Talos Threat Roundup Highlights Eight Malware Families Observed in August 2021
Summary
Talos’s Aug. 13–20, 2021 roundup covers eight malware families, their observed behaviors and indicators from dynamic analysis, and Cisco product coverage.
Key points
- The roundup profiles Ramnit, Formbook, Remcos, Upatre, NetWire, Razy, Dridex and Tofsee, based on dynamic analysis.
- Ramnit and Dridex steal credentials and sensitive information; Formbook logs keystrokes and steals saved browser credentials.
- Remcos and NetWire provide remote-access capabilities and are commonly delivered through malicious Office documents with macros.
- Upatre downloads and executes malware, while Tofsee turns infected systems into spam-botnet members and supports activities including click fraud and cryptocurrency mining.
- Razy collects and encrypts information for transfer to a command-and-control server and uses registry changes for persistence.
- Talos lists behavioral indicators, file hashes and contacted IPs and domains, noting that an IOC match alone does not establish maliciousness.
- The roundup describes Cisco product coverage and detections, including process hollowing, suspicious Office-launched utilities and CVE-2020-1472 exploitation.
Article Details
- Publisher
- Talos Intelligence
- Report Period
- 2021-08-13 to 2021-08-20
- Scope
- Prevalent threats observed during the reporting period; non-exhaustive roundup.
- Sample Size
- Dynamic analysis: Ramnit 20 samples; Formbook 45; Remcos 15; Upatre 41; NetWire 15; Razy 27; Dridex 26; Tofsee 26.
- Recommendations
- Do not rely on a single IOC to determine whether activity is malicious; IOC searching is only one part of threat hunting.
- Consult Firepower Management Center, Snort.org, or ClamAV.net for the most current detection and coverage information.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0052f3f800e9c7b2ad0991ed4e1b48ce73e015d93b5a54b823c952fade0c89dd | File hash listed for the Formbook threat samples. |
| SHA256 | 0113727d842158c5d04aa0a1c89993544cc926f490eacb5cc8352115839e4dbf | File hash listed for the Formbook threat samples. |
| SHA256 | 011597cdbf40d1f08a644d42c20e19175574a433a735eef887283c719ef8e63e | File hash listed for the Ramnit threat samples. |
| SHA256 | 0119530716dc281231697e8e37f4899e88d8f4c50d64ee79b4a102fdd57ade2f | File hash listed for the Tofsee threat samples. |
| SHA256 | 01b7940f00b1fe720244be50cb1eaa65cf41d91d387b0009d7c3c02332c6d90a | File hash listed for the Ramnit threat samples. |
| SHA256 | 01fb7ea1fcfa9973942e47ae832311672e0950b20f600a1cf5af9b86cb10f152 | File hash listed for the NetWire threat samples. |
| SHA256 | 021dc00f29097bae2e878dadd5aef152f6deb540b0cc7220cc61e9f782990f23 | File hash listed for the Ramnit threat samples. |
| SHA256 | 03803c596318c49c1ab6ffaae71c89579d30597e229375a5a6e1c87033943b02 | File hash listed for the Formbook threat samples. |
| SHA256 | 0394c478368df01e8c8d4fdd51949e552415fb4d89f5694477fd9456e9590a88 | File hash listed for the Razy threat samples. |
| SHA256 | 03bf53b91167f5eeb989d970b9ba78af685464140e5d6da0f100f1b5de86791a | File hash listed for the Remcos threat samples. |
