CVE-2018-5002 Exploit CHAINSHOT Malware Sample Download

CHAINSHOT Malware use multiple steps to exploit a a Adobe Flash 0-day vulnerability CVE-2018-5002. Malware is multi stager and downloads additional DLLs to create Backdoor in the victim machine. It than pass data from and to its command and control server.

CHAINSHOT XLXS Document Stage 1 Signatures

Family: Other:Malware-gen [Trj]
MD5: c8aaaa517277fb0dbb4bbf724245e663
SHA256: 0b4f0d8d57fd1cb9b4408013aa7fe5986339ce66ad09c941e76626b5d872e0b5

CHAINSHOT XLXS Document Stage 1 Download

CHAINSHOT SWF Exploit Stage 2 Signatures

Family: SWF:Malware-gen [Trj]
MD5: ee34f466491a5c5cd7423849f32b58f5
SHA256: 189f707cecff924bc2324e91653d68829ea55069bc4590f497e3a34fa15e155c

CHAINSHOT SWF Exploit Stage 2 Download

CHAINSHOT First DLL Dropper Stage 3 Signatures

Family: Win64:Trojan-gen
MD5: 3bb41f218ba57869c59f898b638e761c
SHA256: a260d222dfc94b91a09485647c21acfa4a26469528ec4b1b49469db3b283eb9a

CHAINSHOT First DLL Dropper Stage 3 Download

CHAINSHOT Second DLL Dropper Stage 4 Signatures

Family: Win64:Trojan-gen
MD5: 4c592d3653e0bcae475250d9f54b9707
SHA256: 43f7ae58e8e5471917178430f3425061d333b736974f4b2784ca543e3093204b

CHAINSHOT Second DLL Dropper Stage 4 Download

Password of the archives is infected.