Vulnerabilitymedium
BadPatch
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ads4market.net | nly found one of the seven domains associated with this IP, ads4market[.]net, not associated with malware activity. We did not find an |
| domain | mailsinfo.com | erved in our earlier KASPERAGENT and MICROPSIA research was mailsinfo[.]com. The first IP address that this domain resolved to from a |
| domain | pal2me.net | oad servers, and/or in associated malware code: Pal4u[.]net Pal2me[.]net Pay2earn[.]net Shop8d[.]net Ts4shope[.]net pal4news[.]net |
| domain | pal4news.net | net Pal2me[.]net Pay2earn[.]net Shop8d[.]net Ts4shope[.]net pal4news[.]net We only found one of the seven domains associated with th |
| domain | pal4u.net | .]117. We used passive DNS (pDNS) and found the server mail.pal4u[.]net on 148.251.135[.]117 starting mid-May 2015. We also found |
| domain | palu4u.net | 195.154.216[.]74. We found six additional domains that used palu4u[.]net as NS, and which all shared the same historic IP address |
| domain | pay2earn.net | and/or in associated malware code: Pal4u[.]net Pal2me[.]net Pay2earn[.]net Shop8d[.]net Ts4shope[.]net pal4news[.]net We only found |
| domain | piedslibres.com | ir “BadPatch” Windows malware from hacked WordPress site wp.piedslibres[.]com/wp/wp-includes/js/Next.scr. SHA256 d759dcbebee18a65fda434 |
| domain | shop8d.net | iated malware code: Pal4u[.]net Pal2me[.]net Pay2earn[.]net Shop8d[.]net Ts4shope[.]net pal4news[.]net We only found one of the se |
| domain | ts4shope.net | code: Pal4u[.]net Pal2me[.]net Pay2earn[.]net Shop8d[.]net Ts4shope[.]net pal4news[.]net We only found one of the seven domains ass |
| ipv4 | 148.251.135.117 | passive DNS (pDNS) and found the server mail.pal4u[.]net on 148.251.135[.]117 starting mid-May 2015. We also found other servers on thi |
| ipv4 | 195.154.216.74 | et as NS, and which all shared the same historic IP address 195.154.216[.]74 (Figure 2). From the seven total domains, we observed six |
| sha256 | 106deff16a93c4a4624fe96e3274e1432921c56d5a430834775e5b98861c00ea | de show\Project1.vbp Keylogger functionality is introduced: 106deff16a93c4a4624fe96e3274e1432921c56d5a430834775e5b98861c00ea E:\work here\ ready kl send recent files\Project1.vbp New k |
| sha256 | 17a4126fb1fb19885d78c82271464d82af8618b7d1b7d8901666c1121ddb2ba1 | dy kl send recent files\Project1.vbp New keylogger version: 17a4126fb1fb19885d78c82271464d82af8618b7d1b7d8901666c1121ddb2ba1 D:\000 work\21.3 GB\ newSpoofKL \Project1.vbp New file exfi |
| sha256 | 1a65e43afaaff90b4124cbef21fadc319f10fba4843d09837219400b0dbcc285 | scr (The names of the beneficiaries of Finance. scr) SHA256 1a65e43afaaff90b4124cbef21fadc319f10fba4843d09837219400b0dbcc285 Filename الهباش يتحدى حماس الاعتراف.scr (Habash defies Hama |
| sha256 | 224b5af4ca4de234f03408487f075f0d638826cb6f65944a3e8dcbaac4372e79 | t only \Project1.vbp Visual Basic versions, new downloader: 224b5af4ca4de234f03408487f075f0d638826cb6f65944a3e8dcbaac4372e79 Q:\newPatch\downloader\exe site\shop\Project1.vbp Downloade |
| sha256 | 2c64a3d6b896ee1b58b9cf55531b7256de45025d60b1f4be764b385de087b52f | س الاعتراف.scr (Habash defies Hamas recognition.scr) SHA256 2c64a3d6b896ee1b58b9cf55531b7256de45025d60b1f4be764b385de087b52f Filename Statement of Account-ARABBANK.exe Malware Analysis |
