Fake CVE-2023
A fake PoC for WinRAR RCE CVE-2023-40477 posted on GitHub actually deploys VenomRAT through a multi-step infection chain targeting researchers.
Four days after Zero Day Initiative publicly disclosed the WinRAR RCE vulnerability CVE-2023-40477 on August 17, 2023, an actor using the alias whalersplonk published a fake proof-of-concept on GitHub. The Python script actually repurposed public PoC code for GeoServer SQL injection CVE-2023-25157 and triggered an infection chain ending in VenomRAT. The README and an accompanying video lured users into running the script; the video drew over 100 plays. Unit 42 assesses the actor was opportunistic, targeting other miscreants adopting new vulnerabilities rather than researchers specifically.
- Fake PoC for CVE-2023-40477 committed by whalersplonk on GitHub
- Script reused public PoC code for GeoServer CVE-2023-25157
- Infection chain culminates in VenomRAT payload
- Streamable video luring victims drew over 120 plays
- WinRAR claims more than 500 million users worldwide
- ATT&CK
- T1204.002 Malicious FileT1566.002 Phishing: Malicious LinkT1071.001 Application Layer Protocol: Web Protocols
- Threat actors
- whalersplonk
- Malware
- VenomRAT
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-25157 | GeoServer: GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web… | 9.8 | 85% | ||
| CVE-2023-40477 | RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability | 7.8 | 11% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | checkblacklistwords.eu | eation with WildFire and Advanced URL Filtering. The domain checkblacklistwords[.]eu used to host the various files needed for infection and t |
| domain | streamable.com | . The instructions also include a link to a video hosted on streamable[.]com . The video is no longer hosted at the URL within the REA |
| ipv4 | 94.156.253.109 | n. This URL suggests the C2 is at the following IP address: 94.156.253[.]109:4449 This particular VenomRAT client starts a key logger |
| sha1 | 82cb695f463b93b9cc089253cd6b5e32dce46c35 | 0477 - main . zip Type = zip Physical Size = 2360 Comment = 82cb695f463b93b9cc089253cd6b5e32dce46c35 Date Time Attr Size Compressed Name ------------------- --- |
| sha256 | 7fc8d002b89fcfeb1c1e6b0ca710d7603e7152f693a14d8c0b7514d911d04234 | IoCs is available on our GitHub. Indicator Type Description 7fc8d002b89fcfeb1c1e6b0ca710d7603e7152f693a14d8c0b7514d911d04234 File CVE-2023-40477-main.zip ecf96e8a52d0b7a9ac33a37ac8b277 |
| sha256 | b77e4af833185c72590d344fd8f555b95de97ae7ca5c6ff5109a2d204a0d2b8e | 5afd287915c50a92df244e5041715c3381733e30b666fd3b File c.ps1 b77e4af833185c72590d344fd8f555b95de97ae7ca5c6ff5109a2d204a0d2b8e File Windows.Gaming.Preview.exe - VenomRAT 94.156.253[.]109 |
| sha256 | b99161d933f023795afd287915c50a92df244e5041715c3381733e30b666fd3b | f0c3d95514ac6eeaeacd8a4b62bcc32a716639f7e62cc4 File bat.bat b99161d933f023795afd287915c50a92df244e5041715c3381733e30b666fd3b File c.ps1 b77e4af833185c72590d344fd8f555b95de97ae7ca5c6ff5 |
| sha256 | c2a2678f6bb0ff5805f0c3d95514ac6eeaeacd8a4b62bcc32a716639f7e62cc4 | c33a37ac8b2779f4c52a3d7e0cf8da09d562ba0de6b30ff File poc.py c2a2678f6bb0ff5805f0c3d95514ac6eeaeacd8a4b62bcc32a716639f7e62cc4 File bat.bat b99161d933f023795afd287915c50a92df244e5041715c |
| sha256 | ecf96e8a52d0b7a9ac33a37ac8b2779f4c52a3d7e0cf8da09d562ba0de6b30ff | 7152f693a14d8c0b7514d911d04234 File CVE-2023-40477-main.zip ecf96e8a52d0b7a9ac33a37ac8b2779f4c52a3d7e0cf8da09d562ba0de6b30ff File poc.py c2a2678f6bb0ff5805f0c3d95514ac6eeaeacd8a4b62bcc |
| url | http://checkblacklistwords.eu/ | e PoC code to GitHub. However, the HTTP response to the URL hxxp://checkblacklistwords[.]eu/ has a Last-Modified field that is set to Sun, 16 Jul 2023 |
From the original article
11 min read at unit42.paloaltonetworks.com
Researchers should be aware of threat actors repurposing older proof of concept (PoC) code to quickly craft a fake PoC for a newly released vulnerability. On Aug. 17, 2023, the Zero Day Initiative publicly reported a remote code execution (RCE) vulnerability in WinRAR tracked as CVE-2023-40477 .
By Robert Falcone · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.