Boletín Semanal

06 de julio de 2024 a 12 de julio de 2024

<< Semana anterior

Semana siguiente >>

5 URL

-20 con respecto a la semana pasada

8 Hashes

-17 con respecto a la semana pasada

15 IP

+1 con respecto a la semana pasada

152 Vulnerabilidades

+133 con respecto a la semana pasada

Phishing

11 de julio de 2024 a las 09:54

Microsoft SharePoint - Phishing

FPH24-00982

Indicadores de Compromiso

Tipo	Valor	Comentario
IPv4	216. 219. 94. 131	IP SMTP
IPv4	31. 31. 198. 55	IP sitio falso
URL	https: //dinstars. com/?email={Correo Electronico}	URL redirección
URL	https: //dinstars. com/gp?l31dmzbc-mr72-46z9-0sw3-kf51zlw20ahs_m5q37kpx9ovzstngwhf8il0612ejuycdr4abth9wv6xeifa4knmgr3ljzd2bpq805ys7c1ouva7lc02pys8x4wnbtr61uh3jmd5okqiegz9f&signin=mnb14pafq8uch2r9d6tw7ov-2hta-tumb-seln-u0hlfozi2ma45jwbk1c_6enavyrfx2di3lk57mhw9t0upbcg1jzs48oqdipsygrchjx3ak4ob6ve125nlzfm0quw7t89haxn1bvc7ui58etgko9lr64z3q2jsf0dwymp&string=iz1v56ye3jt78w0xncugh4k&data=klfoqag7-wxyj-72dk-qw5h-nohs6cqt2k8y_nes5pbozjidg17k2qru4xla68vw930hctyfmvxs16i47k32gwor8udmef0zja9ybcpntlh5q4nhoquybzljsarim79gx6e35v28pfwkdc01t&email=Y29udGFjdG9Ac3NiaW9iaW8uY2w=	URL sitio falso
Email	noreply@zf-com. one	Correo de salida

11 de julio de 2024 a las 15:17

Lider - Phishing

FPH24-00983

Indicadores de Compromiso

Tipo	Valor	Comentario
IPv4	144. 217. 96. 196	IP sitio falso
IPv4	195. 154. 164. 40	IP SMTP
URL	https: //liderbci-serviciosfinancieros-cl. evosys. com. gt/	URL sitio falso
URL	https: //sabaarmeh. ir/tarjetaliderbci/superavance-wrup/	URL redirección
Email	sugarbaby@host1. onlineaudience. co. uk	Correo de salida
Asunto Email	Tienes un SUPERAVANCE APROBADO! con el 50% dcto	Asunto del correo

Suplantación con malware

11 de julio de 2024 a las 12:38

Servicio de Impuestos Internos - Suplantación con malware

CMV24-00476

Indicadores de Compromiso

Tipo	Valor	Comentario
IPv4	103. 179. 191. 151	IP SMTP
IPv4	103. 4. 75. 66	IP SMTP
IPv4	148. 113. 165. 186	IP SMTP
IPv4	161. 132. 40. 128	IP SMTP
IPv4	167. 71. 237. 136	IP SMTP
IPv4	170. 246. 56. 213	IP SMTP
IPv4	173. 208. 191. 228	IP SMTP
IPv4	209. 85. 160. 49	IP SMTP
IP:Puerto	212. 71. 244. 6: 8900	Comando y control
IPv4	35. 199. 60. 58	IP SMTP
SHA256	36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068	b.txt
IPv4	37. 49. 227. 98	IP SMTP
SHA256	5d5100480985f7cb1f2bf0ad8d104325a75d511b8af6c8e87e6081e6f43194e6	MSIB8A5.tmp
IPv4	69. 167. 136. 131	IP SMTP
SHA256	7e643c188a1ee3b0251b7dfcab000b7c48fd840eff35189e8a45901852e3910a	ssleay32.dll
SHA256	8cea66c4bd7b03666a88e80791edb015df847381702a356eae0c2f8b6dd08e71	MSIACAA.tmp
SHA256	ca763693cc25d316f14a9ebad80ebf00590329550c45adb7e5205486533c2504e	MSIAC0B.tmp
SHA256	d2ea96db9ddfa369200ebb5fd30c6b884acabdc39de8704a1ec934488cd86a09	SiiFacturaMayonopagada.msi
SHA256	d2ea96db9ddfa369200ebb5fd30c6b884acabdc39de8704a1ec934488cd86a09	SiiFacturaMayonopagada.zip
SHA256	e28e34fbdaff077669586dcdb4e10f0ba2ca6c9973ed4d372a5c3ec3b8ad20e7	libeay32.dll
URL	ipinfo. io	Whois
Email	notificaciones@smartform. cl	Correo de salida
Email	support@dailyxetai. vn	Correo de salida
Email	support@ddec. pf	Correo de salida
Email	support@ecomall. xyz	Correo de salida
Email	support@fordcouncil. com	Correo de salida
Email	support@gothamapparel. com	Correo de salida
Email	support@gpsplus. pe	Correo de salida
Email	support@samehada. one	Correo de salida
Email	support@sier. regioncusco. gob. pe	Correo de salida
Email	support@tbmsg. org	Correo de salida
MITRE ATT&CK	T1012	Registro de consultas
MITRE ATT&CK	T1082	Descubrimiento de información del sistema
MITRE ATT&CK	T1120	Descubrimiento de dispositivos periféricos
MITRE ATT&CK	T1546. 016	Paquetes de instalación
MITRE ATT&CK	T1566. 002	Acceso Inicial (Mediante Phishing)
Email	ventas@ventasimfa. com	Correo de salida

