Exploit / PoCcritical
FireEye revealed APT Operation DeputyDog against Japanes entities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2013-3893 | Memory Corruption RCE in Microsoft Internet Explorer | — | 88% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ali.blankchair.com | 2 rt.blankchair.com 2013-09-01 05:02:21 2013-09-01 08:25:24 ali.blankchair.com 2013-09-01 05:02:20 2013-09-01 08:25:22 dll.freshdns.org 20 |
| domain | dll.freshdns.org | ali.blankchair.com 2013-09-01 05:02:20 2013-09-01 08:25:22 dll.freshdns.org 2013-07-01 10:48:56 2013-07-09 05:00:03 Campaign such as th |
| domain | ea.blankchair.com | icious domains identified are : Domain First Seen Last Seen ea.blankchair.com 2013-09-01 05:02:22 2013-09-01 08:25:22 rt.blankchair.com 2 |
| ipv4 | 103.17.117.90 | 28.102 4d257e569539973ab0bbafee8fb87582 2013-08-19 13:21:58 103.17.117.90 dbdb1032d7bb4757d6011fb1d077856c 2013-08-19 13:21:59 110.45 |
| ipv4 | 110.45.158.5 | 117.90 dbdb1032d7bb4757d6011fb1d077856c 2013-08-19 13:21:59 110.45.158.5 645e29b7c6319295ae8b13ce8575dc1d 2013-08-19 13:21:59 103.17 |
| ipv4 | 180.150.228.102 | chair [ . ] com – the domain that we see was pointed to the 180.150.228.102 IP, which is the callback associated with sample 58dc05118e |
| ipv4 | 210.176.3.130 | as hosted on a server in Hong Kong with IP address equal to 210.176.3.130. Despite the payload is named img20130823.jpg in reality it |
| ipv4 | 66.153.86.14 | downloadmp3server [ . ] servemp3 [ . ] com that resolved to 66.153.86.14. This same IP address also hosted www [ . ] yahooeast [ . ] |
| md5 | 4d257e569539973ab0bbafee8fb87582 | ef8b11dcb5f5c596ab772fd 2013-08-19 13:21:58 180.150.228.102 4d257e569539973ab0bbafee8fb87582 2013-08-19 13:21:58 103.17.117.90 dbdb1032d7bb4757d6011fb1d |
| md5 | 58dc05118ef8b11dcb5f5c596ab772fd | 50.228.102 IP, which is the callback associated with sample 58dc05118ef8b11dcb5f5c596ab772fd, and has been already correlated back to the attack leverag |
| md5 | 645e29b7c6319295ae8b13ce8575dc1d | 32d7bb4757d6011fb1d077856c 2013-08-19 13:21:59 110.45.158.5 645e29b7c6319295ae8b13ce8575dc1d 2013-08-19 13:21:59 103.17.117.90 e9c73997694a897d3c6aadb26 |
| md5 | dbdb1032d7bb4757d6011fb1d077856c | 69539973ab0bbafee8fb87582 2013-08-19 13:21:58 103.17.117.90 dbdb1032d7bb4757d6011fb1d077856c 2013-08-19 13:21:59 110.45.158.5 645e29b7c6319295ae8b13ce85 |
| md5 | e9c73997694a897d3c6aadb26ed34797 | 7c6319295ae8b13ce8575dc1d 2013-08-19 13:21:59 103.17.117.90 e9c73997694a897d3c6aadb26ed34797 2013-04-13 13:42:45 110.45.158.5 The malicious domains iden |
From the original article
3 min read at securityaffairs.com
Security experts at FireEye discovered the Operation DeputyDog against Japanese entities that exploits Zero-Day (CVE-2013-3893) recently announced by Microsoft. FireEye announced the discovery of the cyberespionage Operation DeputyDog leveraging the recently announced zero-day CVE-2013-3893.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.