SysAid IT Service Software 0-day Exploited to Deploy Cl0p Ransomware
Tags
Common Information
| Type | Value |
|---|---|
| UUID | 7833e983-3e66-463c-89c1-f772c4aa199d |
| Fingerprint | 8c230ff6c33785e9 |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | Nov. 10, 2023, 1:44 p.m. |
| Added to db | Nov. 10, 2023, 2:49 p.m. |
| Last updated | Nov. 18, 2024, 1:38 a.m. |
| Headline | UNKNOWN |
| Title | SysAid IT Service Software 0-day Exploited to Deploy Cl0p Ransomware |
| Detected Hints/Tags/Attributes | 36/1/14 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://gbhackers.com/sysaid-it-service-software-0-day/ |
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 125 | ✔ | GBHackers Security | #1 Globally Trusted Cyber Security News Platform | https://gbhackers.com/feed/ | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | File | 22 | user.exe |
|
| Details | File | 131 | spoolsv.exe |
|
| Details | File | 269 | msiexec.exe |
|
| Details | File | 1122 | svchost.exe |
|
| Details | File | 4 | meshagent.exe |
|
| Details | File | 7 | c:\program files\sysaidserver\tomcat\webapps\usersfiles\user.exe |
|
| Details | File | 1209 | powershell.exe |
|
| Details | sha256 | 9 | b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d |
|
| Details | sha256 | 3 | 2035a69bc847dbad3b169cc74eb43fc9e6a0b6e50f0bbad068722943a71a4cca |
|
| Details | IPv4 | 9 | 81.19.138.52 |
|
| Details | IPv4 | 9 | 45.182.189.100 |
|
| Details | IPv4 | 9 | 179.60.150.34 |
|
| Details | IPv4 | 8 | 45.155.37.105 |
|
| Details | Url | 6 | http://179.60.150.34:80/a |