Ransomwarehigh
Modified Zyklon and plugins from India
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-1856 | Remote Code Execution via TabStrip ActiveX Control in Microsoft Office (MSCOMCTL.OCX) | — | 72% | KEV | — KEV |
| CVE-2013-3906 | Memory Corruption RCE in Microsoft Graphics Component (Actively Exploited) | — | 85% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | barkliaytire.com | tp://www.blcpolychemical[.]com/re/PurchaseOrders.exe http://barkliaytire[.]com http://distriegroupelectric[.]com http://extreime-net[.]c |
| domain | blcpolychemical.com | ad URLs http://wszystkozmetalu[.]pl/Invoiceq.exe http://www.blcpolychemical[.]com/re/PurchaseOrders.exe http://barkliaytire[.]com http://di |
| domain | distriegroupelectric.com | ]com/re/PurchaseOrders.exe http://barkliaytire[.]com http://distriegroupelectric[.]com http://extreime-net[.]com http://distriegroupelectric[.]c |
| domain | extreime-net.com | barkliaytire[.]com http://distriegroupelectric[.]com http://extreime-net[.]com http://distriegroupelectric[.]com:80/plugin/index[.]php?p |
| domain | wszystkozmetalu.pl | 8b1c6b6fa154d5a790da944177074d28846d66 Download URLs http://wszystkozmetalu[.]pl/Invoiceq.exe http://www.blcpolychemical[.]com/re/Purchase |
| sha256 | 4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69 | 35a877f1ae2a2b595a6d PE Exes downloaded by the exploit docs 4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69 bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c8908 |
| sha256 | 682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa154d5a790da944177074d28846d66 | c66754fe805630f155fde47ab259fdbd03748 Zyklon Builder v1.0.0 682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa154d5a790da944177074d28846d66 Download URLs http://wszystkozmetalu[.]pl/Invoiceq.exe http |
| sha256 | 6a32a0d83a5c955822502444833283a3fde8e1893f1490fac1ae5b84a00db5c6 | 361af4a709999a492387e3aaf8380187a7699895fc383e40 FTP plugin 6a32a0d83a5c955822502444833283a3fde8e1893f1490fac1ae5b84a00db5c6 Email plugin bbcc07baaa00bb30de43a39a04dc66754fe805630f155f |
| sha256 | 996b19658cffedc9395243693c3ca1d12a2c2a2c986e35a877f1ae2a2b595a6d | 374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be 996b19658cffedc9395243693c3ca1d12a2c2a2c986e35a877f1ae2a2b595a6d PE Exes downloaded by the exploit docs 4bce73a29ee1b9840cd8 |
| sha256 | ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be | is activity to alert administrators. Iocs Document exploits ac944374d5f50ecbdd3b9e7151d5a4b055ec18ea26482c2301ccc439164b25be 996b19658cffedc9395243693c3ca1d12a2c2a2c986e35a877f1ae2a2b5 |
| sha256 | b1906c1d23f62df7f63a06030f27c3249414d027a9deb62d27f65ec6f3a61adb | 2e2ebd3c540489dd4844b066b45f31b2d879a085eabda1f63926ddc0688 b1906c1d23f62df7f63a06030f27c3249414d027a9deb62d27f65ec6f3a61adb PE exe files within ZIPs b7101462507a8cf5bf91b62b641ef1ac3d |
| sha256 | b7101462507a8cf5bf91b62b641ef1ac3d268115d6dfca54a1625efb07fccf0d | 249414d027a9deb62d27f65ec6f3a61adb PE exe files within ZIPs b7101462507a8cf5bf91b62b641ef1ac3d268115d6dfca54a1625efb07fccf0d 4bce73a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce120 |
| sha256 | bbcc07baaa00bb30de43a39a04dc66754fe805630f155fde47ab259fdbd03748 | 502444833283a3fde8e1893f1490fac1ae5b84a00db5c6 Email plugin bbcc07baaa00bb30de43a39a04dc66754fe805630f155fde47ab259fdbd03748 Zyklon Builder v1.0.0 682d5d60d6fc0e1d5810e9cd9d8b1c6b6fa15 |
| sha256 | bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c89084cadf | 3a29ee1b9840cd82d8c08e107179cd74dc1aed488f6d16772ce12092c69 bcf8dbbc78883b2d84511819123cf39b1c2ffe3cd9763d08fe1544c89084cadf ZIP Attachments e67db2e2ebd3c540489dd4844b066b45f31b2d879a0 |
| sha256 | e5d2c3a7ddd219ab361af4a709999a492387e3aaf8380187a7699895fc383e40 | 2d8c08e107179cd74dc1aed488f6d16772ce12092c69 Browser plugin e5d2c3a7ddd219ab361af4a709999a492387e3aaf8380187a7699895fc383e40 FTP plugin 6a32a0d83a5c955822502444833283a3fde8e1893f1490fa |
| sha256 | e67db2e2ebd3c540489dd4844b066b45f31b2d879a085eabda1f63926ddc0688 | 819123cf39b1c2ffe3cd9763d08fe1544c89084cadf ZIP Attachments e67db2e2ebd3c540489dd4844b066b45f31b2d879a085eabda1f63926ddc0688 b1906c1d23f62df7f63a06030f27c3249414d027a9deb62d27f65ec6f3a |
From the original article
11 min read at blog.talosintelligence.com
Introduction Streams of malicious emails Talos inspects every day usually consist of active spamming campaigns for various ransomware families, phishing campaigns and the common malware family suspects such as banking Trojans and bots.. It is however often more interesting to analyze campaigns smaller in volume as they might contain more interesting malware.
By Vanja Svajcer · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.