DarkCrystalRAT 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (260)

言語

en	224
es	14
de	8
ru	8
fr	4

国・地域

us	56
es	20
ru	16
de	8
ro	4

アクター

DarkCrystalRAT	3
FIN7	1
Cobalt Strike	1
TeslaCrypt	1
FelixRoot	1

関心

タイプ

Not Defined	114
Router Operating System	16
Operating System	10
Content Management System	8
Smartphone Operating System	6

ベンダー

Not Defined	84
Apple	14
Google	8
Microsoft	8
SAP	8

製品

SAP Solution Manager	6
Netgear RBK40	6
Qualcomm Snapdragon Auto	6
Qualcomm Snapdragon Compute	6
Qualcomm Snapdragon Industrial IOT	6

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	PHP Link Directory Administration Page index.html クロスサイトスクリプティング	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00374	0.33	CVE-2007-0529
2	DZCP deV!L`z Clanportal config.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.50	CVE-2010-0966
3	Microsoft Windows New Horizon Data Systems Boot Loader Privilege Escalation	6.1	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00065	0.02	CVE-2022-34302
4	Rockwell Automation RSLinx Enterprise Service Port 4444 LogReceiver.exe 情報の漏洩	7.4	7.3	$0-$5k	$0-$5k	Not Defined	Workaround	0.00056	0.02	CVE-2013-2807
5	Microsoft Windows WDAC OLE DB Provider for SQL Server Remote Code Execution	8.8	8.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.00106	0.00	CVE-2024-21391
6	Watchguard Firebox/XTM Remote Code Execution	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.84170	0.03	CVE-2022-26318
7	Zentrack index.php 特権昇格	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.03
8	Microsoft IIS クロスサイトスクリプティング	5.2	4.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00548	0.13	CVE-2017-0055
9	Matrix Synap JSON サービス拒否	5.9	5.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00664	0.00	CVE-2020-26890
10	Invision Power Services IP.Board URL サービス拒否	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00164	0.02	CVE-2015-6812
11	TypeORM Prototype Remote Code Execution	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00301	0.00	CVE-2020-8158
12	Fortinet FortiGate Log 特権昇格	4.0	3.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00089	0.04	CVE-2020-12818
13	Softaculous Loginizer Plugin 未知の脆弱性	5.8	5.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00058	0.00	CVE-2022-45079
14	Terrasoft Bpm'online CRM-System SDK Terrasoft.Core.DB.Column.Const SQLインジェクション	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00138	0.03	CVE-2019-15301
15	Sudo Environment Variable 特権昇格	8.3	7.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00050	0.03	CVE-2023-22809
16	Page Engine CMS login_include.php 特権昇格	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
17	D-Link DIR-816L/DIR-803 URL Encoding info.php クロスサイトスクリプティング	5.2	5.2	$5k-$25k	$0-$5k	Not Defined	Unavailable	0.00111	0.00	CVE-2020-25786
18	Pivotal Spring Framework ディレクトリトラバーサル	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00479	0.05	CVE-2014-3625
19	Fortinet FortiOS/FortiProxy Administrative Interface 弱い認証	9.8	9.7	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.97169	0.00	CVE-2022-40684
20	VMware ESXi settingsd 競合状態	7.2	6.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00101	0.03	CVE-2021-22043

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	Identified	タイプ	信頼度
1	31.7.58.82	no-rdns.offshorededicated.net	DarkCrystalRAT	2022年07月21日	verified	高
2	XX.XXX.X.XX		Xxxxxxxxxxxxxx	2022年07月29日	verified	高
3	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx.xxxxxx.xxxxxxx-xxx.xxx	Xxxxxxxxxxxxxx	2022年07月21日	verified	高
4	XXX.XX.XXX.XX		Xxxxxxxxxxxxxx	2022年07月21日	verified	高

