Menu > Articles de la revue de presse : - l'ensemble [tous | francophone] - par mots clé [tous] - par site [tous] - le tagwall [voir] - Top bi-hebdo de la revue de presse [Voir]

---

S'abonner au fil RSS global de la revue de presse

---

Présentation : Yesterday, we blogged about a malvertising campaign affecting a popular Indonesian news site and leading to the Nuclear Exploit Kit. Today we came across another compromised website that leads to the Nuclear Exploit Kit, but this time we received two malware payloads after the newest Adobe Flash Player vulnerability was exploited. It is worth noting that no user interaction was required at any point--simply visiting the compromised website was enough to end up with malware being executed on our machine. Raytheon Websense customers are protected against this threat via real-time analytics in ACE, the Websense Advanced Classification Engine. Compromised Website ------------------- While reviewing interesting hits on security-related events today, we noticed a website named thisblewmymind . com. The website claims to be viral media for the brain, which may be somewhat true since the site drops viruses on your computer. Google does identify the site as likely compromised According to SimilarWeb, this site is actually quite popular, recently receiving almost 2 million users per month Unfortunately for people browsing to this site, it is injected with obfuscated JavaScript that ends up leading to the Nuclear Exploit Kit and dropping malware. Flash Player Exploit -------------------- The infection chain we saw resulted in Adobe Flash Player version 19.0.0.207 being exploited by the Nuclear Exploit Kit to drop malware. This means that the exploit is likely to be the newest Flash exploit, leveraging CVE-2015-7645, which was recently known to have been incorporated into the Nuclear and Angler exploit kits. In fact, the Nuclear Exploit Kit seems to be packaging up two different Flash Player exploits inside one parent SWF file VirusTotal , and dynamically choosing which one to load, depending on the current Flash Player version. If it detects version 18.0.0.203 or below, an exploit leveraging CVE-2015-5122 is used. Otherwise, the new exploit is chosen We successfully managed to unpack the new SWF exploit, and found that it had been on VirusTotal since 31 October. Malware Payloads ---------------- It's not typical to see more than one payload dropped by an exploit kit, but in this instance both Gamarue and CryptoWall 3.0 were dropped and executed via the Flash Player exploit. Gamarue is modular, plug-in based malware belonging to the Andromeda botnet. Its main intent is usually for credential theft. CryptoWall 3.0 is crypto ransomware that encrypts your files and demands payment in BitCoin to have them decrypted Indicators of Compromise ------------------------ Below are some indicators of compromise from the threat described in this blog hxxp thisblewmymind . com - Compromised website hxxp cdn . goroda235 . pw - Malicious redirect hxxp zadnicaberezu . tk - Nuclear Exploit Kit 2ed1953d2b182a0319041e73f6489d4151475dff - Nuclear EK SWF 36356533f44d6107d49662c78a56149e2f359fcc - Nuclear EK SWF unpacked 3d5682ac799cace0325ca5437445fd3c163ee4ff - Gamarue 9d3cc04dc97d0791565cf69778ee864f8af5d7f7 - CryptoWall 3.0 Summary ------- The Nuclear Exploit Kit operators seem to be looking to maximize their profits by dropping multiple pieces of malware onto machines, capitalizing on the new Adobe Flash Player exploit and compromising popular sites in order to infect as many users as possible. As always, it is important to ensure that your software is up to date, especially your browser and associated plug-ins like Adobe Flash Player.

Les mots clés de la revue de presse pour cet article : flash exploit payload
Les videos sur SecuObs pour les mots clés : flash exploit payload
Les mots clés pour les articles publiés sur SecuObs : exploit
Les éléments de la revue Twitter pour les mots clé : flash exploit payload





Les derniers articles du site "Security Labs" :

- Dridex Down Under
- Newest Flash Player Exploit Double Nuclear Exploit Kit Payload
- Popular Indonesian Tech News Site Serves Up a Side of Malware
- The iPhone 6S 1 Facebook UK Scam
- Japanese Banking Trojan Shifu Distributed via Malicious Word Documents
- Infrastructure Re-use Shared Frameworks and Attack Vectors
- RaytheonWebsense attend the 2015 EUROPOL - INTERPOL Cybercrime Conference in The Hague
- Virus Bulletin 2015 - RaytheonWebsense Security Labs Are Participating
- Healthcare Industry Sees 340pourcents More Security Incidents Than Other Industries
- Typo-squatting Fast Turnaround for Fast Money

---

S'abonner au fil RSS global de la revue de presse

---