Ransomwarehigh
Threat Source newsletter (Aug. 19, 2021)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-1675 | Remote Code Execution in Microsoft Windows Print Spooler (PrintNightmare) | 7.8 | 85% | KEVRansomwarePoC | KEV |
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler | 8.8 | 100% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0a13d106fa3997a0c911edd5aa0e147a | f9440e97bf4f0a85ad34132407f925b27a8759f5a01de5ea4da6af MD5: 0a13d106fa3997a0c911edd5aa0e147a Typical Filename: mg20201223-1.exe Claimed Product: N/A Det |
| md5 | 34560233e751b7e95f155b6f61e7419a | 0599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 MD5: 34560233e751b7e95f155b6f61e7419a Typical Filename: SAntivirusService.exe Claimed Product: A |
| md5 | 6be10a13c17391218704dc24b34cf736 | 38b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb MD5: 6be10a13c17391218704dc24b34cf736 Typical Filename: smbscanlocal0906.exe Claimed Product: N/A |
| md5 | 9a4b7b0849a274f6f7ac13c7577daad8 | e188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww31.exe Claimed Product: N/A Detection N |
| md5 | d54ade674cb0c3e6d322ed7380e8adf6 | df4b98e623f055f5205e2db17aa220c28928b1da1c3a9ba1a75ee0 MD5: d54ade674cb0c3e6d322ed7380e8adf6 Typical Filename: ml20201223.exe Claimed Product: N/A Detec |
| sha256 | 5191548b8edf4b98e623f055f5205e2db17aa220c28928b1da1c3a9ba1a75ee0 | c e Detection Name: PUA.Win.Dropper.Segurazo::tpd SHA 256: 5191548b8edf4b98e623f055f5205e2db17aa220c28928b1da1c3a9ba1a75ee0 MD5: d54ade674cb0c3e6d322ed7380e8adf6 Typical Filename: ml2 |
| sha256 | 5e46ecffcff9440e97bf4f0a85ad34132407f925b27a8759f5a01de5ea4da6af | A Detection Name: Win.Dropper.Ranumbot::in03.talos SHA 256: 5e46ecffcff9440e97bf4f0a85ad34132407f925b27a8759f5a01de5ea4da6af MD5: 0a13d106fa3997a0c911edd5aa0e147a Typical Filename: mg2 |
| sha256 | 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 | Name: RanumBot::mURLin::W32.5E46ECFFCF.in12.Talos SHA 256: 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 MD5: 34560233e751b7e95f155b6f61e7419a Typical Filename: SAn |
| sha256 | 9a74640ca638b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb | Detection Name: W32.GenericKD:Attribute.24ch.1201 SHA 256: 9a74640ca638b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb MD5: 6be10a13c17391218704dc24b34cf736 Typical Filename: smb |
| sha256 | c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e | per-9883867 Most prevalent malware files this week SHA 256: c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww3 |
From the original article
5 min read at blog.talosintelligence.com
I'm writing this on Tuesday morning on account of vacation (again), so apologies if we miss any major stories. You certainly don't want to miss our latest blog post on the Neurevt remote access trojan that's targeting users in Mexico. This malware is mainly designed to steal login credentials to banking websites, and we don't really need to tell you why that would be bad.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.