Vulnerabilitymedium
Flash 0-Day In The Wild: Group 123 At The Controls
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-4878 | Use-After-Free RCE in Adobe Flash Player before 28.0.0.161 | 7.8 | 90% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.1588-2040.co.kr | e URLs where this additional payload was downloaded: hxxp://www[.]1588-2040[.]co[.]kr/conf/product_old.jpg hxxp://www[.]1588-2040[.]co[.]kr |
| domain | www.dylboiler.co.kr | age.php hxxp://www[.]korea-tax[.]info/main/local.php hxxp://www[.]dylboiler[.]co[.]kr/admincenter/files/board/4/manager.php All these URLs |
| domain | www.korea-tax.info | ]1588-2040[.]co[.]kr/design/m/images/image/image.php hxxp://www[.]korea-tax[.]info/main/local.php hxxp://www[.]dylboiler[.]co[.]kr/admince |
| sha256 | 3b1395f620e428c5f68c6497a2338da0c4f749feb64e8f12e4c5b1288cc57a1c | b8479f3a416fa58580ae76a8c731c2294c24663c601a1267e0e5c2678a0 3b1395f620e428c5f68c6497a2338da0c4f749feb64e8f12e4c5b1288cc57a1c ROKRAT sample: E1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6 |
| sha256 | e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd | 6497a2338da0c4f749feb64e8f12e4c5b1288cc57a1c ROKRAT sample: E1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd URL: hxxp://www[.]1588-2040[.]co[.]kr/conf/product_old.jpg |
| sha256 | fec71b8479f3a416fa58580ae76a8c731c2294c24663c601a1267e0e5c2678a0 | available for purchase on Snort.org . IOCs Flash exploits: fec71b8479f3a416fa58580ae76a8c731c2294c24663c601a1267e0e5c2678a0 3b1395f620e428c5f68c6497a2338da0c4f749feb64e8f12e4c5b1288cc |
| url | http://www.1588-2040.co.kr/conf/product_old.jpg | are some URLs where this additional payload was downloaded: hxxp://www[.]1588-2040[.]co[.]kr/conf/product_old.jpg hxxp://www[.]1588-2040[.]co[.]kr/design/m/images/imag |
| url | http://www.1588-2040.co.kr/design/m/images/image/image.php | aded: hxxp://www[.]1588-2040[.]co[.]kr/conf/product_old.jpg hxxp://www[.]1588-2040[.]co[.]kr/design/m/images/image/image.php hxxp://www[.]korea-tax[.]info/main/local.php hxxp://w |
| url | http://www.dylboiler.co.kr/admincenter/files/board/4/manager.php | mage/image.php hxxp://www[.]korea-tax[.]info/main/local.php hxxp://www[.]dylboiler[.]co[.]kr/admincenter/files/board/4/manager.php All these URLs are compromised websites located in So |
| url | http://www.korea-tax.info/main/local.php | //www[.]1588-2040[.]co[.]kr/design/m/images/image/image.php hxxp://www[.]korea-tax[.]info/main/local.php hxxp://www[.]dylboiler[.]co[.]kr/admincenter/files/boar |
From the original article
3 min read at blog.talosintelligence.com
This blog post is authored by Warren Mercer and Paul Rascagneres . The 1st of February, Adobe published an advisory concerning a Flash vulnerability (CVE-2018-4878). This vulnerability is a use after free that allows Remote Code Execute through a malformed Flash object.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.