| sha256 | 2d75335f8c7d4e956dcd637f480c94f6ed49a9870375aad0eee1e651d6e7ac02 | 2 server (e.g. pal4u[.]net or m103.pay2earn[.]net). SHA256: 2d75335f8c7d4e956dcd637f480c94f6ed49a9870375aad0eee1e651d6e7ac02 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
| sha256 | 30282a807c2ee27b0d1dda310e41487f5018bc5fc5df8af6c13d08df34f2b6df | ecoy filenames tailored to the spear-phished target: SHA256 30282a807c2ee27b0d1dda310e41487f5018bc5fc5df8af6c13d08df34f2b6df Filename عاجل جدا وسري جدا.gz (Very urgent and very confide |
| sha256 | 42adec426addf3fd0c6aff406b46fa82d901f5a9bed7758a243458961349a362 | supporting intercepting only Arabic and English characters (42adec426addf3fd0c6aff406b46fa82d901f5a9bed7758a243458961349a362). Autoit downloader / dropper This simple component downloa |
| sha256 | 5c6e531738c1380ec09c1ec0f1438cee5077e6cbade8af87710b8be2f0aaaac7 | bserved a single variant using an obfuscated AutoIt script (5c6e531738c1380ec09c1ec0f1438cee5077e6cbade8af87710b8be2f0aaaac7). Another outlier variant was keylogger-only, supporting in |
| sha256 | 6660491190525a7413b683b91a6c8b0082aa71e6dd6291d11ec26e1e3cf55a57 | aded the same malware from the compromised server. Filename 6660491190525a7413b683b91a6c8b0082aa71e6dd6291d11ec26e1e3cf55a57 First seen 2015-06-15 Filename تسنيم.doc (Tasneem.doc – the |
| sha256 | 92a685c0c8515ef55635760026039564ddd0b299a2b0c4812df3c40aba133812 | 2012) dropped an Adobe Flash decoy file (Figure 2): SHA256 92a685c0c8515ef55635760026039564ddd0b299a2b0c4812df3c40aba133812 Figure 2- Adobe Flash decoy Samples typically employ decoy |
| sha256 | 9a8acd988089e7f9dd04f971374f766db519e854d42e8052b0d98b4c9c6b67e4 | test version (details are in the malware analysis section): 9a8acd988089e7f9dd04f971374f766db519e854d42e8052b0d98b4c9c6b67e4 Y:\My Work\VB 6\Get Files\ GFiles 14-09-2015 - Working tst |
| sha256 | cc8020c36156c7e5c8cfbbb32bc8d7f03536510f4e3b38b22e0abdb9ad90c90e | وسري جدا.gz (Very urgent and very confidential. Gz) SHA256 cc8020c36156c7e5c8cfbbb32bc8d7f03536510f4e3b38b22e0abdb9ad90c90e Filename ,اسماء المستحقين للمالية.scr (The names of the ben |
| sha256 | d759dcbebee18a65fda434ba1da5d348c16d9d3775fe1652a1dacf983ffc93b8 | ite wp.piedslibres[.]com/wp/wp-includes/js/Next.scr. SHA256 d759dcbebee18a65fda434ba1da5d348c16d9d3775fe1652a1dacf983ffc93b8 First seen 2015-05-13 Filename لمستجدات.doc , (Developments |
| sha256 | d906118fb36a0cc4e83121d4d606ad685645252e8e0791f793057499d8751bf0 | wnloader\exe site\shop\Project1.vbp Downloader version 2.8: d906118fb36a0cc4e83121d4d606ad685645252e8e0791f793057499d8751bf0 J:\dowloader 2 8\downloader\site\Project1.vbp Version M103, |
| sha256 | d9253c808d83ace06f885479e0807246a29cb9967ea0d0855f5a3802825b13db | he compile date of this malware was 31 March 2016. Sha256 - d9253c808d83ace06f885479e0807246a29cb9967ea0d0855f5a3802825b13db W:\newPatch\exe vb m103 30 3 2016 \Project1.vbp Conclusion |
From the original article
11 min read at unit42.paloaltonetworks.com
In April 2017, in collaboration with Clearsky, Palo Alto Networks Unit 42 published an article about our research into targeted attacks in the Middle East. In that research we discussed two new malware families we named KASPERAGENT and MICROPSIA. Since then, we have continued our research into the Command and Control (C2) infrastructure associated with KASPERAGENT and MICROPSIA.
By Tomer Bar, Simon Conant · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.