HackerSecret.com - The Most Authoritative Site in the World on the Hacking Tools and Techniques, Penetration Testing and CyberSecurity

  • Home
  • Visit Our Shop
  • Download the free App
  • Contact us for Info
VISIT OUR SHOP! CLICK HERE !

CVE-2018-15982 (Flash Player up to 31.0.0.153) and Exploit Kits

by / Saturday, 06 March 2021 / Published in Hacking
Share
Tweet
Pin
0 Shares

The CVE-2018-15982 is a bug that allows remote code execution in Flash Player up to 31.0.0.153, spotted in the wild as a 0day. Patched on December 05, 2018 with APSB18-42.

Underminer:

Underminer exploit kit improves in its latest iteration – 2018-12-21 – Malwarebytes

Fallout:

2019-01-16

Fallout_CVE-2018-15982

Figure 4: Fallout exploiting CVE-2018-15982 on Windows 7 – 2019-01-16

Files: Fiddler on VT – Pcap on VT

Associated Advert underground:

Итак! Тяжкие работы по восстановлению всей инфраструктуры связки закончены, были проведены тесты и в данный момент связка работает в полном объеме. Также были произведены множество правок и изменений.

Изменения:

  1. Увеличена производительность
  2. Полностью переработан механизм обфускации кода и генерации лэндинга.
  3. Убран CVE-2018-8373 на переработку. В данный момент сплоит ведет себя не стабильно.
  4. Добавлен новый флеш сплоит CVE-2018-15982.
  5. Для запуска повершелл в шеллкод добавлен код отключения AMSI
  6. Кучка мелких правок

ИЗМЕНЕНА ЦЕНОВАЯ ПОЛИТИКА Неделя 400$ Месяц 1300$

В данный момент при проверке отстука софта со связки было выявлено:

  1. Отстук EXE на уровне 80-90%
  2. Отстук PowerShell на уровне 95-100%

Translated by google as:

So! The hard work on the restoration of the entire infrastructure of the bundle was completed, tests were carried out and at the moment the bundle is working in full. There have also been many edits and changes.

Changes:

  1. Increased performance
  2. The code obfuscation and landing generation mechanism has been completely redesigned.
  3. Removed CVE-2018-8373 for recycling. At the moment, the flow rate is not stable.
  4. Added new flash sploit CVE-2018-15982.
  5. To launch Powershell, the disable code AMSI is added to the shellcode
  6. A bunch of minor edits

CHANGED PRICE POLICY Week 400 $ Month $ 1300

At the moment, when checking the otstuk software from the bundle, it was revealed:

  1. Otstuk EXE level 80-90%
  2. Otstuk PowerShell at the level of 95-100%
IOC Type Comment Date
payformyattention[.]site|51.15.35[.]154 domain|IP Fallout EK 2019-01-16
whereismyteam[.]press|51.15.111[.]159 domain|IP Fallout EK 2019-01-16
bd31d8f5f7d0f68222517afc54f85da9d305e63a2ff639c6c535e082de13dede SHA-256 GandCrab Ransomware 2019-01-16

Spelevo:

2019-03-06 Appears to be a new Exploit Kit which has some similarities with “SPL EK”. (CVE-2018-8174 has been spotted there as well)

Spelevo_CVE-2018-15982

Figure 4: Spelevo exploiting CVE-2018-15982 on Windows 7 – 2019-03-07

Acknowledgement:

Thanks to Chaoying Liu for CVE confirmation.

Files: Fiddler on VT – Pcap on VT (note: Some proxy were used)

IOC Type Comment Date
letsdoitquick[.]site|194.113.107.71 domain|IP Redirector (Keitaro TDS) 2019-03-07
index.microsoft-ticket[.]xyz|85.17.197[.]101 domain|IP Spelevo EK 2019-03-06
blasian.bestseedtodo[.]xyz|85.17.197[.]101 domain|IP Spelevo EK 2019-03-06
flashticket[.]xyz|85.17.197[.]101 domain|IP Spelevo EK 2019-03-06
read.updateversionswf[.]xyz|85.17.197[.]101 domain|IP Spelevo EK 2019-03-07
9aa8e341cc895350addaf268b21f7a716f6d7993575fdba67a3fe7a9e23b8f90 SHA-256 Gootkit “1999” 2019-03-07
2feba3cc47b7f1d47a9e1277c4f4ad5aa5126e59798ac096459d1eae8f573c35 SHA-256 Gootkit “3012” (2nd Stage) 2019-03-07
ws.blueberryconstruction[.]it|185.158.250[.]163 domain|IP Gootkit C2 2019-03-07
ws.diminishedvaluevirginia[.]com|185.158.251[.]115 domain|IP Gootkit C2 2019-03-07
gttopr[.]space|198.251.83[.]27 domain|IP Gootkit C2 2019-03-07

