JanelaRAT 解析

IOB - Indicator of Behavior (1000)

タイムライン

言語

en924
de30
ru10
es10
sv6

国・地域

us984
cn10
br4
ir2

アクター

アクティビティ

関心

タイムライン

タイプ

ベンダー

製品

Pearlinger Products8
Microsoft Windows6
Webmin4
Pulse Secure Pulse Connect Secure4
Cybozu Share3602

脆弱性

#脆弱性BaseTemp0day本日修復EPSSCTICVE
1LogicBoard CMS away.php Redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000006.13
2DZCP deV!L`z Clanportal config.php 特権昇格7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009431.10CVE-2010-0966
3FLDS redir.php SQLインジェクション7.37.3$0-$5k$0-$5kHighUnavailable0.002030.21CVE-2008-5928
4Tiki Admin Password tiki-login.php 弱い認証8.07.7$0-$5k$0-$5kNot DefinedOfficial Fix0.009366.68CVE-2020-15906
5My Link Trader out.php SQLインジェクション6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.21
6Bitrix Site Manager redirect.php 特権昇格5.34.7$0-$5k$0-$5kUnprovenUnavailable0.001130.03CVE-2008-2052
7PHP phpinfo クロスサイトスクリプティング4.33.9$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.019600.00CVE-2007-1287
8SAS Web Report Studio javascript: URL logonAndRender.do クロスサイトスクリプティング3.53.4$0-$5k$0-$5kNot DefinedNot Defined0.000890.00CVE-2022-25256
9Vunet VU Web Visitor Analyst redir.asp SQLインジェクション7.37.1$0-$5k$0-$5kHighWorkaround0.001190.03CVE-2010-2338
10Serendipity exit.php 特権昇格6.36.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.000000.76
11OpenX adclick.php Redirect5.34.7$0-$5k$0-$5kUnprovenUnavailable0.004400.69CVE-2014-2230
12Lars Ellingsen Guestserver guestbook.cgi クロスサイトスクリプティング4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.001690.21CVE-2005-4222
13Microsoft Windows Roaming Security Rights Management Services Remote Code Execution8.17.4$100k 以上$5k-$25kUnprovenOfficial Fix0.008500.06CVE-2022-21974
14GetSimpleCMS index.php Redirect6.66.6$0-$5k$0-$5kNot DefinedNot Defined0.001230.00CVE-2019-9915
15vBulletin redirector.php Redirect6.66.6$0-$5k$0-$5kNot DefinedNot Defined0.001060.28CVE-2018-6200
16Atlassian Jira Service Management Server/Data Center InsightDefaultCustomFieldConfig.jspa クロスサイトスクリプティング3.53.4$0-$5k$0-$5kNot DefinedOfficial Fix0.000540.00CVE-2021-43943
17PHPWind goto.php Redirect6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.003480.21CVE-2015-4134
18Openads adclick.php Remote Code Execution7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.018710.55CVE-2007-2046
19Atlassian JIRA Server/Data Center Thread Contention/CPU Monitoring Service ViewInstrumentation.jspa 未知の脆弱性4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000740.00CVE-2021-43953
20Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation8.17.4$100k 以上$5k-$25kUnprovenOfficial Fix0.000430.02CVE-2022-24507

