Update on Snort and ClamAV for ms08-067
Summary: Cisco Talos reported that a private research organization produced an EIP roughly two hours after the MS08-067 patch was released, and that Snort's existing MS06-040 rules (SIDs 7218 and 7238) detected the original pre-patch 0-day attack because the attackers reused the same overflow string to deliver the payload. Talos also described ClamAV detecting the n[x].exe payload, a roughly 388KB Trojan that drops sysmgr.dll, registers a "System Maintenance Service," pings 202.108.22.44 and 64.233.189.147, and downloads more malware from 59.106.145.58 in Japan.
Key Takeaway: The two-hour patch-to-exploit window means defenders who wait for a vendor fix are already behind, and the malware's embedded attempt to exploit 199.166.133.90 at TransCanada Pipeline shows this code was built to spread to other networks, not just the first victim.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026