Rekoobe 解析

IOB - Indicator of Behavior (734)

タイムライン

言語

en692
zh36
ko4
ja2

国・地域

cn76
us8

アクター

アクティビティ

関心

タイムライン

タイプ

ベンダー

製品

Google Android48
Mozilla Firefox18
CMS Made Simple18
Microsoft Windows16
Apple iCloud12

脆弱性

#脆弱性BaseTemp0day本日修復EPSSCTICVE
1D-Link DNS-320 system_mgr.cgi 特権昇格8.08.0$5k-$25k$0-$5kHighNot Defined0.973940.04CVE-2020-25506
2PRTG Network Monitor HTTP Advanced Sensor HttpAdvancedSensor.exe 特権昇格7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.006560.04CVE-2018-19204
3TP-LINK TL-IPC40A-4 validator.lua 特権昇格7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.004020.02CVE-2018-11481
4Cisco ASA WebVPN Login Page logon.html クロスサイトスクリプティング4.33.9$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.001920.07CVE-2014-2120
5CMS Made Simple 特権昇格7.57.5$0-$5k$0-$5kNot DefinedNot Defined0.000910.03CVE-2018-10519
6Ruby Dir.empty ディレクトリトラバーサル7.87.6$0-$5k$0-$5kNot DefinedOfficial Fix0.002270.00CVE-2018-8780
7Ruby UNIXSocket.open 特権昇格7.47.2$0-$5k$0-$5kNot DefinedOfficial Fix0.003320.00CVE-2018-8779
8Apps Manager for PCF 情報の漏洩6.46.1$0-$5k$0-$5kNot DefinedOfficial Fix0.001270.00CVE-2018-1200
9Foxconn Femtocell FEMTO AP-FC4064-T UART 特権昇格6.86.8$0-$5k$0-$5kNot DefinedNot Defined0.000700.03CVE-2018-6311
10iThemes Security Plugin Logs Page 情報の漏洩7.57.2$0-$5k$0-$5kNot DefinedOfficial Fix0.001680.03CVE-2018-7433
11Apache Dubbo 特権昇格5.55.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.049650.00CVE-2023-46279
12H3C ER6300G2 Config File userLogin.asp ディレクトリトラバーサル4.24.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.000520.15CVE-2023-5142
13Ivanti MobileIron Sentry MICS Admin Portal 弱い認証9.89.6$0-$5k$0-$5kHighOfficial Fix0.974130.00CVE-2023-38035
14Dahua IPC/SD/NVR/XVR Packet 未知の脆弱性4.44.4$0-$5k$0-$5kNot DefinedNot Defined0.000630.05CVE-2022-30564
15Wavlink WN579X3 Ping Test adm.cgi 特権昇格6.46.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000640.08CVE-2023-3380
16MobileIron Virtual Smartphone Platform j_spring_security_check 情報の漏洩7.86.8$0-$5k$0-$5kUnprovenOfficial Fix0.193950.05CVE-2014-1409
17PDF.js Viewer Plugin Shortcode クロスサイトスクリプティング4.44.4$0-$5k$0-$5kNot DefinedOfficial Fix0.000580.08CVE-2021-24759
18Google Android efi-rt-wrapper.S __efi_rt_asm_wrapper メモリ破損6.56.4$5k-$25k$5k-$25kNot DefinedOfficial Fix0.000420.05CVE-2023-21102
19Rhinosoft Serv-U メモリ破損10.09.4$0-$5k$0-$5kProof-of-ConceptNot Defined0.238640.00CVE-2009-4873
20Cotonti Siena Forum Post クロスサイトスクリプティング2.42.4$0-$5k$0-$5kNot DefinedNot Defined0.000550.00CVE-2022-39839

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIPアドレスHostnameアクターキャンペーンIdentifiedタイプ信頼度
1139.162.116.218139-162-116-218.ip.linodeusercontent.comRekoobe2023年07月12日verified
2XXX.XXX.XXX.XXXxxx-xxx-xxx-xxx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxxx2023年07月12日verified

