Threat Source newsletter (Sept. 30, 2021)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-22005 | Path Traversal File Upload RCE in VMware vCenter Server (Analytics Service) | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2021-37973 | Use-After-Free Sandbox Escape in Google Chrome/Chromium Portals | 9.6 | 12% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 04c1f4395f80a3890aa8b12ebc2b4855 | 66f466bdeff2a716b9aa79faa6677f2895f0b262cf9402deb4b66c MD5: 04c1f4395f80a3890aa8b12ebc2b4855 Typical Filename: zReXhNb Claimed Product: N/A Detection Na |
| md5 | 34560233e751b7e95f155b6f61e7419a | 0599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 MD5: 34560233e751b7e95f155b6f61e7419a Typical Filename: SAntivirusService.exe Claimed Product: A |
| md5 | 830ffb393ba8cca073a1c0b66af78de5 | b22888724288af038bc0b6e55280ddbbe42a436cdf68889346df18 MD5: 830ffb393ba8cca073a1c0b66af78de5 Typical Filename: smbscanlocal0902.exe Claimed Product: N/A |
| md5 | 9a4b7b0849a274f6f7ac13c7577daad8 | e188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww31.exe Claimed Product: N/A Detection N |
| md5 | fe3659119e683e1aa07b2346c1f215af | d55c45808f2fa8a5b398b0de18e5dd57af00265e42c822fb6938e2 MD5: fe3659119e683e1aa07b2346c1f215af Typical Filename: SqlBase.exe Claimed Product: SqlServerWor |
| sha256 | 6c62b768d8b22888724288af038bc0b6e55280ddbbe42a436cdf68889346df18 | Detection Name: W32.GenericKD:Attribute.24ch.1201 SHA 256: 6c62b768d8b22888724288af038bc0b6e55280ddbbe42a436cdf68889346df18 MD5: 830ffb393ba8cca073a1c0b66af78de5 Typical Filename: smb |
| sha256 | 8639fd3ef8d55c45808f2fa8a5b398b0de18e5dd57af00265e42c822fb6938e2 | Detection Name: Auto.FAD16599A8.241842.in07.Talos SHA 256: 8639fd3ef8d55c45808f2fa8a5b398b0de18e5dd57af00265e42c822fb6938e2 MD5: fe3659119e683e1aa07b2346c1f215af Typical Filename: Sql |
| sha256 | 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 | e: MS17010::mURLin::W32.Auto:6c62b768d8.in03.Talos SHA 256: 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 MD5: 34560233e751b7e95f155b6f61e7419a Typical Filename: SAn |
| sha256 | c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e | 217 - 58219 Most prevalent malware files this week SHA 256: c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww3 |
| sha256 | fad16599a866f466bdeff2a716b9aa79faa6677f2895f0b262cf9402deb4b66c | c e Detection Name: PUA.Win.Dropper.Segurazo::tpd SHA 256: fad16599a866f466bdeff2a716b9aa79faa6677f2895f0b262cf9402deb4b66c MD5: 04c1f4395f80a3890aa8b12ebc2b4855 Typical Filename: zRe |
From the original article
5 min read at blog.talosintelligence.com
In the latest example of attackers trying to capitalize on current headlines, we've spotted a group using the recent fervor around the Pegasus spyware to spread malware. We've detailed a campaign in which the attackers have copied (nearly perfectly) Amnesty International's website and is advertising a tool to sniff out the spyware and remove it.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.