Data breachhigh
Watering Hole Attack on Aerospace Firm Exploits CVE-2015
- CVEs
- CVE-2015-5122
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-5122 | Use-After-Free RCE in Adobe Flash Player AS3 DisplayObject | — | 87% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 163.com | strant Fax: Registrant Fax Ext: Registrant Email: csolyc110@163[.]com The geographic regions indicated in the WHOIS data are co |
| domain | anywhere-staring.com | t Fax Ext: Registrant Email: alta.rohde@inbox[.]com And the anywhere-staring[.]com was found to be allegedly registered to an entity in Chin |
| domain | inbox.com | trant Fax: Registrant Fax Ext: Registrant Email: alta.rohde@inbox[.]com And the anywhere-staring[.]com was found to be allegedly |
| domain | start-vedioing.net | ssible attribution. Specifically, the WHOIS data showed the start-vedioing[.]net to be allegedly registered to an entity in Japan: Registr |
| ipv4 | 172.246.109.27 | ent with IsSpace. IsSpace proceeds to make HTTP requests to 172.246.109.27, which appears to be its primary command and control (C2) s |
| md5 | 10dbfb65836773567b466918250d7ef4 | :35:13 UTC C2 IP Address 172.246.109.27 Name FASAPI.bin MD5 10DBFB65836773567B466918250D7EF4 SHA1 4330F5AD25980E0EBB0165F6B49727152735EF4A SHA256 25BA7D |
| md5 | 1f132f365e60cd43fff75cd3ca464463 | ve data, 4065 bytes, 1 file Name CryptBase.dll (64-bit) MD5 1F132F365E60CD43FFF75CD3CA464463 SHA1 4DF97974B36ADADFDFDA44172484019AD2EDD649 SHA256 BDBD49 |
| md5 | 319500b2c792aee6cd8ef8ee87d9dc1e | llowing attributes is executed on the victim’s machine. MD5 319500B2C792AEE6CD8EF8EE87D9DC1E SHA1 723DB4F13E98364098D76B925EA197F9ECD5309B SHA256 27439A |
| md5 | 7f1779f37f257006576b2d41919441ec | mestamp 2014-05-06 13:23:38 UTC Name FASAP.DAT (64-bit) MD5 7F1779F37F257006576B2D41919441EC SHA1 4AC396084E932733BB887B51FA5A5E489D9CB0EC SHA256 53EDFF |
| md5 | bcdec2a79eadf1da2166bbb705a25aae | ve data, 3870 bytes, 1 file Name CryptBase.dll (64-bit) MD5 BCDEC2A79EADF1DA2166BBB705A25AAE SHA1 FD2CE90293CBB7CD28B42CE8FFB2CE5D95ED3260 SHA256 052AAD |
| md5 | d0d267d8cbbb7dbc59cfc68742fd0559 | ompile Timestamp 2014-04-21 13:08:07 UTC Name FASAP.DAT MD5 D0D267D8CBBB7DBC59CFC68742FD0559 SHA1 4586685CC724DEDFFB9C41F65B2DFFC7017F2970 SHA256 05ACAB |
| sha1 | 4330f5ad25980e0ebb0165f6b49727152735ef4a | 7 Name FASAPI.bin MD5 10DBFB65836773567B466918250D7EF4 SHA1 4330F5AD25980E0EBB0165F6B49727152735EF4A SHA256 25BA7D0399DDA177A2F35F2F5804BA54A272E43C192649339E5C |
| sha1 | 4586685cc724dedffb9c41f65b2dffc7017f2970 | TC Name FASAP.DAT MD5 D0D267D8CBBB7DBC59CFC68742FD0559 SHA1 4586685CC724DEDFFB9C41F65B2DFFC7017F2970 SHA256 05ACABAC8BCA04AC36FBD8B7DFBE21BDE720EBE82A6B64272111 |
| sha1 | 4ac396084e932733bb887b51fa5a5e489d9cb0ec | ASAP.DAT (64-bit) MD5 7F1779F37F257006576B2D41919441EC SHA1 4AC396084E932733BB887B51FA5A5E489D9CB0EC SHA256 53EDFF51E0E52B2D1E8526FEA144E9EA923183C2CFECE8A87DDA |