IOC - Indicator of Compromise (12)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (301)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDクラスIndicatorタイプ信頼度
1File/admin/general.cgipredictive
2File/Admin/login.phppredictive
3File/admin/reminders/manage_reminder.phppredictive
4File/API/infopredictive
5File/CCMAdmin/serverlist.asppredictive
6File/cgi/get_param.cgipredictive
7File/csms/admin/inquiries/view_details.phppredictive
8File/cstecgi.cgipredictive
9File/files.md5predictive
10File/forum/away.phppredictive
11File/home/searchpredictive
12File/hrm/employeeview.phppredictive
13File/include/chart_generator.phppredictive
14File/index.php?menu=asterisk_clipredictive
15File/librarian/bookdetails.phppredictive
16File/loginpredictive
17File/messageboard/view.phppredictive
18File/oauth/idp/.well-known/openid-configurationpredictive
19File/one_church/userregister.phppredictive
20File/out.phppredictive
21File/owa/auth/logon.aspxpredictive
22File/SAP_Information_System/controllers/add_admin.phppredictive
23File/SASWebReportStudio/logonAndRender.dopredictive
24File/secure/admin/InsightDefaultCustomFieldConfig.jspapredictive
25File/secure/admin/ViewInstrumentation.jspapredictive
26File/SVFE2/pages/feegroups/country_group.jsfpredictive
27File/SystemMng.ashxpredictive
28File/textpattern/index.phppredictive
29File/upfile.cgipredictive
30File/v2/quantum/save-data-upload-big-filepredictive
31File/wordpress/wp-admin/admin.phppredictive
32File4.edu.phppredictive
33FileAccountManagerService.javapredictive
34Fileaccount_footer.phppredictive
35Fileadclick.phppredictive
36Fileaddlink.phppredictive
37Filexxx_xxxx_xxx.xxxpredictive
38Filexxx_xxxx_xxxx.xxxpredictive
39Filexxxxx.xxxxxxxxxx.xxxpredictive
40Filexxxxx.xxxxxxxxx.xxxpredictive
41Filexxxxx/xxxxxxxxxxx.xxxpredictive
42Filexxxxx/xxxx_xxxxxxxx.xxxpredictive
43Filexxxxx/xxxxx.xxxpredictive
44Filexxxxx/xxxxxxxxxxxxx.xxxpredictive
45Filexxxxxxxxxxxxxxxx.xxxpredictive
46Filexxxxxxxxxxx.xxxpredictive
47Filexxxxxxxxxxx.xxxpredictive
48Filexxxx_xxxx_xxxxxxxx.xxxpredictive
49Filexx_xxxxxxxxxx.xxxpredictive
50Filexxx/xxxxxx/xxxx_xxxxxx.xxxpredictive
51Filexxxxxxxxxxxxxx.xxxpredictive
52Filexxxxxxxx.xxxxxxx.xxxpredictive
53Filexx_xxxxx_xxxxx.xxxpredictive
54Filexx_xxxx.xxxpredictive
55Filexxx_xxxxxxxxx.xxxpredictive
56Filex:\xxxxpredictive
57Filexxxxxx/xxxxx/xxxxx.xxxpredictive
58Filexxxx_xxxxxxx.xxxpredictive
59Filexxxxxxxx.xxxpredictive
60Filexxxxxxxx.xxxpredictive
61Filexxx-xxx/xxxxxxxxxxxx.xxxpredictive
62Filexxx-xxx/xxx/xxxxxxxx_xxx.xxxpredictive
63Filexxxxxxxxxxx.xxxpredictive
64Filexxxxx.xxxxx.xxxpredictive
65Filexxxxx/xxxxx_xxxxxx.xxxpredictive
66Filexxxxxxxxxx_xxxxx.xxxpredictive
