Bonanza 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (318)

言語

en	210
ru	54
es	12
it	12
sv	10

国・地域

us	294
ru	2

アクター

RedLine Stealer	6
Cobalt Strike	5
Stealc	5
Bonanza	4
RisePro	3

関心

タイプ

Not Defined	104
Content Management System	24
Forum Software	18
Programming Language Software	14
Operating System	6

ベンダー

Not Defined	80
SourceCodester	12
PHPGurukul	4
Apple	4
Linux	4

製品

phpBB	8
SPiD	4
Zentrack	4
Linux Kernel	4
PHPGurukul User Registration & Login and User Mana ...	2

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	SPIP spip.php クロスサイトスクリプティング	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00132	0.50	CVE-2022-28959
2	TikiWiki tiki-register.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01075	9.63	CVE-2006-6168
3	Joomla CMS com_easyblog SQLインジェクション	6.3	6.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00000	0.29
4	SourceCodester Online Employee Leave Management System addemployee.php 未知の脆弱性	5.8	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00075	0.04	CVE-2022-3121
5	OpenBB read.php SQLインジェクション	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00248	0.00	CVE-2005-1612
6	Tiki Admin Password tiki-login.php 弱い認証	8.0	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00936	2.89	CVE-2020-15906
7	Apple Mac OS X Server Wiki Server クロスサイトスクリプティング	4.3	4.3	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00263	0.05	CVE-2009-2814
8	eSyndicat Directory Software suggest-listing.php クロスサイトスクリプティング	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.29
9	Vienuke Vieboard viewtopic.asp SQLインジェクション	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00213	0.00	CVE-2003-1196
10	MGB OpenSource Guestbook email.php SQLインジェクション	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.01302	1.09	CVE-2007-0354
11	Apple Mac OS X Server Wiki Server SQLインジェクション	5.3	4.6	$5k-$25k	$0-$5k	Unproven	Official Fix	0.00339	2.81	CVE-2015-5911
12	Oracle Communications Cloud Native Core Security Edge Protection Proxy SEPP 特権昇格	10.0	9.7	$25k-$100k	$5k-$25k	High	Official Fix	0.97505	0.04	CVE-2022-22947
13	MacCMS index.php 特権昇格	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.85925	0.02	CVE-2017-17733
14	Advisto Peel SHOPPING caddie_ajout.php 未知の脆弱性	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00118	0.04	CVE-2018-20848
15	Promosi-web ardguest ardguest.php クロスサイトスクリプティング	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00134	0.00	CVE-2009-3668
16	Haas Controller Ethernet Q Commands Service Remote Code Execution	9.8	9.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00077	0.00	CVE-2022-2475
17	PHPizabi template.class.php assignuser 情報の漏洩	4.3	4.2	$0-$5k	$0-$5k	High	Unavailable	0.00507	0.16	CVE-2008-2018
18	DZCP deV!L`z Clanportal config.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.63	CVE-2010-0966
19	ESecurityServices GPS Userdata Form allows Persistent クロスサイトスクリプティング	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	Identified	タイプ	信頼度
1	85.217.144.143		Bonanza	2023年11月09日	verified	高
2	109.107.182.2	hosted-by.yeezyhost.net	Bonanza	2023年11月09日	verified	高
3	XXX.XX.XX.XXX		Xxxxxxx	2023年11月09日	verified	高
4	XXX.XX.XX.XXX		Xxxxxxx	2023年11月09日	verified	高
5	XXX.XX.XX.XXX		Xxxxxxx	2023年11月09日	verified	高
6	XXX.XXX.XXX.XX		Xxxxxxx	2023年11月09日	verified	高
7	XXX.XXX.XX.XX		Xxxxxxx	2023年11月09日	verified	高
8	XXX.XXX.XXX.XXX		Xxxxxxx	2023年11月09日	verified	高