| SHA256 | 03edf7d9493484932879614edd7f0649c8bbcf2a19cef53f602c3f28d92905ab | File hash listed for the Ramnit threat samples. |
| SHA256 | 04bf8f96f4deea6cf30dc334728d18d3135b182ed5bf96b11f5d3ec509125a0e | File hash listed for the Razy threat samples. |
| SHA256 | 0542391358df98fe1352d144a1d13303096a0a4b150476a32291ca69597ad4f7 | File hash listed for the Razy threat samples. |
| SHA256 | 0b55007ff5b3919c559dc893f8c2555d9690780667b6b5d04a45a5ab044383f3 | File hash listed for the Upatre threat samples. |
| SHA256 | 0da2d59d76684e3912a82d88c978e16b65e3a9f8aea0c43d269953cff6956a7e | File hash listed for the Ramnit threat samples. |
| SHA256 | 0f98dabc783362529752d0cc7d021b1ac57f022ab24f0572fc9822960ce79764 | File hash listed for the Upatre threat samples. |
| SHA256 | 1004231cf99280ef2d35315c73b31abaad155f344d217a68f68aab94cac32a60 | File hash listed for the Remcos threat samples. |
| SHA256 | 106dcd0fe3b72990f8b27a7fb2e5a47d83ec3755847be14e246cb32115945a20 | File hash listed for the Tofsee threat samples. |
| SHA256 | 12133727d887834f90b8f43b53a9a09cdee7c2bf32db04a2cb75de88634731bf | File hash listed for the Upatre threat samples. |
| SHA256 | 14c87ee6ee94fca3e11cbab76c1caefc560b68b7dd845ef94401aff877714f1a | File hash listed for the Formbook threat samples. |
| SHA256 | 14efe7fa6ab2dfe95f5b0f382ce8d9a058459fc2e08c00d5e00d9bcd546839ee | File hash listed for the Tofsee threat samples. |
| SHA256 | 1551d06e3df9b7381a171b5af17b61004abf24d964d782e3d3de7990856cdd99 | File hash listed for the Upatre threat samples. |
| SHA256 | 155a339ca1cb5f93d9c5a0b76b7e7460af14520d0f32827a5582181f320b2374 | File hash listed for the Formbook threat samples. |
| SHA256 | 16565f51bda4b7b38c8609bff8228f5c7d3a9433c45c51b444637395066704b8 | File hash listed for the Formbook threat samples. |
| SHA256 | 17420154b52f144eb3ea5113c24cf5c936cc3cdb5174fde7b4e6bf86f342edd6 | File hash listed for the Upatre threat samples. |
| SHA256 | 191a8a81de6aee304ac908fccad0c138abccf5baf851714d8e28a3879300500f | File hash listed for the Ramnit threat samples. |
| SHA256 | 1971b647a79367925945c4f37cfece154b604b185cba415204ad037c81d2076b | File hash listed for the Tofsee threat samples. |
| SHA256 | 19de9c9b0141c464a30393d9e0c6e9f172f7a2ab15f1534bb2f73824f480422b | File hash listed for the Razy threat samples. |
| SHA256 | 1a00092e00ec3902038b0ead2b083c686503b33d0bdaa50e669dcf03763143fa | File hash listed for the NetWire threat samples. |
| SHA256 | 1a91ddcf8ca28875149a4f899be6ae42baab213a1383c5e33c434f9dadc192e2 | File hash listed for the Formbook threat samples. |
| SHA256 | 1b78149612f5659d7b790d117b475dffd717fa6614b908ee259eba00c8515f69 | File hash listed for the Formbook threat samples. |
| SHA256 | 1b9668a78ba5166de6ace3915ea905ced3941c5d5c87ef8c289cf67456a63c44 | File hash listed for the Formbook threat samples. |
| SHA256 | 1dd429e06fbd25a747b8d1befe301a79ee793e359941d1b6667d18cc527650bf | File hash listed for the Tofsee threat samples. |
| SHA256 | 1e14e4b1a28a278c232a09075ba665c998e77532298af2a076e00a7baa80b560 | File hash listed for the Remcos threat samples. |
| SHA256 | 1e2d31807f7d36898f617732ff627255967b172598a11cfb81d8999633ab58b0 | File hash listed for the Dridex threat samples. |
