Vulnerabilityhigh
The rush for CVE-2013-3906
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2013-3906 | Memory Corruption RCE in Microsoft Graphics Component (Actively Exploited) | — | 85% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 163.43.32.4 | av4.microsoftsp3.com . This domain points to the IP-address 163.43.32.4 . Other Winnti-related domains have been pointing here star |
| ipv4 | 211.78.90.113 | the PlugX backdoor is downloaded from a remote URL: hxxp:// 211.78.90.113/music/cover/as/update.exe . According to the PE header, thi |
| md5 | 4dd49174d6bc559105383bdf8bf0e234 | a93058 Backdoor.Win32.Gulpix.tu PlugX backdoor: update.exe, 4dd49174d6bc559105383bdf8bf0e234 Backdoor.Win32.Gulpix.tt PlugX internal library: 6982f0125b |
| md5 | 63ffbe83dccc954f6a9ee4a2a6a93058 | ffice.CVE-2013-3906.a MS Word document: Questionnaire.docx, 63ffbe83dccc954f6a9ee4a2a6a93058 Backdoor.Win32.Gulpix.tu PlugX backdoor: update.exe, 4dd491 |
| md5 | 6982f0125b4f28a0add2038edc5f038a | df8bf0e234 Backdoor.Win32.Gulpix.tt PlugX internal library: 6982f0125b4f28a0add2038edc5f038a Latest Webinars Reports Kaspersky researchers have discover |
| md5 | 7dd89c99ed7cec0ebc4afa8cd010f1f1 | ment containing the exploit shows the same TIFF “picture” – 7dd89c99ed7cec0ebc4afa8cd010f1f1 – that triggers the exploitation of the vulnerability, as i |
From the original article
3 min read at securelist.com
Two days ago FireEye reported that the recent CVE-2013-3906 exploit has begun to be used by new threat actors other than the original ones. The new infected documents share similarities with previously detected exploits but carry a different payload. This time these exploits are being used to deliver Taidoor and PlugX backdoors, according to FireEye.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.