Threat Research · blog.talosintelligence.com

Talos Roundup Details Malware Threats and Indicators Observed Aug. 6–13

Aug 13, 2021 · Original article ↗

Summary

Talos summarizes malware observed Aug. 6–13, including Kuluoz, Razy, Remcos, Ursnif, Qakbot and others, with behaviors, sample-derived indicators of compromise and detection coverage.

Key points

Kuluoz is delivered through shipment or travel-themed spam and can download additional malware; Razy steals and encrypts host data and may capture screenshots.
Remcos provides remote access, command execution, keystroke logging and webcam or screenshot capture; it is commonly delivered in macro-enabled Office email attachments.
Ursnif steals information and can download malware, while Swisyn disguises itself as system components and may drop further malware alongside rootkits.
Qakbot targets banking and FTP credentials and can spread across networks via SMB; Zusy uses man-in-the-middle techniques to steal banking information.
Tofsee turns infected systems into spam bots and can also conduct click fraud and cryptocurrency mining; DarkComet enables remote control, persistence and credential theft.
The roundup includes sample-derived file hashes, registry artifacts, contacted IPs and domains, and MITRE ATT&CK technique visualizations; the listed IOCs are non-exhaustive and require contextual analysis.

Article Details

Attack Vectors: Kuluoz is often delivered through spam emails posing as shipment notifications or flight booking confirmations.
Remcos is commonly delivered in macro-enabled Microsoft Office documents attached to malicious emails.
Ursnif is commonly spread through malicious emails or exploit kits.
Qakbot can spread across a network using SMB.
Zusy injects itself into legitimate Windows processes and presents a deceptive form when a user accesses a banking website.
A detection described in the article flags Microsoft Office processes starting Windows utilities, a behavior associated with malicious documents executing scripts.
The article describes a DLL double-hijack attack chain beginning with a fraudulent software bundle.
Defensive Notes: Talos cautions that a single IOC does not necessarily indicate maliciousness and that IOC searching is only one part of threat hunting.
Detection and protection coverage may be updated as additional threat or vulnerability analysis becomes available.
The article reports AMP exploit-prevention detections for behaviors including process hollowing, suspicious Office-spawned utilities, long PowerShell commands, reverse TCP payloads, and specified malware or exploit activity.

Indicators of compromise

Type	Indicator	Context
SHA256	`001276dd30093a56534c93cf39335eb23943ab0b532c9ab4bfac250485355b8e`	DarkComet sample file hash listed by Talos.
SHA256	`00481d790b375a8c427b2bb79aa345667e7250f0c76624c3c1e5c522c46a1832`	Ursnif sample file hash listed by Talos.
SHA256	`0063112e85dfaf4331c73ad5a73856cfa5a29911ef8d80c12250a874f60c48ba`	DarkComet sample file hash listed by Talos.
SHA256	`00648a04fc723925ac103f26a8f6420c32da9038fc1d58ca5c037eb29461622d`	Tofsee sample file hash listed by Talos.
SHA256	`027ba300ceb2dcd1369abd1493c66bde8800c26cd15ff062c7ccf99c10865b69`	Ursnif sample file hash listed by Talos.
SHA256	`02b89b06dc6e456051ed4c4670eb9d2041d6c2f949e7fd527fbf749f96b43e31`	Tofsee sample file hash listed by Talos.
SHA256	`030b5440c89d6890d1e2a12f2643ee1b83c87bf87a4f5583d3d264f3333849c6`	Zusy sample file hash listed by Talos.
SHA256	`033d40969959043acd3d53c9f8b0a5321fa11533a8c33b0a341133a8b60c0b07`	Tofsee sample file hash listed by Talos.
SHA256	`03cb6dc235578dd1562851d4d06555af1cf9382353ba3f54306a27e37a5305a1`	Qakbot sample file hash listed by Talos.
SHA256	`03da512c836f7f3aa610c89f6530227f50972d9f35825b7ebbbf35a4b99de7a8`	DarkComet sample file hash listed by Talos.
SHA256	`03fe14caddbd6902e265a566efcbeacda1a413065a98b66b4e74fa59cea083e4`	Qakbot sample file hash listed by Talos.
SHA256	`05b8b3d0834207d3e718c000e920e704bc65c6b1bfbb638f3843fc4a26b867a2`	Kuluoz sample file hash listed by Talos.
SHA256	`06cc9a66099e3a7b1cfb87a005501ec3410a280521e02fe39674bf31d4bc4c17`	DarkComet sample file hash listed by Talos.
SHA256	`06d5ca9ab245e57ad65d2afa9633a2b7e11eca16555f5c5bf9f7a92d8f78e87d`	Qakbot sample file hash listed by Talos.
