Exploit / PoCcritical
Bitter APT adds Bangladesh to their targets
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
CVE-2018-0798+1 related CVE | Memory Corruption RCE in Microsoft Office Equation Editor (CVE-2018-0798) | 8.8 group max | 95% | KEV | KEV |
| CVE-2021-28310 | Out-of-Bounds Write in Microsoft Win32k Allows Local Privilege Escalation on Windows 10 | 7.8 | 8% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | autodefragapp.com | defragapp[.]com. Its WhoIs record indicates that the domain autodefragapp[.]com registered it in November 2020, and later updated it on N |
| domain | desto.gov.pk | il addresses from this campaign: cdrrab13bd@gmail[.]com arc@desto[.]gov[.]pk so.dc@pc[.]gov[.]pk mem_psd@pc[.]gov[.]pk chief_pia@pc[ |
| domain | helpdesk.autodefragapp.com | cture The actor's infrastructure consists of the C2 server (helpdesk[.]autodefragapp[.]com) and several domains that host the adversary's malware, |
| domain | levarisnetqlsvc.net | reat are 59736 and 300132. IOC Domains olmajhnservice[.]com levarisnetqlsvc[.]net urocakpmpanel[.]com tomcruefrshsvc[.]com autodefragapp[.] |
| domain | mswsceventlog.net | hs and the constants. The 99[.]83[.]154[.]118 IP also hosts mswsceventlog[.]net, according to Cisco Umbrella, a domain that was previousl |
| domain | olmajhnservice.com | in an encrypted format that connects to the malicious host olmajhnservice[.]com and downloads the payload from the URL hxxp[:]//olmajhnse |
| domain | pc.gov.pk | campaign: cdrrab13bd@gmail[.]com arc@desto[.]gov[.]pk so.dc@pc[.]gov[.]pk mem_psd@pc[.]gov[.]pk chief_pia@pc[.]gov[.]pk rab3tikat |
| domain | pof.gov.pk | ]pk chief_pia@pc[.]gov[.]pk rab3tikatuly@gmail[.]com ddscm2@pof[.]gov[.]pk The infection chain The infection chain begins with the |
| domain | tomcruefrshsvc.com | ajhnservice[.]com levarisnetqlsvc[.]net urocakpmpanel[.]com tomcruefrshsvc[.]com autodefragapp[.]com helpdesk[.]autodefragapp[.]com URLs h |
| domain | urocakpmpanel.com | 132. IOC Domains olmajhnservice[.]com levarisnetqlsvc[.]net urocakpmpanel[.]com tomcruefrshsvc[.]com autodefragapp[.]com helpdesk[.]autod |
| ipv4 | 99.83.154.118 | se this C2 in previous campaigns. The C2 domain resolved to 99[.]83[.]154[.]118 during the period of the campaign. This is a legitima |
| sha1 | 04a75df9b60290efb1a2d934570ad203a23f4e9c | 500c04acda5dc1cc4e 530f597666afc147886f5ad651b5071d0cc894ba 04a75df9b60290efb1a2d934570ad203a23f4e9c aeb02ac0c0f0793651f32a3c0f594ce79ba99e82 Documents b0b68797 |
| sha1 | 0cbf8c7ff9faf01a9b5c3874e9a9d49cbbf5037b | /]urocakpmpanel[.]com/nt[.]php SSL Certificates Thumbprints 0cbf8c7ff9faf01a9b5c3874e9a9d49cbbf5037b 25092b60d972e574ed593a468564de2394fa008b 4fbde39a0735d1ad75 |
| sha1 | 25092b60d972e574ed593a468564de2394fa008b | icates Thumbprints 0cbf8c7ff9faf01a9b5c3874e9a9d49cbbf5037b 25092b60d972e574ed593a468564de2394fa008b 4fbde39a0735d1ad757038072cf541dfdc65faa3 5a972665b590cc77dc |
| sha1 | 4fbde39a0735d1ad757038072cf541dfdc65faa3 | 74e9a9d49cbbf5037b 25092b60d972e574ed593a468564de2394fa008b 4fbde39a0735d1ad757038072cf541dfdc65faa3 5a972665b590cc77dcdfb4500c04acda5dc1cc4e 530f597666afc14788 |
| sha1 | 530f597666afc147886f5ad651b5071d0cc894ba | 072cf541dfdc65faa3 5a972665b590cc77dcdfb4500c04acda5dc1cc4e 530f597666afc147886f5ad651b5071d0cc894ba 04a75df9b60290efb1a2d934570ad203a23f4e9c aeb02ac0c0f0793651 |
| sha1 | 5a972665b590cc77dcdfb4500c04acda5dc1cc4e | 468564de2394fa008b 4fbde39a0735d1ad757038072cf541dfdc65faa3 5a972665b590cc77dcdfb4500c04acda5dc1cc4e 530f597666afc147886f5ad651b5071d0cc894ba 04a75df9b60290efb1 |
