Ekipa RAT 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (166)

言語

en	104
de	22
ja	22
zh	4
fr	2

国・地域

us	162
ru	4

アクター

Ekipa RAT	4
Cobalt Strike	3
RedLine Stealer	3
Rhadamanthys	2
Ave Maria	2

関心

タイプ

Not Defined	78
Photo Gallery Software	10
Content Management System	8
Forum Software	6
Mail Server Software	6

ベンダー

Not Defined	56
Microsoft	8
Atlassian	4
Coinsoft Technologies	4
Fortinet	4

製品

Bludit	6
Atlassian Data Center	4
ferretCMS	4
Coinsoft Technologies phpCOIN	4
Microsoft Windows	4

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	Hassan Consulting Shopping Cart shop.cgi ディレクトリトラバーサル	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02149	0.06	CVE-2000-0921
2	Squitosoft Squito Gallery photolist.inc.php メモリ破損	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01371	0.04	CVE-2005-2258
3	PhotoPost PhotoPost vBGallery File Upload upload.php 特権昇格	6.3	5.8	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00546	0.06	CVE-2008-7088
4	Midicart Software MidiCart PHP Shopping Cart search_list.php クロスサイトスクリプティング	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.07338	0.03	CVE-2005-1502
5	HP Integrated Lights-Out 情報の漏洩	9.8	8.5	$5k-$25k	$0-$5k	Unproven	Official Fix	0.02286	0.02	CVE-2012-3271
6	Dell EMC PowerScale OneFS master.passwd 未知の脆弱性	4.1	4.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00044	0.00	CVE-2022-22563
7	Asternic Flash Operator Panel User Control Panel 特権昇格	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00214	0.04	CVE-2018-5694
8	Ilohamail クロスサイトスクリプティング	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.06
9	Cybernetikz Easy Social Icons Authentication admin.php 未知の脆弱性	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00554	0.00	CVE-2015-2084
10	HD FLV PLayer Plugin functions.php hd_update_media SQLインジェクション	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00152	0.15	CVE-2012-10011
11	Franklin Fueling Systems Colibri Controller Module ディレクトリトラバーサル	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.64772	0.07	CVE-2021-46417
12	Fortinet FortiADC クロスサイトスクリプティング	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00070	0.04	CVE-2022-38374
13	FacileForms facileforms.frame.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01845	0.02	CVE-2008-2990
14	htmltonuke htmltonuke.php 特権昇格	7.3	6.7	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.01849	0.04	CVE-2006-0308
15	SimpleBoard file_upload.php 特権昇格	8.1	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.12891	0.00	CVE-2006-3528
16	Skrypty Ppa Gallery functions.inc.php メモリ破損	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02429	0.02	CVE-2005-2199
17	Mamboxchange Extended Registration registration_detailed.inc.php 特権昇格	7.3	6.4	$0-$5k	$0-$5k	Unproven	Unavailable	0.05054	0.04	CVE-2006-5254
18	EyouCMS Index.php wechat_return XML External Entity	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00087	0.00	CVE-2021-42194
19	BD Totalys MultiProcessor 弱い認証	8.1	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.04	CVE-2022-40263
20	Sennheiser HeadSetup Certificates SennComCCKey.pem Key 弱い認証	5.7	5.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00457	0.05	CVE-2018-17612

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	アクター	Identified	タイプ	信頼度
1	85.208.136.130	Ekipa RAT	2024年02月27日	verified	高
2	146.70.87.148	Ekipa RAT	2024年02月27日	verified	高
3	XXX.XX.XX.XXX	Xxxxx Xxx	2024年02月27日	verified	高
4	XXX.XX.XX.XXX	Xxxxx Xxx	2024年02月27日	verified	高
5	XXX.XXX.XXX.XXX	Xxxxx Xxx	2024年02月27日	verified	高
6	XXX.XXX.XXX.XXX	Xxxxx Xxx	2024年02月27日	verified	高
7	XXX.XX.XX.XXX	Xxxxx Xxx	2024年02月27日	verified	高