Vulnerabilidades

9 de julio de 2024 a las 15:15

Microsoft Update Tuesday 2024 Julio - Vulnerabilidades

VSA24-01040

Vulnerabilidades

ID	CVSS	EPSS
CVE-2024-38072	7.5
CVE-2024-38071	7.5
CVE-2024-38070	7.8
CVE-2024-38069	7.0
CVE-2024-39684	7.8
CVE-2024-38517	7.8
CVE-2024-38112	7.5
CVE-2024-38105	6.5
CVE-2024-38104	8.8
CVE-2024-38102	6.5
CVE-2024-38101	6.5
CVE-2024-38100	7.8
CVE-2024-38099	5.9
CVE-2024-38094	7.2
CVE-2024-30071	4.7
CVE-2024-30061	7.3
CVE-2024-30013	8.8
CVE-2024-28928	8.8
CVE-2024-28899	8.8
CVE-2024-26184	6.8
CVE-2024-21449	8.8
CVE-2024-21428	8.8
CVE-2024-21425	8.8
CVE-2024-21417	8.8
CVE-2024-21415	8.8
CVE-2024-21414	8.8
CVE-2024-21398	8.8
CVE-2024-21373	8.8
CVE-2024-21335	8.8
CVE-2024-21333	8.8
CVE-2024-21332	8.8
CVE-2024-21331	8.8
CVE-2024-21317	8.8
CVE-2024-21308	8.8
CVE-2024-21303	8.8
CVE-2024-20701	8.8
CVE-2024-38092	8.8
CVE-2024-38091	7.5
CVE-2024-38089	9.1
CVE-2024-38088	8.8
CVE-2024-38068	7.5
CVE-2024-38067	7.5
CVE-2024-38066	7.8
CVE-2024-38010	8.0
CVE-2024-37989	8.0
CVE-2024-37988	8.0
CVE-2024-37987	8.0
CVE-2024-37986	8.0
CVE-2024-37985	5.9
CVE-2024-37984	8.4
CVE-2024-38065	6.8
CVE-2024-38062	7.8
CVE-2024-38061	7.5
CVE-2024-38060	8.8
CVE-2024-38059	7.8
CVE-2024-38087	8.8
CVE-2024-38086	6.4
CVE-2024-38085	7.8
CVE-2024-38081	7.3
CVE-2024-38080	7.8
CVE-2024-38079	7.8
CVE-2024-38078	7.5
CVE-2024-38077	9.8
CVE-2024-38076	9.8
CVE-2024-38074	9.8
CVE-2024-38073	7.5
CVE-2024-38058	6.8
CVE-2024-38057	7.8
CVE-2024-38056	5.5
CVE-2024-38054	7.8
CVE-2024-38053	8.8
CVE-2024-38052	7.8
CVE-2024-38051	7.8
CVE-2024-38050	7.8
CVE-2024-38049	6.6
CVE-2024-38048	6.5
CVE-2024-38047	7.8
CVE-2024-38044	7.2
CVE-2024-38043	7.8
CVE-2024-38041	5.5
CVE-2024-38034	7.8
CVE-2024-38033	7.3
CVE-2024-38032	7.1
CVE-2024-38031	7.5
CVE-2024-38030	6.5
CVE-2024-38028	7.2
CVE-2024-38027	6.5
CVE-2024-38024	7.2
CVE-2024-38023	7.2
CVE-2024-38022	7.0
CVE-2024-38021	8.8
CVE-2024-38020	6.5
CVE-2024-38019	7.2
CVE-2024-38017	5.5
CVE-2024-38015	7.5
CVE-2024-38013	6.7
CVE-2024-38011	8.0
CVE-2024-37981	8.0
CVE-2024-37977	8.0
CVE-2024-37975	8.0
CVE-2024-37974	8.0
CVE-2024-37973	8.4
CVE-2024-37972	8.0
CVE-2024-37971	8.0
CVE-2024-37970	8.0
CVE-2024-37969	8.0
CVE-2024-37336	8.8
CVE-2024-37334	8.8
CVE-2024-37333	8.8
CVE-2024-37332	8.8
CVE-2024-37331	8.8
CVE-2024-37330	8.8
CVE-2024-37329	8.8
CVE-2024-37328	8.8
CVE-2024-37327	8.8
CVE-2024-37326	8.8
CVE-2024-37323	8.8
CVE-2024-37322	8.8
CVE-2024-37321	8.8
CVE-2024-37320	8.8
CVE-2024-37319	8.8
CVE-2024-37318	8.8
CVE-2024-3596	7.5
CVE-2024-35272	8.8
CVE-2024-35271	8.8
CVE-2024-35270	5.3
CVE-2024-35267	7.6
CVE-2024-35266	7.6
CVE-2024-35264	8.1
CVE-2024-35261	7.8
CVE-2024-35256	8.8
CVE-2024-32987	7.5
CVE-2024-30105	7.5
CVE-2024-30098	7.5
CVE-2024-30079	7.8
CVE-2022-44684	6.5
CVE-2024-38095	7.5
CVE-2024-38064	7.5
CVE-2024-38055	5.5
CVE-2024-38025	7.2
CVE-2024-37978	8.0
CVE-2024-37324	8.8
CVE-2024-30081	7.1