TTP - Tactics, Techniques, Procedures (14)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	高
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	高
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	高
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
6	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
7	TXXXX	CAPEC-136	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
8	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
9	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	高
10	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
11	TXXXX.XXX	CAPEC-	CWE-XXX	Xxxxxxx Xxxxx Xxx Xxxxxxxxxxx Xxxxxxxxxx Xxxxx Xxxxxxx Xxxxx	predictive	高
12	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
13	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
14	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (248)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/?r=email/api/mark&op=delFromSend	predictive	高
2	File	/admin/addemployee.php	predictive	高
3	File	/advanced-tools/nova/bin/netwatch	predictive	高
4	File	/cgi-bin/supervisor/PwdGrp.cgi	predictive	高
5	File	/film-rating.php	predictive	高
6	File	/forum/away.php	predictive	高
7	File	/index.php	predictive	中
8	File	/librarian/bookdetails.php	predictive	高
9	File	/pages/faculty_sched.php	predictive	高
10	File	/php_action/createUser.php	predictive	高
11	File	/spip.php	predictive	中
12	File	/student/bookdetails.php	predictive	高
13	File	account.asp	predictive	中
14	File	addguest.cgi	predictive	中
15	File	add_comment.php	predictive	高
16	File	admin.php	predictive	中
17	File	admin/admin_users.php	predictive	高
18	File	admin/conf_users_edit.php	predictive	高
19	File	Admin/edit-admin.php	predictive	高
20	File	admin/establishment/manage.php	predictive	高
21	File	admin/inquiries/view_details.php	predictive	高
22	File	admin/skins.php	predictive	高
23	File	admin/versions.html	predictive	高
24	File	admindocumentworker.jsp	predictive	高
25	File	admin_feature.php	predictive	高
26	File	album_portal.php	predictive	高
27	File	announce.php	predictive	中
28	File	apply.cgi	predictive	中
29	File	ardguest.php	predictive	中
30	File	bb_usage_stats.php	predictive	高
31	File	bwdates-report-result.php	predictive	高
32	File	xxxxxxxx.xxx	predictive	中
33	File	xxxxxxxx_xxxx.xxx	predictive	高
34	File	xxx-xxx/xxxxx_xxx_xxx	predictive	高
35	File	xxx-xxx/xxxxx_xxxx.xxx?xxxxxx=xxxxxxx	predictive	高
36	File	xxxxx.xxxxx.xxx	predictive	高
37	File	xxxxxxxxxxxxxxxxxxxxxxxxxxxxx.xx	predictive	高
38	File	xxxxxx.xxx	predictive	中
39	File	xxxxxx.xxx.xxx	predictive	高
40	File	xxx.xxx	predictive	低
41	File	xxxxxxx.xxx	predictive	中
42	File	xxxxxx.xxx	predictive	中
43	File	xxxxxxxxxxxxxxx.xxx	predictive	高