GreenFlash Sundown:

19.03.26 #Malvertising -> #GreenFlashSundown EK-> #SeonRansomware ver 0.2 & #pony & #miner using CVE-2018-15982 – 2019-04-05 – @vigilantbeluga

Shadowgate Returns to Worldwide Operations With Evolved Greenflash Sundown Exploit Kit – 2019-06-27 – Trendmicro

Read More:

Adobe Flash Zero-Day Exploited In the Wild – 2018-12-05 – Gigamon

Underminer exploit kit improves in its latest iteration – 2018-12-21 – Malwarebytes

MDNC | Malware don’t need Coffee

Share
Tweet
Pin
0 Shares
Tagged under: 31.0.0.153, CVE201815982, Exploit, Flash, Kits, Player

Click here now to visit our Shop!

Click here now to visit our Shop!

Other 2300 users like you have already done it this year!

Choose the product you need here!

  • THE FIRST TRUE ANDROID SMARTPHONE FOR HACKING WITHOUT ROOT UNIQUE IN THE WORLD WITH ALL THE APPS !!! 499,99€ 249,99€
  • HACKER LIBRARY THE LARGEST COLLECTION OF BOOKS AND MANUALS ON HACKING + 100 !!! 99,99€ 49,99€
  • HACK SOCIAL THE GUIDE TO HACK ALL THE SOCIAL ACCOUNTS 99,99€ 49,99€
  • HACKER PACK FOR YOUR SMARTPHONE AND YOUR TABLET WITH ROOT GUIDE AND + 100 PROGRAMS !!! 99,99€ 49,99€
  • THE FIRST TRUE ANDROID SMARTPHONE FOR HACKING UNIQUE IN THE WORLD WITH ALL THE APPS !!! 599,99€ 299,99€
  • HACKER PACK FOR YOUR COMPUTER AND NOTEBOOK + 1000 PROGRAMS 5 GB OF STUFF !!! 99,99€ 49,99€

Our customers say

Annabel M. – Systems Engineer

 
Samuel D. – Ethical Hacker

 
Karola M. – Influencer

 
Marcus P. – Private Investigator

 
Rosemary S. – Housewife

 
Amit V. – IT Consultant

 
Matthew C. – Entrepreneur

 
Aisha B. – Computer Science student

 
Li W. – IT Analyst

 
Robert C. – Programmer

 

DOWNLOADED 1316 TIMES!

DOWNLOADED 1316 TIMES!

Download now Hacker Secret our free Android app.

CONTACT US NOW FOR IMMEDIATE SUPPORT!

Contact Us
Write your email address here
Write here how we can help you - we support you immediately for all your needs!

## Are you looking for products for hacking, computer security and penetration testing? Do you need to clean up your smartphone, your PC or your site from viruses and malware? Do you need to track down someone or retrieve urgent information? Do you want to buy devices already configured to experiment all the hacking techniques quickly and easily? Do you have special needs in software or hardware? ##

Contact us now … another 2300 users like you have already done it this year!

Click here now!

 

Search on the site

Latest posts

  • Veracode CEO on the Relationship Between Security and Business Functions: Security Can’t Be Effective in a Silo

  • Half a million stolen French medical records, drowned in feeble excuses

  • Google looks at bypass in Chromium’s ASLR security defense, throws hands up, won’t patch garbage issue

  • Announcing Veracode in AWS Marketplace: Streamlining Secure Software Development for AWS Customers

  • Imperva pretty adamant that security analytics aggregator product Sonar is not ‘one dashboard to rule them all’

All the techniques, products and services described or contained on this site are intendend for exclusive use of study and professional training and to test the security of own's computer network in accordance with the national legislations on access to computer and online systems. All the services provided on this site (penetration testing, social accounts hardening, Incident Response & CSIRT, MSSP, Cybersecurity Consultancy, etc.) can be provided only with prior written and documented authorization from the owners or their legitimate representatives in accordance with current national regulations .

TOP