcf7a053afa6960e | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 0ce118aefeab086051a2c061cc7f34d2b979480f80e08131776e62657587ed73 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 0f47ce6da98c8f383a38c87b8324abcaf8be7e96a98e6563e6fda08634e819b4 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 119f21e2ebe27c3e178c88c72e465fd5924615c0b4bb82586e677db62118757b | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 121d48c2d93498023237f775a09c01cd9856e327ff138573d7cfd374484fe2a7 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 176f0a49b7d34d20b512e91f0395280e661ac0511e0246dee1f912ff97bf5db0 | File hash for a Win.Packed.Phorpiex sample. |
| SHA256 | 18c1f6929f8bd77e42e929874f0a6a99e2971eeb359ef8322ea2be7fa404a471 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 1bb788ab0376bf6f702f7dd15a16f4320ef7a5644ab50779e9decedc042c9398 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 20b75f3e479b0881f9d7efd915a7bad5f4260772349b568e3d65061dc06e52a6 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 22915bad486e7cf403b301edca36ef65eea35c9f8990114a59ffc966529220c1 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 2331796fbf3d080a76744f63dc09724cc374f20cb1e1fa4a234072522756ea31 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 2394287e26409be6a543e6a03772f8e0f165fa7a3322cb3c5de73bd42ba28b6e | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 257f32161fb056bf88d761bc99858c722315f6696a162e2376681e730fc6fdb7 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 266342ff4d60419a82a53a5f8d03aed0c080cfc788a4adbe9d36f8aeda89c808 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 2866daafd31bd60ba4d76c80e82486c552ce6e615091c69c0717045d3b1404d0 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 28c5f87ba139b1b78d20f2093b2866d15839b9c14c31a557928718567d9e4176 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 2a0de02b4d6e333f908f7996747d1344a47326d918b6bb3902fd5fd30e3f8745 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 2a84e89e685f5c1f4f0cd3f72756b3617a2bd4aa96304e14fa5b8b04280ba0f3 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 30d369bfb9809db7548387e6999e753026055dc0abfa37dae13e19a8cc9de592 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 3138fd3339dbed9a8c64ebe189ecfdf19ae43447a5f1a0ed701515424d84dd49 | File hash for a Win.Packed.Phorpiex sample. |
| SHA256 | 315813c71faf88703ab7b1d08429674206a9aa7b16f7010694d76a18d88bb5da | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 33bba8db846a6c26fca8f893292a93378d3a290f3092b5812c7c48ee100fbb09 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 3452319c9c4f570d94c9e49cf672bb9983cdf129cafbbce26b75bc47555f9a78 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 39125afb4422ba36d429f186450cfb88546f1dd1c5874dbec356f21e9f9be130 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 39af54b3b330327805534160ee196b0c83df28b4c3fdc4e509bf1f82368f7704 | File hash for a Win.Packed.Phorpiex sample. |
| SHA256 | 3a3025d7eedd687ce6c2d59b1be29a1d39a900f2a2a2c4d0130ca7c3cd072d31 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 3c0130ab7b8a9988f30104180a102ce7c9a2a347f80c3355853f957237930d55 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 3c09d7d48081c6181b54a8288f2cf38fcfeb72cfbf1ca5ec57f4a4c9e2a2d971 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 3c5a8eee570b3bb1ed8e685dd8e00d3822231047d099c5548feef189f1857ead | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 3cc49ca3a0d354efde74d2b60201460bb764b2439fd86d9e213443aea2dc3066 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 3d798d8b0beca4c0cc080be5e4ea73db2e766319a99ad0846e5935307f27f996 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 3d9573a5692dc1a5cebaab1bcd49f0b062623cc9d02e870ad449b429c6327cfb | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 3f49b4017cefd283d3599079a17ea781d2ead4b307103ce4fa2b2cf019af0b15 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 3faa185802205814772b161e6f4b2cda2030c2f7e3789387ee5dd053bdf15dd1 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 405c063d8369d8c80a7773e58514bf9057a55f9fdd80d463a3f5e6baf0ab6381 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 41b8924ab3c87339504e5817bf0364f9a4546e51ee62c71c5860894bb25179e8 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 424fa96a3f8bca56d24f8a2d7612ef07c8c06c1843ad0e96ec6ddae044e960b4 | File hash for a Win.Packed.Phorpiex sample. |