44	File	xxxxxxxx.xxx	predictive	中
45	File	xxxxxxxxx/xxxxxxxxx.xxx	predictive	高
46	File	xxxxxxx/xxx/x_xxxxx.x	predictive	高
47	File	xxxxxxx/xxxxx/xxxxx/xxxxxx-xxx.x	predictive	高
48	File	xxxx-xxxxxxx.xxx	predictive	高
49	File	xxxxx.xxx	predictive	中
50	File	xx/xxxxx/xxxxxx_xxxxx.xxx	predictive	高
51	File	xx_xxx.xxx	predictive	中
52	File	xxxxx.xxx	predictive	中
53	File	xx/xxxx/xxxxxxx.x	predictive	高
54	File	xxxxxxx.xxx	predictive	中
55	File	xxxxxxxxxxxx_xxxx.xxx	predictive	高
56	File	xxxxx.xxx	predictive	中
57	File	xxxx_xxxxxxx.xxx.xxx	predictive	高
58	File	xxxxxx.xxx	predictive	中
59	File	xxxx.xxx	predictive	中
60	File	xx-xxx/xxxx.xxx	predictive	高
61	File	xxxxx_xxxxxx.xxx	predictive	高
62	File	xxx/xxxxxx.xxx	predictive	高
63	File	xxx/xxxxxxxxx.xxx.xxx	predictive	高
64	File	xxxxxxx.xxx	predictive	中
65	File	xxxxx.xxx	predictive	中
66	File	xxxxx.xxxx	predictive	中
67	File	xxxxx.xxx	predictive	中
68	File	xxxxxxx/xxxxxx.xxx	predictive	高
69	File	xxxx_xxxx.xxx	predictive	高
70	File	xxxx.xxx	predictive	中
71	File	xxxxx.xxx	predictive	中
72	File	xxxxx.xx/xxxxxxxxxxx.xxx/xxxxx.xxx	predictive	高
73	File	xxxxxxxxx.xxx	predictive	高
74	File	xxxxxxxxxxxx.xxx	predictive	高
75	File	xxx/xxxx_xxx.xxx	predictive	高
76	File	xxxx/xxxxxxx_xxxx.x	predictive	高
77	File	xxx/xxx.xxx	predictive	中
78	File	xxxxxxx/xxx_xxxxxxxx.xxx	predictive	高
79	File	xxx_xxxxxxxx.xxx	predictive	高
80	File	xxxxxxxx.xxx	predictive	中
81	File	xxxx-xxxxxx.xxx	predictive	高
82	File	xxxxxxxx.xxx	predictive	中
83	File	xxx_xxxx.xxx	predictive	中
84	File	xxxxxxx_xxxx.xxx	predictive	高
85	File	xxxxx.xxx	predictive	中
86	File	xxxxx	predictive	低
87	File	xxxxxxxx.xxx	predictive	中
88	File	xxxxx/xxxxxxx.xxx	predictive	高
89	File	xxxxx-xxx.x	predictive	中
90	File	xxxxx.xxx	predictive	中
91	File	xxxxx/xxxxxxxxxxx/xxxxx.xxx	predictive	高
92	File	xxxx.xxx	predictive	中
93	File	xxxxxxxxxxxxxx.xxx	predictive	高
94	File	xxxx.xxx	predictive	中
95	File	xxxxxxxx-x.xx	predictive	高
96	File	xxxxxxxx.xxx	predictive	中
97	File	xxxxxxxxxxx-xxxxxxx.xxx	predictive	高
98	File	xxxx/xxx/xxx_xxxx.x	predictive	高
99	File	xxxx_xxxx_xxxxxx.xxx	predictive	高
100	File	xxxxxx.xxx	predictive	中
101	File	xxxxxx.xxx	predictive	中
102	File	xxxxxxxx.xxx	predictive	中
103	File	xxxxxx_xxx_xxxxxx.xxx	predictive	高
104	File	xxxxx.xxx	predictive	中
105	File	xxxxxxx/xxxxxx.xxx	predictive	高
106	File	xxxxxxx.xxx	predictive	中
107	File	xxxx_xxxxx.xxxx	predictive	高
108	File	xxxxx.xxx	predictive	中
109	File	xxxxx_xxxxx.xxx	predictive	高
110	File	xxxxx.xxx	predictive	中
111	File	xxxxxxx-xxxxxxxx.xxx	predictive	高
112	File	xxxxxxx-xxxxxxx.xxx	predictive	高
113	File	xxxxxxx_xxxxxxxx.xxx	predictive	高
114	File	xxxxxxxx.xxxxx.xxx	predictive	高
