Malwaremedium
RTF Exploit Installs Italian RAT: uWarrior
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-1856 | Remote Code Execution via TabStrip ActiveX Control in Microsoft Office (MSCOMCTL.OCX) | — | 72% | KEV | — KEV |
| CVE-2015-1770 | Uninitialized Memory Use RCE in Microsoft Office | — | 35% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | login.collegefan.org | structure found in this sample of uWarrior has the domain “login.collegefan.org” set as the C2 host, and 2020 for the communications port. |
| domain | login.loginto.me | oaming\warriors.dat Network indicators login.collegefan.org login.loginto.me 63.142.245.12 23.249.225.140 |
| ipv4 | 23.249.225.140 | icators login.collegefan.org login.loginto.me 63.142.245.12 23.249.225.140 |
| ipv4 | 63.142.245.12 | at Network indicators login.collegefan.org login.loginto.me 63.142.245.12 23.249.225.140 |
| sha256 | 57a5d0da72655df9c5ca9137df7210b86845eeabae488537c70e36587274937c | 4ece7b7b7bd3f034f444362d35c8765f6ec4bd279 WUPOS_update.doc, 57a5d0da72655df9c5ca9137df7210b86845eeabae488537c70e36587274937c File system indicators %AppData%\Local\Temp\bootloader.dec |
| sha256 | 5dce01ec5e1bc1b4f5012e0b4bf16532206284fc8c64cfb8dcf907f45caf98fc | he uWarrior tag. Indicators Sample Hashes WindowsUpdate.exe,5dce01ec5e1bc1b4f5012e0b4bf16532206284fc8c64cfb8dcf907f45caf98fc Windows_Update.UtilityWarrior.dll,f4aa83297844eb8297711e325 |
| sha256 | 70ea7ef3bf9966c3297a4e78024e3083013558670d051c2ca3095e2588a576d8 | 54b577558a7c871da17d08d937c5d7b3564e07b object_000187A1.bin 70ea7ef3bf9966c3297a4e78024e3083013558670d051c2ca3095e2588a576d8 object_0002802C.bin Closer examination of each of the OLE o |
| sha256 | 7f29f2dc8b60c0e5a22575d9c76fd9c3d39604d1acf5cb4d938a63095c61a72e | 0bb1c5b116d1f9e5468ae52674bb443468658d9 object_00000020.bin 7f29f2dc8b60c0e5a22575d9c76fd9c3d39604d1acf5cb4d938a63095c61a72e object_000000E6.bin fe80d59686806afe3dc48f73d54b577558a7c87 |
| sha256 | 7ff9ff29b79d0eb38813bfa0b0bb1c5b116d1f9e5468ae52674bb443468658d9 | erestingly, both documents contained identical OLE objects: 7ff9ff29b79d0eb38813bfa0b0bb1c5b116d1f9e5468ae52674bb443468658d9 object_00000020.bin 7f29f2dc8b60c0e5a22575d9c76fd9c3d39604d |
| sha256 | a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444362d35c8765f6ec4bd279 | e32554e41f677cce290732171583199a57fb7a0674b ammendment.doc, a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444362d35c8765f6ec4bd279 WUPOS_update.doc, 57a5d0da72655df9c5ca9137df7210b86845eeaba |
| sha256 | f4aa83297844eb8297711e32554e41f677cce290732171583199a57fb7a0674b | c8c64cfb8dcf907f45caf98fc Windows_Update.UtilityWarrior.dll,f4aa83297844eb8297711e32554e41f677cce290732171583199a57fb7a0674b ammendment.doc, a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444 |
| sha256 | fe80d59686806afe3dc48f73d54b577558a7c871da17d08d937c5d7b3564e07b | 76fd9c3d39604d1acf5cb4d938a63095c61a72e object_000000E6.bin fe80d59686806afe3dc48f73d54b577558a7c871da17d08d937c5d7b3564e07b object_000187A1.bin 70ea7ef3bf9966c3297a4e78024e30830135586 |
From the original article
12 min read at unit42.paloaltonetworks.com
Unit 42 researchers have observed a new Remote Access Tool (RAT) constructed by an unknown actor of Italian origin. This RAT, referred to as uWarrior because of embedded PDB strings, has been previously described by an independent researcher who noted a potentially unknown exploit being used against Microsoft Office.
By Brandon Levene, Tomer Bar · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.