Exploit / PoCmedium
Continued analysis of the LightsOut Exploit Kit
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-1723 | Remote Arbitrary Code Execution in Oracle Java SE (Hotspot Component) | — | 94% | KEVRansomware | — KEV |
| CVE-2013-1347 | Memory corruption RCE in Microsoft Internet Explorer | — | 78% | KEV | — KEV |
| CVE-2013-2423 | Remote Integrity-Affecting Vulnerability in Oracle JRE HotSpot (CVE-2013-2423) | — | 85% | KEV | — KEV |
| CVE-2013-2465 | Unspecified Flaw in Oracle Java SE 2D Component Exploited in the Wild (CVE-2013-2465) | — | 99% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 93.171.216.118 | 58b86dac332a03629fc91095a4c7841b559da/analysis/ C&C Server: 93.171.216.118 IP Address hosting malware: 93.188.161.235 Secondary droppe |
| ipv4 | 93.188.161.235 | ; character, and trivally defanged) work:3|downexec hxxp://93.188.161[.]235/check2/muees27jxt/shot.jpg; work:5|downexec hxxp://93.188 |
| sha1 | 334eeaf5ea3920b612b4e26bbe3e0cccbc431c2e | trator\Application Data\ Broker services\plugs\mmc.exe SHA: 334eeaf5ea3920b612b4e26bbe3e0cccbc431c2e SHA256: 5ee0761f5eda01985d5f93a5e50a1247fb5c17deba1d471b05f |
| sha1 | d667833e4915c385321b553785732bbed3009c2a | rst stage dropper: - initially dropped as ntsys391.exe SHA: D667833E4915C385321B553785732BBED3009C2A SHA256: 164de09635532bb0a4fbe25ef3058b86dac332a03629fc91095 |
| sha256 | 1218d79fca1aca48e13a5e6e582cdc5c4d24c3367328c56d61d975a757509335 | 188.161.235 Secondary dropped malware sample sha256 hashes: 1218d79fca1aca48e13a5e6e582cdc5c4d24c3367328c56d61d975a757509335 fl.jpg ac9294849559c94d5e85cb113ce8ca61bca2e576a97a9e81f663 |
| sha256 | 164de09635532bb0a4fbe25ef3058b86dac332a03629fc91095a4c7841b559da | First stage dropper: VT: https://www.virustotal.com/en/file/164de09635532bb0a4fbe25ef3058b86dac332a03629fc91095a4c7841b559da/analysis/ C&C Server: 93.171.216.118 IP Address hosting mal |
| sha256 | 5ee0761f5eda01985d5f93a5e50a1247fb5c17deba1d471b05fc09751d09a08e | c94d5e85cb113ce8ca61bca2e576a97a9e81f66321496ddada61 tl.jpg 5ee0761f5eda01985d5f93a5e50a1247fb5c17deba1d471b05fc09751d09a08e shot.jpg a26f3225aa7e7b5263033dee682153fb7a4332429782c5755a |
| sha256 | a26f3225aa7e7b5263033dee682153fb7a4332429782c5755a9eaebe8a5df095 | 985d5f93a5e50a1247fb5c17deba1d471b05fc09751d09a08e shot.jpg a26f3225aa7e7b5263033dee682153fb7a4332429782c5755a9eaebe8a5df095 inf.jpg JavaScript IDS evasion methods: Sample encoded stri |
| sha256 | ac9294849559c94d5e85cb113ce8ca61bca2e576a97a9e81f66321496ddada61 | ca48e13a5e6e582cdc5c4d24c3367328c56d61d975a757509335 fl.jpg ac9294849559c94d5e85cb113ce8ca61bca2e576a97a9e81f66321496ddada61 tl.jpg 5ee0761f5eda01985d5f93a5e50a1247fb5c17deba1d471b05fc |
| url | http://93.188.161.235/check2/muees27jxt/fl.jpg | /93.188.161[.]235/check2/muees27jxt/tl.jpg; work:7|downexec hxxp://93.188.161[.]235/check2/muees27jxt/fl.jpg; work:290|downexec hxxp://93.188.161[.]235/check2/muees27 |
| url | http://93.188.161.235/check2/muees27jxt/inf.jpg | 3.188.161[.]235/check2/muees27jxt/fl.jpg; work:290|downexec hxxp://93.188.161[.]235/check2/muees27jxt/inf.jpg; 93.188.161.235 Request ( Analyst Note: this kit only ret |
| url | http://93.188.161.235/check2/muees27jxt/shot.jpg | ed by a ; character, and trivally defanged) work:3|downexec hxxp://93.188.161[.]235/check2/muees27jxt/shot.jpg; work:5|downexec hxxp://93.188.161[.]235/check2/muees27jx |
| url | http://93.188.161.235/check2/muees27jxt/tl.jpg | 3.188.161[.]235/check2/muees27jxt/shot.jpg; work:5|downexec hxxp://93.188.161[.]235/check2/muees27jxt/tl.jpg; work:7|downexec hxxp://93.188.161[.]235/check2/muees27jx |
From the original article
6 min read at blog.talosintelligence.com
At the end of March, we disclosed the coverage of an Exploit Kit we called “Hello”: http://blog. talosintel. com/2014/03/hello-new-exploit-kit.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.