Malwarehigh
GhostContainer backdoor for Exchange servers
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-0688 | RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys | 8.8 | 100% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 01d98380dfb9211251c75c87ddb3c79c | tand the threat landscape. GhostContainer: the backdoor MD5 01d98380dfb9211251c75c87ddb3c79c SHA1 2bb0a91c93034f671696da64a2cf6191a60a79c5 SHA256 87a3ae |
| sha1 | 2bb0a91c93034f671696da64a2cf6191a60a79c5 | ner: the backdoor MD5 01d98380dfb9211251c75c87ddb3c79c SHA1 2bb0a91c93034f671696da64a2cf6191a60a79c5 SHA256 87a3aefb5cdf714882eb02051916371fbf04af2eb7a5ddeae4b6 |
| sha256 | 87a3aefb5cdf714882eb02051916371fbf04af2eb7a5ddeae4b6b441b2168e36 | b3c79c SHA1 2bb0a91c93034f671696da64a2cf6191a60a79c5 SHA256 87a3aefb5cdf714882eb02051916371fbf04af2eb7a5ddeae4b6b441b2168e36 Link time 1970-01-01 12:00 AM UTC File type PE32 executable |
From the original article
8 min read at securelist.com
In a recent incident response (IR) case, we discovered highly customized malware targeting Exchange infrastructure within government environments. Analysis of detection logs and clues within the sample suggests that the Exchange server was likely compromised via a known N-day vulnerability.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.