Threat Intelligence Report
October 14-20, 2019
Trends
• The top attacker country was China with 3102 unique attackers (31.30%)
• The top Exploit event was Application with 39% of occurrences.
• The top Trojan C&C server detected was Trickbot with 36 instances detected.
Top Attacker by Country
Country Occurrences Percentage
China 3102 31.30%
United States 1725 17.41%
India 672 6.78%
Russian Federation 580 5.85%
Brazil 467 4.71%
Korea 449 4.53%
Vietnam 411 4.15%
France 363 3.66%
Indonesia 297 3.00%
United Kingdom 280 2.83%
Taiwan 237 2.39%
Canada 196 1.98%
Turkey 179 1.81%
Thailand 174 1.76%
Venezuela 160 1.61%
Ukraine 160 1.61%
Italy 157 1.58%
Germany 151 1.52%
Hong Kong 149 1.50%
Threat Geo-location
Top Attacking Hosts
Host Occurrences
[Link] 76
[Link] 26
[Link] 8
[Link] 6
Top Network Attackers
Origin AS Announcement Description
AS14061 [Link]/23 ServerStack Inc.
AS4837 [Link]/13 China Unicom Jiangsu Province Network
AS198093 [Link]/24 Foreningen for digitala fri- och rattigheter
AS63949 [Link]/19 Linode, LLC
Top Event NIDS and Exploits
Top Alarms
Type of Alarm Occurrences
DatabaseAttack - Stored Procedure Access —Attack 81
Bruteforce Authentication 43
Network Anomaly 2
Comparison from last week
Type of Alarm Occurrences
Bruteforce Authentication 808687
Intrusion Detection 33223
Network Anomaly 1721987
Remote Access Trojan C&C Servers Found
Name Number Discovered Location
AgentTesla 1 [Link]
AlphaStealer 1 [Link]
Azorult 2 [Link], [Link]
Heodo 13 [Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link]
keitaro 1 [Link]
Kpot 1 [Link]
LokiBot 2 [Link] , [Link]
PredatorTheThief 1 [Link]
Name Number Discovered Location
TrickBot 36 [Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link],
[Link], [Link]
Common Malware
Malware Type MD5 Typical Filename
8c80dd
[Link] 97c375
ryLdrA:Trojan. 25927c
[Link]
1e549c
22k2.1201
b59bcb
f3
4a5078
W32.7ACF 0ddb3d
b16eba [Link]
71AFA8-95. b57b0c
[Link] a42da0
fb
799b30
[Link]: f47060
Gen.22fz. ca05d8 [Link]
0ece53
1201
866e01
cc
e2ea31
5d9a83 c3e530cc005583b
[Link] 47322b6649ddc0d
e75770
WDCR:Gen. ab1b64bcf22b124a
21gn.1201 53f52c
974f6a
492606763c52fb04
[Link]
5a
db69ea
W32.46B2 aea4d4
41E3D3-95. 9703f1 [Link]
[Link] 61c81e
6fdd03
6f
CVEs For Which Public Exploits Have Been Detected
ID: CVE-2019-1346
Title: Microsoft Windows Denial of Service Vulnerability
Vendor: Microsoft
Description: The Microsoft Windows kernel suffers from an out-of-bounds read vulnerability in
CI!HashKComputeFirstPageHash while parsing a malformed PE file. An attacker who
successfully exploited the vulnerability could cause a target system to stop responding.
Note: This CVE ID is unique from CVE-2019-1343, CVE-2019-1347.
CVSS v2 Base Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
ID: CVE-2019-1343
Title: Microsoft Windows Denial of Service Vulnerability
Vendor: Microsoft
Description: The Microsoft Windows kernel suffers from a null pointer dereference
vulnerability in nt!MiOffsetToProtos while parsing a malformed PE file. A denial of service
vulnerability exists when Windows improperly handles objects in memory.
Note: This CVE ID is unique from CVE-2019-1346, CVE-2019-1347.
CVSS v2 Base Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
ID: CVE-2019-17503, CVE-2019-17504
Title: Kirona-DRS Information Disclosure Vulnerability
Vendor: Kirona
Description: An information disclosure vulnerability exists in Kirona Dynamic Resource
Scheduling (DRS). An unauthenticated user can access /osm/[Link] (aka
/osm_tiles/[Link]) directly that contains sensitive information about the database
through the SQL queries within this batch file. This file exposes SQL database information
such as database version, table name, column name, etc.
CVSS v2 Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
ID: CVE-2019-11932
Title: Whatsapp Remote Code Execution Vulnerability
Vendor: Whatsapp
Description: A double free vulnerability in the DDGifSlurp function in decoding.c in
libpl_droidsonroids_gif, as used in WhatsApp for Android, allows remote attackers to execute
arbitrary code or cause a denial of service.
CVSS v2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
ID: CVE-2019-11932
Title: sudo Security Bypass Vulnerability
Vendor: Multi-Vendor
Description: When sudo is configured to allow a user to run commands as an arbitrary user via
the ALL keyword in a Runas specification, it is possible to run commands as root by specifying
the user ID -1 or 4294967295. This can be used by a user with sufficient sudo privileges to run
commands as root even if the Runas specification explicitly disallows root access as long as
the ALL keyword is listed first in the Runas specification.
CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
info@[Link] RedPiranhaSec
+618 6365 0450 RedPiranhaSec
[Link] RedPiranha