| SHA256 | 20b2a5a13b004522123ce20b3c07e9b21c16e5a0e96061e62500e3bb7dcb154b | File hash listed for the Upatre threat samples. |
| SHA256 | 20b5fbb5a66b2f26ddee943dfd0bd7cf5b323b0eb570efbd938064f969a58e7e | File hash listed for the Formbook threat samples. |
| SHA256 | 20bbbf90e36e60bcca9a8a937734819634e9fa28a9b9fab27348c0f0adeff5f3 | File hash listed for the NetWire threat samples. |
| SHA256 | 215d39e7eb41a4e5412410846d084892dc82f80f0deee7f4fc8eca9243aff20f | File hash listed for the Dridex threat samples. |
| SHA256 | 219ace00525f3ecf5570a13d5b2765e7bb5739aaa5fe501a87e68c876b111094 | File hash listed for the Razy threat samples. |
| SHA256 | 233e7e39f24876f809e37a6d3ed724362f6c9dc86b29732e4c2ac0a05182a806 | File hash listed for the Upatre threat samples. |
| SHA256 | 26e2073c73f294c1fcc9805e08f78b8bc3bdbefb709e0aa522e17190d2d60693 | File hash listed for the Remcos threat samples. |
| SHA256 | 28154b8d303715d3fb75dd8cf18308542da4994a8b443336b18027c7f63048ac | File hash listed for the Upatre threat samples. |
| SHA256 | 28b856f77d2d25595c59cb1e2091c9b6cd080997bee43f4795db6b7398c6d7b6 | File hash listed for the Dridex threat samples. |
| SHA256 | 28fa9d0333a602b1587daddc078726e23b72e303e111826d38f0aa6d7d6e591b | File hash listed for the Upatre threat samples. |
| SHA256 | 2a37d41bdedac6dee889934eb0ec9d511adbc93e693e76334de563997a9ef241 | File hash listed for the Dridex threat samples. |
| SHA256 | 2bc4aba736f5b4da88cffea9934a76cda20b9c9869d9d14b31f558b03b9cf6d8 | File hash listed for the Remcos threat samples. |
| SHA256 | 2c019f1ca2de64299488762254763248c93bca048fb255f3fa678016fac1f315 | File hash listed for the NetWire threat samples. |
| SHA256 | 2ca25eac6d03ac1299eb7540619e10a778c1e8dfc33b4c4e7533e9c5bf0f4bf6 | File hash listed for the Remcos threat samples. |
| SHA256 | 2f765f6fabd9a9575c5b2f9432837c9908a8c50ddfa485d91defe23568faaeca | File hash listed for the Formbook threat samples. |
| SHA256 | 2fe5db3040aee670f1cbf56ecf8dfcc52466d7143daa7855d63a1ca830b9fe98 | File hash listed for the Tofsee threat samples. |
| SHA256 | 30714a7591c95cdbfa849afa606b69201f269d141dbc20c12b63ebc67ee4f168 | File hash listed for the Dridex threat samples. |
| SHA256 | 325d26bda08529f327f5990444cebfd9d043e72234b3e69d7e09aaf8f8b950a9 | File hash listed for the NetWire threat samples. |
| SHA256 | 32625b9155b52768116116cd98a8f8065a750f5bd317f368d83a31cd7e9de669 | File hash listed for the Razy threat samples. |
| SHA256 | 32dbddfda24a2eaa96552b6f8ce8e528915962f3bae2242a010ac6a438328a71 | File hash listed for the Upatre threat samples. |
| SHA256 | 35634574695dee60a559e09cae0402c7570a770f7dfd56867e3e6bff62684938 | File hash listed for the Razy threat samples. |
| SHA256 | 35dd313909dfc9d8fef5a419b9710b3f137aabbfc18ed09d72c5a367704b1788 | File hash listed for the Formbook threat samples. |
| SHA256 | 373986d5caa0f891d1585b96752aa347281aefddfee864401d7f71250ff9c814 | File hash listed for the Formbook threat samples. |
| SHA256 | 3770c8ef58c356fb2daad52f81c8eb4c592be81bcba74c465fabc702cac37aa9 | File hash listed for the Tofsee threat samples. |
