Exploit / PoCcritical
Operation Daybreak
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-0147 | Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability." | 8.8 | 16% | ||
| CVE-2016-1010 | Integer Overflow RCE in Adobe Flash Player and AIR | 8.8 | 19% | KEV | KEV |
| CVE-2016-4117 | Arbitrary Code Execution in Adobe Flash Player 21.0.0.226 and earlier | 9.8 | 94% | KEVRansomwarePoC | KEV |
| CVE-2016-4171 | Unspecified Remote Code Execution Flaw in Adobe Flash Player | 9.8 | 20% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | flnet.org | compromise: Malicious IPs and hostnames: 212.7.217[.]10 reg.flnet[.]org webconncheck.myfw[.]us MD5s: 3e5ac6bbf108feec97e1cc36560a |
| domain | myfw.us | d3e5f83e) connects to the following C2: hXXp://webconncheck.myfw[.]us:8080/8xrss.php The modules are signed by an invalid digit |
| ipv4 | 212.7.217.10 | es . Indicators of compromise: Malicious IPs and hostnames: 212.7.217[.]10 reg.flnet[.]org webconncheck.myfw[.]us MD5s: 3e5ac6bbf108 |
| md5 | 067681b79756156ba26c12bc36bf835c | 063 cfgifut.dll e51ce28c2e2d226365bc5315d3e5f83e cldbct.dll 067681b79756156ba26c12bc36bf835c cryptbase.dll f8a2d4ddf9dc2de750c8b4b7ee45ba3f msfte.dll Th |
| md5 | 3e5ac6bbf108feec97e1cc36560ab0b6 | 212.7.217[.]10 reg.flnet[.]org webconncheck.myfw[.]us MD5s: 3e5ac6bbf108feec97e1cc36560ab0b6 a6f14b547d9a7190a1f9f1c06f906063 e51ce28c2e2d226365bc5315d3 |
| md5 | 8844a537e7f533192ca8e81886e70fbc | payload of the attack is a CAB file with the following MD5: 8844a537e7f533192ca8e81886e70fbc The MS CAB file (md5: 8844a537e7f533192ca8e81886e70fbc) con |
| md5 | a6f14b547d9a7190a1f9f1c06f906063 | 8e81886e70fbc) contains 4 malicious DLL files: MD5 Filename a6f14b547d9a7190a1f9f1c06f906063 cfgifut.dll e51ce28c2e2d226365bc5315d3e5f83e cldbct.dll 067 |
| md5 | e51ce28c2e2d226365bc5315d3e5f83e | : MD5 Filename a6f14b547d9a7190a1f9f1c06f906063 cfgifut.dll e51ce28c2e2d226365bc5315d3e5f83e cldbct.dll 067681b79756156ba26c12bc36bf835c cryptbase.dll f |
| md5 | f8a2d4ddf9dc2de750c8b4b7ee45ba3f | e cldbct.dll 067681b79756156ba26c12bc36bf835c cryptbase.dll f8a2d4ddf9dc2de750c8b4b7ee45ba3f msfte.dll The file cldbct.dll (e51ce28c2e2d226365bc5315d3e5 |
| url | http://webconncheck.myfw.us:8080/8xrss.php | e28c2e2d226365bc5315d3e5f83e) connects to the following C2: hXXp://webconncheck.myfw[.]us:8080/8xrss.php The modules are signed by an invalid digital certificates |
From the original article
7 min read at securelist.com
Earlier this year, we deployed new technologies in Kaspersky Lab products to identify and block zero-day attacks. This technology already proved its effectiveness earlier this year, when it caught an Adobe Flash zero day exploit (CVE-2016-1010 ). Earlier this month, our technology caught another zero-day Adobe Flash Player exploit deployed in targeted attacks.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.