Ransomwarecritical
Threat Source newsletter (Aug. 12, 2021)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-26424 | Windows TCP/IP Remote Code Execution Vulnerability | 9.9 | 61% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 0a13d106fa3997a0c911edd5aa0e147a | f9440e97bf4f0a85ad34132407f925b27a8759f5a01de5ea4da6af MD5: 0a13d106fa3997a0c911edd5aa0e147a Typical Filename: mg20201223-1.exe Claimed Product: N/A Det |
| md5 | 0b506c6dde8d07f9eeb82fd01a6f97d4 | 2c0215192be6c52f08f10c01e7af9a3136c2f67ec3e7ba563f565d MD5: 0b506c6dde8d07f9eeb82fd01a6f97d4 Typical Filename: ybcbqgo5z.dll Claimed Product: N/A Detect |
| md5 | 6be10a13c17391218704dc24b34cf736 | 38b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb MD5: 6be10a13c17391218704dc24b34cf736 Typical Filename: smbscanlocal0906.exe Claimed Product: N/A |
| md5 | 963aa12c1d0427cb154d519f21358ab4 | 923b6ead19109dbf591bbe93f3407153c992ad35fc6ed8969a34c3 MD5: 963aa12c1d0427cb154d519f21358ab4 Typical Filename: bld.exe Claimed Product: cleaper.exe Dete |
| md5 | 9a4b7b0849a274f6f7ac13c7577daad8 | e188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww31.exe Claimed Product: N/A Detection N |
| sha256 | 4d59e857c6923b6ead19109dbf591bbe93f3407153c992ad35fc6ed8969a34c3 | A Detection Name: Win.Dropper.Ranumbot::in03.talos SHA 256: 4d59e857c6923b6ead19109dbf591bbe93f3407153c992ad35fc6ed8969a34c3 MD5: 963aa12c1d0427cb154d519f21358ab4 Typical Filename: bld |
| sha256 | 5e46ecffcff9440e97bf4f0a85ad34132407f925b27a8759f5a01de5ea4da6af | duct: N/A Detection Name: Win.Dropper.Ecltys::1201 SHA 256: 5e46ecffcff9440e97bf4f0a85ad34132407f925b27a8759f5a01de5ea4da6af MD5: 0a13d106fa3997a0c911edd5aa0e147a Typical Filename: mg2 |
| sha256 | 9a74640ca638b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb | Detection Name: W32.GenericKD:Attribute.24ch.1201 SHA 256: 9a74640ca638b274bc8e81f4561b4c48b0c5fbcb78f6350801746003ded565eb MD5: 6be10a13c17391218704dc24b34cf736 Typical Filename: smb |
| sha256 | c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e | 503 - 57508 Most prevalent malware files this week SHA 256: c1d5a585fce188423d31df3ea806272f3daa5eb989e18e9ecf3d94b97b965f8e MD5: 9a4b7b0849a274f6f7ac13c7577daad8 Typical Filename: ww3 |
| sha256 | f682bdbd612c0215192be6c52f08f10c01e7af9a3136c2f67ec3e7ba563f565d | exe Detection Name: W32.Auto:4d59e857c6.in03.Talos SHA 256: f682bdbd612c0215192be6c52f08f10c01e7af9a3136c2f67ec3e7ba563f565d MD5: 0b506c6dde8d07f9eeb82fd01a6f97d4 Typical Filename: ybc |
From the original article
5 min read at blog.talosintelligence.com
No, that's not Ratatouille. It's ServHelper , who is much more dangerous (albeit just as cute) as the cartoon chef. We have a new blog post out today detailing this RAT, run by the threat actor Group TA505, that is stealing credit card data and other sensitive information.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.