Ransomwarecritical

Threat Source Newsletter (April 15, 2021)

Cisco TalosApr 15, 2021 · 18:00 UTC (Apr 15, 2021)4 min read3 · 2 reads

Read at blog.talosintelligence.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-28480 CVE-2021-28481 CVE-2021-28482 CVE-2021-28483

Tags: cve-2021-28480 cve-2021-28481 cve-2021-28482 cve-2021-28483 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-28480 +3 related CVEs CVE-2021-28481 CVE-2021-28482 CVE-2021-28483	Microsoft Exchange Server Remote Code Execution Vulnerability	9.8 group max	71%		Apr 13, 2021

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
md5	34560233e751b7e95f155b6f61e7419a	0599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 MD5: 34560233e751b7e95f155b6f61e7419a Typical Filename: SAntivirusService.exe Claimed Product: A
md5	8193b63313019b614d5be721c538486b	4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd MD5: 8193b63313019b614d5be721c538486b Typical Filename: SAService.exe Claimed Product: SAService
md5	8c80dd97c37525927c1e549cb59bcbf3	be5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5 MD5: 8c80dd97c37525927c1e549cb59bcbf3 Typical Filename: svchost.exe Claimed Product: N/A Detectio
md5	96f8e4e2d643568cf242ff40d537cd85	339f525196d7f5da3a02e43c97513ff50b6bc17db4470ae3b182e2 MD5: 96f8e4e2d643568cf242ff40d537cd85 Typical Filename: SAService.exe Claimed Product: SAService
md5	9a4b7b0849a274f6f7ac13c7577daad8	e188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww31.exe Claimed Product: N/A Detection N
sha256	17c4a85cdc339f525196d7f5da3a02e43c97513ff50b6bc17db4470ae3b182e2	Detection Name: W32.GenericKD:Attribute.24ch.1201 SHA 256: 17c4a85cdc339f525196d7f5da3a02e43c97513ff50b6bc17db4470ae3b182e2 MD5: 96f8e4e2d643568cf242ff40d537cd85 Typical Filename: SAS
sha256	85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5	c e Detection Name: PUA.Win.Dropper.Segurazo::tpd SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5 MD5: 8c80dd97c37525927c1e549cb59bcbf3 Typical Filename: svc
sha256	8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9	e Detection Name: PUA.Win.File.Segurazo::95.sbx.tg SHA 256: 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 MD5: 34560233e751b7e95f155b6f61e7419a Typical Filename: SAn
sha256	c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e	etection Name: PUA.Win.Dropper.Segurazo::95.sbx.tg SHA 256: c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww3
sha256	e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd	x-9850692-0 Most prevalent malware files this week SHA 256: e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd MD5: 8193b63313019b614d5be721c538486b Typical Filename: SAS

From the original article

4 min read at blog.talosintelligence.com

If you missed our webinar last week, we've got you covered. We've uploaded an extended version to our YouTube page that includes the scripts used in the presentation. This video will show you how to reverse-engineer and detect Android malware .

Cisco Talos

blog.talosintelligence.com

Read the full article at Cisco Talos

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.