SHA256	`07f0e31106f56a2af7eb4e283625b4b3408f0eeb74c09b1ade3840daa4d1b8bb`	Qakbot sample file hash listed by Talos.
SHA256	`081e7a43899df5ed1f8afe0b7fbc94d6396761e79a2d400745542d70da9aec32`	Razy sample file hash listed by Talos.
SHA256	`090b7a368b261b9e48cf67498671d5f17805902d314731ba7e4f7c17441935ca`	Kuluoz sample file hash listed by Talos.
SHA256	`092bd938779e1706f6834465dd28d4f05d0e1c716acea0361ee9a4ce31e8142a`	Razy sample file hash listed by Talos.
SHA256	`094850ea73f8f4086e88bf44df5a483f03909202cc78ad718866f8e19b5b9a53`	Remcos sample file hash listed by Talos.
SHA256	`099f71d091ef7977d4ed532b5989a0bd7e2dba2756df82cd30e3a271debdebe0`	Zusy sample file hash listed by Talos.
SHA256	`0a17d899767ba1bc99f2d56c5ea049ff68f6a1d2a5debc56b744e273c3b17969`	Tofsee sample file hash listed by Talos.
SHA256	`0a4acb875e2052335654082e77210a8a30001d2847532ae2a58066efafb37c5e`	DarkComet sample file hash listed by Talos.
SHA256	`0a9c165848b887d60f905e503ab8c9918a3300b999b206dc4e91429efc2d4256`	Tofsee sample file hash listed by Talos.
SHA256	`0b77fdf610d7444d1fe1a7f5098d45152936fc48ca601b929281c587bb5133b8`	Qakbot sample file hash listed by Talos.
SHA256	`0bde394b4387f6853393a0e4742aa0fede0652a40d82452594b878bc6dbf8d42`	Tofsee sample file hash listed by Talos.
SHA256	`0c14c868d645b8c01c873f5cda5f03f66bf9c2d7207aada6a34af94f3b779ced`	DarkComet sample file hash listed by Talos.
SHA256	`0cebe431390ffb41b3fe7fc921a477257c3516b97ac48fab74f04495dcb19b32`	Tofsee sample file hash listed by Talos.
SHA256	`0d08e3c0b2f6668387b90dc0d21ebd8fec5de6393580cff145cdff8a32c10ea6`	DarkComet sample file hash listed by Talos.
SHA256	`0d2aad6da1068580e457b85c1df14497b1f66870c73d9c7b60d387a8ecc587ba`	Qakbot sample file hash listed by Talos.
SHA256	`0db3f1fdb14ab26067db2b64446a31933ff0ec0570d0f5a171d0e8fb933a1401`	DarkComet sample file hash listed by Talos.
SHA256	`0ea2f761e10efb2a635185671de8ca90837745f5da186d84e6a3c564bd020903`	Qakbot sample file hash listed by Talos.
SHA256	`0f08b7adecebbe1149b7be0966fa6b69aa5d5e3f03fa96ad35ddb07199084b22`	DarkComet sample file hash listed by Talos.
SHA256	`0f4c5e961866dd46ae096f7c04f1b45b3ded7f1c12b52f5f44dc19d7ea9eac36`	Kuluoz sample file hash listed by Talos.
SHA256	`0fb7ffc5ccc6a4250153508f8af38b9f70aa06516164c441aa2ef81cf1289cd5`	Ursnif sample file hash listed by Talos.
SHA256	`100ec7a6ad31a6adc5ffb4c02e18e53de634677bea7ddd81ba97bed869820b56`	Tofsee sample file hash listed by Talos.
SHA256	`109690a4baee04d9e64e7179bcd31a6c6bde15a347b76edc0494c9d31fa7a367`	Remcos sample file hash listed by Talos.
SHA256	`10db944ebab48eba12c8db04fb511b6eea8ae6ae5f690ae9fd12c5ad736a9803`	Tofsee sample file hash listed by Talos.
SHA256	`11032e23c07326c484dae2c226da1dc142077e747a068ed45f71c3af600a8040`	Kuluoz sample file hash listed by Talos.
SHA256	`12828f1d4f7c0712053dfcb206f44f2d64eba8e9d9c5454c39b24553b6dd1721`	Tofsee sample file hash listed by Talos.
SHA256	`12cdb5982898810f2b0f25b2d9b5489387927dc5cd9bed38b9205b5a2b2157e1`	Tofsee sample file hash listed by Talos.
SHA256	`130367bf969101c487af25574c5f5da158bf059b7d1f4cef0f867327c73b2dd8`	Tofsee sample file hash listed by Talos.
SHA256	`13bae156da737072688ec3b3ce46bac88a771179b899c9e4a15bacff9587acc1`	Razy sample file hash listed by Talos.
