Vulnerabilitymedium
Angler Exploit Kit
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-0311 | Use-After-Free Remote Code Execution in Adobe Flash Player | — | 86% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 176.103.144.48 | 650 of these subdomains linked back to a single IP address, 176.103.144.48. The main distribution method is malvertising with the mali |
| ipv4 | 178.32.131.185 | g IP addresses: 85.25.107.126 207.182.149.14 178.32.131.248 178.32.131.185 85.25.107.127 These domains are associated with the landing |
| ipv4 | 178.32.131.248 | by the following IP addresses: 85.25.107.126 207.182.149.14 178.32.131.248 178.32.131.185 85.25.107.127 These domains are associated w |
| ipv4 | 207.182.149.14 | een being used by the following IP addresses: 85.25.107.126 207.182.149.14 178.32.131.248 178.32.131.185 85.25.107.127 These domains a |
| ipv4 | 85.25.107.126 | ns have been seen being used by the following IP addresses: 85.25.107.126 207.182.149.14 178.32.131.248 178.32.131.185 85.25.107.127 |
| sha256 | 003156c92d99aa8bca0f7bc443a03f32a8ce5e26e940f6681747abbc44e1409c | 64c81277ed3291d79c27e0c326df43eccb050058cc3b1705ade SHA256: 003156c92d99aa8bca0f7bc443a03f32a8ce5e26e940f6681747abbc44e1409c Despite the low Anti-Virus detection rates, Cisco AMP and N |
| sha256 | 56f61bd84f6851dcd749c95ebcbc94b7814bedb12ae72db776e3c27d4be43ef8 | ilities. The first and most commonly served sample: SHA256: 56f61bd84f6851dcd749c95ebcbc94b7814bedb12ae72db776e3c27d4be43ef8 is the widely distributed version of the Flash 0-day for An |
| sha256 | 6e2d96990f92864c81277ed3291d79c27e0c326df43eccb050058cc3b1705ade | low detection rates currently (Between 1/57 - 3/57) SHA256: 6e2d96990f92864c81277ed3291d79c27e0c326df43eccb050058cc3b1705ade SHA256: 003156c92d99aa8bca0f7bc443a03f32a8ce5e26e940f668174 |
| sha256 | ca0cd15e28620dcb1b2fb5d29fb6daaa88346d8775139607bd9d2f583415e7b8 | the Angler EK, as Talos has discussed previously . SHA256: ca0cd15e28620dcb1b2fb5d29fb6daaa88346d8775139607bd9d2f583415e7b8 There is an additional group of hashes that are all variant |
From the original article
3 min read at blog.talosintelligence.com
On January 27th, Talos researchers began observing a new Angler Exploit Kit (EK) campaign using new variants associated with ( CVE-2015-0311) . Based on our telemetry data the campaign lasted from January 26th until January 30th with the majority of the events occurring on January 28th & 29th.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.