PAPERWALL 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (10)

言語

zh	8
en	2

国・地域

cn	8
us	2

アクター

PAPERWALL	3
Cobalt Strike	1

関心

タイプ

Not Defined	6
Content Management System	2
Smartphone Operating System	2

ベンダー

Not Defined	4
Joomla	2
Hashicorp	2
Google	2

製品

Elasticsearch	4
Joomla CMS	2
Hashicorp Terraform	2
Google Android	2

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	0xJacky nginx-ui Certificate Import write_file.go ディレクトリトラバーサル	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00165	0.07	CVE-2024-23827
2	Clash Proxies Name Column 特権昇格	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00274	0.00	CVE-2022-26255
3	Hashicorp Terraform ディレクトリトラバーサル	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.04	CVE-2023-4782
4	Google Android ShannonRcs 情報の漏洩	4.4	4.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.04	CVE-2023-20923
5	Google Android ActivityManagerService.java openContentUri 情報の漏洩	3.3	3.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2023-21292
6	Elasticsearch Searchable Snapshot 特権昇格	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00112	0.00	CVE-2021-22147
7	Elasticsearch Grok Parser サービス拒否	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00138	0.03	CVE-2021-22144
8	Elasticsearch Error Report 情報の漏洩	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.96378	0.03	CVE-2021-22145
9	Joomla CMS com_easyblog SQLインジェクション	6.3	6.1	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00000	0.66
10	FLDS redir.php SQLインジェクション	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00203	0.03	CVE-2008-5928

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	アクター	Identified	タイプ	信頼度
1	43.153.75.48	PAPERWALL	2024年02月08日	verified	高
2	43.155.173.104	PAPERWALL	2024年02月08日	verified	高
3	XX.XXX.XX.XXX	Xxxxxxxxx	2024年02月08日	verified	高
4	XX.XXX.XX.XXX	Xxxxxxxxx	2024年02月08日	verified	高
5	XX.XXX.XXX.XXX	Xxxxxxxxx	2024年02月08日	verified	高
6	XX.XX.XX.XX	Xxxxxxxxx	2024年02月08日	verified	高
7	XXX.XX.XXX.XX	Xxxxxxxxx	2024年02月08日	verified	高
8	XXX.XXX.XXX.XX	Xxxxxxxxx	2024年02月08日	verified	高

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	高
2	TXXXX	CAPEC-10	CWE-XX	Xxxxxxxx Xxxxxxxxxxxxxx Xx Xxxx Xxxxxx Xxxxx Xxxxxxxxxxx	predictive	高
3	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	高
4	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高

IOA - Indicator of Attack (4)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	ActivityManagerService.java	predictive	高
2	File	redir.php	predictive	中
3	File	xxxxx_xxxx.xx	predictive	高
4	Argument	xx	predictive	低

参考 (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!