Vulnerabilitymedium
Evilgrab Delivered by Watering Hole Attack on President of Myanmar’s Website
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-6332 | Remote Code Execution via Array Bounds Flaw in Microsoft Windows OLE Automation | — | 95% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gnway.cc | ]com:81 (211.169.202.2) C2 : ns.websecexp[.]com C2 : appeur.gnway[.]cc Mutex: 2010-3 Mutex : New2010-V3-Uninstall This Evilgrab |
| domain | mailpseonfz.com | d using a service to hide the registrant information: ceshi.mailpseonfz[.]com dns.mailpseonfz[.]com Unit 42 is aware of the ceshi.mailp |
| domain | tiger1234.com | a1e4a0b0b58fcb1dc6d2016422a35cb3111168fd3fae577 C2 : mmslsh.tiger1234[.]com This suggests threat actors, who may or may not be the sa |
| domain | websecexp.com | 1b1bdc1010a0564c8780ba55c87c Compiled : 2015-04-30 C2 : dns.websecexp[.]com:81 (211.169.202.2) C2 : ns.websecexp[.]com C2 : appeur.gn |
| ipv4 | 211.169.202.2 | ba55c87c Compiled : 2015-04-30 C2 : dns.websecexp[.]com:81 (211.169.202.2) C2 : ns.websecexp[.]com C2 : appeur.gnway[.]cc Mutex: 2010 |
| ipv4 | 59.188.16.130 | espionage campaigns. This domain resolved to the IP address 59.188.16[.]130 as far back as December 2013, which also hosted the follo |
| md5 | 2e78e6d02aaed4f057f4dfa631ea5519 | has the following attributes: Filename : newdata.exe MD5 : 2e78e6d02aaed4f057f4dfa631ea5519 SHA256: 10d9611e5b4ff41fc79e8907e3eb522630131b1bdc1010a0564 |
| sha256 | 10d9611e5b4ff41fc79e8907e3eb522630131b1bdc1010a0564c8780ba55c87c | newdata.exe MD5 : 2e78e6d02aaed4f057f4dfa631ea5519 SHA256: 10d9611e5b4ff41fc79e8907e3eb522630131b1bdc1010a0564c8780ba55c87c Compiled : 2015-04-30 C2 : dns.websecexp[.]com:81 (211.169. |
| sha256 | b69106e06dc008e4fa1e4a0b0b58fcb1dc6d2016422a35cb3111168fd3fae577 | ownloader Trojan had the following characteristics: SHA256 :b69106e06dc008e4fa1e4a0b0b58fcb1dc6d2016422a35cb3111168fd3fae577 C2 : mmslsh.tiger1234[.]com This suggests threat actors, wh |
From the original article
13 min read at unit42.paloaltonetworks.comOn May 12, 2015, Unit 42 observed an apparent watering hole attack, also known as a strategic website compromise (SWC), involving the President of Myanmar's website. Visiting the main page hosted at "www. president-office.
By Robert Falcone · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.