Trusted Design

Updated Sundown Exploit Kit Uses Steganography

概要

Sundown is something of an outlier from typical exploit kits. It tends to reuse old exploits and doesn’t make an effort to disguise their activity. The URLs for Sundown requests for Flash files end in .swf, while Silverlight requests end in .xap. These are the normal extensions for these file types. Typically, other exploit kits make an effort to hide their exploits. In addition, Sundown doesn’t have the anti-crawling feature used by other exploit kits.

Created: 2026-02-23

Indicators

• hostname - xbs.q30.biz -
• IPv4 - 188.165.163.228 -
• CVE - CVE-2016-4117 -
• CVE - CVE-2016-0189 -
• FileHash-SHA1 - c2cd9ea5ad1061fc33adf9df68eeed6a1883c5f9 -
• CVE - CVE-2015-2419 -
• hostname - cjf.0340.mobi -

類似Pulses

• AV Labs: Sundown Exploit Kit Indicators (score: 0.62)
• 2015-12-27 Sundown EK Sending Neutrino (score: 0.62)
• Sundown EK Spreads LuminosityLink RAT (score: 0.58)
• Magnitude Exploit Kit Uses Newly Patched Adobe Vulnerability (score: 0.51)
• Blackhole Exploit Kit Resurfaces in Live Attacks (score: 0.50)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る