Vulnerabilityhigh
Ancient Mac Site Harbors Botnet that Exploits IE Vulnerability
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-6332 | Remote Code Execution via Array Bounds Flaw in Microsoft Windows OLE Automation | — | 95% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | macport.com | bottom before the closing </html> tag: <iframe src="hxxp://macport[.]com/vga.html" width="0" height="0"></iframe> The iframe is us |
| ipv4 | 209.54.57.97 | ot attempt to connect to. 313.legend.rocks sex.legend.rocks 209.54.57.97 85.214.135.193 irc.rankand.hits.com Malware Landing Page an |
| ipv4 | 85.214.135.193 | connect to. 313.legend.rocks sex.legend.rocks 209.54.57.97 85.214.135.193 irc.rankand.hits.com Malware Landing Page and Executable (F |
| sha256 | aa99e3d8e784fbae2c6395d17eff0da9c5fe410ab2db3e1f71509f010e3f2005 | e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5) vga.exe (aa99e3d8e784fbae2c6395d17eff0da9c5fe410ab2db3e1f71509f010e3f2005) MSWINSCK.OCX appears to be a legitimate ActiveX file. Howe |
| sha256 | bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5 | to C:\Windows\System32 on the client machine: MSWINSCK.OCX (bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5) vga.exe (aa99e3d8e784fbae2c6395d17eff0da9c5fe410ab2db3e1f7 |
| sha256 | f6dfea954b4cb6fd0e737a7b806039e5490224e692123105fbf947541d73550b | l. The executable that gets dropped, VgaDriver.exe (SHA256: f6dfea954b4cb6fd0e737a7b806039e5490224e692123105fbf947541d73550b) turns out to be nothing more than a RAR file containing tw |
| url | http://macport.com/VgaDriver.exe | d Executable (For Reference): hxxp://macport[.]com/vga.html hxxp://macport[.]com/VgaDriver.exe Conclusion The malware distributed in this campaign poses |
| url | http://macport.com/vga.html | at the bottom before the closing </html> tag: <iframe src="hxxp://macport[.]com/vga.html" width="0" height="0"></iframe> The iframe is used to dir |
From the original article
7 min read at blog.talosintelligence.com
Last month, Microsoft released a security bulletin to patch CVE-2014-6332, a vulnerability within Windows Object Linking and Embedding (OLE) that could result in remote code execution if a user views a maliciously crafted web page with Microsoft Internet Explorer. Since then, there have been several documented examples of attackers leveraging this vulnerability and attempting to compromise users.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.