Vulnerabilitymedium
Threat Spotlight: Group 72, Opening the ZxShell
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2011-2462 | U3D Memory Corruption in Adobe Reader and Acrobat Enables Remote Code Execution | — | 89% | KEV | — KEV |
| CVE-2013-3163 | Remote Code Execution via Memory Corruption in Microsoft Internet Explorer | — | 71% | KEV | — KEV |
| CVE-2014-0322 | Use-After-Free Remote Code Execution in Microsoft Internet Explorer | — | 85% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | e3878d541d17b156b7ca447eeb49d96a | ell module, Let’s take a look at the following sample: MD5: e3878d541d17b156b7ca447eeb49d96a SHA256: 1eda7e556181e46ba6e36f1a6bfe18ff5566f9d5e51c53b41d0 |
| sha256 | 1e200d0d3de360d9c32e30d4c98f07e100f6260a86a817943a8fb06995c15335 | xShell droppers mentioned earlier, there is a file (SHA256: 1e200d0d3de360d9c32e30d4c98f07e100f6260a86a817943a8fb06995c15335) that installs a kernel device driver called loveusd.sys . |
| sha256 | 1eda7e556181e46ba6e36f1a6bfe18ff5566f9d5e51c53b41d08f9459342e26c | owing sample: MD5: e3878d541d17b156b7ca447eeb49d96a SHA256: 1eda7e556181e46ba6e36f1a6bfe18ff5566f9d5e51c53b41d08f9459342e26c It exports the following functions, which are examined in g |
From the original article
13 min read at blog.talosintelligence.com
This post was authored by Andrea Allievi , Douglas Goddard , Shaun Hurley , and Alain Zidouemba . Recently, there was a blog post on the takedown of a botnet used by threat actor group known as Group 72 and their involvement in Operation SMN.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.