India Police 解析

IOB - Indicator of Behavior (193)

タイムライン

言語

en164
zh14
es8
fr4
de2

国・地域

us94
cn30
ru10
ag10
au10

アクター

アクティビティ

関心

タイムライン

タイプ

ベンダー

製品

WordPress12
Microsoft Windows12
Google Android8
Oracle GlassFish Server6
Microsoft IIS4

脆弱性

#脆弱性BaseTemp0day本日修復EPSSCTICVE
1Microsoft IIS IP/Domain Restriction 特権昇格6.55.7$25k-$100k$0-$5kUnprovenOfficial Fix0.008170.44CVE-2014-4078
2Adiscon LogAnalyzer Login Button Referer Field login.php クロスサイトスクリプティング5.24.7$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.002410.02CVE-2018-19877
3Apple iOS IOMobileFramebuffer メモリ破損8.38.1$25k-$100k$0-$5kNot DefinedOfficial Fix0.001670.02CVE-2016-4654
4Sunny WebBox 未知の脆弱性7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.001500.02CVE-2019-13529
5Bitrix Site Manager Vote Module Remote Code Execution7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.006680.07CVE-2022-27228
6WordPress Password Reset wp-login.php mail 特権昇格6.15.8$5k-$25k$0-$5kProof-of-ConceptNot Defined0.028270.06CVE-2017-8295
7Jalios JCMS ajaxPortal.jsp クロスサイトスクリプティング5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.001280.02CVE-2020-15497
8XiongMai uc-httpd メモリ破損8.58.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.022010.03CVE-2018-10088
9Websense Forcepoint User ID Service Port 5001 特権昇格8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.144810.02CVE-2019-6139
10F5 BIG-IP Configuration Utility ディレクトリトラバーサル4.33.9$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.033430.00CVE-2015-4040
11WordPress WP_Query class-wp-query.php SQLインジェクション8.58.4$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.003180.02CVE-2017-5611
12Microsoft Windows Remote Desktop Service 特権昇格10.09.0$100k 以上$0-$5kHighOfficial Fix0.788950.00CVE-2012-0002
13Kentico CMS 特権昇格6.76.7$0-$5k$0-$5kNot DefinedNot Defined0.004220.00CVE-2018-7046
14Drei 3Kundenzone X.509 Certificate 弱い暗号化6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.000490.00CVE-2014-5828
15vsftpd deny_file 未知の脆弱性3.73.6$0-$5k$0-$5kNot DefinedOfficial Fix0.003120.04CVE-2015-1419
16Totolink A7100RU HTTP POST Request main メモリ破損9.89.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000790.07CVE-2023-7095
17D-Link DCS-936L info.cgi 情報の漏洩6.46.4$5k-$25k$5k-$25kNot DefinedNot Defined0.006210.02CVE-2018-18441
18SMA Solar Sunny WebBox 弱い認証7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.005680.03CVE-2015-3964
19Microsoft Windows HTML Remote Code Execution5.85.7$25k-$100k$25k-$100kFunctionalOfficial Fix0.531400.06CVE-2023-36884
20Maxprint Maxlink 1200G Diagnostic Tool 特権昇格7.17.1$0-$5k$0-$5kNot DefinedNot Defined0.000880.00CVE-2023-36143

キャンペーン (1)

These are the campaigns that can be associated with the actor:

