Vulnerabilityhigh
Chthonic: a new modification of ZeuS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-1761 | Memory Corruption RCE in Microsoft Word | — | 78% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 12b6717d2b16e24c5bd3c5f55e59528c | oubtedly see new variants of ZeuS in the future. A few md5: 12b6717d2b16e24c5bd3c5f55e59528c 148563b1ca625bbdbb60673db2edb74a 6db7ecc5c90c90b6077d5aef59 |
| md5 | 148563b1ca625bbdbb60673db2edb74a | in the future. A few md5: 12b6717d2b16e24c5bd3c5f55e59528c 148563b1ca625bbdbb60673db2edb74a 6db7ecc5c90c90b6077d5aef59435e02 5a1b8c82479d003aa37dd7b1dd |
| md5 | 2ab73f2d1966cd5820512fbe86986618 | c5c90c90b6077d5aef59435e02 5a1b8c82479d003aa37dd7b1dd877493 2ab73f2d1966cd5820512fbe86986618 329d62ee33bec5c17c2eb5e701b28639 615e46c2ff5f81a11e73794efe |
| md5 | 329d62ee33bec5c17c2eb5e701b28639 | 82479d003aa37dd7b1dd877493 2ab73f2d1966cd5820512fbe86986618 329d62ee33bec5c17c2eb5e701b28639 615e46c2ff5f81a11e73794efee96b38 77b42fb633369de146785c8327 |
| md5 | 5a1b8c82479d003aa37dd7b1dd877493 | b1ca625bbdbb60673db2edb74a 6db7ecc5c90c90b6077d5aef59435e02 5a1b8c82479d003aa37dd7b1dd877493 2ab73f2d1966cd5820512fbe86986618 329d62ee33bec5c17c2eb5e701 |
| md5 | 615e46c2ff5f81a11e73794efee96b38 | 2d1966cd5820512fbe86986618 329d62ee33bec5c17c2eb5e701b28639 615e46c2ff5f81a11e73794efee96b38 77b42fb633369de146785c83270bb289 78575db9f70374f4bf2f5a401f |
| md5 | 6db7ecc5c90c90b6077d5aef59435e02 | 7d2b16e24c5bd3c5f55e59528c 148563b1ca625bbdbb60673db2edb74a 6db7ecc5c90c90b6077d5aef59435e02 5a1b8c82479d003aa37dd7b1dd877493 2ab73f2d1966cd5820512fbe86 |
| md5 | 77b42fb633369de146785c83270bb289 | ee33bec5c17c2eb5e701b28639 615e46c2ff5f81a11e73794efee96b38 77b42fb633369de146785c83270bb289 78575db9f70374f4bf2f5a401f70d8ac 97d010a31ba0ddc0febbd87190 |
| md5 | 78575db9f70374f4bf2f5a401f70d8ac | c2ff5f81a11e73794efee96b38 77b42fb633369de146785c83270bb289 78575db9f70374f4bf2f5a401f70d8ac 97d010a31ba0ddc0febbd87190dc6078 b670dceef9bc29b49f7415c31f |
| md5 | 97d010a31ba0ddc0febbd87190dc6078 | b633369de146785c83270bb289 78575db9f70374f4bf2f5a401f70d8ac 97d010a31ba0ddc0febbd87190dc6078 b670dceef9bc29b49f7415c31ffb776a bafcf2476bea39b338abfb524c |
| md5 | b670dceef9bc29b49f7415c31ffb776a | b9f70374f4bf2f5a401f70d8ac 97d010a31ba0ddc0febbd87190dc6078 b670dceef9bc29b49f7415c31ffb776a bafcf2476bea39b338abfb524c451836 c15d1caccab5462e090555bcbe |
| md5 | bafcf2476bea39b338abfb524c451836 | a31ba0ddc0febbd87190dc6078 b670dceef9bc29b49f7415c31ffb776a bafcf2476bea39b338abfb524c451836 c15d1caccab5462e090555bcbec58bde ceb9d5c20280579f316141569d |
| md5 | c15d1caccab5462e090555bcbec58bde | eef9bc29b49f7415c31ffb776a bafcf2476bea39b338abfb524c451836 c15d1caccab5462e090555bcbec58bde ceb9d5c20280579f316141569d2335ca d0c017fef12095c45fe01b7773 |
| md5 | ceb9d5c20280579f316141569d2335ca | 476bea39b338abfb524c451836 c15d1caccab5462e090555bcbec58bde ceb9d5c20280579f316141569d2335ca d0c017fef12095c45fe01b7773a48d13 d438a17c15ce6cec4b60d25dbc |
| md5 | d0c017fef12095c45fe01b7773a48d13 | accab5462e090555bcbec58bde ceb9d5c20280579f316141569d2335ca d0c017fef12095c45fe01b7773a48d13 d438a17c15ce6cec4b60d25dbc5421cd |
| md5 | d438a17c15ce6cec4b60d25dbc5421cd | c20280579f316141569d2335ca d0c017fef12095c45fe01b7773a48d13 d438a17c15ce6cec4b60d25dbc5421cd |
| url | http://globalblinds.org/BATH/lider.exe | klost.exe. The Andromeda bot downloaded the downloader from hxxp://globalblinds.org/BATH/lider.exe. Downloading the Trojan Once downloaded, the downloader inj |
| url | http://valtex-guma.com.ua/docs/tasklost.exe | ple above, the file is downloaded from a compromised site – hxxp://valtex-guma.com.ua/docs/tasklost.exe. The Andromeda bot downloaded the downloader from hxxp://gl |
From the original article
6 min read at securelist.com
In the fall of 2014, we discovered a new banking Trojan, which caught our attention for two reasons: First, it is interesting from the technical viewpoint, because it uses a new technique for loading modules. Second, an analysis of its configuration files has shown that the malware targets a large number of online-banking systems: over 150 different banks and 20 payment systems in 15 countries.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.