Threat Outbreak Alert RuleID7930KVR: Email Messages Distributing Malicious Software on July 14, 2016

Medium Alert ID: 42087 First Published: 2015 November 16 14:25 GMT Last Updated: 2016 July 19 12:31 GMT Version: 56 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID7930 an...

Threat Outbreak Alert RuleID4961: Email Messages Distributing Malicious Software on July 6, 2016

Medium Alert ID: 41886 First Published: 2015 November 2 13:41 GMT Last Updated: 2016 July 6 19:09 GMT Version: 50 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID4961 and...

PE Static Malware Analysis: PortEx

PortEx is a Java library for static malware analysis of portable executable files. Its focus is on PE malformation robustness and anomaly detection. PortEx is written in Java and Scala, and targeted at Java applications. Features Reading Header information from: MSDOS Header, COFF File Header,...

Threat Outbreak Alert RuleID18013: Email Messages Distributing Malicious Software on September 16, 2015

Medium Alert ID: 41031 First Published: 2015 September 16 13:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18013 may contain the following files: Name ...

MS15-100 Microsoft Windows Media Center MCL Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS15-100 Microsoft Windows Media Center MCL Vulnerability", 'Description' = %q This module exploits a vulnerability in Windows Media...

Threat Outbreak Alert RuleID17916: Email Messages Distributing Malicious Software on September 11, 2015

Medium Alert ID: 40951 First Published: 2015 September 11 14:10 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17916 may contain the following files: Name ...

Microsoft Windows HTA (HTML Application) - Remote Code Execution Exploit

Microsoft Windows HTA HTML Application remote code execution exploit that leverages MS14-064. !/usr/bin/php poc'."\n\n"; $reza = socketcreateAFINET, SOCKSTREAM, 0 or die'Failed to create socket!'; socketbind$reza, 0,$port; socketlisten$...

Heroes Of Might And Magic III .h3m Map File Buffer Overflow Exploit

This Metasploit module embeds an exploit into an uncompressed map file .h3m for Heroes of Might and Magic III. Once the map is started in-game, a buffer overflow occurring when loading object sprite names leads to shellcode execution. This module requires Metasploit: http://metasploit.com/downloa...

Threat Outbreak Alert RuleID17006: Email Messages Distributing Malicious Software on July 28, 2015

Medium Alert ID: 40191 First Published: 2015 July 29 14:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17006 may contain the following files: Name | Siz...

Internet Download Manager - OLE Automation Array Remote Code Execution Exploit

Exploit for windows platform in category remote exploits !/usr/bin/php Run Site Grabber 4 . Enter any word "Start page/address" 5 . Click Addvance 6 . check "Enter Login and password manually at the following web page" 7 . Enter your exploit link http://ipaddress:80/ 8 . Next -- Next -- Next --...

Internet Download Manager - OLE Automation Array Remote Code Execution

Internet Download Manager - OLE Automation Array Remote Code Execution !/usr/bin/php Run Site Grabber 4 . Enter any word "Start page/address" 5 . Click Addvance 6 . check "Enter Login and password manually at the following web page" 7 . Enter your exploit link http://ipaddress:80/ 8 . Next -- Nex...

Impero Education Pro Remote Command Execution

/ If you're unsure what Impero is, it's essentially a corporate/educational RAT. Vendor site: https://www.imperosoftware.co.uk/ They recently were in the news about how they implemented "anti-radicalisation" shit or something. They had a booth at BETT back in January. They gave out donuts. Those...

Threat Outbreak Alert RuleID16617: Email Messages Distributing Malicious Software on July 13, 2015

Medium Alert ID: 39895 First Published: 2015 July 13 17:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID16617 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID15857: Email Messages Distributing Malicious Software on June 10, 2015

Medium Alert ID: 39290 First Published: 2015 June 10 13:34 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15857 may contain the following files: Name | Siz...

Wavelink Emulation ConnectPro TermProxy Remote Code Execution Vulnerability

Wavelink Emulation ConnectPro TermProxy is a product from Wavelink that provides a stable connection environment for Wavelink Terminal Emulation TE, Terminal Emulation. A remote code execution vulnerability exists in Wavelink Emulation ConnectPro TermProxy, which stems from the program failing to...

Microsoft Windows - Local Privilege Escalation (MS15-051)

Source: https://github.com/hfiref0x/CVE-2015-1701 Win32k LPE vulnerability used in APT attack Original info: https://www.fireeye.com/blog/threat-research/2015/04/probableapt28useo.html Credits R136a1 / hfiref0x Compiled EXE: x86 +...

Threat Outbreak Alert RuleID14673: Email Messages Distributing Malicious Software on April 15, 2015

Medium Alert ID: 38375 First Published: 2015 April 15 13:41 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14673 may contain the following files: Name | Si...

Threat Outbreak Alert RuleID14325: Email Messages Distributing Malicious Software on March 29, 2015

Medium Alert ID: 38096 First Published: 2015 March 30 13:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID14325 may contain the following files: Name | Si...

RM-Downloader-2.7.5.400

Exploit Title: RM Downloader v2.7.5.400 Local Buffer Overflow + Date: 25-03-2015 + Type: Local Exploits + Tested on: WinXp/Windows 7 Pro + Vendor: http://software-files-a.cnet.com/s/software/10/65/60/49/Mini-streamRM-MP3Converter.exe?token=142731898198f71d0e10e2e3bd2e730179341feb0a + Friendly...

Threat Outbreak Alert RuleID13894: Email Messages Distributing Malicious Software on March 11, 2015

Medium Alert ID: 37801 First Published: 2015 March 11 13:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID13894KVR may contain the following files: Name |...