SHA256	`140323aad2d37f98b09bbf8d710a9180f55faa70b102cb25327ee9d44e30ab37`	Swisyn sample file hash listed by Talos.
SHA256	`1502723beda5c3fc95c3532d89ee16bdd3ad5ead9f323ee48be4d653474110bc`	Qakbot sample file hash listed by Talos.
SHA256	`162748ef4bd32b8da036dcc04563128180e76999261c13740e21567d712247fb`	Kuluoz sample file hash listed by Talos.
SHA256	`16830511fe445b162c2430826ada8597b7153619740c9731f7f83a7ae710f398`	Razy sample file hash listed by Talos.
SHA256	`16ad7701d366ef3dab53c0979741279b684f2f94fb52398a788071438921b31d`	Qakbot sample file hash listed by Talos.
SHA256	`16bfe7a7b9b9cce48dc8adf3e669ba24b5a2e7403d8358e69338038fb17e0cce`	Razy sample file hash listed by Talos.
SHA256	`16e0219a1ff89822cfabbc9f584b3168882bbed09296f3f871a95e1e2d0be48a`	Ursnif sample file hash listed by Talos.
SHA256	`170de3038c83f40286e6ca843ecfd541f7b509e53d21848673d313c05ea0e233`	Razy sample file hash listed by Talos.
SHA256	`172b6ada107441489b8abc961f2548486487a15d5e3375417b9c6981e5d676e9`	Qakbot sample file hash listed by Talos.
SHA256	`1845ebdef56daeb7edebc6677864436a036d3b043b7e1923b75c65594d4345a9`	DarkComet sample file hash listed by Talos.
SHA256	`188902aff209c46ed8f3018de451590fa58f306cef66bb804316165fa349bedb`	Zusy sample file hash listed by Talos.
SHA256	`18c16c49723dc928fa82844f0789dbe0a09e71f867995782b297134a02665d1b`	Ursnif sample file hash listed by Talos.
SHA256	`19081d5e0638f7a4c119e33f3ea90ffe78c7d422da9eb752470c54f3adad3318`	Kuluoz sample file hash listed by Talos.
SHA256	`194d2b8b233876aad6f7875d9ae9c7547d4033bfd0e8a769794ed8388734612d`	Kuluoz sample file hash listed by Talos.
SHA256	`19a6251c963016df9a9f209765c1f27a7d685398f37b9756da94db64a1f1ec69`	Kuluoz sample file hash listed by Talos.
SHA256	`19e1b9fc4fe08a5115b6b6853ec704d673683100038cca2d1450135e101bc3b8`	Ursnif sample file hash listed by Talos.
SHA256	`1a6001b1156d05b284fb239ff785c02a4c6a33d61041ce9631d3533820eaf503`	Tofsee sample file hash listed by Talos.
SHA256	`1b13eb517fe256fb3ae78eedebd763ca6b9d84cb5bca832b4f5ecc4267ab24e8`	Ursnif sample file hash listed by Talos.
SHA256	`1d13a6b142fd6c24248a44ba35526b3dc058520792b17cb6f96d3e6070ff9256`	Tofsee sample file hash listed by Talos.
SHA256	`1d2595bfce45630f50d2169bcbafd4448d0132e082e7bdce3ebf21d73cbbe592`	Kuluoz sample file hash listed by Talos.
SHA256	`1f3399e6d37a98bffb03a8e40fec12163db23a5088240229c0b9816e6c79d494`	Tofsee sample file hash listed by Talos.
SHA256	`2082193f5a5ca59d57d310e8c38358b6f7a1cfe4e9500b58b4c19305facb8588`	Kuluoz sample file hash listed by Talos.
SHA256	`209b3eeabd048f7cb2c634bf1e7414262ded407ae41b25d00db5db86008aa84f`	Qakbot sample file hash listed by Talos.
SHA256	`20cb8fe07f5e3ce18eb9aabafc93974be79f9f1935650ab1820a8ebc6ca3f296`	DarkComet sample file hash listed by Talos.
SHA256	`20d724fc562fa14b107c292020f6d03cb3c958d90a79ce3476e3f877f46ea0e8`	Qakbot sample file hash listed by Talos.
SHA256	`2172c2ae86f2eb06c38791b142dcda0580ab21ce67b603f8c4152b3eca9530b8`	Kuluoz sample file hash listed by Talos.
SHA256	`21b4634e17ab1de4e533f9b1a82c0dfdf53cf1ecf9eb17979dedd0cd78ceadba`	Ursnif sample file hash listed by Talos.
SHA256	`221a30be1c2fa46fdc50337a98298714ae0ee7ca9d725c100889d463e4801c30`	Tofsee sample file hash listed by Talos.
SHA256	`22f0c9dbef3c30aef61fcb511c2b11b6b61423005049ccc1be3c08c1a47b621c`	Remcos sample file hash listed by Talos.