| SHA256 | 38953969ed21113318984529205154f47908974d18e791e04955386aaf4dadaf | File hash listed for the Ramnit threat samples. |
| SHA256 | 3b884caaa4b0c6aa7cde73ee166c20ec4bbef3a2de76436ae220fc427598125a | File hash listed for the Upatre threat samples. |
| SHA256 | 3ca3e6ac1fad0e004643a5512be7282935d6dbe98e088e256846ee6de2c390ce | File hash listed for the Ramnit threat samples. |
| SHA256 | 3d3aafa56c032413439e265ca7f762f462b78e127ff9994ce830e803082418be | File hash listed for the Upatre threat samples. |
| SHA256 | 3e82631adb4fdd2eaa252a8990a8454ba96a69961a0c75388a8935d96943e48e | File hash listed for the Dridex threat samples. |
| SHA256 | 3f47786344a6d8d239b9aa535cb463f07d82af2fe338415485a76e8c105ae294 | File hash listed for the Formbook threat samples. |
| SHA256 | 3f7aead9d0c88dce4bafa709f2ba0f73482fdc11d62f5721a84aded01b5ec7e8 | File hash listed for the Dridex threat samples. |
| SHA256 | 407b698c9a17a20a1dce87bbc91f5d7d2294793a517f29497ac4b56cf6e09da4 | File hash listed for the NetWire threat samples. |
| SHA256 | 40b501b3444e00004e3483c4d36e85337802d5a22667dc3bb487b5e9e1c7b569 | File hash listed for the Razy threat samples. |
| SHA256 | 410b09f571f2246302e341f2d31bef8fb9d0f0f2558b9974951e3427a349a943 | File hash listed for the Razy threat samples. |
| SHA256 | 4222985e11760166f8d415b49ab478d6082a4265022dd9fe29a0c2cdab4470fb | File hash listed for the Formbook threat samples. |
| SHA256 | 42be0374a8ed0cc8b79e66efa95f809231ddc5dba0e4d946ffed0831a8beba75 | File hash listed for the NetWire threat samples. |
| SHA256 | 42f1e9f830ef80f92e5abd3e2463e01c4bbce62342247c76c0ee4f1d87ec28b5 | File hash listed for the Ramnit threat samples. |
| SHA256 | 44638e6c7d98ce52e9bd5860c2e56cecdc97651b9bb2fc95d4e8fc438167c02f | File hash listed for the Upatre threat samples. |
| SHA256 | 46f08ae2b6191cd2fd07adcf8cc5c0c321016ba91e1161dc6ef6f423bdb3008a | File hash listed for the Formbook threat samples. |
| SHA256 | 480c71212acab3cd5e8a023baa597388adbfc688b0f611e1736f99a1441aba67 | File hash listed for the Razy threat samples. |
| SHA256 | 49e2af775b9511a073b868bae2c681754b01d90f2ac41c850155aa5bc5ddbbcd | File hash listed for the Formbook threat samples. |
| SHA256 | 4bf4b83a5ecb68d58534352c617c7184b8e723c7a4b1a50d9976245e43175f17 | File hash listed for the Dridex threat samples. |
| SHA256 | 4c0cb1c6ec58b44671e7c3f31f72a75841bf0be16319e4e6aaf76b0c1c0b7937 | File hash listed for the Razy threat samples. |
| SHA256 | 4d532be4cb030f8d4ae10f49144eb468aa56e25c5b2aaeafb6f5f2b3259ba66d | File hash listed for the Dridex threat samples. |
| SHA256 | 4ece70458739f9f7d0fe8776c3a417f79134a3e4e21e121ab06bb62fc84edd3d | File hash listed for the Razy threat samples. |
| SHA256 | 504cbf61ec1fd55dd5522d7f2306eda5f16239e09e95ffb47d024dc486dc32bb | File hash listed for the Formbook threat samples. |
| SHA256 | 506ba201f5632ceb6b1da8d1b25786c3b17ea63d4c25cd997788fc6da3cb4b40 | File hash listed for the Upatre threat samples. |
| SHA256 | 5117a0e67f1e641bd3eaf9f31923aadd6440f12894df36d1eb58fbe06f622ad1 | File hash listed for the Razy threat samples. |
| SHA256 | 5221ba8cc090a4a07723090ee11ea33f26ba12938595c4565738185d0e2b9778 | File hash listed for the NetWire threat samples. |
