Exploit / PoChigh
Threat Spotlight: Sundown Matures
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-0189 | Memory Corruption RCE in Microsoft IE Scripting Engines (JScript/VBScript) | 7.5 | 94% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | europe.com | n. This registrant was tied to the email address of porqish@europe[.]com. Looking back historically we have found a total of more |
| domain | namepros.com | . As shown below the google search top results were tied to namepros[.]com, which is a domain reselling site. Reselling of domains i |
| ipv4 | 109.236.88.87 | 86 93.190.143.185 88.99.41.189 93.190.143.82 94.140.120.233 109.236.88.87 Conclusion Sundown is an exploit kit in transition, it has |
| ipv4 | 188.165.163.226 | 190.143.211 188.165.163.229 188.165.163.228 188.165.163.227 188.165.163.226 93.190.143.201 88.99.41.190 93.190.143.186 93.190.143.185 8 |
| ipv4 | 188.165.163.227 | 2016 and on) 93.190.143.211 188.165.163.229 188.165.163.228 188.165.163.227 188.165.163.226 93.190.143.201 88.99.41.190 93.190.143.186 |
| ipv4 | 188.165.163.228 | m Late December 2016 and on) 93.190.143.211 188.165.163.229 188.165.163.228 188.165.163.227 188.165.163.226 93.190.143.201 88.99.41.190 |
| ipv4 | 188.165.163.229 | ddresses are from Late December 2016 and on) 93.190.143.211 188.165.163.229 188.165.163.228 188.165.163.227 188.165.163.226 93.190.143. |
| ipv4 | 88.99.41.189 | 6 93.190.143.201 88.99.41.190 93.190.143.186 93.190.143.185 88.99.41.189 93.190.143.82 94.140.120.233 109.236.88.87 Conclusion Sundo |
| ipv4 | 88.99.41.190 | .165.163.228 188.165.163.227 188.165.163.226 93.190.143.201 88.99.41.190 93.190.143.186 93.190.143.185 88.99.41.189 93.190.143.82 94 |
| ipv4 | 93.190.143.185 | 188.165.163.226 93.190.143.201 88.99.41.190 93.190.143.186 93.190.143.185 88.99.41.189 93.190.143.82 94.140.120.233 109.236.88.87 Con |
| ipv4 | 93.190.143.186 | 188.165.163.227 188.165.163.226 93.190.143.201 88.99.41.190 93.190.143.186 93.190.143.185 88.99.41.189 93.190.143.82 94.140.120.233 10 |
| ipv4 | 93.190.143.201 | 165.163.229 188.165.163.228 188.165.163.227 188.165.163.226 93.190.143.201 88.99.41.190 93.190.143.186 93.190.143.185 88.99.41.189 93. |
| ipv4 | 93.190.143.211 | resses (Note: Addresses are from Late December 2016 and on) 93.190.143.211 188.165.163.229 188.165.163.228 188.165.163.227 188.165.163 |
| ipv4 | 93.190.143.82 | 201 88.99.41.190 93.190.143.186 93.190.143.185 88.99.41.189 93.190.143.82 94.140.120.233 109.236.88.87 Conclusion Sundown is an explo |
| ipv4 | 94.140.120.233 | 90 93.190.143.186 93.190.143.185 88.99.41.189 93.190.143.82 94.140.120.233 109.236.88.87 Conclusion Sundown is an exploit kit in trans |
From the original article
13 min read at blog.talosintelligence.com
This post authored by Nick Biasini with contributions from Edmund Brumaghin and Alex Chiu The last time Talos discussed Sundown it was an exploit kit in transition. Several of the large exploit kits had left the landscape and a couple of strong contenders remain.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.