SHA256	`23674a3831ab7a7427f3a4cd3031d4e3c361f3f8a97a9a42ad723cc0d71a409c`	Zusy sample file hash listed by Talos.
SHA256	`238894cb4732295a561d95c570025ce3edb907a8b989cd4ae64550b82c7ce406`	Tofsee sample file hash listed by Talos.
SHA256	`2396e2c32b73d201fb2b6397412c4fd0d40d0486119966989241749649c7fd37`	Tofsee sample file hash listed by Talos.
SHA256	`23c3b45782c70bccb1ca807e59486247c5b9074228e14ce9b3994003b354919f`	Qakbot sample file hash listed by Talos.
SHA256	`23df7ab5c611d90d853895fac5fd83714315d5f3bb754c3cbbc104d0185c59d6`	Ursnif sample file hash listed by Talos.
SHA256	`240e331b52966de8e05cea16155fb5cbf97ccc934af991f7d794107302665b4c`	Qakbot sample file hash listed by Talos.
SHA256	`24cb939d5a4d8de7c0326d5e23f4ad3a7a6c2e3a738ce6ffea27c11ee54ec839`	Tofsee sample file hash listed by Talos.
SHA256	`2541433b0da6d4e4e1a81c644515422d9ad86663a259cd200d2c052ece9d2357`	Kuluoz sample file hash listed by Talos.
SHA256	`254b0754656291f75de40e1c34f633f5df5a02b1330374fcdc2af795b30df731`	DarkComet sample file hash listed by Talos.
SHA256	`2583fac05346c76f46b50fef5e888be81dc68b70c5ce02f65f75bcef273c3145`	Ursnif sample file hash listed by Talos.
SHA256	`280d700d6c96eb71c5a87678e750b121ccaffa063d176659824f23506a61b8da`	Ursnif sample file hash listed by Talos.
SHA256	`28862859e0ffbbe3d103fdd2d0c83cb9c9b7d40ea5c3f0b7e0e38944ca86bcff`	Tofsee sample file hash listed by Talos.
SHA256	`291e7983cab8a8ca27a375dc7450efd992091ffa4df9dc62373c835d14aee431`	DarkComet sample file hash listed by Talos.
SHA256	`29ce47d65aa2049d4b786255ff8b9b1a9a8d9c664026b737a1c2ecd3fb6e519f`	Tofsee sample file hash listed by Talos.
SHA256	`2ac72960a87d6deca00ed4b9d8f32b0113fe4ef5cde73c218a60be5ddd972769`	Tofsee sample file hash listed by Talos.
SHA256	`2b01d8af177debea8016eaf6fa9fc875fd3cee6fbcc1dd3d354e438bdef901e0`	Tofsee sample file hash listed by Talos.
SHA256	`2b15df3199f11e25f73e30f3c921c854a421747864a7e62852658d179393d529`	Zusy sample file hash listed by Talos.
SHA256	`2b2efc73fcbc97e66c7c200e6b3bc3e85a5412ac8b4f0a085a5f1062ca73c4fe`	Tofsee sample file hash listed by Talos.
SHA256	`2bc09aca7b3f3e9722b86fa849c929b35f1761c4d95a85389e947dc0a96edf24`	Remcos sample file hash listed by Talos.
SHA256	`2c3b6a8eabc7c102007f6802a5272dd3567374bf2e9cc8c7ee6c7e94887ae4be`	Razy sample file hash listed by Talos.
SHA256	`2c4541a8d520b195f8dda3f731584e6391f714e2c4b01f4f97523728511dfb5c`	Qakbot sample file hash listed by Talos.
SHA256	`2dc66fa82db06bed4725c376f1fddbf331f27caca8352993df3896bfd60d4df5`	Ursnif sample file hash listed by Talos.
SHA256	`2e28e78b9a67c92fd6768b1f4f3ea7dca94f421f66fefad627c5c079047da060`	Ursnif sample file hash listed by Talos.
SHA256	`2edf0dabcb16bde79ecddafaaa52644de1229db74ba8e1abf6fe868e8e1c4447`	Qakbot sample file hash listed by Talos.
SHA256	`302085c4d19e84b33f64b7f177dcb5bdf31a919917e27c54691e599b65ec550f`	DarkComet sample file hash listed by Talos.
SHA256	`30ad84861978e3d472833f2ab1862f9628c7cd59bb46a5a5f5a0ddc95a4aabd5`	Ursnif sample file hash listed by Talos.
SHA256	`3136bf60107ecc6bcf659edd6e60cf01b3228fc7098a4bf2acf7d5a250ac3f29`	Qakbot sample file hash listed by Talos.
