Discord Server Red Security Twitter Donation to Red Security Red Security Youtube Channel Red Security Tumblr Profile
Login or Register to Hide ads and Accessing all features on the forum

News 

Hackers Abusing Windows Management Interface Command Tool

0 Replies, 1572 Views

In The Name OF Allah
Al-Salam Alelkum

[Image: New-Project.jpg]

Quote:Attackers use to deliver a shortcut file (.lnk) through URL or link in email or as an attachment, once the user opens the file contains a WMIC command, it downloads the malicious file from the attacker’s remote server. The file downloaded from the remote server is the malicious XSL(eXtensible Stylesheet Language) file and the malicious XSL contains the javascript which is executed using another legitimate application mshta[.]exe used in running Microsoft HTML Application Host.
Researchers said the JavaScript contains a list of 52 domains and it chooses a random URL as well as the random port between 25010-25099 to download the HTA file.
https://gbhackers.com/hackers-abusing-wi...words/amp/


Wa Salam Alekum
Rs
* Thankful to Allah *
Kurdy
(This post was last modified: 09-03-2018, 07:24 AM by Mr.Kurd.)

Possibly Related Threads…
Thread Author Replies Views Last Post
Star News ASUS TM-AC1900 Arbitrary Command Execution - CXSecurity.com News 0 1,707 11-14-2020, 04:40 AM
Last Post: News
Star News Update Windows 10 to patch critical vulnerability in Microsoft store games News 0 1,665 11-06-2020, 04:22 AM
Last Post: News
Star News Google Project Zero Discloses Nasty Windows 0-Day Security Exploit Already In The Wi News 0 1,723 11-01-2020, 06:12 AM
Last Post: News
Star News Top tip, everyone: Chinese hackers are hitting these 25 vulns, so make sure you patc News 0 1,801 10-21-2020, 11:27 AM
Last Post: News
Star News US Warns: Hackers Chaining Zerologon, Other Vulnerabilities News 0 1,849 10-11-2020, 01:15 PM
Last Post: News
Star News Homeland Security Issues Urgent Windows Security Warning Over Zerologon Exploit News 0 1,570 09-21-2020, 09:26 AM
Last Post: News
Exclamation News Windows SMB Protocol Bug Let Hackers Leak Kernel Memory & Execute a Code Remotely Mr.Kurd 0 1,687 06-12-2020, 08:24 AM
Last Post: Mr.Kurd
Exclamation News $100,000 Bounty Apple Zero-day Bug in “Sign in with Apple” Let Hackers Take Takeover Mr.Kurd 0 1,735 06-01-2020, 07:42 AM
Last Post: Mr.Kurd
Star News Hackers Are Bundling Cryptominer With a Seemingly Legit Zoom Installer on Unofficial Mr.Kurd 0 1,942 04-08-2020, 08:43 AM
Last Post: Mr.Kurd
Question News Windows Running MS-SQL Servers Under Attack!! Hackers Installing 10 Secret Backdoors Mr.Kurd 0 1,526 04-02-2020, 08:38 AM
Last Post: Mr.Kurd



Users browsing this thread: 1 Guest(s)