Data breachcritical
ScarCruft continues to evolve, introduces Bluetooth harvester
- CVEs
- CVE-2018-8120
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-8120 | Local Privilege Escalation in Microsoft Win32k (Windows 7 / Server 2008) | 7.0 | 73% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 000webhostapp.com | ://lotusprintgroup[.]com/images.png https://planar-progress.000webhostapp[.]com/UserFiles/File/image/image/girl.jpg https://planar-progre |
| domain | jnts1532.cn | 000webhostapp[.]com/userfiles/file/sliderpic.jpg http://www.jnts1532[.]cn/phpcms/templates/default/message/bottom.jpg http://www.rh |
| domain | lotusprintgroup.com | ttp://www.stjohns-burscough[.]org/uploads/images.png http://lotusprintgroup[.]com/images.png https://planar-progress.000webhostapp[.]com/Us |
| domain | nitesbr1.org | igns.com[.]au/demo/red/images/slider-pic-6.jpg http://kmbr1.nitesbr1[.]org/UserFiles/File/image/index.php http://kmbr1.nitesbr1[.]or |
| domain | rhooters.com | .]cn/phpcms/templates/default/message/bottom.jpg http://www.rhooters[.]com/bbs/data/m_photo/bottom.jpg https://buttyfly.000webhostap |
| domain | stjohns-burscough.org | //kmbr1.nitesbr1[.]org/UserFiles/File/images.png http://www.stjohns-burscough[.]org/uploads/images.png http://lotusprintgroup[.]com/images.pn |
| ipv4 | 120.192.73.202 | fly.000webhostapp[.]com planar-progress.000webhostapp[.]com 120.192.73[.]202 180.182.52[.]76 |
| ipv4 | 180.182.52.76 | [.]com planar-progress.000webhostapp[.]com 120.192.73[.]202 180.182.52[.]76 |
| ipv4 | 34.13.42.35 | c1ee6860 Konni 4c2016df6b546326d67ac2a79dea1343 URLs http://34.13.42[.]35/uploads/1.jpg http://34.13.42[.]35/uploads/2.jpg http://3 |
| md5 | 02681a7fe708f39beb7b3cf1bd557ee9 | licious documents, Trojans, emails, decoys) ScarCruft tools 02681a7fe708f39beb7b3cf1bd557ee9 Bluetooth info harvester C781f5fad9b47232b3606e4d374900cd I |
| md5 | 032ed0cd234f73865d55103bf4ceaa22 | h info harvester C781f5fad9b47232b3606e4d374900cd Installer 032ed0cd234f73865d55103bf4ceaa22 Downloader 22aaf617a86e026424edb7c868742495 AV Remover 07d2 |
| md5 | 03e5e566c1153cb1d18b8bc7c493025f | Initial Dropper 4d20f7311f4f617104f559a04afd2fbf Installer 03e5e566c1153cb1d18b8bc7c493025f Downloader C66ef71830341bb99d30964a8089a1fc Loader 5999e01b |
| md5 | 04371bf88b598b56691b0ad9da08204b | 457ad4 Injector 0790F1D7A1B9432AA5B8590286EB8B95 Downloader 04371bf88b598b56691b0ad9da08204b Installer e8b23cfc805353f55ed67cf0af58f305 UAC bypass(UACME |
| md5 | 0790f1d7a1b9432aa5b8590286eb8b95 | 0dc27c3 Installer 4d3c34a3070643c225be1dbbb3457ad4 Injector 0790F1D7A1B9432AA5B8590286EB8B95 Downloader 04371bf88b598b56691b0ad9da08204b Installer e8b23 |
| md5 | 07d2200f5c2d03845adb5b20841faa94 | aa22 Downloader 22aaf617a86e026424edb7c868742495 AV Remover 07d2200f5c2d03845adb5b20841faa94 AV Remover 1f5ac2f1744ed9c3fd01fe72ee8d334f Initial Dropper |
| md5 | 172b4dc27e41e4a0c84a803b0b944d3e | 0937c Downloader 25701492a18854ffdb05317ec7d19c29 Installer 172b4dc27e41e4a0c84a803b0b944d3e UAC bypass(UACME) 7149c205d634c4d17dae33fffb8a68ab Image fi |
| md5 | 1f5ac2f1744ed9c3fd01fe72ee8d334f | 2495 AV Remover 07d2200f5c2d03845adb5b20841faa94 AV Remover 1f5ac2f1744ed9c3fd01fe72ee8d334f Initial Dropper 4d20f7311f4f617104f559a04afd2fbf Installer |
| md5 | 22aaf617a86e026424edb7c868742495 | 900cd Installer 032ed0cd234f73865d55103bf4ceaa22 Downloader 22aaf617a86e026424edb7c868742495 AV Remover 07d2200f5c2d03845adb5b20841faa94 AV Remover 1f5a |
| md5 | 25701492a18854ffdb05317ec7d19c29 | 12768 Installer Ec0e77b57cb9dd7a04ab6e453810937c Downloader 25701492a18854ffdb05317ec7d19c29 Installer 172b4dc27e41e4a0c84a803b0b944d3e UAC bypass(UACME |
| md5 | 46f66d2d990660661d00f5177306309c | der 7a338d08226f5a38353385c8a5dec746 Simple HTTP Downloader 46F66D2D990660661D00F5177306309C Simple HTTP Uploader GreezaBackdoor of DarkHotel 5e0e11bca0 |