SHA256	`31d6514aaa66b40ebe0fc8cc5b74c65e4f0a247a85296ee18d8b6a5275828d7d`	Razy sample file hash listed by Talos.
SHA256	`3337b985888559a139cd62e925156264e64b8a1a8943bbb08ccb7a8c2684b570`	Qakbot sample file hash listed by Talos.
SHA256	`336e53510be09f61ea9d5a9557b24f7b67ade369168380b429825c296c5a7d5f`	Kuluoz sample file hash listed by Talos.
SHA256	`3383b0672661207be263722ba4cd2341bb90f680819359cb07c26c6b7dfcaa9b`	Qakbot sample file hash listed by Talos.
SHA256	`33f6dd4c2ff2d0efd1d9ffb404283a2b0be8d461482fe055bb63d4f012e97019`	Ursnif sample file hash listed by Talos.
SHA256	`35150a082f7fc90418facbde01f262cee672ae4dfd34b0aae06da95ec064b580`	Qakbot sample file hash listed by Talos.
SHA256	`357be50930bd829907a4068b1017b945263a56bc12cc9728977d3c866c9a68a6`	Qakbot sample file hash listed by Talos.
SHA256	`3643663d8d2ef58aaf10daa91ceb24b9edb962f7af268d62afdfd93726b3b311`	Swisyn sample file hash listed by Talos.
SHA256	`36a577dbd7557a52b6d422adf5fa98ed2f44379be60aebaa7a0dc970b249ef96`	Ursnif sample file hash listed by Talos.
SHA256	`36d670753f7ae9937a242f64691b19ade2652fe724349388a0d2131841cc075b`	Kuluoz sample file hash listed by Talos.
SHA256	`36ebb70c3fa7f455f8cec1e9c92daa907503d98c8e62c0f001b5441d7043e197`	DarkComet sample file hash listed by Talos.
SHA256	`371bc0bb9158e8ddda342465877358fccb6823bd4f0a7230c480ea2ba94af56f`	Kuluoz sample file hash listed by Talos.
SHA256	`3a1e5884cf079fdca3cb5b8385c53f780dd4c17a3165ccb4148f9916c3740614`	Qakbot sample file hash listed by Talos.
SHA256	`3a905333c0597c42b37f45c88f7f2f8cf0eb9a1a3cf64016740941d1c063c270`	Kuluoz sample file hash listed by Talos.
SHA256	`3adb37bbe880d92ab48f92849ecc877a336e734b3e6a2345824f856c1052911e`	Ursnif sample file hash listed by Talos.
SHA256	`3ae06e543ecfd267006a95fe8a8e2410e326fc877aa6bbe38b3d53ca16d4de80`	Zusy sample file hash listed by Talos.
SHA256	`3b06eecb334b5f57bde24eeb0a7c4147fc01713c8c3e8f0a660a4e8a9a5df3e1`	Qakbot sample file hash listed by Talos.
SHA256	`3c4e2eb21f26dee76e957a5c46b0492a43bf4dd53651615b2a84940011257929`	Qakbot sample file hash listed by Talos.
SHA256	`3cb3070e943ac93e5d0ee53ceac1c849462e8d35f0450a890381c27e78c71546`	Ursnif sample file hash listed by Talos.
SHA256	`3ce5d01bbfac60553507f8407696ed7b5de2ee135a561e199862f5cf9666015e`	Remcos sample file hash listed by Talos.
SHA256	`3d7033398b21750f5c580e1dd37e470922642b2a9cd0bc897135f3aeb9473f55`	Kuluoz sample file hash listed by Talos.
SHA256	`3dd2da6cd1450e56523609dac0353da3ab911e190abb689b8306a0a717272d22`	Ursnif sample file hash listed by Talos.
SHA256	`40934bae7c322b0d6ae26a5a90dc17ad28f5d964a9c2032de0243043781c586d`	Qakbot sample file hash listed by Talos.
SHA256	`419b5579c28b4c1b5efe0db559a646de49610f64a3ecac1edbb701b7ed7886e7`	Ursnif sample file hash listed by Talos.
SHA256	`41ccd5d6f3e1bba6090a0d17708c2e5e85c570279192c4efb64d3e7161942814`	Ursnif sample file hash listed by Talos.
SHA256	`41f6e76078b6ddfeea53f073d2b0b26eaec4c6502d5655c6dd777c41ca72bc8b`	Remcos sample file hash listed by Talos.
SHA256	`42c2c565e5844ee30f45e046984956949aa7b4268fa79fa3bca325079a0199b5`	DarkComet sample file hash listed by Talos.
SHA256	`445d9223cdc386994df6089ab69340c195b06125cf30b9424d44c0eb24b0d502`	DarkComet sample file hash listed by Talos.