  • Spyware

IOC - Indicator of Compromise (44)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIPアドレスHostnameアクターキャンペーンIdentifiedタイプ信頼度
15.1.82.1065-1-82-106.static.creoline.netIndia PoliceSpyware2022年06月28日verified
28.5.1.33India PoliceSpyware2022年06月28日verified
38.5.1.49India PoliceSpyware2022年06月28日verified
434.246.254.156ec2-34-246-254-156.eu-west-1.compute.amazonaws.comIndia PoliceSpyware2022年06月28日verified
536.86.63.182India PoliceSpyware2022年06月28日verified
652.4.209.250ec2-52-4-209-250.compute-1.amazonaws.comIndia PoliceSpyware2022年06月28日verified
754.210.47.225ec2-54-210-47-225.compute-1.amazonaws.comIndia PoliceSpyware2022年06月28日verified
864.15.205.100India PoliceSpyware2022年06月28日verified
964.15.205.101India PoliceSpyware2022年06月28日verified
10XX.XXX.XXX.XXXxxxx XxxxxxXxxxxxx2022年06月28日verified
11XX.XXX.XXX.XXXxxxx XxxxxxXxxxxxx2022年06月28日verified
12XX.XX.XXX.XXXxxxx.xxxxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
13XX.X.XXX.XXXxxxxxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
14XX.XXX.XX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
15XX.XXX.XXX.XXXxxxx XxxxxxXxxxxxx2022年06月28日verified
16XXX.XXX.XXX.XXXxxx-x.xxxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
17XXX.XXX.XXX.XXxxxx XxxxxxXxxxxxx2022年06月28日verified
18XXX.XXX.XX.XXXxxx-xxx-xx-xxx.xxxxxx-xx-xxxxxxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
19XXX.X.XXX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
20XXX.X.XXX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
21XXX.XXX.XX.XXXxxx-xxxxx.xxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
22XXX.XXX.XX.XXXxxx.xx.xxx.xxx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
23XXX.XX.XXX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
24XXX.XXX.XX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
25XXX.XX.XXX.XXXxxxx XxxxxxXxxxxxx2022年06月28日verified
26XXX.XX.XXX.XXXxxx.xxxxxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
27XXX.XXX.XX.XXXxxx-xxx-xx-xxx.xxxx-xxxxx.xxXxxxx XxxxxxXxxxxxx2022年06月28日verified
28XXX.XXX.XX.XXxxxxxxxxx.xxxxxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
29XXX.XXX.XX.XXxxxxxxxxx.xxxxxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
30XXX.XXX.XXX.XXXxxxx XxxxxxXxxxxxx2022年06月28日verified
31XXX.XX.XXX.XXXxxx.xx.xxx.xxx.xxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
32XXX.XXX.XXX.XXxxx-xxx-xxx-xx.xxxxxx.xxxxxxxxxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
33XXX.XXX.XXX.XXXxxxx XxxxxxXxxxxxx2022年06月28日verified
34XXX.XX.XXX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
35XXX.XX.XXX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
36XXX.XX.XXX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
37XXX.XX.XXX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
38XXX.XXX.XX.XXXxxxx XxxxxxXxxxxxx2022年06月28日verified
39XXX.XX.XX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
40XXX.XX.XX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
41XXX.XX.XXX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
42XXX.XX.XX.XXXxxx-xx-xx-xxx.xxx.xxxxxxxxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified
43XXX.XXX.XXX.XXXXxxxx XxxxxxXxxxxxx2022年06月28日verified
44XXX.XX.XX.XXXxxx.xxxxx.xxxXxxxx XxxxxxXxxxxxx2022年06月28日verified

