Discord Server Red Security Twitter Donation to Red Security Red Security Youtube Channel Red Security Tumblr Profile
Windscribe
Login or Register to Hide ads and Accessing all features on the forum
Thread Rating:
  • 7 Vote(s) - 2.86 Average
  • 1
  • 2
  • 3
  • 4
  • 5
News Hackers Abusing Windows Management Interface Command Tool
#1
In The Name OF Allah
Al-Salam Alelkum

[Image: New-Project.jpg]

Quote:Attackers use to deliver a shortcut file (.lnk) through URL or link in email or as an attachment, once the user opens the file contains a WMIC command, it downloads the malicious file from the attacker’s remote server. The file downloaded from the remote server is the malicious XSL(eXtensible Stylesheet Language) file and the malicious XSL contains the javascript which is executed using another legitimate application mshta[.]exe used in running Microsoft HTML Application Host.
Researchers said the JavaScript contains a list of 52 domains and it chooses a random URL as well as the random port between 25010-25099 to download the HTA file.
https://gbhackers.com/hackers-abusing-wi...words/amp/


Wa Salam Alekum
Rs
* Thankful to Allah *
Kurdy
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
Star News ASUS TM-AC1900 Arbitrary Command Execution - CXSecurity.com News 0 420 11-14-2020, 04:40 AM
Last Post: News
Star News Update Windows 10 to patch critical vulnerability in Microsoft store games News 0 375 11-06-2020, 04:22 AM
Last Post: News
Star News Google Project Zero Discloses Nasty Windows 0-Day Security Exploit Already In The Wi News 0 414 11-01-2020, 06:12 AM
Last Post: News
Star News Top tip, everyone: Chinese hackers are hitting these 25 vulns, so make sure you patc News 0 443 10-21-2020, 11:27 AM
Last Post: News
Star News US Warns: Hackers Chaining Zerologon, Other Vulnerabilities News 0 422 10-11-2020, 01:15 PM
Last Post: News
Star News Homeland Security Issues Urgent Windows Security Warning Over Zerologon Exploit News 0 436 09-21-2020, 09:26 AM
Last Post: News
Exclamation News Windows SMB Protocol Bug Let Hackers Leak Kernel Memory & Execute a Code Remotely Mr.Kurd 0 729 06-12-2020, 08:24 AM
Last Post: Mr.Kurd
Exclamation News $100,000 Bounty Apple Zero-day Bug in “Sign in with Apple” Let Hackers Take Takeover Mr.Kurd 0 712 06-01-2020, 07:42 AM
Last Post: Mr.Kurd
Star News Hackers Are Bundling Cryptominer With a Seemingly Legit Zoom Installer on Unofficial Mr.Kurd 0 724 04-08-2020, 08:43 AM
Last Post: Mr.Kurd
Question News Windows Running MS-SQL Servers Under Attack!! Hackers Installing 10 Secret Backdoors Mr.Kurd 0 671 04-02-2020, 08:38 AM
Last Post: Mr.Kurd



Users browsing this thread: 1 Guest(s)