| SHA256 | 53ade9878918ca49d74fbaf8d64b150fc3c7d6d6d4c0e894dcdea14c87b84811 | File hash listed for the Upatre threat samples. |
| SHA256 | 54ac12c100f8aef7a6f98330d653feedec60bf52acbb9bd3a21b8a21ea422e27 | File hash listed for the Formbook threat samples. |
| SHA256 | 54c5ea24380b658bd73e5954d7fd9e9e44e5b95ead21a24bae83ca7e3eaf42b6 | File hash listed for the Razy threat samples. |
| SHA256 | 55114939022d058fa99363d45d9a9e6aaff1c4e711c5817d0c9638847d651e49 | File hash listed for the Razy threat samples. |
| SHA256 | 58b419900f2b6ede3ab5494ba270a257213d0fc19d4b2817eedeb8474347b34a | File hash listed for the Razy threat samples. |
| SHA256 | 5a4d9f470369a7b93aaeabeb63f37d1fc402bf757970efa3c630dedf3cdafa42 | File hash listed for the Formbook threat samples. |
| SHA256 | 5b2ca117e7bfddd8863b6a61520433488e50155db71f9c681f174819ff975034 | File hash listed for the Ramnit threat samples. |
| SHA256 | 5c5be2df6398d79bc809326baaa6c0e48430799f3031bb8523be2460fcc81a3d | File hash listed for the Upatre threat samples. |
| SHA256 | 5d3d80148a8b47406d7b053274dfe53105b92ed1db15ea9963e059aa5014c5ab | File hash listed for the Formbook threat samples. |
| SHA256 | 5d5d522c80d90a077cedc1701b69bba4a0ec3b5c607de6802143f334a448d3c8 | File hash listed for the Ramnit threat samples. |
| SHA256 | 5dc3518837889fea9f00a31500686aae909c77023d23dfa4c6257755bd575680 | File hash listed for the Tofsee threat samples. |
| SHA256 | 5e319298a6f2f5aa73fa2b5f0d8d098862541bdb9bd3c3f566f4e18ba191f2b7 | File hash listed for the Upatre threat samples. |
| SHA256 | 6037a065a51ef6b91ad2b35d0c511ad987eb2cadd5fe2b879ba170271521e8a5 | File hash listed for the Upatre threat samples. |
| SHA256 | 604724f5db4975c1aa1eb88eaf1931e674a506b7da0e29f10344b8bb7ce7c15c | File hash listed for the Ramnit threat samples. |
| SHA256 | 641178b640985b20b4ab3d150b113322e7ef6e072dfe1b3ee67bff2166861f04 | File hash listed for the Razy threat samples. |
| SHA256 | 6436d7c9594cfeced8301b0b39667d2e6f3c1c4a48f1bf1e9adf0da69207c72c | File hash listed for the Tofsee threat samples. |
| SHA256 | 66dd1be6545092bd39e660c4abf5feb696507f4611b8a39518d84376da96132e | File hash listed for the Dridex threat samples. |
| SHA256 | 6788c4a2c0bc6d5f80dc8b5ecb7b37100f6c37d231a389ec906aae784cff529e | File hash listed for the Ramnit threat samples. |
| SHA256 | 680bcfe5f603117e4baf2f3a56e2a7818a95f4e1be1499a12de89253be3ef097 | File hash listed for the Upatre threat samples. |
| SHA256 | 687d2a85577bc012b4559aa7c10d9d0f08fcdbb2e4b94d7620bdeba0bf26bf1b | File hash listed for the Razy threat samples. |
| SHA256 | 68c583944193bf05b3dc60787a7f277836d8009d664250f395a88b313fcc0b5b | File hash listed for the Dridex threat samples. |
| SHA256 | 6b1c4ecf03e71ee2c00deb9b82e805b16adaf5e01691f7d3fd1a972087c7481a | File hash listed for the Remcos threat samples. |
| SHA256 | 6e96ed74e77da3fb6698a87a2b0429d70e4cad40426cca12fdfd9ce5dd347c6d | File hash listed for the Tofsee threat samples. |
| SHA256 | 70c417fcdd20459484733bc71379e11b17dbea93b4848e1a990dc68e928c04ce | File hash listed for the Ramnit threat samples. |
| SHA256 | 717f79398d47d3554e406c46281bab30972353f937f2d99a3a0ae092bc200383 | File hash listed for the Formbook threat samples. |