67Filexxxxx_xx_xxxxxxxxx.xxxpredictive
68Filexxxxx_xxxx.xxxpredictive
69Filexxxxx.xxxpredictive
70Filexxx.xxx?xxx=xxxxx_xxxxpredictive
71Filexxxx/xxxxxxxx.xxpredictive
72Filexxxxxxxx_xxxxxxxxxxxxxxxxx.xxxpredictive
73Filexxxxxxx.xxxpredictive
74Filexxxxxxxxxx.xxxpredictive
75Filexxxxxxxxxxxxxxxxxxx.xxpredictive
76Filexxxxxxxxx.xxxpredictive
77Filexxxxxxx.xxxpredictive
78Filexxxxxx.xxxpredictive
79Filexxxxxx.xxxpredictive
80Filexxxxxxxx.xxxpredictive
81Filexxxxxxxxxx-xxxxxxxxxxxxx.xxxpredictive
82Filexxxxxxx/xxxxx/xxxxx.xpredictive
83Filexxxxx.xxxpredictive
84Filexxxxx.xxxpredictive
85Filexxxx.xxxpredictive
86Filexxxxxxxx.xxxpredictive
87Filexxxxxxxx.xxxpredictive
88Filexxxxxxxxx.xxxpredictive
89Filexxxxxx.xxxxpredictive
90Filexxxx.xxxpredictive
91Filexxxx.xxxpredictive
92Filexxxxxxxxx.xxxpredictive
93Filexxxxxxxxx.xxpredictive
94Filexxxxxxxxxx.xxxpredictive
95Filexxxxx_xxxxxx.xxxpredictive
96Filexxxxxxxxx.xxxpredictive
97Filexxx/xxxxxxxx.xxxpredictive
98Filexxx/xxxxxx.xxxpredictive
99Filexxx/xxxxxxxxxxx/xxxxxxx.xxxpredictive
100Filexxx/xxxxxxx/xxxxxxxxxxxx.xxxpredictive
101Filexxxxxxx.xxxpredictive
102Filexxxxxxx/xxxx.xxxpredictive
103Filexxxxxxxx/xxxx.xxxpredictive
104Filexxxxx.xxxpredictive
105Filexxxx.xxxxpredictive
106Filexxxxxxxxxxxxx.xxxpredictive
107Filexxxxxxxx/xxxxxxxx_xxxxxxx_xxxxxx/xxxxx.xxxpredictive
108Filexxxx_xxxx.xxxpredictive
109Filexxx_xxxxxxxxx.xxxpredictive
110Filexxx.xxxxpredictive
111Filexxxxxx/xxxxxx/xxxxxx-xx.xpredictive
112Filexxxxxx.xxxpredictive
113Filexxxxx.xxxxpredictive
114Filexxxxx.xxxpredictive
115Filexxxxx.xxxxpredictive
116Filexxxxx_xxxxxxx.xxxpredictive
117Filexxx_xxxxxxxx.xxxpredictive
118Filexxx/xxxx_xxx.xxxpredictive
119Filexxxxxxx.xxxpredictive
120Filexxxxxxx/xxx.xxxpredictive
121Filexxx/xxxxxxxxx/xx_xxx_xxxxxx.xpredictive
122Filexxx.xxxpredictive
123Filexxxxxx_xx.xxxpredictive
124Filexxx/xxxxx.xxxxpredictive
125Filex-xxxx.xxxpredictive
126Filexxxx.xxxxxxxxx.xxxpredictive
127Filexxxxxxxxx.xxx.xxxpredictive
128Filexxxxxx.xxxpredictive
129Filexxxx.xxxpredictive
130Filexxxx.xxxpredictive
131Filexxxxxxxxx/xxxxxxxxxxxxxx.xxxxpredictive
132Filexxx.xxxxx.xxxpredictive
133Filexxxxx.xxxpredictive
134Filexxxxx.xxxpredictive
135Filexxxxxxxx.xxxpredictive
136Filexxxxxxxxxx.xxxpredictive
137Filexxxxxxxx.xxxpredictive
138Filexxxxxxxx.xxxpredictive
139Filexxxxxxxx_xxxx.xxxpredictive
140Filexxxxxxxxxxxx_xxxxxxxx.xxx.xxxpredictive
141Filexxxxxx.xxxpredictive
142Filexxxxxxxx.xpredictive
143Filexx_xxxx.xpredictive
144Filexxxx_xxxx_xxxxxx.xxxpredictive
145Filexxxxxx.xxxpredictive
146Filexxxxxx.xxxpredictive
147Filexxxx/xxxxxxx/xxxxxxxxxxxxx_xxx.xxxpredictive
148Filexxxxxx.xxxxpredictive
