Gafgyt 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (495)

言語

en	412
ru	66
es	4
sv	4
pl	4

国・地域

us	256
sc	180
li	14
ru	12
ca	4

アクター

Mirai	6
Bashlite	4
Cobalt Strike	3
Nanocore RAT	3
Gafgyt	2

関心

タイプ

Not Defined	130
Content Management System	48
Operating System	24
Web Server	20
Firewall Software	18

ベンダー

Not Defined	128
Microsoft	40
Apache	28
Joomla	22
Apple	12

製品

Joomla CMS	22
Apache HTTP Server	20
Microsoft Windows	20
Microsoft Exchange Server	10
Google Android	8

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00000	6.14
2	Zyxel ARMOR Z1/ARMOR Z2 CGI Program 特権昇格	8.8	8.8	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00053	0.00	CVE-2021-4029
3	spring-boot-actuator-logview LogViewEndpoint.view ディレクトリトラバーサル	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00052	0.04	CVE-2023-29986
4	Apache HTTP Server 特権昇格	5.3	5.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00044	0.06	CVE-2023-38709
5	Joomla CMS com_actionslogs 特権昇格	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01310	0.00	CVE-2019-12765
6	esoftpro Online Guestbook Pro ogp_show.php SQLインジェクション	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00135	0.05	CVE-2010-4996
7	Microsoft Windows Active Directory Federation Services ls 特権昇格	7.9	7.9	$25k-$100k	$25k-$100k	Not Defined	Not Defined	0.00426	0.03	CVE-2018-16794
8	CKFinder File Name 特権昇格	7.4	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00155	0.04	CVE-2019-15862
9	Joomla CMS Cache 情報の漏洩	6.4	6.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00326	0.03	CVE-2017-9933
10	Joomla CMS CSRF Token クロスサイトスクリプティング	5.2	4.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00571	0.00	CVE-2017-9934
11	Jetty URI 特権昇格	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.48917	0.00	CVE-2021-34429
12	Microsoft Windows SNMP GET Remote Code Execution	7.3	7.0	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.45448	0.00	CVE-1999-0517
13	GitLab Community Edition/Enterprise Edition Password Reset 特権昇格	8.0	7.9	$0-$5k	$0-$5k	High	Official Fix	0.95952	0.00	CVE-2023-7028
14	Kyocera MFP Net View 情報の漏洩	6.9	6.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01011	0.03	CVE-2022-1026
15	WordPress SQLインジェクション	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00467	0.00	CVE-2022-21664
16	SAP Knowledge Warehouse KW クロスサイトスクリプティング	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00425	0.04	CVE-2021-42063
17	portable SDK for UPnP unique_service_name メモリ破損	10.0	9.5	$0-$5k	$0-$5k	High	Official Fix	0.97414	0.05	CVE-2012-5958
18	Dropbear SSH 特権昇格	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02911	0.04	CVE-2016-7406
19	Joomla CMS mod_latestactions クロスサイトスクリプティング	5.2	4.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00103	0.00	CVE-2020-24599
20	Bitrix Site Manager Vote Module Remote Code Execution	7.3	7.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00668	0.04	CVE-2022-27228

キャンペーン (3)

These are the campaigns that can be associated with the actor:

CVE-2014-8361 / CVE-2017-17215 / CVE-2017-18368
Xxx-xxxx-xxxx / Xxx-xxxx-xxxx
Xxxx Xxxxxxx

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	キャンペーン	Identified	タイプ	信頼度
1	46.249.32.109	reverse.hostingbb.com	Gafgyt	DDoS Ukraine	2022年02月25日	verified	高
2	172.245.6.134	172-245-6-134-host.colocrossing.com	Gafgyt		2022年02月25日	verified	高
3	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xx.xxx.xx	Xxxxxx	Xxx-xxxx-xxxx / Xxx-xxxx-xxxx	2021年08月29日	verified	高
4	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xx.xxx.xx	Xxxxxx	Xxx-xxxx-xxxx / Xxx-xxxx-xxxx	2021年08月29日	verified	高
5	XXX.XXX.XXX.XXX		Xxxxxx	Xxx-xxxx-xxxx / Xxx-xxxx-xxxxx / Xxx-xxxx-xxxxx	2021年08月30日	verified	高
6	XXX.XXX.XXX.X	xxxxxxxxxxxxxxx.xxxx	Xxxxxx		2022年02月25日	verified	高
7	XXX.XXX.XX.XX		Xxxxxx	Xxxx Xxxxxxx	2022年02月25日	verified	高
8	XXX.XXX.XXX.XX		Xxxxxx	Xxxx Xxxxxxx	2022年02月25日	verified	高