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-21, CWE-22	Path Traversal	predictive	高
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	高
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
5	TXXXX.XXX	CAPEC-16	CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
6	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
7	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	高
8	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	高
9	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
10	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
11	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (159)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/bl-plugins/backup/plugin.php	predictive	高
2	File	/cgi-bin/nightled.cgi	predictive	高
3	File	/controller/Index.php	predictive	高
4	File	/etc/master.passwd	predictive	高
5	File	/etc/passwd	predictive	中
6	File	/opt/zimbra/jetty/webapps/zimbra/public	predictive	高
7	File	/secure/admin/InsightDefaultCustomFieldConfig.jspa	predictive	高
8	File	/secure/admin/RestoreDefaults.jspa	predictive	高
9	File	/wmiwizard.jsp	predictive	高
10	File	accounts/inc/include.php	predictive	高
11	File	acrotxt.php	predictive	中
12	File	addpost_newpoll.php	predictive	高
13	File	admin.php	predictive	中
14	File	admin.php/index/upload because app/common/service/UploadService.php	predictive	高
15	File	admin/handlers.php	predictive	高
16	File	adminBoards.php	predictive	高
17	File	adminSmileys.php	predictive	高
18	File	akocomments.php	predictive	高
19	File	ampie.swf	predictive	中
20	File	xxxxxxxxxxx/xxxxxx/xxxxxx.xxx	predictive	高
21	File	xxxxxxxx.xxxxxxx.xxx	predictive	高
22	File	xxxxxxxxx/xxxxx.xxx	predictive	高
23	File	xx-xxxxxx/xxxx/xxxxxx-xxxx.xxx	predictive	高
24	File	xx-xxxxxx/xxxxx/xxxxxxxxxxx/xxxx-xxxxxxxx.xxx	predictive	高
25	File	xx-xxxxxx/xxxx/xxxxxx-xxxxxx.xxx	predictive	高
26	File	xx-xxxxxx/xxxxxxxx.xxxxx.xxx	predictive	高
27	File	xx_xxxxxxxxx_xxxx.xxx	predictive	高
28	File	xx_xxxxxxxxxx_xxxx.xxx	predictive	高
29	File	xxxxx.xxx	predictive	中
30	File	xx_xxxx.xxx	predictive	中
31	File	xxxx_xxxxxxx.xxx	predictive	高
32	File	xxx-xxx/xxxxxxx.xx	predictive	高
33	File	xxx-xxx/xxxxxxxx.xxx	predictive	高
34	File	xxxx_xxxxxxxx/xx.xxx	predictive	高
35	File	xxxxxxxx_xxxxxxx.xxx	predictive	高
36	File	xxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
37	File	xxxxxxxxx.xxx	predictive	高
38	File	xxxxxxxxxxx\xxxxx.xxx	predictive	高
39	File	xxx.xxx	predictive	低
40	File	xxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
41	File	xxxxxx.xxx	predictive	中
42	File	xxxxxxx.xxx	predictive	中
43	File	xxxxxxxxxxxxxxx.xxx	predictive	高
44	File	xxxxxxxx_xxx.xxx	predictive	高
45	File	xxxxxxxx.xx	predictive	中
46	File	xxxxxxxx.xxx.xxx	predictive	高
47	File	xxxxxxxxxxx.xxxxx.xxx	predictive	高
48	File	xxxxx_xxxxxx.x	predictive	高
49	File	xxxx_xxxxxx.xxx	predictive	高
50	File	xxxxxxxxx.xxx	predictive	高
51	File	xxxxxxx.xxx	predictive	中
52	File	xxxxxxxxxx.xxx	predictive	高
53	File	xxxxx_xxxxxx.xxx	predictive	高
54	File	xxxxxxxxx.xxx	predictive	高
55	File	xxx/xxxxxxxxx.xxx.xxx	predictive	高
56	File	xxx_xxxxxxxxxxxxxx.xxx	predictive	高
57	File	xxxxx.xxx	predictive	中
58	File	xxxx.xxx.xxx	predictive	中
59	File	xxxxxxx.xxxxxxxxxx.xxx	predictive	高
60	File	xxxxxxxxxx/xxxxx.xx	predictive	高
61	File	xxxx_xxxx.xxx	predictive	高
62	File	xxx_xxxxxxx.xxx	predictive	高
63	File	xxxxx.xxx	predictive	中
64	File	xxx_xxxx.xxx	predictive	中
65	File	xxxx.xxx	predictive	中
66	File	xxxxxxxxxxxxx.xxxx	predictive	高
67	File	xxxxxxxxx.xxx	predictive	高
68	File	xxx_xxxxx.xxx	predictive	高
69	File	xxxxx.xxxxxxxxxx.xxx	predictive	高
