Slicing and Dicing CVE-2018-5002 Payloads: New CHAINSHOT Malware
Summary: Unit 42 analyzed targeted attacks that used the CVE-2018-5002 Adobe Flash 0-day inside malicious Excel documents, and cracked the 512-bit RSA keys the downloader generated to decrypt the exploit and malware payloads. The staged malware, named CHAINSHOT, passes data from each stage to the next, loads an embedded FirstStageDropper.dll that injects SecondStageDropper.dll and includes bypass code for EMET, Kaspersky and Bitdefender.
Bottom line: The attacker chose a 512-bit RSA key that public factoring services running on Amazon EC2 could break in hours, and the same network infrastructure pointed to similar attacks against a wide range of targets with disparate interests.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2018-5002
- Related
- CVE-2018-5002: Adobe Flash Player Stack-based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · May 23, 2022Adobe Patches Zero-Day Flash Flaw Cyber Risks ·ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026