Atomic Stealer 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (135)

言語

en	92
ru	30
de	6
it	4
fr	2

国・地域

us	86
ru	6
de	6
it	4
fr	2

アクター

Atomic Stealer	4
RedLine Stealer	3
Stealc	3
Amadey	2
RecordBreaker	2

関心

タイプ

Not Defined	34
Operating System	4
Content Management System	4
WordPress Plugin	4
Forum Software	2

ベンダー

Not Defined	18
SourceCodester	8
Linux	2
PressTigers	2
Siemens	2

製品

Devilz Clanportal	4
Unisoc T610	4
Unisoc T606	4
Unisoc T760	4
Linux Kernel	2

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	2.09
2	Indexu suggest_category.php クロスサイトスクリプティング	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.13
3	DZCP deV!L`z Clanportal browser.php 情報の漏洩	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02733	1.01	CVE-2007-1167
4	DZCP deV!L`z Clanportal config.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.49	CVE-2010-0966
5	Apple Mac OS X Server Wiki Server SQLインジェクション	5.3	4.6	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00339	1.18	CVE-2015-5911
6	PHP Link Directory Administration Page index.html クロスサイトスクリプティング	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00374	0.33	CVE-2007-0529
7	LG SuperSign CMS Service Port 9080 reboot 特権昇格	6.4	6.2	$5k-$25k	$0-$5k	Not Defined	Workaround	0.00115	0.04	CVE-2018-16706
8	PHPizabi template.class.php assignuser 情報の漏洩	4.3	4.2	$0-$5k	$0-$5k	High	Unavailable	0.00507	0.05	CVE-2008-2018
9	Joomla CMS com_easyblog SQLインジェクション	6.3	6.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00000	0.26
10	TikiWiki tiki-register.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01009	1.41	CVE-2006-6168
11	Citrix NetScaler ADC/NetScaler Gateway OpenID openid-configuration ns_aaa_oauthrp_send_openid_config CitrixBleed メモリ破損	8.3	8.2	$25k-$100k	$0-$5k	High	Official Fix	0.96869	0.00	CVE-2023-4966
12	YaBB yabb.pl クロスサイトスクリプティング	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01240	0.04	CVE-2004-2402
13	Devilz Clanportal index.php SQLインジェクション	7.3	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00784	0.00	CVE-2006-3347
14	PHPGurukul Emergency Ambulance Hiring Portal Manage Ambulance Page manage-ambulance.php 未知の脆弱性	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.06	CVE-2024-3089
15	Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError クロスサイトスクリプティング	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00045	0.07	CVE-2017-20191
16	Technicolor TC8715D User Defined Service managed_services_add.asp クロスサイトスクリプティング	3.0	2.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00043	0.04	CVE-2024-28091
17	Zoho ManageEngine Applications Manager FailOverHelperServlet 情報の漏洩	5.3	5.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00385	0.04	CVE-2019-19800
18	Netentsec NS-ASG Application Security Gateway listloginfo.php SQLインジェクション	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.06	CVE-2024-3041
19	SourceCodester Simple Subscription Website manage_plan.php SQLインジェクション	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.06	CVE-2024-3015
20	SourceCodester Complete File Management System Login Form index.php SQLインジェクション	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.20	CVE-2024-1831

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	アクター	Identified	タイプ	信頼度
1	5.42.65.108	Atomic Stealer	2024年01月17日	verified	高
2	X.XX.XX.XXX	Xxxxxx Xxxxxxx	2024年02月28日	verified	高
3	XX.XXX.XXX.XXX	Xxxxxx Xxxxxxx	2024年04月02日	verified	高
4	XXX.XXX.XX.XXX	Xxxxxx Xxxxxxx	2024年01月17日	verified	高
5	XXX.XXX.XXX.XXX	Xxxxxx Xxxxxxx	2024年04月02日	verified	高

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	高
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
3	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	高
4	TXXXX	CAPEC-19	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
5	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
6	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
7	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	高
8	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	高
9	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
10	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (41)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/admin/manage-ambulance.php	predictive	高
2	File	/cgi-bin/system_mgr.cgi	predictive	高
3	File	/display/map	predictive	中
4	File	/forum/away.php	predictive	高
5	File	/oauth/idp/.well-known/openid-configuration	predictive	高
6	File	/protocol/log/listloginfo.php	predictive	高
7	File	/xxx_xxxxxx/xxxxxx/xxxxxx	predictive	高
8	File	xxxxxxxxx.xxx	predictive	高
9	File	xxxxxx.xxx	predictive	中
10	File	xxxxxxx/xxxxxxx/xxxx-xxxxxxx-xx.x	predictive	高
11	File	xxx/xxxxxx.xxx	predictive	高
12	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	高
13	File	xxxxxxx\xxxxxxx\xxxxxxx_xxxxx.xxx	predictive	高
14	File	xxxxx.xxxx	predictive	中
15	File	xxxxx.xxx	predictive	中
16	File	xxxxxxx_xxxxxxxx_xxx.xxx	predictive	高
17	File	xxxxxx_xxxx.xxx	predictive	高
18	File	xxxxx_xxxxxx.xxx	predictive	高
19	File	xxxxxxx_xxxxxxxx.xxx	predictive	高
20	File	xxxxxxxx.xxxxx.xxx	predictive	高
21	File	xxxx-xxxxx.xxx	predictive	高
22	File	xxxx-xxxxxxxx.xxx	predictive	高
23	File	xxxxx/xxxxx.xxx	predictive	高
24	File	xxxxx/xxxxxxxx-xxxxxxxxx.xxx	predictive	高
25	File	xxxxxxx/xx/xxxx/xxx/xxxxxx/xxxxxxxxx.xx	predictive	高
26	File	xxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
27	File	xxxx.xx	predictive	低
28	Argument	xxxxx	predictive	低
29	Argument	xxxxxxxx	predictive	中
30	Argument	xxxxx	predictive	低
31	Argument	xxx	predictive	低
32	Argument	xxxxx_xxx	predictive	中
33	Argument	xxxx	predictive	低
34	Argument	xxxxxxxxxxxx	predictive	中
35	Argument	xx	predictive	低
36	Argument	xxxxxxx	predictive	低
37	Argument	xxx	predictive	低
38	Argument	xxxx	predictive	低
39	Argument	xxxxxxx_xxx	predictive	中
40	Argument	xxxxxxxx	predictive	中
41	Input Value	xxxxxx%xx+xx+%xxx%xx+%xx+%xxx%xx+--+-	predictive	高

参考 (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Interested in the pricing of exploits?

See the underground prices here!