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (103)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDクラスIndicatorタイプ信頼度
1File%PROGRAMDATA%\Razer Chroma\SDK\Appspredictive
2File.htaccesspredictive
3File/cgi-bin/cstecgi.cgi?action=loginpredictive
4File/cgi-bin/webviewer_login_pagepredictive
5File/common/info.cgipredictive
6File/mgmt/tm/util/bashpredictive
7File/recordings/index.phppredictive
8File/uncpath/predictive
9File/websshpredictive
10Fileadd_vhost.phppredictive
11Fileadmin-ajax.phppredictive
12Filexxx/xxpredictive
13Filexxxxx/xxxxxxx/xxxxxxxxxxxxxpredictive
14Filexxxxxxxxxxxx.xxxxpredictive
15Filexxxxxxxx.xxxpredictive
16Filexxx-xxx/xxxxx/xxxxx.xxxpredictive
17Filexxxxx/xxxxxxxx/xxxxxxxxxxxxxxx.xxxpredictive
18Filexxxxx.xxxxxxxxx.xxxpredictive
19Filexxxxxx/xxxxx.xpredictive
20Filexxxx/xxxxxxxxxxxxxx.xxxpredictive
21Filexxxxxxxxxxxxx.xxxxpredictive
22Filexxx/xxxx/xxxx.xpredictive
23Filexxxxxxxxxxxx.xxxpredictive
24Filexxxxxxxx_xxxpredictive
25Filexxxxxxxxx/xxxx-xxxxxxx-xxx.xxxpredictive
26Filexxxxx.xxxpredictive
27Filexxxx_xxxx.xpredictive
28Filexxxxx.xxxpredictive
29Filexxxxx/xxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxpredictive
30Filexxxx.xxxpredictive
31Filexxxx_xxxx.xxxpredictive
32Filexxxxx/xxxxxx/xxxxxxxxxx.xxxpredictive
33Filexx/xxx/xxxxxxxx/xxx_xxxxxxxxx/xxx_xxxxxxxx_xxxxx/_/xxxxxxx_xxxpredictive
34Filexxxxx.xxxpredictive
35Filexxxxxxx/predictive
36Filexxxxxxxx.xpredictive
37Filexxxxxxx/xxxxxxxx/xxxxxxx/xxxxxxx.xxxx_xxxxxx.xxx/xxxx_xxxxxx.xxxpredictive
38Filexxxxxxx\xxxxxxxxx\xxxxxxx.xxxpredictive
39Filexxx/xxxxxxxxx/xxxxxxxxx_xxxxx.xpredictive
40Filexxxx.xxxpredictive
41Filexxxx_xxx_xxxxxxx.xpredictive
42Filexxxxxxxxxx.xxx.xxxpredictive
43Filexxxxxxx.xxxpredictive
44Filexxxxx_xxx.xxxpredictive
45Filexxx.xpredictive
46Filexxxxxxxx.xxxpredictive
47Filexxxxxxxx.xxpredictive
48Filexxxxxx.xxxxpredictive
49Filexxxxxx_xxxxxxx.xxxpredictive
50Filexxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxxpredictive
51Filexxx%xxxxx-xxxxxxxxxxxxx+xxxxxxx/xxxxxxx+xxxxx+xxxx/predictive
52Filexxxxx/xxxxxx.xpredictive
53Filexxxx.xpredictive
54Filexxxx/xxxxxxxx/xxxxxxxx.xxxxpredictive
55Filexxxxxxxx.xxxpredictive
56Filexxxxx/xxxxxxxxpredictive
57Filexx-xxxxxxxx/xxxxx-xx-xxxxx.xxxpredictive
58Filexx-xxxxx.xxxpredictive
59Filexx/xx/xxxxxpredictive
60Filexxxxxxxxxxxxx.xxpredictive
61Libraryxxxxxxxx_xxxxxxxxx.xxx.xxxpredictive
62Libraryxxx/xxxxxxxxx.xxxpredictive
63Libraryxxxxxxpredictive
64Argument--xxxpredictive
65Argumentxxxxxxx xx/xxxxxxx xxxxpredictive
66Argumentxxxxxxpredictive
67Argumentxxxxxxpredictive
68Argumentxxxxxpredictive
69Argumentxxxxxxxxxxpredictive
70Argumentxxx[xxxxxx][xxxxxxxxx]predictive
71Argumentxxxpredictive
72Argumentxxxpredictive
73Argumentxxxx_xxpredictive
74Argumentxxxxxxpredictive
75Argumentxxxxxpredictive
76Argumentxxxxxxxxpredictive
77Argumentxxxxpredictive
78Argumentxxxxxxxxxpredictive
79Argumentxxxxpredictive
80Argumentxxpredictive
81Argumentxxxxxxpredictive
82Argumentxxxxxxxpredictive
83Argumentxxxx_xxxxxx_xxpredictive
84Argumentxxxxxpredictive
85Argumentxxxxx_xxxxxxxxpredictive
86Argumentxxxpredictive
87Argumentxxxxxxxxpredictive
88Argumentxxxxxxxxpredictive
89Argumentxxxxxxxxxpredictive
90Argumentxxxpredictive
91Argumentxxxxxpredictive
92Argumentxxxxpredictive
93Argumentxxxxxxpredictive
94Argumentxxxxxxxxpredictive
95Argumentxxxxxx_xxxxxxxxpredictive
96Argument_xxxxxxxpredictive
97Input Value%xxpredictive
98Input Value'>[xxx]predictive
99Input Valuexxx.xxxx.%xxx.%xxxpredictive
100Input Value</xxxxxx><xxxxxx>xxxxx(x)</xxxxxx>predictive
101Input Valuexxxxxpredictive
102Pattern|xx xx xx xx|predictive
103Network Portxxx/xxxx (xxx)predictive

参考 (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!