Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support

15/04/2013VariousAdobe, CVE-2011-3544, CVE-2012-0507, CVE-2012-1723, CVE-2012-1889, CVE-2012-4681, CVE-2012-4792, CVE-2012-4969, CVE-2012-5076, CVE-2013-0422, CVE-2013-0634, CVE-2013-1493, Flash, Gondad, Gong Da, Java, Microsoft, Oraclewow

Like other Exploit Kits, Gong Da has add support for Oracle Java CVE-2013-1493 vulnerability, fixed in Oracle Java 6 Update 17, has also add support for Microsoft Internet Explorer CVE-2012-4969 and CVE-2012-4792 vulnerabilities, fixed in an emergency patch in September 2012 and January 2013.

Here is the new code for CVE-2013-1493.

And here the new code for CVE-2012-4792 (aka 4792.html) and CVE-2012-4969 (aka payload.html).

Also a new variant of CVE-2012-1889 (xml.html) has been introduced, reducing the detection rate by anti-viruses.

As always this new version of Gong Da Exploit Kit has been discovered on a Korean web site.

Gong Da Pack has involve to the following diagram.

Here under some information s regarding the different files:

HcIa2.jar (aka CVE-2011-3544): 11/46 on VirusTotal.com
bzExj6.jar (aka CVE-2012-0507): 14/45 on VirusTotal.com
BnkLbvY3.jar (aka CVE-2012-1723): 19/46 on VirusTotal.com
iCNpns4.jar (aka CVE-2012-4681): 28/46 on VirusTotal.com
JdtDFRW1.jar (aka CVE-2012-5076): 16/46 on VirusTotal.com
TolxrJG6.jar (aka CVE-2013-0422): 19/46 on VirusTotal.com
FQxzUjYP.jar (aka CVE-2013-1493): 16/46 on VirusTotal.com
GwDFO7.swf (aka CVE-2013-0634): 10/46 on VirusTotal.com
xmlcoreOld.html (aka CVE-2012-1889): 18/46 on VirusTotal.com
xml.html (aka CVE-2012-1889): 3/35 on VirusTotal.com
xmlcoreNew.html (aka CVE-2012-1889): 10/45 on VirusTotal.com
4792.html (aka CVE-2012-4792): 1/46 on VirusTotal.com
xyaKEg.html and payload.html (aka CVE-2012-4969): 5/46 on VirusTotal.com

Normally Gong Da was used against gamers, but this time the loaded malware seem to be different (analysis on ThreatExpert)

32 thoughts on “Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support”

wopot says:

18/04/2013 at 17:32

RT @eromang: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/nSHUP18niF
MalwareMustDie says:

18/04/2013 at 08:01

RT @eromang: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/nSHUP18niF
wopot says:

15/04/2013 at 19:31

RT @ubersec: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support: http://t.co/TJEiUYSqtT #i …
EricOpdyke says:

15/04/2013 at 19:28

RT @ubersec: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support: http://t.co/TJEiUYSqtT #i …
ubersec says:

15/04/2013 at 17:33

Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support: http://t.co/TJEiUYSqtT #infosec
SecThafer says:

15/04/2013 at 17:16

Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support – http://t.co/l7asTER6hO
sganiere says:

15/04/2013 at 12:23

RT @virusbtn: The Gong Da exploit kit added “support” for three new vulnerabilities. @eromang has the details http://t.co/81bfwkKY6x
ITSecurityPty says:

15/04/2013 at 11:07

RT @virusbtn: The Gong Da exploit kit added “support” for three new vulnerabilities. @eromang has the details http://t.co/81bfwkKY6x
virusbtn says:

15/04/2013 at 10:40

The Gong Da exploit kit added “support” for three new vulnerabilities. @eromang has the details http://t.co/81bfwkKY6x
tonispbr says:

15/04/2013 at 10:17

Top story: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2… http://t.co/sgyxTnPrCA, see more http://t.co/WwvxaHI5Px
o0tAd0o says:

15/04/2013 at 10:15

RT @eromang: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/nSHUP18niF
lemoine_vincent says:

15/04/2013 at 09:43

RT @Dinosn: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/z4ALQwGx4v
secnight says:

15/04/2013 at 08:53

Gong Da has add support for Oracle Java vulnerability,fixed in @Oracle Java6 Update 17
http://t.co/FdxlQullUx http://t.co/iRhfenxe14
trimosx says:

15/04/2013 at 08:31

RT @Dinosn: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/z4ALQwGx4v
fl3xu5 says:

15/04/2013 at 08:28

Check this http://t.co/NowTuJvJzA
nice2kn0w says:

15/04/2013 at 08:24

RT @DarkOperator Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/VbtcckMDTS
SelsRoger says:

15/04/2013 at 07:22

RT @eromang: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/nSHUP18niF
m4ysix says:

15/04/2013 at 06:55

RT @Dinosn: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/z4ALQwGx4v
braoru says:

15/04/2013 at 06:53

RT @Dinosn: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/z4ALQwGx4v
botnets_fr says:

15/04/2013 at 06:37

RT @Dinosn: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/z4ALQwGx4v
xanda says:

15/04/2013 at 06:30

RT @Dinosn: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/z4ALQwGx4v
bleuscr says:

15/04/2013 at 06:29

RT @Dinosn: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/z4ALQwGx4v
Dinosn says:

15/04/2013 at 06:29

Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/z4ALQwGx4v
tombolinux says:

15/04/2013 at 05:08

RT @eromang: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/nSHUP18niF
ChadChoron says:

15/04/2013 at 04:45

Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support: http://t.co/lMoLYXlSnw via @eromang
kvotterk says:

15/04/2013 at 03:37

RT @unpacker: [EricRomang] Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/ …
kubotake3 says:

15/04/2013 at 02:39

RT @unpacker: [EricRomang] Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/ …
muhan56 says:

15/04/2013 at 02:17

RT @unpacker: [EricRomang] Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/ …
unpacker says:

15/04/2013 at 01:14

[EricRomang] Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/onnWrtme8F
SPCoulson says:

15/04/2013 at 00:48

RT @eromang: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/nSHUP18niF
rjacksix says:

15/04/2013 at 00:46

RT @eromang: Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support http://t.co/nSHUP18niF
suffert says:

15/04/2013 at 00:37

http://t.co/RQn4cennWU Gong Da Exploit Kit Add Java CVE-2013-1493 & IE CVE-2012-4792 & IE CVE-2012-4969 Support (Correct Link) via @eromang

Comments are closed.