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-21, CWE-22, CWE-23	Path Traversal	predictive	高
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	高
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
4	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	高
5	T1068	CAPEC-122	CWE-264, CWE-266, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	高
6	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
7	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
8	TXXXX	CAPEC-	CWE-XXXX	Xxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxx Xxxxxxxx Xxxx Xx X Xxxxxxxx Xxxxxx	predictive	高
9	TXXXX	CAPEC-1	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	高
10	TXXXX.XXX	CAPEC-492	CWE-XXXX	Xxxxxxxxxxx Xxxxxxx Xxxxxxxxxx Xxxxxxxxxx	predictive	高
11	TXXXX	CAPEC-108	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	高
12	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	高
13	TXXXX	CAPEC-55	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
14	TXXXX	CAPEC-37	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
15	TXXXX.XXX	CAPEC-154	CWE-XXX	Xxxxxxxxxxxx	predictive	高
16	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	高
17	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
18	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
19	TXXXX	CAPEC-112	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
20	TXXXX.XXX	CAPEC-112	CWE-XXX, CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	高
21	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (129)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/adfs/ls	predictive	中
2	File	/admin/sysmon.php	predictive	高
3	File	/api/content/posts/comments	predictive	高
4	File	/cimom	predictive	低
5	File	/debug/pprof	predictive	中
6	File	/forum/away.php	predictive	高
7	File	/Home/GetAttachment	predictive	高
8	File	/LogoStore/search.php	predictive	高
9	File	/MIME/INBOX-MM-1/	predictive	高
10	File	/modules/projects/vw_files.php	predictive	高
11	File	/sm/api/v1/firewall/zone/services	predictive	高
12	File	/usr/bin/pkexec	predictive	高
13	File	/var/run/zabbix	predictive	高
14	File	adclick.php	predictive	中
15	File	xxxxx/xxxxxx.xxx	predictive	高
16	File	xxxxxxx.xxx	predictive	中
17	File	xxxxxxxxxxxxxxxxxxxxx.xxx	predictive	高
18	File	xxxx-xxxx.x	predictive	中
19	File	xxxxxx.xxx	predictive	中
20	File	xxxxxx/xxxxxxxxx/xxxxxxxx/xxxxxxxxxx/xxxxxx/xxxx/xxxx_xxxxxxxx/xxxxxx.xx	predictive	高
21	File	xxxxxxxxxxxxxxx.xxx	predictive	高
22	File	xxx-xxx/xxxxxxx.xx	predictive	高
23	File	xxx-xxx/xxxx_xxx.xxx	predictive	高
24	File	xxxxxx.x	predictive	中
25	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	高
26	File	xxxx/xxxx	predictive	中
27	File	xxxxxx.xxx	predictive	中
28	File	xxxxxx_xxx.x	predictive	中
29	File	xxxxxxxxxxxxxx.xx	predictive	高
30	File	xxxxxxxx.xxxx	predictive	高
31	File	xxxxxxxxxx.xxxx	predictive	高
32	File	xx/xxxxxxx/xxx.x	predictive	高
33	File	xxx/xx/xxxx/xxxx.xxxxx.xxx	predictive	高
34	File	xxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxx	predictive	高
35	File	xxxxx.xxx	predictive	中
36	File	xxxxxxx.xxx	predictive	中
37	File	xxxx_xxxxxxx.xxxx	predictive	高
38	File	xxxxxx.x	predictive	中
39	File	xxxxxxxx.xxx	predictive	中
40	File	xxxxxx_x.xx.x	predictive	高
41	File	xxxxxx.xx	predictive	中
42	File	xxxxxxxxxxxx/xxx.x	predictive	高
43	File	xxx_xxxxxxxxx.x	predictive	高
44	File	xxxxxxx.xxx	predictive	中
45	File	xxx_xxxx.xxx	predictive	中
46	File	xxx_xxxxx_xxxx.x	predictive	高
47	File	xxxxxxxxxxxxxx.xxxxx	predictive	高
48	File	xxx_xxxx.xxx	predictive	中
49	File	xxxxxxx.xxx	predictive	中