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (288)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDクラスIndicatorタイプ信頼度
1File/+CSCOE+/logon.htmlpredictive
2File/admin-document/@@sharepredictive
3File/admin/?/user/addpredictive
4File/admin/fst_upload.inc.phppredictive
5File/admin/index/index.html#listarticlepredictive
6File/admin/user/manage/addpredictive
7File/api/file_uploader.phppredictive
8File/api/RecordingList/downloadpredictive
9File/backend/system.htmlpredictive
10File/bin/falsepredictive
11File/cgi-bin/adm.cgipredictive
12File/cgi-bin/cgiServer.exxpredictive
13File/cgi-bin/system_mgr.cgipredictive
14File/etc/shadowpredictive
15File/etc/zarafa/licensepredictive
16File/guest/index.htmlpredictive
17File/importTool/previewpredictive
18File/index.phppredictive
19File/index.php?/manage/channel/addchannelpredictive
20File/index.php?m=member&f=index&v=profile&set_iframe=1predictive
21File/index.php?m=tags&f=index&v=addpredictive
22File/install/index.phppredictive
23File/loginpredictive
24File/mics/j_spring_security_checkpredictive
25File/mifs/c/i/reg/reg.htmlpredictive
26File/modules/DesignManager/action.ajax_get_templates.phppredictive
27File/pms/update_user.php?user_id=1predictive
28File/programScopespredictive
29File/userfs/bin/tcapipredictive
30File/userLogin.asppredictive
31File/usr/local/nagiosxi/html/admin/sshterm.phppredictive
32File/usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.phppredictive
33File/usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.phppredictive
34File/usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.phppredictive
35File/xxx-xxx/xxx.xxxpredictive
36Filexxx_xxxxx.xxxpredictive
37Filexxxxx.xxxpredictive
38Filexxxxx/?/xxxxxx/xxxxpredictive
39Filexxxxx/?/xxxx/xxxxpredictive
40Filexxxxx/?/xxxxxxx/xxxxpredictive
41Filexxxxx/xxxxx_xxxxx.xxx?xxx=xxxx_xxxxx_xxxx&xxxxx_x_xxx=xxxxpredictive
42Filexxxxx/xxxxx.xxx/xxxxx/xxxxpredictive
43Filexxxxx/xxxxxxx_xxxx.xxx?xxxx=xxxpredictive
44Filexxxxx/xxxxxxxxxxxxxxx.xxxpredictive
45Filexxxxx/xxxx/xxx-xxx/xxxxx.xxxpredictive
46Filexxxx.xxx?xxxxxx=xxxxxxpredictive
47Filexxxxxxxxxx.xxxpredictive
48Filexxxxx.xxpredictive
49Filexxx/xxxxxxxx/xxxx-xxxx.xxxpredictive
50Filexxxxxxxxxxx/xxxxxxx/xxxxxxx/xxxxx/xxxx.xxxpredictive
51Filexxxxxxxxxxx\xxx\xxxxxxxxxx\xxxx.xxxpredictive
52Filexxxx/xxxxx/xxxxxxx/xxx/xxxx_xxxxx.xpredictive
53Filexxxxxxx.xxxpredictive
54Filexxxxx/xxxxxxx/xxxxxxxxxxxxxpredictive
55Filexxx/xxxx.xpredictive
56Filexxxx_xxxx_xx.xxpredictive
57Filexxxx_xxxx.xxpredictive