SHA256	`455eeab54f59d6df61fa615a11288f90aa0b61fd6d77832796967d8c57f78812`	Remcos sample file hash listed by Talos.
SHA256	`455f506ca5312c201aa7084ad772da9128295c52b77d17f160263b5a36901cfd`	Ursnif sample file hash listed by Talos.
SHA256	`473935a02827eef38192ecc62c38e270eb275961cad98c1ce9f71a796921783b`	Swisyn sample file hash listed by Talos.
SHA256	`47a78e5e5f9c70e0b2d41b565532f11c8a573a620eae5d361792129f8e3f4ee5`	Kuluoz sample file hash listed by Talos.
SHA256	`4a5b19b533cebc75c41804384b7adf798b4e7600ab5a70c95541bb534d489516`	Kuluoz sample file hash listed by Talos.
SHA256	`4bb81a635c264ddde15e87b3f6182ae707e02f5e1c3f68d8cd10b3813f7ad9c6`	Zusy sample file hash listed by Talos.
SHA256	`4d060bd1b295b2952625b471e8324d764ede5e53c827d4b3a3ae6baba27b7b5f`	Zusy sample file hash listed by Talos.
SHA256	`4efae949b98bf76d42f3613a7864e3d70ada3d1b2824149b3a40a07a3654160d`	DarkComet sample file hash listed by Talos.
SHA256	`51338e5df94150d7e8a52fd3ce5a55fc6266a2f6cba41a82e697bf90e472a6c9`	Razy sample file hash listed by Talos.
SHA256	`5174169e7a1ef4ba358189dafac7eb4c514e4c12ecdc9525e2fe6cb5b35265ad`	DarkComet sample file hash listed by Talos.
SHA256	`517b93d074ef4f108aa84c588377242547b3a43f869f06f2dfbb457222499dd1`	Zusy sample file hash listed by Talos.
SHA256	`5241179ae063ee3fbc5b1512c2924e0482cd29b1d4247378ef818445e6c575ce`	Kuluoz sample file hash listed by Talos.
SHA256	`52488393180ab2539a941636a5143eedc8845240a5beeeb740d6416e934d73e6`	DarkComet sample file hash listed by Talos.
SHA256	`5492366ceb99bb0f4e8322eae89e9674974aa0b66435678d9fd5f9550603567d`	DarkComet sample file hash listed by Talos.
SHA256	`54e2ef113d9b8084424e1133314d59d07a81ae2b26264d33a979f8150ce5991e`	Zusy sample file hash listed by Talos.
SHA256	`5730e6c5c52c0cc8847c9dc85f5a093c5a4322d598fd519ace19af87bb2faa75`	DarkComet sample file hash listed by Talos.
SHA256	`577b702838edeb698bc8cf4f0ee5f7cc00e7053ea736b075b9542fc0a0e8fe95`	Ursnif sample file hash listed by Talos.
SHA256	`57961f963b59dac4e66b07a2de7ba1bbbcac4b43202359690a5095cb8dfdb4a1`	Ursnif sample file hash listed by Talos.
SHA256	`583cb7ac9e4fda982f94cf5d752bfd19eec7e5f2bdd042022e86792cb950b6ff`	Kuluoz sample file hash listed by Talos.
SHA256	`592b3336a16c2c028b275aefd6306e46f626d029504ced82ac5e8bac97b69f28`	Ursnif sample file hash listed by Talos.
SHA256	`5a805c7180f94ca9e3a73b302a8496edc7580cb2d8a85cef11c8bc612e07b525`	Kuluoz sample file hash listed by Talos.
SHA256	`5c1727ce8a67bd217a649836f33f38942414ba1a94433f543dd1aec9302c26bd`	Kuluoz sample file hash listed by Talos.
SHA256	`5e4c76e6c275cfd91c107a7471cdfbbe97c206d9749c76a173bcc0944b5b9c16`	DarkComet sample file hash listed by Talos.
SHA256	`661f8ca34eaabf8eb763d1281067c8becb4f2d132ab157d1b347bbe6ef639797`	Swisyn sample file hash listed by Talos.
SHA256	`69529025c15f3625e6aa5367dda783a701249c3c196b23af9dfbb76a58a5f368`	Zusy sample file hash listed by Talos.
SHA256	`6aae645789f16aa25555dabca7887b4f595716575e76ff485d835240bb6edec1`	Zusy sample file hash listed by Talos.
SHA256	`6b0a054dac1fd58581745144163b9d11dc4b63908d8ccec105aaf89e3d92a538`	Kuluoz sample file hash listed by Talos.
SHA256	`6b4513dfebf14e5e5d53f0743c7ea2c7e617a8486c09fb148b6d86284104df59`	Zusy sample file hash listed by Talos.
SHA256	`6bc49d8fc692613d4d049b8eaa38cf4bcac73fe93df4a62d96da01120367c324`	Remcos sample file hash listed by Talos.