50	File	xxxxxxx/xxxx	predictive	中
51	File	xxx/xxxxx.xxxx	predictive	高
52	File	xxxxxxx.xxx	predictive	中
53	File	xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
54	File	xxxxxxxx/xxx/xxxx_xxxxxxxxx/xxxx_xxxxxx_xxxxxxx/xxxx_xxxxxx_xxxxxxx.xxx	predictive	高
55	File	xxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	高
56	File	xxxxxxxx.xxx	predictive	中
57	File	xxxxxxxx_xxxxxxxxxxxx_xxxxxx.xx	predictive	高
58	File	xxx_xxxxx_xxxxxxxxx.x	predictive	高
59	File	xxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxx	predictive	高
60	File	xxxxx.xxx	predictive	中
61	File	xxx/xxxx.xx	predictive	中
62	File	xxxxxxxxxxxxxxx.xxx	predictive	高
63	File	xxxxxxxx/xxxxxxxxxxxx-xxxxxxxxxx	predictive	高
64	File	xxxxxx/xxxxxxx/xxxxxx/xxxxxxxx.xxx	predictive	高
65	File	xxxx.xxx	predictive	中
66	File	xxxxx.xxx	predictive	中
67	File	xxx.xxx	predictive	低
68	File	xxx xxxx xxxxxxx	predictive	高
69	File	xx-xxxxx/xxxxx-xxxxxx.xxx	predictive	高
70	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	高
71	File	xx-xxxxxxxx/xxxx.xxx	predictive	高
72	File	xxxxxx.xxx?xxxxxx=xxxxxxxxx.xxxx&xxxxxxxxxxx=x	predictive	高
73	Library	xxx-xx-xxx-xxxx-xxxx-xx-x-x.xxx	predictive	高
74	Library	xxxx.xxx	predictive	中
75	Argument	-x	predictive	低
76	Argument	xxxxxx	predictive	低
77	Argument	xxxxxxxxxxxxxx	predictive	高
78	Argument	xxxxxxx	predictive	低
79	Argument	xxxxxx	predictive	低
80	Argument	xxxxx$xxxxxxxxxxxxxx$xxxxxxxxxxx	predictive	高
81	Argument	xxxxxxx	predictive	低
82	Argument	xxxxxx/xxxxxxx	predictive	高
83	Argument	xxxxxxxx[xxxx_xxx]	predictive	高
84	Argument	xxxxxx	predictive	低
85	Argument	xxxxxx	predictive	低
86	Argument	xxxxxxx[xx_xxx_xxxx]	predictive	高
87	Argument	xxxx	predictive	低
88	Argument	xxxxxxxx xxxx/xxxxxxxx xxxxxxxx/xxxxxxxx xxxxxxx xx/xxxxxxx/xxxx	predictive	高
89	Argument	xx	predictive	低
90	Argument	xxxxxxxxxxx	predictive	中
91	Argument	xxxxxxx_xxxx	predictive	中
92	Argument	xxxx	predictive	低
93	Argument	xxxxx	predictive	低
94	Argument	xxxxxxxx	predictive	中
95	Argument	xxxxxxxxxx	predictive	中
96	Argument	xxxx_xxx_xxxxxxxx_xxx	predictive	高
97	Argument	xxxxxxxxxxxxxxxx	predictive	高
98	Argument	xxxxxxx	predictive	低
99	Argument	xxxxxxxx	predictive	中
100	Argument	xxxxxxxx	predictive	中
101	Argument	xxxxxxxx	predictive	中
102	Argument	xxxx_xx	predictive	低
103	Argument	xx	predictive	低
104	Argument	xxxxx	predictive	低
105	Argument	xxxxx/xxxxxxxx	predictive	高
106	Argument	xxxxx	predictive	低
107	Argument	xxxxxx	predictive	低
108	Argument	xxxxxx_xxxxxx	predictive	高
109	Argument	xxxxxx_xxxxxx	predictive	高
110	Argument	xxxxx_xxxxxx_xxxxxxxx	predictive	高
111	Argument	xxx	predictive	低
112	Argument	xx_xxx_xxxxx	predictive	中
113	Argument	xxxxxxxxxxx	predictive	中
114	Argument	xxx	predictive	低
115	Argument	xxxxxxxx/xxxx	predictive	高
116	Argument	xxxxx	predictive	低
117	Input Value	../	predictive	低
118	Input Value	x!x@x#x$x%x	predictive	中
119	Input Value	xxxx' xxxxx xxx xxxxxx xxxxxx(xxxxxx('xxxxx','xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'),'xxxxx'),xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx,xxxx-- xxxx&xxxxxx=	predictive	高
120	Input Value	\x	predictive	低
121	Pattern	xxxxxxx-xxxx\|xx\|	predictive	高
122	Pattern	\|xx\|xx\|xx\|	predictive	中
123	Pattern	\|xx xx xx xx\|	predictive	高
124	Network Port	xxxx/xxxx	predictive	中
125	Network Port	xxx/xx (xxxx)	predictive	高
126	Network Port	xxx/xx	predictive	低
127	Network Port	xxx/xxx	predictive	低
128	Network Port	xxx/xxxx	predictive	中
129	Network Port	xxx/xxxx	predictive	中

参考 (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!