58Filexxxx_xxxxx.xxpredictive
59Filexxx_xxx_xxx.xxpredictive
60Filexxxxx.xpredictive
61Filex:\xxxxxxxxxxx\xxxxxxx xxxxxxxx\xxxxxxx xxxxxpredictive
62Filexxxx.xpredictive
63Filexxxxxxx.xpredictive
64Filexxxxxxxxxxxx.xxxpredictive
65Filexxxxxx/xxxxxx.xpredictive
66Filexxxxxx/xxx.xpredictive
67Filexxxxxx/xxx.xpredictive
68Filexxxxxx/xxxx.xpredictive
69Filexxxxxxxxxx/xxxxxxxxxxxxxxxxxxpredictive
70Filexxxxxx.xxxpredictive
71Filexxxxxxxxx.xpredictive
72Filexxxxxx.xxxpredictive
73Filexxxxxx/xxxxxx.xpredictive
74Filexxxxxxxxxxxxxxxx.xxxpredictive
75Filexxxxxxx/xxx/xxx/xxxx-xxx-xxxxxx.xpredictive
76Filexxxxxx.xpredictive
77Filexxx-xx-xxxxxxx.xpredictive
78Filexxxxxxxxxxxxxxxx.xpredictive
79Filexxxxxx-xxxxxxx.xxpredictive
80Filexxx/xxxx/xxxx.xpredictive
81Filexxx/xxxxx/xxxxx.xpredictive
82Filexxx/xxxx/xxxx.xpredictive
83Filexxx/xxxx/xxxx_xxxxxx.xpredictive
84Filexxxxxxxxxx/xxxxxxxxxx_xxxx.xxpredictive
85Filexxxxxxxxxx.xxxxxpredictive
86Filexxxxx.xxx?xxx=xxxx&xxxxxx=xxxxxxxxxpredictive
87Filexxx_xxxx.xpredictive
88Filexx/xxxx/xxxxxxxxxxx.xpredictive
89Filexx/xxxx/xxxxxx.xpredictive
90Filexx/xxxx/xxxxx.xpredictive
91Filexx/xxxx/xxxxx.xpredictive
92Filexx/xxxx/xxxxx.xpredictive
93Filexx/xxxxx/xxxx.xpredictive
94Filexxxxxxx.xxxpredictive
95Filexxxxxxxx.xxxpredictive
96Filexxxxxx/xxxxxxxxx?xx=xxx_xxx.xxxpredictive
97Filexxxxx/xxxxxx/xxxxxx.xxpredictive
98Filexxxxx/xxxxxx/xxxxxx.xxpredictive
99Filexxxxxxxxxxxxxxxxxx.xxxpredictive
100Filexxxxxx/xxxxxxxpredictive
101Filexxx/xxxxxxxxx.xxxpredictive
102Filexxxxxxxx/xxxxxxx/xxxxxxx.xxxx.xxxpredictive
103Filexxxxx.xxxpredictive
104Filexxxxx.xxx?xxxxx&x=xxxx&x=xxx_xxxxpredictive
105Filexxxxx.xxx?x=xxxxxx&x=xx_xxxxxpredictive
106Filexxxxx.xxx?xxxxxxxx=./predictive
107Filexxxxxx.xx?xxx=xxxxxxxxxxxxx/xxx=xxxxx/xxxxx=xxxxxxxpredictive
108Filexxxxxxx/xxxxx.xxxpredictive
109Filexxxxxxxx.xpredictive
110Filexxxxxx/xxx/xxxxxxxx.xpredictive
111Filexxxxxxxxxxx/xx_xxxxxxxxx.xpredictive
112Filexxxxxxxxx/xxxxx.xpredictive
113Filexxxxxx/xxxxxxxxxxxxxxxxx.xpredictive
114Filexxxxxx_xxx.xxxpredictive
115Filexxxxxx_xxx.xxxpredictive
116Filexxx\xxx\xxxxxx\xxxxx\xxxxxxxxxx.xxxxx.xxxpredictive
117Filexxx\xxx\xxxxxx\xxxxx\xxxxxxxxx.xxxxx.xxxpredictive
118Filexxx\xxx\xxxxxx\xxxxx\xxxxxxxxxxxx.xxxxx.xxxpredictive
119Filexxx\xxx\xxxxxx\xxxx\xxxxxxxxxx.xxxxx.xxxpredictive
120Filexxxxxxxxxx/xxxxxx.xpredictive
121Filexxxxxxxxxx/xxxxxxx.xpredictive
122Filexxxxxxx/xxxxx_xxxx.xxx?xxxxxx=xxxx&xxx={xxx}xxxxxxxpredictive
123Filexxxxxxx/xxxxx_xxxx.xxx?xxxxxx=xxxx&xxx={xxx}xxx_xxxxpredictive
