Vulnerabilityhigh
Beware: Fake Exploit for WinRAR Vulnerability on GitHub Infects Users with Venom RAT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-25157 | GeoServer: GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web… | 9.8 | 85% | ||
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion | 7.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2023-40477 | RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability | 7.8 | 11% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | checkblacklistwords.eu | opposed to running the PoC, reaches out to a remote server (checkblacklistwords[.]eu) to fetch an executable named Windows.Gaming.Preview.exe, |
| ipv4 | 94.156.253.109 | esses and receive commands from an actor-controlled server (94.156.253[.]109). A closer examination of the attack infrastructure shows |
From the original article
2 min read at thehackernews.com
A malicious actor released a fake proof-of-concept (PoC) exploit for a recently disclosed WinRAR vulnerability on GitHub with an aim to infect users who downloaded the code with Venom RAT malware.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.