Vulnerabilitymedium
Attacking Diffie-Hellman protocol implementation in the Angler Exploit Kit
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2419 | Memory Corruption RCE in Microsoft Internet Explorer JScript Engine | — | 53% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 014b170e00b46fd3fc35ce8766293c69 | , "2b18" : "0339b845ae35e9d7af629fa2d0d0fed3" } { "4256" : "014b170e00b46fd3fc35ce8766293c69" , "6799" : "YZfySNTEMcSWl8QqrgSuGA%3D%3D" , "2b18" : "ZEQN |
| md5 | 02aa6526e6edc0042394b7ea81ec5b75 | 1k1dnVNYWY1UlVXZjYxSSUzRCJ9 After Base64 decoding: { "B" : "02aa6526e6edc0042394b7ea81ec5b75" , "k" : "I5nkiFBk3LALF%2BnfkR7%2FYQ%3D%3D" , "b" : "to0ShZ |
| md5 | 0339b845ae35e9d7af629fa2d0d0fed3 | e1a" , "942d" : "18,0,0,209" , "377e" : "false" , "2b18" : "0339b845ae35e9d7af629fa2d0d0fed3" } { "4256" : "014b170e00b46fd3fc35ce8766293c69" , "6799" : |
| md5 | 0eb034f99e33e17df058de5b448b7241 | 4 15 16 17 18 19 20 21 <?php include 'xtea_ak.php' ; $dh = "0eb034f99e33e17df058de5b448b7241" ; $resp = "eyJCIjoiMDJhYTY1MjZ…" ; $dh = hex2bin ( $dh ) ; |
| md5 | 1b0b5c6e6b0b5b7e6c6d0b1b0a8c3c7e | 161a9a5" , "A" : "5eff90f1c48342f5d519cd02b5dfd8b" , "p" : "1b0b5c6e6b0b5b7e6c6d0b1b0a8c3c7e" , "v" : "17923" } The server generates its own random priv |
| md5 | 25d9508418493284da024712a41a29a1 | 5-2419. { "g" : "538c40fc6ec04c7a5e0790564b2afe33" , "A" : "25d9508418493284da024712a41a29a1" , "p" : "6e2e5c0b4c4d8d3c7a5d1e3d8a5d7c3e" , "v" : "17728" |
| md5 | 3d0d6c3b4a5b5e2c2d5d6d6e1a5a2e1a | : { "4256" : "425667992b18942d377eff0218961ce7" , "6799" : "3d0d6c3b4a5b5e2c2d5d6d6e1a5a2e1a" , "942d" : "18,0,0,209" , "377e" : "false" , "2b18" : "033 |
| md5 | 3db7b45576c08f61feb454ece94762d3 | 79bb137a77f87d554d1559274" , "51a2" : "17937" } { "47da" : "3db7b45576c08f61feb454ece94762d3" , "dcbd" : "4yIse5uSjsJXBZrbBMrpcA%3D%3D" , "7c83" : "6r28 |
| md5 | 40a262b1360a6a16612ca8251161a9a5 | ON object along with the Internet browser version. { "g" : "40a262b1360a6a16612ca8251161a9a5" , "A" : "5eff90f1c48342f5d519cd02b5dfd8b" , "p" : "1b0b5c6 |
| md5 | 425667992b18942d377eff0218961ce7 | shellcode vulnerability for Internet Explorer: { "4256" : "425667992b18942d377eff0218961ce7" , "6799" : "3d0d6c3b4a5b5e2c2d5d6d6e1a5a2e1a" , "942d" : " |
| md5 | 47dadcbd7c8351a26860da263ca8e0af | ript communication protocol: { "6860" : "false" , "47da" : "47dadcbd7c8351a26860da263ca8e0af" , "dcbd" : "5d1b0d5d5c4a8c5d1d5b4d6a3b5d7e3b" , "7c83" : " |
| md5 | 481dbc66fe90ded2eb8d027395abe4fd | e2e5c0b4c4d8d3c7a5d1e3d8a5d7c3e" , "v" : "17728" } { "B" : "481dbc66fe90ded2eb8d027395abe4fd" , … p = 146455792068641286704746413745292278846 = 2 * 2269 |
| md5 | 538c40fc6ec04c7a5e0790564b2afe33 | needcoffee.com with the exploit for CVE-2015-2419. { "g" : "538c40fc6ec04c7a5e0790564b2afe33" , "A" : "25d9508418493284da024712a41a29a1" , "p" : "6e2e5c |
| md5 | 5757a0b79bb137a77f87d554d1559274 | " , "dcbd" : "5d1b0d5d5c4a8c5d1d5b4d6a3b5d7e3b" , "7c83" : "5757a0b79bb137a77f87d554d1559274" , "51a2" : "17937" } { "47da" : "3db7b45576c08f61feb454ece |
| md5 | 5d1b0d5d5c4a8c5d1d5b4d6a3b5d7e3b | " , "47da" : "47dadcbd7c8351a26860da263ca8e0af" , "dcbd" : "5d1b0d5d5c4a8c5d1d5b4d6a3b5d7e3b" , "7c83" : "5757a0b79bb137a77f87d554d1559274" , "51a2" : " |
| md5 | 6e2e5c0b4c4d8d3c7a5d1e3d8a5d7c3e | 2afe33" , "A" : "25d9508418493284da024712a41a29a1" , "p" : "6e2e5c0b4c4d8d3c7a5d1e3d8a5d7c3e" , "v" : "17728" } { "B" : "481dbc66fe90ded2eb8d027395abe4f |
From the original article
17 min read at securelist.com
Exploit kit creators have been inventing increasingly interesting methods of masking their exploits, shellcodes, and payloads so that it is harder for analysts to define the type of the exploit and know what actions they may perform. Several days ago analysts found the usage of the Diffie-Hellman cryptographic protocol in the Angler Exploit Kit, which is one of the most popular exploit kits at the moment.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.