| SHA256 | 42b0fec30bdcec1eabb1953baa047aa5cab94258f912562469602a8f9a5c8f61 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 43cf21293b1aab37697807596dd980207f8ff225e84801d7da150356964f196d | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 497adcbafabf836785f0212b7733fc8f3bd0bb0187ae01bfa4ee24f6e0ba649e | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 4f3417fe48ca1c77c0e47bac776f74967586cc64462bfd1c182471f328f45a26 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 4ff0c05aaa00f7133c1cb5d907c8fcb51203765019073b5e5b48fffe47e04056 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 50b4b0aa6f34627889dd02700e74ef060eeea378f3cf2cb87e46adddfccba929 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 5174c19f27e3c7c6bda7b8f6ffe1720ae32da5682cd21909cd8305c058ebeea8 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 5241deccc67cee5a18db847a9636ac94a951722197ae7263397c37ffe4a30c91 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 535d4685e4926bb47fe221e9b0279a3b4f1a23b9f3dbd38beca704f50a596c01 | File hash for a Win.Packed.Phorpiex sample. |
| SHA256 | 53947d3c3fe7526ef319f18a5cc7a38dea29682788bcba6f56966d8dff90cd9a | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 5458ecc78971f8e7a475685f9cb3c6a0e9fb79e8881d210090c3c06117c0071f | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 551c3ff81ba1069d9e8faf9fa1549c38c9946b2c352351d2266d548d6ea9162a | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 57805836719e3a3a3f3543f8cc51afacbd8a83531a679bcf4152617ee2f119f9 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 58a03581d9e48aba0e01e180be9ed0df458cd5a2e964509007a15d69c36cb98c | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 598fdeebd4270fa442ab8ca6fd7bf2a742d7dbbe2f7df9fe4a8387e1028b51ee | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 5a7044fee737cb066bf480c869f010e9761c7380da410e4f9274da6986a0fe60 | File hash for a Win.Packed.Phorpiex sample. |
| SHA256 | 5acb1e778dfdfe2c396cde69111f5130dc5b46de894d464feef891fd305cf67d | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 5f22ef8944cca81a1211d5eed27461c24a5fe01ac7f5ebd33995052083ab31ef | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 605c33f570d0bcdf496a04a25eb8536a4b3391d8609bfbb7bd63cf460377bd23 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 60e4f03e02399e34c1e809393ca534d859eecd6d7b0c4857f15fe5c850a7abe5 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 63d3f86b5c116e783b04635474546c1151ebad1e9ff90e1592fed9a5c2ac6a49 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 63e179f1af84fa7dfb844fc4d2c162ecaa97cea1c8023c29441d197c340d83cb | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 673674a840095485b134079ffba71648cb0e43792448554a39f9f384bfcbaea2 | File hash for a Win.Dropper.Remcos sample. |
| SHA256 | 67a93f527e70175ea5e1bdaaa3d2e9b201984d42b1bbd81cec0e54fc47fa8b09 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 6834a8b4558baf03f91faa26910c425fcd1a32e485195266e2dd805f31c342d9 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 6843801fa2e691b3092cab4d4c49e899541017a4dc73e26a0762915671a79590 | File hash for a Win.Packed.Phorpiex sample. |
