Malwarehigh
SockDetour – a Silent, Fileless, Socketless Backdoor
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-28799 | Improper Authorization in QNAP HBS 3 Allows Remote Login to NAS Devices | 9.8 | 78% | KEVRansomware | KEV |
| CVE-2021-40539 | Unauthenticated RCE via REST API auth bypass in Zoho ManageEngine ADSelfService Plus | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2021-44077 | Unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus and SupportCenter Plus | 9.8 | 93% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 0b2b9a2ac4bff81847b332af18a8e0705075166a137ab248e4d9b5cbd8b960df | n: +81.50.1790.0200. Indicators of Compromise SockDetour PE 0b2b9a2ac4bff81847b332af18a8e0705075166a137ab248e4d9b5cbd8b960df PowerSploit Memory Injectors Delivering SockDetour 80ed7984 |
| sha256 | 11b2b719d6bffae3ab1e0f8191d70aa1bade7f599aeadb7358f722458a21b530 | ce7dc2252e9e582e757bbfa2f18e3f3864cb4267cd07129f4b9a241300b 11b2b719d6bffae3ab1e0f8191d70aa1bade7f599aeadb7358f722458a21b530 cd28c7a63f91a20ec4045cf40ff0f93b336565bd504c9534be857e971b4 |
| sha256 | 3ea2bf2a6b039071b890f03b5987d9135fe4c036fb77f477f1820c34b341644e | 6f37e7188a6f0cc85744376cdc672e495607f85ba3cbee6980049951889 3ea2bf2a6b039071b890f03b5987d9135fe4c036fb77f477f1820c34b341644e 7e9cf2a2dd3edac92175a3eb1355c0f5f05f47b7798e206b470637c5303 |
| sha256 | 607a2ce7dc2252e9e582e757bbfa2f18e3f3864cb4267cd07129f4b9a241300b | c1d0350341764f877f5c4249151981200df0769a38386f6b7c8ca6f9c7a 607a2ce7dc2252e9e582e757bbfa2f18e3f3864cb4267cd07129f4b9a241300b 11b2b719d6bffae3ab1e0f8191d70aa1bade7f599aeadb7358f722458a2 |
| sha256 | 7e9cf2a2dd3edac92175a3eb1355c0f5f05f47b7798e206b470637c5303ac79f | f2a6b039071b890f03b5987d9135fe4c036fb77f477f1820c34b341644e 7e9cf2a2dd3edac92175a3eb1355c0f5f05f47b7798e206b470637c5303ac79f bb48438e2ed47ab692d1754305df664cda6c518754ef9a58fb5fa8545f5 |
| sha256 | 80ed7984a42570d94cd1b6dcd89f95e3175a5c4247ac245c817928dd07fc9540 | d8b960df PowerSploit Memory Injectors Delivering SockDetour 80ed7984a42570d94cd1b6dcd89f95e3175a5c4247ac245c817928dd07fc9540 bee2fe0647d0ec9f2f0aa5f784b122aaeba0cddb39b08e3ea19dd4cdb90 |
| sha256 | a5b9ac1d0350341764f877f5c4249151981200df0769a38386f6b7c8ca6f9c7a | e0647d0ec9f2f0aa5f784b122aaeba0cddb39b08e3ea19dd4cdb90e53f9 a5b9ac1d0350341764f877f5c4249151981200df0769a38386f6b7c8ca6f9c7a 607a2ce7dc2252e9e582e757bbfa2f18e3f3864cb4267cd07129f4b9a24 |
| sha256 | bb48438e2ed47ab692d1754305df664cda6c518754ef9a58fb5fa8545f5bfb9b | 2a2dd3edac92175a3eb1355c0f5f05f47b7798e206b470637c5303ac79f bb48438e2ed47ab692d1754305df664cda6c518754ef9a58fb5fa8545f5bfb9b Public Key Embedded in SocketDetour -----BEGIN PUBLIC KEY-- |
| sha256 | bee2fe0647d0ec9f2f0aa5f784b122aaeba0cddb39b08e3ea19dd4cdb90e53f9 | 984a42570d94cd1b6dcd89f95e3175a5c4247ac245c817928dd07fc9540 bee2fe0647d0ec9f2f0aa5f784b122aaeba0cddb39b08e3ea19dd4cdb90e53f9 a5b9ac1d0350341764f877f5c4249151981200df0769a38386f6b7c8ca6 |
| sha256 | cd28c7a63f91a20ec4045cf40ff0f93b336565bd504c9534be857e971b4e80ee | 719d6bffae3ab1e0f8191d70aa1bade7f599aeadb7358f722458a21b530 cd28c7a63f91a20ec4045cf40ff0f93b336565bd504c9534be857e971b4e80ee ebe926f37e7188a6f0cc85744376cdc672e495607f85ba3cbee69800499 |
| sha256 | ebe926f37e7188a6f0cc85744376cdc672e495607f85ba3cbee6980049951889 | 7a63f91a20ec4045cf40ff0f93b336565bd504c9534be857e971b4e80ee ebe926f37e7188a6f0cc85744376cdc672e495607f85ba3cbee6980049951889 3ea2bf2a6b039071b890f03b5987d9135fe4c036fb77f477f1820c34b34 |
From the original article
10 min read at unit42.paloaltonetworks.com
Unit 42 has been tracking an APT campaign we name TiltedTemple, which we first identified in connection with its use of the Zoho ManageEngine ADSelfService Plus vulnerability CVE-2021-40539 and ServiceDesk Plus vulnerability CVE-2021-44077.
By Unit 42 · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.