| SHA256 | 72d4e7805d94785b9c95147f8a42e3700f2bfa56a79a46dfcf0791bd3a0f090d | File hash listed for the Ramnit threat samples. |
| SHA256 | 731fc49dabea5962c6a00ef142a75a507415e2aae14d426e063f9e53a60355ca | File hash listed for the Ramnit threat samples. |
| SHA256 | 74bb10eb3ef9bd847dd62369268579bee41d9afb0ec815855c4661912b0b8dab | File hash listed for the Upatre threat samples. |
| SHA256 | 750ecc1177dd0dad1c7d0097868cc632551c83d7ee42494471b4746c77938b48 | File hash listed for the Formbook threat samples. |
| SHA256 | 7593e0038cf369da28d60be1b173d771bb0fdfc232f8a7fbd2265248ce8a248f | File hash listed for the Razy threat samples. |
| SHA256 | 76194bc8312ee6ad5513db12b093dd8c57367a1f5eec0ee19189ea8699017dc4 | File hash listed for the Dridex threat samples. |
| SHA256 | 7862dc68956b7510b74fbe738d8c1438f145be20f2ad53b4fa7e91a09d5d9c03 | File hash listed for the Tofsee threat samples. |
| SHA256 | 78c970b6848cf42a304f5c8d0dcd7157cb99da348179b4f8e8d466bbd88a9723 | File hash listed for the Razy threat samples. |
| SHA256 | 7cf7edff537da0751fa3b60b34d16927c5be0b26de1147647b7305178fc24918 | File hash listed for the Razy threat samples. |
| SHA256 | 7dc2c3b847a3033a5b5a65abb6ba69ed846703aab0b97c10fb0215151ecba0d1 | File hash listed for the Upatre threat samples. |
| SHA256 | 7dc63125475b00b5dee4228a876dec9f92cf41aae8a908ace345e48a05dc7a86 | File hash listed for the Tofsee threat samples. |
| SHA256 | 7dfd9aee9bf2b3a62f6a7b6ea8ae097b080f1f0c98f75bae9008a1956d91c326 | File hash listed for the Dridex threat samples. |
| SHA256 | 7ee078a51f19bd60ee013d95426918d4e0edcc35a5bd3a25abdf119093533399 | File hash listed for the Remcos threat samples. |
| SHA256 | 7f7e9007e51bbb23f20f4781116e50b7a4d930a4b8202d2652e90ea9d200b908 | File hash listed for the Upatre threat samples. |
| SHA256 | 826746a316af5f798cc3c0625dbbea8c2d35b08c172502e26c590dca80468c43 | File hash listed for the Upatre threat samples. |
| SHA256 | 87222923bfac31bfb57ea9a7242efba287b80ba6778659b80d6c6bf0dfc1fa24 | File hash listed for the Dridex threat samples. |
| SHA256 | 8836d87dec16f04560a0ba2f9ab1423bbedcc69031a7b5d7a11cf4fed024a984 | File hash listed for the Ramnit threat samples. |
| SHA256 | 888368daa079dad1ba47d59f2ef8d7a5f9352f09004e59aea1e3c1118b72c524 | File hash listed for the Ramnit threat samples. |
| SHA256 | 88ebbfe1761c97655fa5e767fdea004c0a161d2a76308d6eb1ae53a94a2629ae | File hash listed for the Upatre threat samples. |
| SHA256 | 89aca5b0470e7e6e7bf3d6397f4dd8fd64e72c8ec711491a849c21a17636644b | File hash listed for the Upatre threat samples. |
| SHA256 | 8a6d4f67301d491c24ebd22135a2473fb0e047d563c1df51d125d1621079ab49 | File hash listed for the Tofsee threat samples. |
| SHA256 | 8aa542acd7005627c41b79d0a65e2e6f2504e4fdacf3b867128a21c568ae3f98 | File hash listed for the Dridex threat samples. |
| SHA256 | 8b1ce348134f9b2ad05b3757aee326c514bf090bef81704a407c7b43ad529c49 | File hash listed for the Remcos threat samples. |
| SHA256 | 8b21239240f447e2a397a8bb180cc1da31244e479b2dee720daca4f7215ac7e7 | File hash listed for the Tofsee threat samples. |
