Malwarehigh
New Poison Ivy RAT Variant Targets Hong Kong Pro
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2545 | Malformed EPS Image RCE in Microsoft Office | — | 86% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | leeh0m.org | ackdoor. Both identified C2 domains are third-levels off of leeh0m[.]org, which was created in late February 2016, less than a mon |
| sha256 | 0191cb2a2624b532b2dffef6690824f7f32ea00730e5aef5d86c4bad6edf9ead | mate, signed binary that is used in the sideloading process 0191cb2a2624b532b2dffef6690824f7f32ea00730e5aef5d86c4bad6edf9ead ssMUIDLL.dll - 7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97 |
| sha256 | 0414bd2186d9748d129f66ff16e2c15df41bf173dc8e3c9cbd450571c99b3403 | 16afde80a41ce6eb7d6d93da2ea5ce00aa9e36944c20657d062330e13d8 0414bd2186d9748d129f66ff16e2c15df41bf173dc8e3c9cbd450571c99b3403 C2 Domains sent.leeh0m[.]org found.leeh0m[.]org |
| sha256 | 13bdc52c2066e4b02bae5cc42bc9ec7dfcc1f19fbf35007aea93e9d62e3e3fd0 | this family using the SPIVY tag. IOCs Weaponized EPS Docs: 13bdc52c2066e4b02bae5cc42bc9ec7dfcc1f19fbf35007aea93e9d62e3e3fd0 4d38d4ee5b625e09b61a253a52eb29fcf9c506ee9329b3a90a0b3911e59 |
| sha256 | 4d38d4ee5b625e09b61a253a52eb29fcf9c506ee9329b3a90a0b3911e59174f2 | 2 port: 443 Mutex: 40EM76iR9 ID: 03-18 Group: 03-18 SHA256: 4d38d4ee5b625e09b61a253a52eb29fcf9c506ee9329b3a90a0b3911e59174f2 Password: bqesid#@ C2 domain: sent.leeh0m[.]org C2 port: 44 |
| sha256 | 7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4 | fef6690824f7f32ea00730e5aef5d86c4bad6edf9ead ssMUIDLL.dll - 7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4 Poison Ivy shellcode files c707716afde80a41ce6eb7d6d93da2ea |
| sha256 | 9c6dc1c2ea5b2370b58b0ac11fde8287cd49aee3e089dbdf589cc8d51c1f7a9e | n Ivy configurations with our samples, shown below. SHA256: 9c6dc1c2ea5b2370b58b0ac11fde8287cd49aee3e089dbdf589cc8d51c1f7a9e Password: bqesid#@ C2 domain: found.leeh0m[.]org C2 port: 4 |
| sha256 | c707716afde80a41ce6eb7d6d93da2ea5ce00aa9e36944c20657d062330e13d8 | 8af8730a2a97485a639928f66d5f6bf4 Poison Ivy shellcode files c707716afde80a41ce6eb7d6d93da2ea5ce00aa9e36944c20657d062330e13d8 0414bd2186d9748d129f66ff16e2c15df41bf173dc8e3c9cbd450571c99 |
From the original article
6 min read at unit42.paloaltonetworks.comMalware writers have always sought to develop feature-rich, easy to use tools that are also somewhat hard to detect via both host- and network-based detection systems. For many years, one of the go-to families of malware used by both less-skilled and advanced actors has been the Poison Ivy (aka PIVY) RAT.
By Micah Yates, Mike Scott, Brandon Levene, Jen Miller-Osborn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.