| sha1 | 4df97974b36adadfdfda44172484019ad2edd649 | Base.dll (64-bit) MD5 1F132F365E60CD43FFF75CD3CA464463 SHA1 4DF97974B36ADADFDFDA44172484019AD2EDD649 SHA256 BDBD4974F872A6B62528F4F03C64D6CD9CF5E9352582F5AE242D |
| sha1 | 723db4f13e98364098d76b925ea197f9ecd5309b | victim’s machine. MD5 319500B2C792AEE6CD8EF8EE87D9DC1E SHA1 723DB4F13E98364098D76B925EA197F9ECD5309B SHA256 27439ADAA07F5AD16EB8039C16ECEB4E71F6358E7FC13AC645E8 |
| sha1 | fd2ce90293cbb7cd28b42ce8ffb2ce5d95ed3260 | Base.dll (64-bit) MD5 BCDEC2A79EADF1DA2166BBB705A25AAE SHA1 FD2CE90293CBB7CD28B42CE8FFB2CE5D95ED3260 SHA256 052AAD8133E1FFC2863581DB33D366BA4180DFCF2E01ED7ACBEA |
| sha256 | 052aad8133e1ffc2863581db33d366ba4180dfcf2e01ed7acbea4d53c355ab59 | A25AAE SHA1 FD2CE90293CBB7CD28B42CE8FFB2CE5D95ED3260 SHA256 052AAD8133E1FFC2863581DB33D366BA4180DFCF2E01ED7ACBEA4D53C355AB59 Size 7680 Bytes File Type PE32 executable (DLL) (GUI) Intel |
| sha256 | 05acabac8bca04ac36fbd8b7dfbe21bde720ebe82a6b642721114e7fbda01bea | FD0559 SHA1 4586685CC724DEDFFB9C41F65B2DFFC7017F2970 SHA256 05ACABAC8BCA04AC36FBD8B7DFBE21BDE720EBE82A6B642721114E7FBDA01BEA Size 3870 Bytes File Type Microsoft Cabinet archive data, 3 |
| sha256 | 25ba7d0399dda177a2f35f2f5804ba54a272e43c192649339e5cbf8bd4efa0e0 | 0D7EF4 SHA1 4330F5AD25980E0EBB0165F6B49727152735EF4A SHA256 25BA7D0399DDA177A2F35F2F5804BA54A272E43C192649339E5CBF8BD4EFA0E0 Size 9216 Bytes File Type PE32+ executable (console) x86-64 |
| sha256 | 27439adaa07f5ad16eb8039c16eceb4e71f6358e7fc13ac645e8878da8c3e77e | D9DC1E SHA1 723DB4F13E98364098D76B925EA197F9ECD5309B SHA256 27439ADAA07F5AD16EB8039C16ECEB4E71F6358E7FC13AC645E8878DA8C3E77E Size 59904 Bytes File Type PE32 executable (GUI) Intel 8038 |
| sha256 | 53edff51e0e52b2d1e8526fea144e9ea923183c2cfece8a87dda92b8390651af | 9441EC SHA1 4AC396084E932733BB887B51FA5A5E489D9CB0EC SHA256 53EDFF51E0E52B2D1E8526FEA144E9EA923183C2CFECE8A87DDA92B8390651AF Size 4065 Bytes File Type Microsoft Cabinet archive data, 4 |
| sha256 | bdbd4974f872a6b62528f4f03c64d6cd9cf5e9352582f5ae242dc7f843a6fe55 | 464463 SHA1 4DF97974B36ADADFDFDA44172484019AD2EDD649 SHA256 BDBD4974F872A6B62528F4F03C64D6CD9CF5E9352582F5AE242DC7F843A6FE55 Size 9216 Bytes File Type PE32+ executable (DLL) (GUI) x86- |
From the original article
9 min read at unit42.paloaltonetworks.comOn July 16, 2015, the Palo Alto Networks Unit 42 threat intelligence team discovered a watering hole attack on the website of a well-known aerospace firm. The website was compromised to launch an apparent watering-hole attack against the company's customers. It was hosting an Adobe Flash exploit targeting one of the newly disclosed vulnerabilities from the Hacking Team data breach, CVE-2015-5122.
By Bryan Lee · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.