| sha1 | aeb02ac0c0f0793651f32a3c0f594ce79ba99e82 | d651b5071d0cc894ba 04a75df9b60290efb1a2d934570ad203a23f4e9c aeb02ac0c0f0793651f32a3c0f594ce79ba99e82 Documents b0b687977eee41ee7c3ed0d9d179e8c00181f0c0db64eebc0 |
| sha256 | 3fdf291e39e93305ebc9df19ba480ebd60845053b0b606a620bf482d0f09f4d3 | 2faa3da831976fee90860ac39d50484b20bee692ce7f0ec35a15670fa92 3fdf291e39e93305ebc9df19ba480ebd60845053b0b606a620bf482d0f09f4d3 69b397400043ec7036e23c225d8d562fdcd3be887f0d076b93f6fcaae8f |
| sha256 | 490e9582b00e2622e56447f76de4c038ae0b658a022e6bc44f9eb0ddf0720de6 | eec6d1869498f2fca8f989125326b2d8cee8dcacf3bc9315ae7566963db 490e9582b00e2622e56447f76de4c038ae0b658a022e6bc44f9eb0ddf0720de6 b7765ff16309baacff3b19d1a1a5dd7850a1640392f64f19353e8a608b5 |
| sha256 | 69b397400043ec7036e23c225d8d562fdcd3be887f0d076b93f6fcaae8f3dd61 | 91e39e93305ebc9df19ba480ebd60845053b0b606a620bf482d0f09f4d3 69b397400043ec7036e23c225d8d562fdcd3be887f0d076b93f6fcaae8f3dd61 90fd32f8f7b494331ab1429712b1735c3d864c8c8a2461a5ab67b050238 |
| sha256 | 90fd32f8f7b494331ab1429712b1735c3d864c8c8a2461a5ab67b05023821787 | 7400043ec7036e23c225d8d562fdcd3be887f0d076b93f6fcaae8f3dd61 90fd32f8f7b494331ab1429712b1735c3d864c8c8a2461a5ab67b05023821787 |
| sha256 | b0b687977eee41ee7c3ed0d9d179e8c00181f0c0db64eebc0005a5c6325e8a82 | a23f4e9c aeb02ac0c0f0793651f32a3c0f594ce79ba99e82 Documents b0b687977eee41ee7c3ed0d9d179e8c00181f0c0db64eebc0005a5c6325e8a82 f7ed5eec6d1869498f2fca8f989125326b2d8cee8dcacf3bc9315ae7566 |
| sha256 | b7765ff16309baacff3b19d1a1a5dd7850a1640392f64f19353e8a608b5a28c5 | 582b00e2622e56447f76de4c038ae0b658a022e6bc44f9eb0ddf0720de6 b7765ff16309baacff3b19d1a1a5dd7850a1640392f64f19353e8a608b5a28c5 ce922a20a73182c18101dae7e5acfc240deb43c1007709c20ea74c1dd35 |
| sha256 | ce922a20a73182c18101dae7e5acfc240deb43c1007709c20ea74c1dd35d2b12 | ff16309baacff3b19d1a1a5dd7850a1640392f64f19353e8a608b5a28c5 ce922a20a73182c18101dae7e5acfc240deb43c1007709c20ea74c1dd35d2b12 e4545764e0c54ed1e1321a038fa2c1921b5b70a591c95b24127f1b9de72 |
| sha256 | e4545764e0c54ed1e1321a038fa2c1921b5b70a591c95b24127f1b9de7212af8 | a20a73182c18101dae7e5acfc240deb43c1007709c20ea74c1dd35d2b12 e4545764e0c54ed1e1321a038fa2c1921b5b70a591c95b24127f1b9de7212af8 Payload fa0ed2faa3da831976fee90860ac39d50484b20bee692ce7f0e |
| sha256 | f7ed5eec6d1869498f2fca8f989125326b2d8cee8dcacf3bc9315ae7566963db | 7977eee41ee7c3ed0d9d179e8c00181f0c0db64eebc0005a5c6325e8a82 f7ed5eec6d1869498f2fca8f989125326b2d8cee8dcacf3bc9315ae7566963db 490e9582b00e2622e56447f76de4c038ae0b658a022e6bc44f9eb0ddf07 |
| sha256 | fa0ed2faa3da831976fee90860ac39d50484b20bee692ce7f0ec35a15670fa92 | ed1e1321a038fa2c1921b5b70a591c95b24127f1b9de7212af8 Payload fa0ed2faa3da831976fee90860ac39d50484b20bee692ce7f0ec35a15670fa92 3fdf291e39e93305ebc9df19ba480ebd60845053b0b606a620bf482d0f0 |
| url | http://olmajhnservice./nxl/nx | olmajhnservice[.]com and downloads the payload from the URL hxxp[:]//olmajhnservice[.]/nxl/nx. The payload is downloaded in the folder "C:\$Utf" crea |
From the original article
11 min read at blog.talosintelligence.com
Cisco Talos has observed an ongoing malicious campaign since August 2021 from the Bitter APT group that appears to target users in Bangladesh, a change from the attackers' usual victims. As part of this, there's a new trojan based on Apost Talos is calling "ZxxZ," that, among other features, includes remote file execution capability.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.