Vulnerabilityhigh
This Bot Is Out for Brains: ElasticZombie Exploiting Elasticsearch Vulnerabilities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-1427 | Sandbox Bypass RCE in Elasticsearch Groovy Scripting Engine | — | 100% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | hackforums.net | pears to be a modification on Psyk’s Bash Backdoor — hxxp://hackforums[.]net/archive/index.php/thread-86488.html — published in 2009. |
| md5 | 27581f0c58ad800f99ab918b2866756b | eaa6444cdf02ecf4cfc35de54310034d2bc060acff3f9b619e65e585ab2 27581f0c58ad800f99ab918b2866756b 340a0d6d7be8936173c89570154b3cedce23f9d0 d3fa2fb54914a480fe |
| sha1 | 340a0d6d7be8936173c89570154b3cedce23f9d0 | bc060acff3f9b619e65e585ab2 27581f0c58ad800f99ab918b2866756b 340a0d6d7be8936173c89570154b3cedce23f9d0 d3fa2fb54914a480feef6a9058fb68cf188ed03b45be2670e66c8bf9794 |
| sha256 | 6a97970257fca599b4a103de128de862add331391311a9b8f9161e0e8658bd15 | ddress (1) 664035800@qq.com Filename (1) gydm.exe Hash (10) 6a97970257fca599b4a103de128de862add331391311a9b8f9161e0e8658bd15 6f424912df548749b7fd354e9bda4217bb271f518b7f3d02e301275f0b5 |
| sha256 | 6f424912df548749b7fd354e9bda4217bb271f518b7f3d02e301275f0b5230d3 | 70257fca599b4a103de128de862add331391311a9b8f9161e0e8658bd15 6f424912df548749b7fd354e9bda4217bb271f518b7f3d02e301275f0b5230d3 7d73f65d59f8b388f2d107dd236834c867f219529581c67cf034348a4e7 |
| sha256 | 7d73f65d59f8b388f2d107dd236834c867f219529581c67cf034348a4e70aff4 | 912df548749b7fd354e9bda4217bb271f518b7f3d02e301275f0b5230d3 7d73f65d59f8b388f2d107dd236834c867f219529581c67cf034348a4e70aff4 860095ab2386ad878e8d2829e40f29f0a393436c99f50d1b589ddf914e8 |
| sha256 | 860095ab2386ad878e8d2829e40f29f0a393436c99f50d1b589ddf914e8e63bf | 65d59f8b388f2d107dd236834c867f219529581c67cf034348a4e70aff4 860095ab2386ad878e8d2829e40f29f0a393436c99f50d1b589ddf914e8e63bf 9ac7b43fe9ed564db684ec991efa7fc2204c1c1351741284becf47bcefb |
| sha256 | 9ac7b43fe9ed564db684ec991efa7fc2204c1c1351741284becf47bcefbf7113 | 5ab2386ad878e8d2829e40f29f0a393436c99f50d1b589ddf914e8e63bf 9ac7b43fe9ed564db684ec991efa7fc2204c1c1351741284becf47bcefbf7113 d0839eaa6444cdf02ecf4cfc35de54310034d2bc060acff3f9b619e65e5 |
| sha256 | d0839eaa6444cdf02ecf4cfc35de54310034d2bc060acff3f9b619e65e585ab2 | 43fe9ed564db684ec991efa7fc2204c1c1351741284becf47bcefbf7113 d0839eaa6444cdf02ecf4cfc35de54310034d2bc060acff3f9b619e65e585ab2 27581f0c58ad800f99ab918b2866756b 340a0d6d7be8936173c8957015 |
| sha256 | d3fa2fb54914a480feef6a9058fb68cf188ed03b45be2670e66c8bf9794e8d0f | 0f99ab918b2866756b 340a0d6d7be8936173c89570154b3cedce23f9d0 d3fa2fb54914a480feef6a9058fb68cf188ed03b45be2670e66c8bf9794e8d0f dccfa1ac574c6a884c24db77b3791ceb1183ecca483a1706527674e333f |
| sha256 | dccfa1ac574c6a884c24db77b3791ceb1183ecca483a1706527674e333fe1b72 | fb54914a480feef6a9058fb68cf188ed03b45be2670e66c8bf9794e8d0f dccfa1ac574c6a884c24db77b3791ceb1183ecca483a1706527674e333fe1b72 |
| url | http://hackforums.net/archive/index.php/thread-86488.html | code appears to be a modification on Psyk’s Bash Backdoor — hxxp://hackforums[.]net/archive/index.php/thread-86488.html — published in 2009. The script requires two arguments fr |
From the original article
5 min read at recordedfuture.com
While recently mining our Recorded Future alerts (event, entity, and keyword matches on the Web) for new attacker TTPs (techniques, tactics, and procedures) we came across an interesting and trending text fragment — ElasticZombie Botnet.
By LEVI GUNDERT · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.