149Filexxxxxxxx-xxxxxx_xxxxx.xxxpredictive
150Filexxxx.xxxpredictive
151Filexxxx_xxxxxxx_xxxxxxxx.xxxpredictive
152Filexxxxxxxx.xxx/xxxxxx.xxx/xxxxxxxx.xxxpredictive
153Filexxxxxxxxxxx.xxxpredictive
154Filexxx/xxx/xxxxxxx/xxxx.xxxpredictive
155Filexxxxx_xxxxx.xxxpredictive
156Filexxxx-xxxxx.xxxpredictive
157Filexxxx-xxxxxxxx.xxxpredictive
158Filexxxxx.xxpredictive
159Filexxxxx.xxxpredictive
160Filexxxxxx.xxxpredictive
161Filexxxx.xxxpredictive
162Filexxxxx-xxxxxxxx-xxxxx-xxxxxxxxxxx-xxx-xxxxx.xxxpredictive
163Filexxxxx.xxxxpredictive
164Filexxxx.xxxpredictive
165Filexxxxxxxxx.xxxxpredictive
166Filexxxxxxx/xxxxxxxxx/xxxxxxxxxxxx.xxxpredictive
167Filexxxxxxx.xxxpredictive
168Filexx-xxxxx/xxxxx.xxxpredictive
169Filexx.xxxpredictive
170Filexxxxxxxxxxxx.xxxpredictive
171File~/xxxxx-xxxxx.xxxpredictive
172File~/xxxxxxxx-xxxxxxxx.xxxpredictive
173Libraryxxxxxx[xxxxxx_xxxxpredictive
174Libraryxxxxxx.xxxxxxxxx.xxxxxxx.xxxxx_xxxxx.xxxpredictive
175Libraryxxxx/xxxxxxx/xxxx/xxxxxxxxx/xxxxx.xxxpredictive
176Library~/xxx/xxxxx-xxxxxxxx-xxxxxxxxxx.xxxpredictive
177Argument$_xxxxxxpredictive
178Argumentxxx_xxxxpredictive
179Argumentxx_xxpredictive
180Argumentxxxxxxpredictive
181Argumentxxpredictive
182Argumentxxx_xxpredictive
183Argumentxxpredictive
184Argumentxxpredictive
185Argumentxxxxxxxxpredictive
186Argumentxxxxxxxxpredictive
187Argumentxxxxxpredictive
188Argumentxxxxpredictive
189Argumentxxxx_xxx_xxxxpredictive
190Argumentxxxpredictive
191Argumentxxxxxxxxpredictive
192Argumentxxxxxxxxxxpredictive
193Argumentxxxxxxxx_xxxxpredictive
194Argumentxxx_xxpredictive
195Argumentxx_xxxxxxpredictive
196Argumentxxxxpredictive
197Argumentxxxx_xxpredictive
198Argumentxxxxxxxpredictive
199Argumentxxxxxxxxxxpredictive
200Argumentxxxxxx[xxxxxx_xxxx]predictive
201Argumentxxxx_xxpredictive
202Argumentxxxxxxxxxxxxpredictive
203Argumentxxxpredictive
204Argumentxxxxxxxxpredictive
205Argumentxxxxxpredictive
206Argumentxxxxpredictive
207Argumentxxxxx_xxxx_xxxxpredictive
208Argumentxxxxxxx=xxxxxxxxpredictive
209Argumentxxxxpredictive
210Argumentxxxxxxxpredictive
211Argumentxxxxxxx_xxxxxxxpredictive
212Argumentxxxxxxxxxxxxxx[xxxxxxxxxxxxxxxxxx]predictive
213Argumentxxxxxxxxpredictive
214Argumentxxxxpredictive
215Argumentxxpredictive
216Argumentxx/xx_xxxxxx_xxxx/xx_xxxx_xxxxxxpredictive
217Argumentxxxxxxxxxpredictive
218Argumentxx_xxxxxpredictive
219Argumentxxxxxpredictive
220Argumentxxxxx_xxxxpredictive
221Argumentxxxxxxpredictive
222Argumentxxxx_xxpredictive
223Argumentxxxxpredictive
224Argumentxxxxxxxx_xxxpredictive
225Argumentxxx_xxxpredictive
226Argumentxxxxxxxpredictive
227Argumentxxxpredictive
228Argumentxxxxpredictive
229Argumentxxxxxxxpredictive