SHA256	`6cb2189eaf43e5b07d4aa80c7d5906ed62107eda77bbfb244282cc9f85f6c3a9`	Remcos sample file hash listed by Talos.
SHA256	`6d90c7a70892f56555ea6b2a183b97b255d8801dda339c91bd74fca7feb2aa6a`	Kuluoz sample file hash listed by Talos.
SHA256	`6e2659d28fa3c948fd4e7c304e02bc1096a00ab3a7c77eb0940090e66b6dd1fb`	Razy sample file hash listed by Talos.
SHA256	`6e6b12209476c178f102c61b07535773ac104ad2db1dcbd45f3941e6eb1886a9`	Remcos sample file hash listed by Talos.
SHA256	`76bee560d3c66c09e99d4d9d06930b3adca4228f9563b7aeb6aa7a63d1c21294`	Remcos sample file hash listed by Talos.
SHA256	`781b85da9284614bf045583a9ac92f8352216b26a279e3c86120238c093ba5f8`	Remcos sample file hash listed by Talos.
SHA256	`794f8bd0277dfdec300f24ba4f90b4d0177d2b42abdb410ba049cddd05304bc6`	Razy sample file hash listed by Talos.
SHA256	`808a9950ca78ae40a50fa75cc9e9d6a64dda7b0aaba7aa934b3f6008fd8704a2`	Swisyn sample file hash listed by Talos.
SHA256	`827bdbf8fc8545b5e73b916333d0490a7851f7973631dea267ca2aa3e0b5c04b`	Zusy sample file hash listed by Talos.
SHA256	`85b9f85a584228a35f8fae58101c4046fa2c0ac072667b5b017d46750d8cda06`	Zusy sample file hash listed by Talos.
SHA256	`89b16e5b2474a0090be385dbebe9a0da78b3d17f75f707495746c6cfd1447dd3`	Razy sample file hash listed by Talos.
SHA256	`8a4138f00ed07780021aeee5daefeaadc365966407c1318e3078a292a91a7abb`	Zusy sample file hash listed by Talos.
SHA256	`8e6b1ae9a9f62d32b08320bbf3eb3484148ad7ccc08515502ab709772cde3fa2`	Swisyn sample file hash listed by Talos.
SHA256	`913378cfe37c55a093295bb041d503a07938d240d9d01a41008150815e0888da`	Razy sample file hash listed by Talos.
SHA256	`916b73efef24bad9024c50696acf3279a707ad08983e408e292d22937b5f45a3`	Zusy sample file hash listed by Talos.
SHA256	`98af759705a21ec5e42fabddaf3ef92fad766288a581febba50a66ab78ad3fb1`	Razy sample file hash listed by Talos.
SHA256	`9b6500e9e5bf5b125ea43fb40caf3c66354834204902bb68959ae503b8d2446f`	Zusy sample file hash listed by Talos.
SHA256	`9d82f169fcbb774495a2f6cbd104aa8594fde661f11b2cebba2cb299f1542c1e`	Zusy sample file hash listed by Talos.
SHA256	`a32fcd7935b6a2e707a2ac3ac4db0a0b12a9884074f3a947b3783d3ec57499ec`	Zusy sample file hash listed by Talos.
SHA256	`a87938f29ac7651fca266438f3a12642c4a64a278223108aa78d64628de04130`	Remcos sample file hash listed by Talos.
SHA256	`a8c25552deffab5bf8e6fae545e066ba75ebf00386f5c8a5f61086c99de3ce72`	Razy sample file hash listed by Talos.
SHA256	`a8f52c8eb58f3f5eb7482da1529d1c8381ce899f57ffe20b5c6b3646f6d900fd`	Remcos sample file hash listed by Talos.
SHA256	`ab7578b435d337a6e25d9151249c9ed4f2db198f3f642de5a5824ae110bdc25b`	Razy sample file hash listed by Talos.
SHA256	`acba8a921cc9e2a12b87e24b45f6e7136ce7cc9dd1d9d171d1561f993d9f00e5`	Zusy sample file hash listed by Talos.
SHA256	`acfdeaa4b7c76d2461cd3b85c4813e1e278d1766f5005381d8d07fd9735294fb`	Zusy sample file hash listed by Talos.
SHA256	`add0181dda3145b94a95dc3a4adb0791366ca254f5049941e76c94c4734ea8e3`	Swisyn sample file hash listed by Talos.
SHA256	`afa2c90e8c2f8d69e12bda8cfd52ec8117b04ffcc1bf33097950555bfc244347`	Zusy sample file hash listed by Talos.
SHA256	`b24c1787745cbae8149e424f4b6a4cf0e045af75af90beaa69d45715d2b79406`	Remcos sample file hash listed by Talos.