| SHA256 | 8edc4f42c0e306977948e20b8230c8f0198d8e7b5979bbf7c8ce6fc0ce1e36ad | File hash listed for the NetWire threat samples. |
| SHA256 | 8ff2b99a3b848b18ad4847683cd5e9cda08695bee7c1a090643269968501a613 | File hash listed for the Tofsee threat samples. |
| SHA256 | 9608abfbeabaacdf934cf26f3ca3203763facf3ea3d0088f16d59d325506e638 | File hash listed for the Tofsee threat samples. |
| SHA256 | 9709946caee93f6cb8e222f71bcb609e5cefe51aad5fddd16709d33315173ff6 | File hash listed for the Razy threat samples. |
| SHA256 | 9a26f69769e0613f71756c4924520defc4d7b93b11e9775e55e680e1b7bcfd39 | File hash listed for the Dridex threat samples. |
| SHA256 | 9c5cb4710017f6049ca3d660076027e27bf4fa1938f782847da7ae9c21669c01 | File hash listed for the Dridex threat samples. |
| SHA256 | 9d36f79559de0c8c80dcdb394e0ce8bc178e880a2bc893ac7db21a73ee3ad6ae | File hash listed for the Razy threat samples. |
| SHA256 | a045c905a1024251680eba6a398e9dc197e99cfb615489715a497df7130bdece | File hash listed for the Tofsee threat samples. |
| SHA256 | a1ac045d7d3958bf6c9177cce9e85b1045f5a62de8a9249fd66d5a220250a22c | File hash listed for the Dridex threat samples. |
| SHA256 | a88a625c46f141b3e81066f5cf298716d30e9192ce799c09fd88785df0e896be | File hash listed for the Dridex threat samples. |
| SHA256 | ade2413bba85a0e0b9c4743f910d1800c751f0a27b2e8bc5c6e9d92c1e0aab30 | File hash listed for the Dridex threat samples. |
| SHA256 | af7ed37f9293761f1777a2b1f190470e31ec44c9d122495b174713d70524810c | File hash listed for the Remcos threat samples. |
| SHA256 | b41664331a1332736020314d1cc8d602182a198c938f71b22b223091f37e4487 | File hash listed for the Dridex threat samples. |
| SHA256 | b4b91f611ff0e2e1f396f0c77db0d43fc1caa4faf0fc148403b62c8e09b57220 | File hash listed for the Dridex threat samples. |
| SHA256 | b627a38c343478ff6f7fc531bf7b41c81a062022f9c200aaa9e7d6be71d841e4 | File hash listed for the NetWire threat samples. |
| SHA256 | b72438e7d0ed4880a4b808496465ea7dc6c6f845fd2dda4c2961945747b4dd04 | File hash listed for the Remcos threat samples. |
| SHA256 | b7471e5efffe57e48d8af86e2695f151c6d282dafc1346c182e87fabf9f9d367 | File hash listed for the Tofsee threat samples. |
| SHA256 | ba24c173a8ea7dc3ebb33f1b282a51adc98b3a59c682cadd03067b9090d31e5c | File hash listed for the NetWire threat samples. |
| SHA256 | bf83ceab46ff918d8aede46f9633aed3a34f47d1bbfff2aac5cbbde7fe9a1260 | File hash listed for the Dridex threat samples. |
| SHA256 | c3e9ef45aa3951aaa48c86e96cfc02011e994e65e0967ce0a415888def68711c | File hash listed for the NetWire threat samples. |
| SHA256 | c442701a4255da370a5e798ef563d8e325f8a42d976b9cb0b166b6e228ed68b4 | File hash listed for the Tofsee threat samples. |
| SHA256 | c555a5ca6c6dea2d735d83c444621e9df1adaa9f022502d3fc7c05f115355028 | File hash listed for the Dridex threat samples. |
| SHA256 | c5b909c84d6cad2aa020937ddd46b0b4fac78f56ed2523376cbd306516b130d0 | File hash listed for the Tofsee threat samples. |
| SHA256 | cc31c12faf61b40c04950f47168a3fe895d2139ddb5c7b85f70489657ae9c6ae | File hash listed for the Tofsee threat samples. |
| SHA256 | ced5c435d9c0bb0b68980851396da43fe1053d36e1e2035bfa4c2b2833f6b018 | File hash listed for the Tofsee threat samples. |
