Threat Source Newsletter (May 13, 2021)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-1468 | Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or gain access to sensitive… | 9.8 | 2% | ||
| CVE-2021-31166 | Use-After-Free RCE in Microsoft Windows HTTP Protocol Stack (http.sys) | 9.8 | 100% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0a13d106fa3997a0c911edd5aa0e147a | f9440e97bf4f0a85ad34132407f925b27a8759f5a01de5ea4da6af MD5: 0a13d106fa3997a0c911edd5aa0e147a Typical Filename: mg20201223-1.exe Claimed Product: N/A Det |
| md5 | 34560233e751b7e95f155b6f61e7419a | 0599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 MD5: 34560233e751b7e95f155b6f61e7419a Typical Filename: SAntivirusService.exe Claimed Product: A |
| md5 | 8193b63313019b614d5be721c538486b | 4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd MD5: 8193b63313019b614d5be721c538486b Typical Filename: SAService.exe Claimed Product: SAService |
| md5 | 8c80dd97c37525927c1e549cb59bcbf3 | be5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5 MD5: 8c80dd97c37525927c1e549cb59bcbf3 Typical Filename: svchost.exe Claimed Product: N/A Detectio |
| md5 | 9a4b7b0849a274f6f7ac13c7577daad8 | e188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww31.exe Claimed Product: N/A Detection N |
| sha256 | 5e46ecffcff9440e97bf4f0a85ad34132407f925b27a8759f5a01de5ea4da6af | e: Win.Exploit.Shadowbrokers::5A5226262.auto.talos SHA 256: 5e46ecffcff9440e97bf4f0a85ad34132407f925b27a8759f5a01de5ea4da6af MD5: 0a13d106fa3997a0c911edd5aa0e147a Typical Filename: mg2 |
| sha256 | 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5 | c e Detection Name: PUA.Win.Dropper.Segurazo::tpd SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5 MD5: 8c80dd97c37525927c1e549cb59bcbf3 Typical Filename: svc |
| sha256 | 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 | etection Name: PUA.Win.Dropper.Segurazo::95.sbx.tg SHA 256: 8b4216a7c50599b11241876ada8ae6f07b48f1abe6590c2440004ea4db5becc9 MD5: 34560233e751b7e95f155b6f61e7419a Typical Filename: SAn |
| sha256 | c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e | 535 - 57538 Most prevalent malware files this week SHA 256: c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww3 |
| sha256 | e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd | Detection Name: W32.GenericKD:Attribute.24ch.1201 SHA 256: e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd MD5: 8193b63313019b614d5be721c538486b Typical Filename: SAS |
From the original article
5 min read at blog.talosintelligence.com
In case you missed the Friday news drop last week, we have an update on the Lemon Duck cryptocurrency miner. It's not as eye-catching as the ransomware attacks that make the news, but Lemon Duck's exploitation of Microsoft Exchange servers shows that patching is still king, and a cryptocurrency attack shows there's room for additional attacks in the future.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.