70	File	xxxxxxxxx.xxx.xxx	predictive	高
71	File	xxxxxxxx.xxx	predictive	中
72	File	xxxxxxxxxxxxxxxxxxxxxxxxxxx!xxxxxxx.xxxx	predictive	高
73	File	xxxxxxxxxxxx_xxxxxxxx.xxx.xxx	predictive	高
74	File	xxxxxxx_xxxxxx_xxxxx.xxx	predictive	高
75	File	xxxxxxx_xxxxxx_xxxxxx.xxx	predictive	高
76	File	xxxxxx_xxxx.xxx	predictive	高
77	File	xxxxxxxxxxxx.xxx	predictive	高
78	File	xxxx$xx.xxx	predictive	中
79	File	xxxx.xxx	predictive	中
80	File	xxxx.xxx	predictive	中
81	File	xxxxxxx.xxx	predictive	中
82	File	xxxxxxxxxxxxxxxx.xxx	predictive	高
83	File	xxxxx/xxxxxxxx/xxxxxxxxx.xxx	predictive	高
84	File	xxxx_xxxxxxx.xxxxx.xxx	predictive	高
85	File	xxxxx_xxxxx.xxx	predictive	高
86	File	xxx-xxxxxxxxx.xxx	predictive	高
87	File	xxxxxx.xxx	predictive	中
88	File	xxxxxxxxx.xxx	predictive	高
89	File	xx-xxxxx/xxxxx.xxx	predictive	高
90	File	xxxxxx.xxx	predictive	中
91	File	_xxxxxxxxx.xxx	predictive	高
92	File	~/xxx/xxxxx.xxx	predictive	高
93	Library	xxxxxx[xxxxxx_xxxx	predictive	高
94	Library	xxxxxx.xxxxxxx('xxxxx_xxxx:/xxx/xxxxxx')	predictive	高
95	Argument	xxxxxx	predictive	低
96	Argument	xxxx_xxxx	predictive	中
97	Argument	xxxxxxxx	predictive	中
98	Argument	xxxxx	predictive	低
99	Argument	xxxxxx	predictive	低
100	Argument	xxxx_xxx_xxxx	predictive	高
101	Argument	xxx	predictive	低
102	Argument	xxx	predictive	低
103	Argument	xxxxxxxxxx	predictive	中
104	Argument	xxxxxxxxxx	predictive	中
105	Argument	xxxx_xx	predictive	低
106	Argument	xxxxxxx	predictive	低
107	Argument	xxxxxx	predictive	低
108	Argument	xxxxxx[xxxxxx_xxxx]	predictive	高
109	Argument	xxxxxx[xxx_xxxx_xxxx]	predictive	高
110	Argument	xxx_x_xxx	predictive	中
111	Argument	xxxx_xxxx	predictive	中
112	Argument	xxx	predictive	低
113	Argument	xxx[xxx]	predictive	中
114	Argument	xx_xxxxxxx	predictive	中
115	Argument	xxxxxxx	predictive	低
116	Argument	xxxxxxx	predictive	低
117	Argument	xxxxxxx_xxxxxxx	predictive	高
118	Argument	xxxx_xx	predictive	低
119	Argument	xxxxxxxxxxxxxx[xxxxxxxxxxxxxxxxxx]	predictive	高
120	Argument	xx	predictive	低
121	Argument	xxxxx_xxxx	predictive	中
122	Argument	xxxx	predictive	低
123	Argument	xxxxxx	predictive	低
124	Argument	xxxxxx	predictive	低
125	Argument	xxxxxxx	predictive	低
126	Argument	xxx_xxxx_xxxx	predictive	高
127	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	高
128	Argument	xxxxxxx_xxxx	predictive	中
129	Argument	xxxx	predictive	低
130	Argument	xxxx_xxxx	predictive	中
131	Argument	xxxxxx_xxxxxx[xxxxxx_xxxx]	predictive	高
132	Argument	xxxxxx xxxxxx	predictive	高
133	Argument	xxxx	predictive	低
134	Argument	xxxxxxxxx	predictive	中
135	Argument	xxxx_xxxx/xxxxx_xxxx	predictive	高
136	Argument	xxxxxxxxxx[x]	predictive	高
137	Argument	xxxxxx	predictive	低
138	Argument	xxxxx	predictive	低
139	Argument	xxxxxxxxxxx	predictive	中
140	Argument	xxx	predictive	低
141	Argument	xxxxxxxxxxxxxxxxxxx	predictive	高
142	Argument	xxxxxxxxxxxx	predictive	中
143	Argument	xxxx$xx.xxx	predictive	中
144	Argument	xxxx	predictive	低
145	Argument	xxxx_xxxxx_xx	predictive	高
146	Argument	xxxx_xxxx	predictive	中
147	Argument	xxxxx_xxxx	predictive	中
148	Argument	xxxxxx	predictive	低
149	Argument	xxxxxx	predictive	低
150	Argument	xxxxxxxxxx	predictive	中
151	Argument	xxxxxxxx	predictive	中
152	Argument	xxxx	predictive	低
153	Argument	xxxxxxxxxxxxx.xxxxxxxxxx	predictive	高
154	Argument	xxxxxxxx	predictive	中
155	Argument	xxxx_xx	predictive	低
156	Argument	x-xxxxxxxxx-xxx	predictive	高
157	Argument	_xxxx[_xxx_xxxx_xxxx	predictive	高
158	Argument	_xxxx[_xxx_xxxx_xxxx]	predictive	高
159	Network Port	xxx/xxxx	predictive	中

参考 (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!