| SHA256 | 6a4bbf6ceacaf0bf9b5f1af21ee97ee9482b8676d6189ffd9289438ff271fbaa | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 6c842af254a3fac832db40f1a37dc790174363b6cdcfe8e28970297ede92d352 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 7106ec4c7194a383e07045cb7b0f4724f80de8986d5620dc232121914163f9b1 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 7358e1f61c5dd9734fd5456222ff6d2160efb6626d3dce4244d23b309be8001c | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 74f37ba38ada746cae3364ca451b2e32f98554bf98b3ca3eb68b8bc34c877efa | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 77881e60f8750c98c0f083461968453ab5e5f845dfdaa77cdc4b557641b06834 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 7f23c9143233ebdadb67225b16efb46d9dbcb359dbb495deeaad22cd98f55315 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 806b8607f8a2962415328eb4decb00b2b13ebd70c0723098408f80e8c31ff094 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 877e30aa0d65cf476e2322cae03df3c27c9e5d4d01c6c1be10da2f9c3024496f | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 888f8f932e93c9f26cf1914bd211a0d942c49c65734a7a318cb5b510671d20d7 | File hash for a Win.Malware.Lokibot sample. |
| SHA256 | 924eabf33a2823c5e4684530f5028120f8afe04464d8f7d72f236c869c862ef4 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 9296651be9fe1dc681f474e8c8996b44bdd2b3f7a43aee0ad7f53d82d71aa3a9 | File hash for a Win.Packed.Barys malware sample. |
| SHA256 | 949e6d2911da67036abb80fd33e572cb16178b24d35b5ea97bb637dc01958c93 | File hash for a Win.Malware.Lokibot sample. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelRazy sends collected information to a command-and-control server.T1055 · Process InjectionUrsu injects code into legitimate process address space; Zusy injects itself into legitimate Windows processes; Kovter is described as injecting a malicious DLL into memory.T1055.012 · Process HollowingThe roundup describes process hollowing as detected exploit-prevention activity.T1056.001 · KeyloggingRemcos can log keystrokes on an infected host.T1059.001 · PowerShellThe roundup reports detection of excessively long PowerShell command lines and describes Kovter using PowerShell.T1068 · Exploitation for Privilege EscalationThe roundup reports detection of attempts to exploit CVE-2020-1472 for privilege escalation.T1105 · Ingress Tool TransferBarys allows malicious actors to upload files to a victim's computer; Upatre downloads malicious executables.T1113 · Screen CaptureRemcos can capture screenshots; Razy may collect screenshots.T1125 · Video CaptureRemcos can interact with an infected host's webcam.T1210 · Exploitation of Remote ServicesThe roundup reports detection of attempts to exploit CVE-2019-0708 through a crafted RDP request.T1218.010 · Regsvr32The Squiblydoo detection involves regsvr32.exe executing script content hosted on an attacker-controlled server.T1547.001 · Registry Run Keys / Startup FolderRazy establishes persistence by creating a registry value for auto-execution.T1566.001 · Spearphishing AttachmentLokibot and Remcos are described as delivered through malicious documents sent as email attachments.
CVE
Malware
BarysWin.Packed.Barys-9887065-0DealPlyDealply adware detected - (984)KovterKovter injection detected - (266)LokiBotWin.Malware.Lokibot-9887069-1PhorpiexWin.Packed.Phorpiex-9887077-1RazyWin.Malware.Razy-9887791-0RemcosWin.Dropper.Remcos-9887578-0TinbaZusy, also known as TinyBanker or Tinba, is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" andTinyBankerZusy, also known as TinyBanker or Tinba, is a trojan that uses man-in-the-middle attacks to steal banking information. When executed, it injects itself into legitimate Windows processes such as "explorer.exe" andTofseeWin.Dropper.Tofsee-9887377-0UpatreWin.Downloader.Upatre-9887082-0UrsuWin.Malware.Ursu-9887083-0ZusyWin.Downloader.Zusy-9887097-0
Vendors
Products
AMPAMPClamAVFor the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.CloudlockCloudlockCWSCWSEmail SecurityEmail SecurityFirepower Management Centerthreat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.Microsoft Officeinteract with a webcam and capture screenshots. This malware is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.Network SecurityNetwork SecuritySnortanalysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.StealthwatchStealthwatchStealthwatch CloudStealthwatch CloudThreat GridThreat GridUmbrellaUmbrellaWindows Defender<HKLM>\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\EXCLUSIONS\PATHSWSAWSA