Vulnerabilitymedium
The never ending Exploit Kit shift
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2011-3544 | Remote Code Execution in Oracle Java SE JRE Applet Rhino Script Engine | — | 97% | KEV | — KEV |
| CVE-2012-1723 | Remote Arbitrary Code Execution in Oracle Java SE (Hotspot Component) | — | 94% | KEVRansomware | — KEV |
| CVE-2013-2465 | Unspecified Flaw in Oracle Java SE 2D Component Exploited in the Wild (CVE-2013-2465) | — | 99% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 3c3172a47915fe77ef1f2d38ccb5c786d30f13d8c5161fd0f2411c3b0459a036 | 35AB90 -- CVE-2014-0515 1.jar appears to be several hashes: 3C3172A47915FE77EF1F2D38CCB5C786D30F13D8C5161FD0F2411C3B0459A036 -- CVE-2011-3544 C35A5AA55C911F1F1CFF733E0F422C0DE316CFFAF3 |
| sha256 | 4525f4fe895d887ae354ce6221bad424690503dafebc87a43cf54092faa9cbe8 | 3E0F422C0DE316CFFAF3B285ABA57A4CFDB7188341 -- CVE-2012-1723 4525F4FE895D887AE354CE6221BAD424690503DAFEBC87A43CF54092FAA9CBE8 -- CVE-2012-1723 C1806E59BAE8CD3A320FB249223852D25DD6229984 |
| sha256 | 4788cca43f06752bd6d52978cbf8058fa4a3aeb76bc5242ee83da4223ec2de13 | u.swf, 1.swf, and 2.swf, these appears to be a single hash: 4788CCA43F06752BD6D52978CBF8058FA4A3AEB76BC5242EE83DA4223EC2DE13 -- CVE-2013-0634 n3.swf, however, is a different hash: 8A5E |
| sha256 | 7f04e3b43fa259984aee7cf9fbe83a2c0994fb321d650e5b9fdfdfb11435f05e | 265825FBAC3887F6840B1DBB2E2556148F597D80C7 -- CVE-2013-2465 7F04E3B43FA259984AEE7CF9FBE83A2C0994FB321D650E5B9FDFDFB11435F05E -- CVE-2013-2465 2.jar appears to be a single hash: C945046 |
| sha256 | 8a5edd1e23db8054e6b7b76193a70edc7c0924320f4d26ab963aa53cea35ab90 | DE13 -- CVE-2013-0634 n3.swf, however, is a different hash: 8A5EDD1E23DB8054E6B7B76193A70EDC7C0924320F4D26AB963AA53CEA35AB90 -- CVE-2014-0515 1.jar appears to be several hashes: 3C3172 |
| sha256 | c1806e59bae8cd3a320fb249223852d25dd62299844cf045d5af4ae1df0452af | 6221BAD424690503DAFEBC87A43CF54092FAA9CBE8 -- CVE-2012-1723 C1806E59BAE8CD3A320FB249223852D25DD62299844CF045D5AF4AE1DF0452AF -- CVE-2012-1723 C43DBBADD79F2C50F67BFC265825FBAC3887F6840B |
| sha256 | c35a5aa55c911f1f1cff733e0f422c0de316cffaf3b285aba57a4cfdb7188341 | 38CCB5C786D30F13D8C5161FD0F2411C3B0459A036 -- CVE-2011-3544 C35A5AA55C911F1F1CFF733E0F422C0DE316CFFAF3B285ABA57A4CFDB7188341 -- CVE-2012-1723 4525F4FE895D887AE354CE6221BAD424690503DAFE |
| sha256 | c43dbbadd79f2c50f67bfc265825fbac3887f6840b1dbb2e2556148f597d80c7 | 49223852D25DD62299844CF045D5AF4AE1DF0452AF -- CVE-2012-1723 C43DBBADD79F2C50F67BFC265825FBAC3887F6840B1DBB2E2556148F597D80C7 -- CVE-2013-2465 7F04E3B43FA259984AEE7CF9FBE83A2C0994FB321D |
| sha256 | c9450462f9a58c2c854e93ff8a6782c7af677653097347f20dd679939ea19b5a | 435F05E -- CVE-2013-2465 2.jar appears to be a single hash: C9450462F9A58C2C854E93FF8A6782C7AF677653097347F20DD679939EA19B5A -- CVE-2013-2465 The hostnames where this exploit kit has b |
From the original article
2 min read at blog.talosintelligence.com
Recently we've been able to observe several shifts in exploit kit techniques, so I thought it would be good to share the IOC information for the exploit kits so that administrators and network defenders can take a look at their devices and logs to remediate on their networks. Bleeding life, traditionally, was not one of the more subtle exploit kits.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.