Threat Source Newsletter (April 29, 2021)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-22893 | Use-After-Free RCE in Ivanti Pulse Connect Secure License Services | 10.0 | 47% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 8193b63313019b614d5be721c538486b | 4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd MD5: 8193b63313019b614d5be721c538486b Typical Filename: SAService.exe Claimed Product: SAService |
| md5 | 8c80dd97c37525927c1e549cb59bcbf3 | be5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5 MD5: 8c80dd97c37525927c1e549cb59bcbf3 Typical Filename: svchost.exe Claimed Product: N/A Detectio |
| md5 | 96f8e4e2d643568cf242ff40d537cd85 | 339f525196d7f5da3a02e43c97513ff50b6bc17db4470ae3b182e2 MD5: 96f8e4e2d643568cf242ff40d537cd85 Typical Filename: SAService.exe Claimed Product: SAService |
| md5 | 9a4b7b0849a274f6f7ac13c7577daad8 | e188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww31.exe Claimed Product: N/A Detection N |
| md5 | d709ea22945c98782dc69e996a98d643 | 51b74ebffb9fbdaf89569fadcce6682584088fde222685079f7bb9 MD5: d709ea22945c98782dc69e996a98d643 Typical Filename: FlashHelperService.exe Claimed Product: F |
| sha256 | 17c4a85cdc339f525196d7f5da3a02e43c97513ff50b6bc17db4470ae3b182e2 | e: Win.Exploit.Shadowbrokers::5A5226262.auto.talos SHA 256: 17c4a85cdc339f525196d7f5da3a02e43c97513ff50b6bc17db4470ae3b182e2 MD5: 96f8e4e2d643568cf242ff40d537cd85 Typical Filename: SAS |
| sha256 | 3bc24c618151b74ebffb9fbdaf89569fadcce6682584088fde222685079f7bb9 | etection Name: PUA.Win.Dropper.Segurazo::95.sbx.tg SHA 256: 3bc24c618151b74ebffb9fbdaf89569fadcce6682584088fde222685079f7bb9 MD5: d709ea22945c98782dc69e996a98d643 Typical Filename: Fla |
| sha256 | 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5 | ice Detection Name: W32.Auto:3bc24c6181.in03.Talos SHA 256: 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5 MD5: 8c80dd97c37525927c1e549cb59bcbf3 Typical Filename: svc |
| sha256 | c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e | SIDs: 57431 Most prevalent malware files this week SHA 256: c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww3 |
| sha256 | e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd | Detection Name: W32.GenericKD:Attribute.24ch.1201 SHA 256: e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd MD5: 8193b63313019b614d5be721c538486b Typical Filename: SAS |
From the original article
4 min read at blog.talosintelligence.com
Ransomware is not just financial extortion. It is crime that transcends business, academic and geographic boundaries. Talos was proud to assist with a newly released report from the international Ransomware Task Force that provides a path forward to mitigate this criminal enterprise.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.