115	File	xxxxxxxxx/xxxxx/xxxx/xxx_xxxxxxx/xxxxxxx/xxxxxxx.xxx	predictive	高
116	File	xxxxxxxxxxxxxxxxxxx.xxx/xxxxxxxx_xxxxx_xxxx_xxxxxxxx_xxxxxxxxxx.xxx	predictive	高
117	File	xxxxx-xxxx.xxx	predictive	高
118	File	xxxx-xxxxx.xxx	predictive	高
119	File	xxxx-xxxxxxxx.xxx	predictive	高
120	File	xxxx.xxx	predictive	中
121	File	xxx.xxx	predictive	低
122	File	xxxxxxx-x-x-x.xxx	predictive	高
123	File	xxxxxx.xxx	predictive	中
124	File	xxxxxx_xxxxxxxx.xxx	predictive	高
125	File	xxxx/xxx/xxxx-xxxxx.xxx	predictive	高
126	File	xxxx.xxx	predictive	中
127	File	xxxx/xxxxxxxxxxxx.xxx	predictive	高
128	File	xxxxxxxxx.xxx	predictive	高
129	File	xxxx_xxxx.xxx	predictive	高
130	File	xxxx_xxxxxxx.xxx	predictive	高
131	File	xxxxxxxxxxxxx.xxx	predictive	高
132	File	xxx/xxxxxxx.xxx	predictive	高
133	File	xxxxxxx.xxxx	predictive	中
134	File	xxxxxxxxxx.xxxx	predictive	高
135	File	xxxxxx.xxx	predictive	中
136	Library	/xxxxxxxxx/xxxxxxxxxxxxxx.xxx	predictive	高
137	Library	xxxxxx[xxxxxx_xxxx	predictive	高
138	Library	xxxxxxxx.xxx	predictive	中
139	Library	xxxxxxxxxxx.xxx	predictive	高
140	Library	xxxxxxx_xxxxxx_xxxxxxx	predictive	高
141	Argument	$_xxxxxx['xxxxx_xxxxxx']	predictive	高
142	Argument	xxxxxx	predictive	低
143	Argument	xxxxxxxxxxxx	predictive	中
144	Argument	xxxxxxxx	predictive	中
145	Argument	xxxxxxxx	predictive	中
146	Argument	xxxx_xxx	predictive	中
147	Argument	xxx_xxx	predictive	低
148	Argument	xxx	predictive	低
149	Argument	xxx_xx	predictive	低
150	Argument	xxx	predictive	低
151	Argument	xxxx_xx	predictive	低
152	Argument	xxxxxxx	predictive	低
153	Argument	xxxxxx	predictive	低
154	Argument	xxxxxxxxxx	predictive	中
155	Argument	xxxxxx[xxxxxx_xxxx]	predictive	高
156	Argument	xxxxxx[xxxx]	predictive	中
157	Argument	xxxxxx[xxx_xxxx_xxxx]	predictive	高
158	Argument	xxxxxxxxx[x]	predictive	中
159	Argument	xxxxx	predictive	低
160	Argument	xxxxxx_xx/xxxx/xxxxxxx	predictive	高
161	Argument	xxxxxxxxxxx	predictive	中
162	Argument	xxxxxxx	predictive	低
163	Argument	xxxxx	predictive	低
164	Argument	xxxxxxxxxx	predictive	中
165	Argument	xxxx_xxxxxxxx	predictive	高
166	Argument	xxxxx	predictive	低
167	Argument	xxxxxxxx	predictive	中
168	Argument	xxxxx_xxx	predictive	中
169	Argument	xxxxx	predictive	低
170	Argument	xxxxxxx	predictive	低
171	Argument	xxxx/xxxx	predictive	中
172	Argument	xx_xxxx	predictive	低
173	Argument	xxxx_xx	predictive	低
174	Argument	xxxxxxx	predictive	低
175	Argument	xxxxx_xx	predictive	中
176	Argument	xxxxxxxxxx	predictive	中
177	Argument	xxxxxxx	predictive	低
178	Argument	xxxxxxx	predictive	低
179	Argument	xx	predictive	低
180	Argument	xxxxxxxx	predictive	中
181	Argument	xx	predictive	低
182	Argument	xx	predictive	低
183	Argument	xx=	predictive	低
184	Argument	xxxxx/xxxx	predictive	中