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	高
2	T1040	CAPEC-102	CWE-294	Authentication Bypass by Capture-replay	predictive	高
3	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	高
4	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
5	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	高
6	TXXXX	CAPEC-104	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
7	TXXXX.XXX	CAPEC-0	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	高
8	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
9	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
10	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
11	TXXXX	CAPEC-0	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	高
12	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	高
13	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	高
14	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	高
15	TXXXX	CAPEC-102	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
16	TXXXX.XXX	CAPEC-154	CWE-XXX	Xxxxxxxxxxxx	predictive	高
17	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
18	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
19	TXXXX	CAPEC-112	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
20	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (100)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/backupsettings.conf	predictive	高
2	File	/export	predictive	低
3	File	/horde/util/go.php	predictive	高
4	File	/show_news.php	predictive	高
5	File	/uncpath/	predictive	中
6	File	adclick.php	predictive	中
7	File	admin/dashboard.php	predictive	高
8	File	admin/index.php	predictive	高
9	File	admin/tools/dolibarr_export.php	predictive	高
10	File	adv_remotelog.asp	predictive	高
11	File	api.php	predictive	低
12	File	xxx/xxxxx/xxxxxxxxxx/xxxx.xxx	predictive	高
13	File	xxxx-xxxx.x	predictive	中
14	File	xxxxxxx.xx	predictive	中
15	File	xxxx.xxx	predictive	中
16	File	x:\xxxxxxxxxx	predictive	高
17	File	xxx.xxx	predictive	低
18	File	xxx.xxx	predictive	低
19	File	xxx_xxx_xxx.xxx	predictive	高
20	File	xxxxxxxxxx.xxxxxx.xxx	predictive	高
21	File	xxxxxxxxxx_xxxxx.xxx	predictive	高
22	File	xxxxxx.xx	predictive	中
23	File	xxxx/xxx/xxxxx/xxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxx.xxxxxxxx	predictive	高
24	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
25	File	xxxxxxxxxx_xxxxxx.x	predictive	高
26	File	xxx.xxx	predictive	低
27	File	xxxxxxx.xxx	predictive	中
28	File	xxxxx.xxx	predictive	中
29	File	xxxxx.xxx	predictive	中
30	File	xxxxxxxx/xxxxxx/xxxxx.xxx	predictive	高
31	File	xxxxxxxx.xxx	predictive	中
32	File	xxxxxx/x.xxx	predictive	中
33	File	xxx/xxxxxx.xxx	predictive	高
34	File	xxxxxxxx/xxxxxxx/xxxxx_xxxxxxx.xxx	predictive	高
35	File	xxxxx.xxxx	predictive	中
36	File	xxxxx.xxx	predictive	中
37	File	xx xxx/xxxx/xxxx.x	predictive	高
38	File	xxx/xxxxxx.xxx	predictive	高
39	File	xxxxxx/xxx/xxxxxxxx.x	predictive	高
40	File	xxxxxxxxxxx/xx_xxxxxxxxxx.x	predictive	高
41	File	xxxx/xxxxxxx/xxxxxxxxxxxxx.xx	predictive	高
42	File	xxxx/xxxxxxx/xxxxxxx.x	predictive	高
43	File	xxxxx.xxx	predictive	中
44	File	xxxxxxxxxxx.xxx	predictive	高
45	File	xxxx/xxxxxxxx/xxxxxx_xxxx.xxx	predictive	高
46	File	xxxxxxx/xxxxxxxx/xxxxxxxx/xxxxxx.xxx	predictive	高
47	File	xxxxx.xxx	predictive	中
48	File	xxxxxxxxx/xxxx-xxxx	predictive	高
49	File	xxxxxxx.xxx	predictive	中
50	File	xxxxxxxxxxxx.xx	predictive	高
51	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	高
52	File	xxxxxx.x	predictive	中
53	File	xxxx_xxxxxxx.xxx	predictive	高
54	File	xxxxx.x	predictive	低
55	File	xxxx.xx	predictive	低
56	File	xxxxxxxx.xxx	predictive	中
57	File	xxxxxx.xxx	predictive	中
58	File	xxxxxxxx/xxxxx_xxxxx	predictive	高
59	File	xxxx-xxxxxxx-xxxxxx.xxx	predictive	高
60	File	xxxxxx/xx/xxxx.xxx	predictive	高
61	File	xx-xxxxx/xxxxxxxx/xxxxx-xx-xxxxx-xxxx.xxx	predictive	高
62	File	xx-xxxx.xxx	predictive	中
63	File	xx/xxx.xxx	predictive	中
64	File	~/xxx/xxxx-xxxxxxxxx.xxx	predictive	高
65	Argument	xxxxxxxx	predictive	中
66	Argument	xxx_xxxxxx_x	predictive	中
67	Argument	xxx	predictive	低
68	Argument	xxxxxx	predictive	低
69	Argument	xxxxxxxxxx	predictive	中
70	Argument	xxxx	predictive	低
71	Argument	xxxxxxxxxxxx	predictive	中
72	Argument	xxxxx xxxx/xxxx xxxx	predictive	高
73	Argument	xxxxxxx	predictive	低
74	Argument	xxxxx	predictive	低
75	Argument	xxxx_xxx	predictive	中
76	Argument	xxxx	predictive	低
77	Argument	xx	predictive	低
78	Argument	xx_xxxxxxx	predictive	中
79	Argument	xxxxxx	predictive	低
80	Argument	xxxxxxxx_xxx	predictive	中
81	Argument	xxxx	predictive	低
82	Argument	x_xxx_xxxxxx	predictive	中
83	Argument	xxxxxxxxxxxx	predictive	中
84	Argument	xxxx_xxxxx	predictive	中
85	Argument	xxxxxxxx	predictive	中
86	Argument	xxxxxxxxxxx	predictive	中
87	Argument	xxxxxxxxx	predictive	中
88	Argument	xxxx_xxxxxx/xxxxxx/xxxxxx	predictive	高
89	Argument	xxxxxxxxxxxxxxxx	predictive	高
90	Argument	xxxxx	predictive	低
91	Argument	xxxx	predictive	低
92	Argument	xxx	predictive	低
93	Argument	xxx	predictive	低
94	Argument	xxxx	predictive	低
95	Argument	xxxxx	predictive	低
96	Argument	xxxxxxxxxxx_xxxxxxxx	predictive	高
97	Input Value	x.x.x.x%xxxxxx+-x+x+xxx.xxx.x.xx%xx	predictive	高
98	Input Value	xxx (xxxxxx xxxx xxxx(xxxxxx xxxxx(),xxxxxx(xxxxxxxxxxxx,(xxxxxx (xxx(xxxx=xxxx,x))),xxxxxxxxxxxx,xxxxx(xxxx(x)x))x xxxx xxxxxxxxxxx_xxxxxx.xxxxxxxxx_xxxx xxxxx xx x)x)	predictive	高
99	Network Port	xxx/xxxxx	predictive	中
100	Network Port	xxx/xxxx	predictive	中

参考 (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Do you need the next level of professionalism?

Upgrade your account now!