Exploit / PoChigh
SambaCry is coming
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-7494 | Unauthenticated RCE in Samba via malicious shared library upload (SambaCry) | 9.8 | 99% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | xmr.crypto-pool.fr | Along with the attackers’ wallet number, the pool address ( xmr.crypto-pool.fr:3333 ) can be found in the body of the miner. This pool is |
| md5 | 2009af3fed2a4704c224694dfc4b31dc | 4230351ef3bc2a – Backdoor.Linux.Agent.an) and cblRWuoCc.so (2009af3fed2a4704c224694dfc4b31dc – Trojan-Downloader.Linux.EternalMiner.a). INAebsGB.so This |
| md5 | 349d84b3b176bbc9834230351ef3bc2a | iles were uploaded and executed in such a way: INAebsGB.so (349d84b3b176bbc9834230351ef3bc2a – Backdoor.Linux.Agent.an) and cblRWuoCc.so (2009af3fed2a47 |
| md5 | 8d8bdb58c5e57c565542040ed1988af9 | The main functionality of cblRWuoCc.so The file minerd64_s (8d8bdb58c5e57c565542040ed1988af9 — RiskTool.Linux.BitCoinMiner.a) downloaded in such a way i |
From the original article
4 min read at securelist.com
Not long ago, news appeared online of a younger sibling for the sensational vulnerability EternalBlue. The story was about a new vulnerability for *nix-based systems – EternalRed (aka SambaCry). This vulnerability (CVE-2017-7494) relates to all versions of Samba , starting from 3.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.