Ransomwarehigh
Threat Spotlight: TeslaCrypt
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-0311 | Use-After-Free Remote Code Execution in Adobe Flash Player | — | 86% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 7tno4hib47vlep5o.63ghdye17.com | at we have analysed contains the following C&C server URLs: 7tno4hib47vlep5o.63ghdye17.com 7tno4hib47vlep5o.79fhdm16.com 7tno4hib47vlep5o.tor2web.blut |
| domain | 7tno4hib47vlep5o.79fhdm16.com | e following C&C server URLs: 7tno4hib47vlep5o.63ghdye17.com 7tno4hib47vlep5o.79fhdm16.com 7tno4hib47vlep5o.tor2web.blutmagie.de 7tno4hib47vlep5o.tor2 |
| ipv4 | 192.251.226.206 | 9591bc4117704f1c95f4 IP Addresses: 38.229.70.4 82.130.26.27 192.251.226.206 Domains Contacted: 7tno4hib47vlep5o.63ghdye17.com 7tno4hib4 |
| ipv4 | 38.229.70.4 | c77622176183414d318845f709591bc4117704f1c95f4 IP Addresses: 38.229.70.4 82.130.26.27 192.251.226.206 Domains Contacted: 7tno4hib47v |
| ipv4 | 82.130.26.27 | 414d318845f709591bc4117704f1c95f4 IP Addresses: 38.229.70.4 82.130.26.27 192.251.226.206 Domains Contacted: 7tno4hib47vlep5o.63ghdye |
| sha256 | 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370 | rch 2015 and the second dated April 2015. Their SHA256 are: 3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370 6c6f88ebd42e3ef5ca6c77622176183414d318845f709591bc4117704f1 |
| sha256 | 6c6f88ebd42e3ef5ca6c77622176183414d318845f709591bc4117704f1c95f4 | 1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370 6c6f88ebd42e3ef5ca6c77622176183414d318845f709591bc4117704f1c95f4 Both samples implement the following hashing algorithms: SH |
From the original article
8 min read at blog.talosintelligence.com
This post was authored by: Andrea Allievi , Earl Carter & Emmanuel Tacheau Update 4/28: Windows files recompiled with backward compatibility in Visual Studio 2008 Update 5/8: We've made the source code available via Github here
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.