| md5 | 4c2016df6b546326d67ac2a79dea1343 | ackdoor of DarkHotel 5e0e11bca0e94914e565c1dcc1ee6860 Konni 4c2016df6b546326d67ac2a79dea1343 URLs http://34.13.42[.]35/uploads/1.jpg http://34.13.42[.]3 |
| md5 | 4d20f7311f4f617104f559a04afd2fbf | AV Remover 1f5ac2f1744ed9c3fd01fe72ee8d334f Initial Dropper 4d20f7311f4f617104f559a04afd2fbf Installer 03e5e566c1153cb1d18b8bc7c493025f Downloader C66ef |
| md5 | 4d3c34a3070643c225be1dbbb3457ad4 | a8089a1fc Loader 5999e01b83aa1cc12a2ad6a0c0dc27c3 Installer 4d3c34a3070643c225be1dbbb3457ad4 Injector 0790F1D7A1B9432AA5B8590286EB8B95 Downloader 04371b |
| md5 | 5380a173757e67d9b12f316771012768 | nstaller e8b23cfc805353f55ed67cf0af58f305 UAC bypass(UACME) 5380a173757e67d9b12f316771012768 Installer Ec0e77b57cb9dd7a04ab6e453810937c Downloader 25701 |
| md5 | 5999e01b83aa1cc12a2ad6a0c0dc27c3 | c493025f Downloader C66ef71830341bb99d30964a8089a1fc Loader 5999e01b83aa1cc12a2ad6a0c0dc27c3 Installer 4d3c34a3070643c225be1dbbb3457ad4 Injector 0790F1D |
| md5 | 5e0e11bca0e94914e565c1dcc1ee6860 | 177306309C Simple HTTP Uploader GreezaBackdoor of DarkHotel 5e0e11bca0e94914e565c1dcc1ee6860 Konni 4c2016df6b546326d67ac2a79dea1343 URLs http://34.13.42 |
| md5 | 7149c205d634c4d17dae33fffb8a68ab | nstaller 172b4dc27e41e4a0c84a803b0b944d3e UAC bypass(UACME) 7149c205d634c4d17dae33fffb8a68ab Image file embedded ROKRAT A76c4a79e6ff73bfd7149a49852e8916 |
| md5 | 7a338d08226f5a38353385c8a5dec746 | der A6bd2cf7bccf552febb8e8347d07529a Simple HTTP Downloader 7a338d08226f5a38353385c8a5dec746 Simple HTTP Downloader 46F66D2D990660661D00F5177306309C Sim |
| md5 | 899e90a0851649a5c270d1f78baf60f2 | a49852e8916 ROKRAT F63fc2d11fcebd37be3891def5776f6c Dropper 899e90a0851649a5c270d1f78baf60f2 Simple HTTP Downloader E88f7f285163d0c080c8d3e525b35ab3 Sim |
| md5 | a6bd2cf7bccf552febb8e8347d07529a | der D7c94c5ba028dc22a570f660b8dee5b9 Simple HTTP Downloader A6bd2cf7bccf552febb8e8347d07529a Simple HTTP Downloader 7a338d08226f5a38353385c8a5dec746 Sim |
| md5 | a76c4a79e6ff73bfd7149a49852e8916 | 7149c205d634c4d17dae33fffb8a68ab Image file embedded ROKRAT A76c4a79e6ff73bfd7149a49852e8916 ROKRAT F63fc2d11fcebd37be3891def5776f6c Dropper 899e90a0851 |
| md5 | c66ef71830341bb99d30964a8089a1fc | d2fbf Installer 03e5e566c1153cb1d18b8bc7c493025f Downloader C66ef71830341bb99d30964a8089a1fc Loader 5999e01b83aa1cc12a2ad6a0c0dc27c3 Installer 4d3c34a30 |
| md5 | c781f5fad9b47232b3606e4d374900cd | s 02681a7fe708f39beb7b3cf1bd557ee9 Bluetooth info harvester C781f5fad9b47232b3606e4d374900cd Installer 032ed0cd234f73865d55103bf4ceaa22 Downloader 22aaf |
| md5 | d7c94c5ba028dc22a570f660b8dee5b9 | der E88f7f285163d0c080c8d3e525b35ab3 Simple HTTP Downloader D7c94c5ba028dc22a570f660b8dee5b9 Simple HTTP Downloader A6bd2cf7bccf552febb8e8347d07529a Sim |
| md5 | e88f7f285163d0c080c8d3e525b35ab3 | per 899e90a0851649a5c270d1f78baf60f2 Simple HTTP Downloader E88f7f285163d0c080c8d3e525b35ab3 Simple HTTP Downloader D7c94c5ba028dc22a570f660b8dee5b9 Sim |
| md5 | e8b23cfc805353f55ed67cf0af58f305 | B8B95 Downloader 04371bf88b598b56691b0ad9da08204b Installer e8b23cfc805353f55ed67cf0af58f305 UAC bypass(UACME) 5380a173757e67d9b12f316771012768 Installe |
| md5 | ec0e77b57cb9dd7a04ab6e453810937c | AC bypass(UACME) 5380a173757e67d9b12f316771012768 Installer Ec0e77b57cb9dd7a04ab6e453810937c Downloader 25701492a18854ffdb05317ec7d19c29 Installer 172b4 |
| md5 | f63fc2d11fcebd37be3891def5776f6c | ile embedded ROKRAT A76c4a79e6ff73bfd7149a49852e8916 ROKRAT F63fc2d11fcebd37be3891def5776f6c Dropper 899e90a0851649a5c270d1f78baf60f2 Simple HTTP Downlo |
From the original article
5 min read at securelist.com
After publishing our initial series of blogposts back in 2016, we have continued to track the ScarCruft threat actor. ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usually targets organizations and companies with links to the Korean peninsula. The threat actor is highly skilled and, by all appearances, quite resourceful.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.