| SHA256 | cf30d766a7e47b15906d98f42ecc70dc6e5e5c1cd9d9b71cd2ec9c55363f3316 | File hash listed for the Tofsee threat samples. |
| SHA256 | d1d219fa7fb7ff7ef7eadc1c3e32ed00afe68c636c34ac9878a1fc0496eb1f0d | File hash listed for the Remcos threat samples. |
| SHA256 | d1f95a5223c6f4dc954e4ccbab6d58fa9e54ff9037c88f06c9814ab4a7877058 | File hash listed for the Ramnit threat samples. |
| SHA256 | d4188598d26f25df5ca02f658adb3b807ee2f8645ed76a813c4fbdea8f08ac6c | File hash listed for the NetWire threat samples. |
| SHA256 | dc32dea1029a0858ddaf97e336f29b1ffdd221153b2af449914ddbc9beba724f | File hash listed for the Remcos threat samples. |
| SHA256 | e2c3f1b0fb92594d299f9364e688ce9365e6b7e25535e26c7924c7fa186af049 | File hash listed for the Tofsee threat samples. |
| SHA256 | ed3fdc42250bf871ce5d8c242c1b5377fcb10aeb37c68fd56f922fc8d2f0ec51 | File hash listed for the Tofsee threat samples. |
| SHA256 | ee5009c49cf3f165cd86eb576abbb720f457b50796525bff18b33a4278d9a6b1 | File hash listed for the Remcos threat samples. |
| SHA256 | f28ab9f9b4faab48c15e95eeba6ac62adb0464c1e04f25ee000f10ed456c5d6a | File hash listed for the Remcos threat samples. |
| SHA256 | f8a531c7c782f8aed9029e25414cd9f08ac1360251cb21e448ffc71a954dc160 | File hash listed for the NetWire threat samples. |
| SHA256 | ff0705adb6a2cedafa599d448c554e1e7378c8ba405277c291a1676b4f1f03ba | File hash listed for the NetWire threat samples. |
| SHA256 | ff7ca617a730a8d1f245142054b09a76341dc6b543a239ff7e1d3be28287d902 | File hash listed for the Ramnit threat samples. |
CVE
People
Malware
DealPlyDealply adware detected - (764)DridexWin.Packed.Dridex-9886173-1FormBookWin.Dropper.Formbook-9885481-1KovterKovter injection detected - (213)NetWireWin.Dropper.NetWire-9885572-0RamnitWin.Dropper.Ramnit-9885471-0RazyWin.Trojan.Razy-9885835-0RemcosWin.Dropper.Remcos-9885489-0TofseeWin.Packed.Tofsee-9886306-1TrickBotTrickbot malware detected - (153)UpatreWin.Downloader.Upatre-9885523-0
Vendors
Products
AMPAMPCisco AMP for EndpointsCisco AMP for Endpoints protects users from a variety of malware functions with exploit prevention. Exploit prevention helps users defend endpoints from memory attacks commonly used by obfuscated malware and exploits.ClamAV.netFor the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.CloudlockCloudlockCWSCWSEmail SecurityEmail SecurityFirepower Management Centerthreat or vulnerability analysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.Microsoft Officeinteract with a webcam, and capture screenshots. This malware is commonly delivered through Microsoft Office documents with macros, sent as attachments on malicious emails.Microsoft WindowsRazy is oftentimes a generic detection name for a Windows trojan. It collects sensitive information from the infected host and encrypt the data, and send it to a command and control (C2) server. Information collectedNetwork SecurityNetwork SecuritySnort.organalysis. For the most current information, please refer to your Firepower Management Center, Snort.org, or ClamAV.net.StealthwatchStealthwatchStealthwatch CloudStealthwatch CloudThreat GridThreat GridUmbrellaUmbrellaWSAWSA