SHA256	`b39887a31edefcb349f309369eb0a4fb912d979b034f4f6d24428d47615c6bd1`	Razy sample file hash listed by Talos.
SHA256	`b8b4840ceb1b9ad015b9e0002e83dbaf404569a3f63be99d8c3181d3c567c8f6`	Razy sample file hash listed by Talos.
SHA256	`bb0c74a008d9cbe96a886d7ff1d9fc672e7b47088fcff6facac7016f2ea1071c`	Razy sample file hash listed by Talos.
SHA256	`bb831e54e41d0090904658059ae6650ad85fc87e0011169b9d676797c6ec63b0`	Swisyn sample file hash listed by Talos.
SHA256	`bcf5c64e8919fd0d51a990512acf1b562bda8c929dc5e475559b39c1d14d96d7`	Zusy sample file hash listed by Talos.
SHA256	`c1f7d696a180ba71289f76348fe7e0fe18ef48eb305cab79962502685652fe36`	Remcos sample file hash listed by Talos.
SHA256	`c7d90a65a495dc7c0a37e0aa5fa25d411cba6c66b8c440be271edd30510245ee`	Razy sample file hash listed by Talos.
SHA256	`c8b5d08fc00f2febfa862df9a1e6b1b908dba619558615013e860598aff50228`	Zusy sample file hash listed by Talos.
SHA256	`c8c5d7de785141f15e7d628602a4a3875916b3964f5e1b0cf3dd8d013eb0da13`	Swisyn sample file hash listed by Talos.
SHA256	`ca92deed4df8b54c6401b7fe950989cdf53d270b8db7ba9e023a005af9b03250`	Swisyn sample file hash listed by Talos.
SHA256	`cf513f09f5cecead22e48c65e335d1d4317c91627efaa8860bdc130b5bb852d2`	Remcos sample file hash listed by Talos.
SHA256	`d1feff69d116e0cdb2c8278af20072277de5957055b709a8b113b621d267eb01`	Razy sample file hash listed by Talos.
SHA256	`d68e723e40db42965ad791f5292806d034292dfeecdf2d35db455cb75ae347ed`	Remcos sample file hash listed by Talos.
SHA256	`d8215eb8483fa584cf7b6f56d0cb3d565163b44987981ad862dc1d05f6a2acca`	Remcos sample file hash listed by Talos.
SHA256	`db83299d0a93d6d7fae3723d60a77e48c2222389792f537e62194e2e7418f869`	Razy sample file hash listed by Talos.
SHA256	`de8a32ab1d07b5eb72c5ba26abeeca7df793819e2fa50f36efcd2954cdae9e49`	Swisyn sample file hash listed by Talos.
SHA256	`e29a0c37e1f1d043387d3ef265504bdbcc8d38562ebc4c899d9e55f03637f400`	Remcos sample file hash listed by Talos.
SHA256	`eec287dc0bbee89b56a8d71066a3feaf4a317d00778687e456da25b5eeba65fe`	Swisyn sample file hash listed by Talos.
SHA256	`f15d02556958ae9b2c4461e3bdf6b3780560f207522d1771ce41406e5023ce6f`	Swisyn sample file hash listed by Talos.
SHA256	`f19cd71951ec11a043f70b4fa0c5e6eb2f1e8048a3d9bbe3b3358b43e3bf60d2`	Remcos sample file hash listed by Talos.
SHA256	`f247a055bbc16e5b3e3c2da4b048de92dee78c3bfce423d26d90a14eb83c67cc`	Remcos sample file hash listed by Talos.
SHA256	`f25671d6c836df96b4e3e4b3b54fee0da5eb3194c2547f62f35a4d23d36e326f`	Remcos sample file hash listed by Talos.
SHA256	`f530f928dcccf13e81219a77469c3d1a76195dd1d28f63a9d203de92b2af3e1d`	Swisyn sample file hash listed by Talos.
SHA256	`f5b86a7d0dcf91a12e59fef493d1641731371e58c864bdfa8c494b3246bb02ef`	Razy sample file hash listed by Talos.
SHA256	`fc58cf5fc046cf3e0106aed3b992fd35d448502ec5763bcf62c53fa4d01256a2`	Swisyn sample file hash listed by Talos.
SHA256	`fd11cebf67ccb2cdadb8c99254a5f32311bda36d8aee7c58822c33fcc1811d78`	Remcos sample file hash listed by Talos.
SHA256	`fd9791589ed383bd040f5afaf818d8f7de23a5e7db99436818dc2823a9e9d0b6`	Remcos sample file hash listed by Talos.
SHA256	`fff327ae9f9c867bb7c04a2f6514f811386bc594702b3862933e0b16554083b5`	Razy sample file hash listed by Talos.