185	Argument	xxxxx.xxx?xxxxxx=xxx_xxxxxxx/xxxx=xxxxxxx/xx=x/xxxxxxxx=xxxxx	predictive	高
186	Argument	xxxx	predictive	低
187	Argument	xxxx	predictive	低
188	Argument	xxxxxx	predictive	低
189	Argument	xxxxx	predictive	低
190	Argument	xxxxxxxx	predictive	中
191	Argument	xxxx	predictive	低
192	Argument	xxxx_xxxx	predictive	中
193	Argument	xxxx_xxx	predictive	中
194	Argument	xxxxx_xxxx	predictive	中
195	Argument	xxx_xxxxxxx_xxx	predictive	高
196	Argument	xxxx	predictive	低
197	Argument	xxx	predictive	低
198	Argument	xx_xxxxxxxx	predictive	中
199	Argument	xxxxxxxx	predictive	中
200	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	高
201	Argument	xxxxx	predictive	低
202	Argument	xxxx_xxxx	predictive	中
203	Argument	xx	predictive	低
204	Argument	xxxxxxx xxxxxx	predictive	高
205	Argument	xxxx	predictive	低
206	Argument	xxxxxx	predictive	低
207	Argument	xxxxxxxx	predictive	中
208	Argument	xxxx	predictive	低
209	Argument	xxxx_xx_xx_xxx	predictive	高
210	Argument	xxxxx_xxxx_xxxx	predictive	高
211	Argument	xxxxx	predictive	低
212	Argument	xxxxxxxx	predictive	中
213	Argument	xxxxxxx_xx	predictive	中
214	Argument	xxxxx	predictive	低
215	Argument	xxxxxxxxx	predictive	中
216	Argument	xxxxxxx	predictive	低
217	Argument	xxxxxx	predictive	低
218	Argument	xxxxxxxx	predictive	中
219	Argument	xxxxxxxxx	predictive	中
220	Argument	xxx	predictive	低
221	Argument	xxx	predictive	低
222	Argument	xxxxxx	predictive	低
223	Argument	xxxxxxxxxx	predictive	中
224	Argument	xxx	predictive	低
225	Argument	xxx	predictive	低
226	Argument	xxxxxxxxx_xxxxxx_xxx	predictive	高
227	Argument	xxxx	predictive	低
228	Argument	xxxx	predictive	低
229	Argument	xxxx	predictive	低
230	Argument	xxxxxxxxxx	predictive	中
231	Argument	xxxx	predictive	低
232	Argument	xxx	predictive	低
233	Argument	xxxxx	predictive	低
234	Argument	xxxxxx	predictive	低
235	Argument	xxx	predictive	低
236	Argument	xxxx	predictive	低
237	Argument	xxxxxxxx	predictive	中
238	Argument	xxxxxxxx	predictive	中
239	Argument	xxxxxxxx/xxxxxxxx	predictive	高
240	Argument	xx	predictive	低
241	Input Value	' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxx	predictive	高
242	Input Value	'xx''='	predictive	低
243	Input Value	' xx (xxxxxx xxxx xxxx(xxxxxx xxxxx(),xxxxxx(xxxxxxxxxxxx,(xxxxxx (xxx(xxxx=xxxx,x))),xxxxxxxxxxxx,xxxxx(xxxx(x)x))x xxxx xxxxxxxxxxx_xxxxxx.xxxxxxx xxxxx xx x)x)-- xxxx	predictive	高
244	Input Value	-x	predictive	低
245	Input Value	<xxxxxx>xxxxx(/xxx/)</xxxxxx>	predictive	高
246	Input Value	xxxx<xxx xxx="" xxxxxxx=xxxxx(x)>	predictive	高
247	Input Value	\xxx../../../../xxx/xxxxxx	predictive	高
248	Network Port	xxx/xx (xxx xxxxxxxx)	predictive	高

参考 (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!