Exploit / PoCcritical
InPage zero-day exploit used to attack financial institutions in Asia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
| CVE-2017-12824 | Special crafted InPage document leads to arbitrary code execution in InPage reader | 7.8 | 1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aliasway.com | ns[.]com kinohata[.]ru Visitorzilla[.]com Ambicluster[.]com Aliasway[.]com <- SINKHOLED by Kaspersky Lab Xynoder[.]com By4mode[.]com |
| domain | ambicluster.com | givx[.]com Gigatrons[.]com kinohata[.]ru Visitorzilla[.]com Ambicluster[.]com Aliasway[.]com <- SINKHOLED by Kaspersky Lab Xynoder[.]co |
| domain | b4invite.com | hostname>\#/<OS version>\#/<IP address>\#/-” In addition to b4invite[.]com this same Trojan was also spread using a configuration wi |
| domain | by4mode.com | Aliasway[.]com <- SINKHOLED by Kaspersky Lab Xynoder[.]com By4mode[.]com Stringbit[.]com Encrypzi.com Gigsense[.]com I3mode[.]com |
| domain | digivx.com | elaybg[.]com B4invite[.]com Leastinfo[.]com tropicmig[.]com Digivx[.]com Gigatrons[.]com kinohata[.]ru Visitorzilla[.]com Ambiclus |
| domain | gigatrons.com | B4invite[.]com Leastinfo[.]com tropicmig[.]com Digivx[.]com Gigatrons[.]com kinohata[.]ru Visitorzilla[.]com Ambicluster[.]com Aliasw |
| domain | gigsense.com | ab Xynoder[.]com By4mode[.]com Stringbit[.]com Encrypzi.com Gigsense[.]com I3mode[.]com |
| domain | i3mode.com | m By4mode[.]com Stringbit[.]com Encrypzi.com Gigsense[.]com I3mode[.]com |
| domain | kinohata.ru | eastinfo[.]com tropicmig[.]com Digivx[.]com Gigatrons[.]com kinohata[.]ru Visitorzilla[.]com Ambicluster[.]com Aliasway[.]com <- SI |
| domain | leastinfo.com | e weaponized InPage documents: Relaybg[.]com B4invite[.]com Leastinfo[.]com tropicmig[.]com Digivx[.]com Gigatrons[.]com kinohata[.]r |
| domain | relaybg.com | an was also spread using a configuration with the C2 server relaybg[.]com. Victims So far, victims of these attacks have been obser |
| domain | stringbit.com | m <- SINKHOLED by Kaspersky Lab Xynoder[.]com By4mode[.]com Stringbit[.]com Encrypzi.com Gigsense[.]com I3mode[.]com |
| domain | tropicmig.com | age documents: Relaybg[.]com B4invite[.]com Leastinfo[.]com tropicmig[.]com Digivx[.]com Gigatrons[.]com kinohata[.]ru Visitorzilla[. |
| domain | visitorzilla.com | several internal strings. One of them is the C2 domain name visitorzilla[.]com . This backdoor maintains persistence by creating “ C:\Do |
| domain | xynoder.com | icluster[.]com Aliasway[.]com <- SINKHOLED by Kaspersky Lab Xynoder[.]com By4mode[.]com Stringbit[.]com Encrypzi.com Gigsense[.]com |
| ipv4 | 195.189.227.26 | _MSGFILTER parameter. It communicates with its C2 server at 195.189.227.26 on port 8080. During the initial session the C2 server send |
| md5 | 18a5194a4254cefe8644d191cb96da21 | and Visual Basic. One such keylogger we analysed (MD5 hash: 18a5194a4254cefe8644d191cb96da21 ) was written in Visual C++. After gaining control, the mod |
| md5 | 4d508e44c5f3028a36a5206383cf235c | f79496dee1d624a7b508f83f4e B43aa5ea4ff5292fd92d416bb2b41c3a 4d508e44c5f3028a36a5206383cf235c 53c3503d3193bf14a93dc3ac24829490 5a9a8502b87ce1a6a608debd10 |
| md5 | 53c3503d3193bf14a93dc3ac24829490 | ea4ff5292fd92d416bb2b41c3a 4d508e44c5f3028a36a5206383cf235c 53c3503d3193bf14a93dc3ac24829490 5a9a8502b87ce1a6a608debd10761957 C&Cs used in the samples d |
| md5 | 5a9a8502b87ce1a6a608debd10761957 | 44c5f3028a36a5206383cf235c 53c3503d3193bf14a93dc3ac24829490 5a9a8502b87ce1a6a608debd10761957 C&Cs used in the samples dropped by the weaponized InPage d |
| md5 | 729194d71ed65dd1fe9462c212c32159 | f compromise: Hashes f00e20ec50545106dc012b5f077954ae – rtf 729194d71ed65dd1fe9462c212c32159 – inp c9e7ec899142477146d4f7f83df3f63f 750ed4f79496dee1d624 |
| md5 | 750ed4f79496dee1d624a7b508f83f4e | 5dd1fe9462c212c32159 – inp c9e7ec899142477146d4f7f83df3f63f 750ed4f79496dee1d624a7b508f83f4e B43aa5ea4ff5292fd92d416bb2b41c3a 4d508e44c5f3028a36a5206383 |
| md5 | b43aa5ea4ff5292fd92d416bb2b41c3a | 899142477146d4f7f83df3f63f 750ed4f79496dee1d624a7b508f83f4e B43aa5ea4ff5292fd92d416bb2b41c3a 4d508e44c5f3028a36a5206383cf235c 53c3503d3193bf14a93dc3ac24 |
| md5 | c9e7ec899142477146d4f7f83df3f63f | 012b5f077954ae – rtf 729194d71ed65dd1fe9462c212c32159 – inp c9e7ec899142477146d4f7f83df3f63f 750ed4f79496dee1d624a7b508f83f4e B43aa5ea4ff5292fd92d416bb2 |
| md5 | f00e20ec50545106dc012b5f077954ae | intelreports@kaspersky.com Indicators of compromise: Hashes f00e20ec50545106dc012b5f077954ae – rtf 729194d71ed65dd1fe9462c212c32159 – inp c9e7ec89914247 |
From the original article
5 min read at securelist.com
In September 2016, while researching a new wave of attacks, we found an interesting target which appeared to constantly receive spearphishes, a practice we commonly describe as a “magnet of threats”. Among all the attacks received by this magnet of threats, which included various older Office exploits such as CVE-2012-0158, one of them attracted our attention.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.