SPL exploit kit – now with CVE-2013-0422

(Publication) Google search: [1]

SPL exploit kit – now with CVE-2013-0422
Botnet
Malware
Botnet/malware group
Exploit kits	SPL Pack
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability	CVE-2013-0422, CVE-2012-1723
CCProtocol
Date	2013 / 2013-01-14
Editor/Conference
Link	http://ondailybasis.com/blog/2013/01/14/spl-exploit-kit-now-with-cve-2013-0422/ (Archive copy)
Author	Denis Laskov
Type

Abstract

“ Once in few days I see some new stuff (for me, of course) and Google cannot answer me with enough details :)

Friends, WTF is SPL Exploit Kit? urlquery.net/report.php?id=… << sample detection by @urlquery.

— Denis Laskov (@it4sec) January 7, 2013

So URLquery named it SPL Exploit kit, and almost no additional info about it present. Weird? Yep.

So me and @nsmfoo had a look at it, to see what we can learn.

Well, first of all, as I understand, name to this EK was given based on some tech specs, that return in each installation detected. Since then tech details slightly changed, but major idea is the same.

Ok, lets begin…

Bibtex

 @misc{Laskov2013BFR1833,
   editor = {},
   author = {Denis Laskov},
   title = {SPL exploit kit – now with CVE-2013-0422},
   date = {14},
   month = Jan,
   year = {2013},
   howpublished = {\url{http://ondailybasis.com/blog/2013/01/14/spl-exploit-kit-now-with-cve-2013-0422/}},
 }