Ransomwarehigh
Threat Source newsletter (Sept. 23, 2021)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-38647+3 related CVEs | Unauthenticated RCE in Microsoft Open Management Infrastructure (OMI) | 9.8 group max | 100% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 04c1f4395f80a3890aa8b12ebc2b4855 | 66f466bdeff2a716b9aa79faa6677f2895f0b262cf9402deb4b66c MD5: 04c1f4395f80a3890aa8b12ebc2b4855 Typical Filename: zReXhNb Claimed Product: N/A Detection Na |
| md5 | 2915b3f8b703eb744fc54c81f4a9c67f | 393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc50 7 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Typical Filename: VID[1].dat Claimed Product: N/A Detection |
| md5 | 34560233e751b7e95f155b6f61e7419a | 0599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 MD5: 34560233e751b7e95f155b6f61e7419a Typical Filename: SAntivirusService.exe Claimed Product: A |
| md5 | 830ffb393ba8cca073a1c0b66af78de5 | b22888724288af038bc0b6e55280ddbbe42a436cdf68889346df18 MD5: 830ffb393ba8cca073a1c0b66af78de5 Typical Filename: smbscanlocal0902.exe Claimed Product: N/A |
| md5 | 9a4b7b0849a274f6f7ac13c7577daad8 | e188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww31.exe Claimed Product: N/A Detection N |
| sha256 | 6c62b768d8b22888724288af038bc0b6e55280ddbbe42a436cdf68889346df18 | Detection Name: W32.GenericKD:Attribute.24ch.1201 SHA 256: 6c62b768d8b22888724288af038bc0b6e55280ddbbe42a436cdf68889346df18 MD5: 830ffb393ba8cca073a1c0b66af78de5 Typical Filename: smb |
| sha256 | 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 | e: MS17010::mURLin::W32.Auto:6c62b768d8.in03.Talos SHA 256: 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 MD5: 34560233e751b7e95f155b6f61e7419a Typical Filename: SAn |
| sha256 | c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e | SID: 58169 Most prevalent malware files this week SHA 256: c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww3 |
| sha256 | fad16599a866f466bdeff2a716b9aa79faa6677f2895f0b262cf9402deb4b66c | duct: N/A Detection Name: Win.Worm.Coinminer::1201 SHA 256: fad16599a866f466bdeff2a716b9aa79faa6677f2895f0b262cf9402deb4b66c MD5: 04c1f4395f80a3890aa8b12ebc2b4855 Typical Filename: zRe |
From the original article
5 min read at blog.talosintelligence.com
The Russian APT Turla is one of the most notorious threat actors out there today. And they aren't stopping, recently adding a new backdoor to their arsenal that serves as a "last chance" to retain a foothold on victim machines, even after their other malware has been removed. Elsewhere on the APT landscape, the U.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.