230Argumentxxx_xxxx_xxxxpredictive
231Argumentxxxxxxxxxxpredictive
232Argumentxxxpredictive
233Argumentxx_xxxxpredictive
234Argumentxxx/xxxxxxxxxpredictive
235Argumentxxxxxxxxx_xxxxxxxx_xxxxpredictive
236Argumentxxxxxpredictive
237Argumentxxxxxxx_xxxxpredictive
238Argumentxxxxpredictive
239Argumentxxxx/xxxxxxxx/xxx/xxx/xxxxxxxx/xxxxxxxpredictive
240Argumentxxxxxxx_xxpredictive
241Argumentxxxxxx xxxxxxpredictive
242Argumentxxxxxxxxxxxxpredictive
243Argumentxxxxpredictive
244Argumentxxx_xxx[]predictive
245Argumentxxxxxxxxpredictive
246Argumentxxxx_xx_xx_xxxpredictive
247Argumentxxxxxxxpredictive
248Argumentxxxxxxxxxxxxxpredictive
249Argumentxxxxxxxxxpredictive
250Argumentxxxxx_xxxx_xxxxpredictive
251Argumentxxxxxxxxxxxxpredictive
252Argumentxxxxxpredictive
253Argumentxxxxxxxpredictive
254Argumentxxxxpredictive
255Argumentxx_xxxxpredictive
256Argumentxx_xxxxpredictive
257Argumentxxxxxxpredictive
258Argumentxxxxxpredictive
259Argumentxxxxxxxxpredictive
260Argumentxxxxxxxxxxpredictive
261Argumentxxxxxpredictive
262Argumentxxxxxxx_xxpredictive
263Argumentxxxxxxxxxxpredictive
264Argumentxxxxxx_xxxxxxx_xxxxxxxxx_xxxx/xxxxxx_xxxxxxx_xxxxxxx_xxxxpredictive
265Argumentxxxpredictive
266Argumentxxxxxxpredictive
267Argumentxxxxxx_xxxxxxpredictive
268Argumentxxxpredictive
269Argumentxxxxxx_xxxpredictive
270Argumentxxxx_xxxxpredictive
271Argumentxxxxxxxpredictive
272Argumentxxxxxx_xxpredictive
273Argumentxxxxxxx_xxpredictive
274Argumentxxxxxxpredictive
275Argumentxx_xxxxx_xxxx_xxxxpredictive
276Argumentxxpredictive
277Argumentxxxxxxxxxpredictive
278Argumentxxxxxxxpredictive
279Argumentxxxxxxxxxxpredictive
280Argumentx_xxpredictive
281Argumentxxxxxpredictive
282Argumentxxxxxxxxxx_xxpredictive
283Argumentxxxxxxxxxxxpredictive
284Argumentxxxxpredictive
285Argumentxxxx_xxpredictive
286Argumentxxxpredictive
287Argumentxxxpredictive
288Argumentxxxx.xxxxxpredictive
289Argumentxxxxxxxx:x_xxxx/xxxxxxxx:x_xxxx/xxxxxxxx:x_xxxxpredictive
290Argumentxxxxxxpredictive
291Argumentxxxxxxxxpredictive
292Argumentxxxx_xxpredictive
293Argumentxx_xxxxpredictive
294Input Value' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx)-- xxxxpredictive
295Input Value..predictive
296Input Valuexxpredictive
297Input Valuex%xxxxxxx%xxxxxxxx%xxx,xxxxxx_xx%xxxxxx,xx_xxxxxxx,xxxxxxxx%xx,x,x,x,x,x,x,x,xx,xx,xx,xx,xx,xx,xx,xx,xx%xxxxxx%xxxxxxxxxx%xxxxxxx%xxxx%xxxpredictive
298Input Value<xxx%xxxxx='xxxx://xxx.xxxx.xx/xxxx.xxx'%xxxxxxx='xxxxxx:%xxxxx%xxxxxxx%xxxxxxx;'>predictive
299Input Value\xxx../../../../xxx/xxxxxxpredictive
300Patternxxxxxxx-xxxx|xx| xxxx/xxxxpredictive
301Patternxxxx /xpredictive

参考 (6)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!