124Filexxxxxxx/xxxxxx/xxxxxx.xxxpredictive
125Filexx-xxxxx/xxxx-xxxx.xxxpredictive
126Filexx.xxpredictive
127Filexxx/xxx_xxx_xxxxxxx.xpredictive
128Filexxxxxx-xxxx/xxxxxxxx.xxxpredictive
129Filexxxxxxx/xxxxxxxxxx/xxxx_xxxxxxx.xxxpredictive
130Filexxxxxxx/xxx/xxx_xxxxxxx.xpredictive
131Filexxxxxxx.xxpredictive
132Filexxx-xx/xxxxxxxxpredictive
133Filexxx/xxxx/xxxxxxxxx/xxx_xxxxxx.xpredictive
134Filexxx_xxxx.xxxpredictive
135Filexxxxx.xxxpredictive
136Filexxxxxxxxxxx.xxxpredictive
137Filexxx.xpredictive
138Filexxxxxxx.xxpredictive
139Filexxxx.xxxpredictive
140Filexxxxx/xxxxxx.xxxpredictive
141Filexxxxxxx.xxxpredictive
142Filexxxxxxxxxxxxxxx.xxxpredictive
143Filexxxxxxxxxxxx.xxxpredictive
144Filexxxxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictive
145Filexxxxxxxx.xpredictive
146Filexxxxxx_xxxx.xxxpredictive
147Filexxxxxx.xxx?xxx=xxxxxxxx&xx=xxxxxxxpredictive
148Filexxxxx.xxxpredictive
149Filexxxxxx/xxxxx/xxxx/xxxxxxx.xxxxpredictive
150Filexxxxxx/xxxxx.xxx/xxxxpredictive
151Filexxxxxx/xxxxx.xxx/xxxx/xxxxxxxxxxxxx/xxxxx.xxxxpredictive
152Filexxxxxx/xxxxx.xxx/xxxx/xxxxxxxxxxxxxxx/xxxxxxxx.xxxxpredictive
153Filexxxxxx/xxxxx.xxx/xxxx/xxxxxxxxxx/xxxxx.xxxxpredictive
154Filexxxxxx/xxxxx.xxx/xxxx/xxxxxxxxxx/xxxxx.xxxx?xxx_xxpredictive
155Filexxx.xxpredictive
156Filexxxxxxxx.xxxpredictive
157Filexxxxxxxxx/xxxxx/xxxxxxx/xxx.xxxxx.xxxpredictive
158Filexxxxxxx/xxxxxxxxxxx/xxxxxxxxxxxxxxxxxxxxpredictive
159Filexxxx.xpredictive
160Filexxx_xxxxxxxxx.xxpredictive
161Filexxx_xxxxxx.xpredictive
162Filexxx_xxxxxx.xxpredictive
163Filexxxxxxxxxx.xxxpredictive
164Filexxxxxxx.xxxpredictive
165Filexxxxxx_xxxx.xxxpredictive
166Filexxxxxx/xxx/xxxxx/xxxxxx/xxxx.xxxxpredictive
167Filexxxxxx/xxxxxx.xpredictive
168Filexxxxxx.xxpredictive
169Filexxxx_xxxxxx.xxxpredictive
170Filexxxxxxxx/xxxxx/xxxxxxx.xxxx?xxxxxxxxxx=xxxxxxxxxxxxxxxx/xxxxpredictive
171Filexxx/xxxxxxxxxxxx/__xxxx__.xxpredictive
172Filexxxxxxx.xxxpredictive
173Filexxxxxxxxxx.xxxpredictive
174Filexxx/xxx.xxpredictive
175Filexxx_xxx.xpredictive
176Filexxx_xxxxxxxx.xpredictive
177Filexxx/predictive
178Filexxxxxxx.xxxxpredictive
179Filexxxx/xxxxxxx/xxxxx_xxx.xxpredictive
180Filexxxx.xpredictive
181Filexxxx/xxxxxxxxx.xpredictive
182Filexxxxxx.xpredictive
183Filexxxxx.xpredictive
184Filexxxxxx/xxxx/xxxxxxxx/xxxxxx.xxxx.xxxpredictive
185File\\.\xxxx\xxxxxxxxxxx\xxxxxxxxxxxpredictive
186Library/xxx/xxx/xxx/xxxx/xxxxxxxxxx/xxxxxxxxx.xxxpredictive
187Library/xxx/xxx/xxx/xxxx/xxxxxx.xxxpredictive
188Libraryxxxxxxxxxxxxxxx.xxx)predictive
189Libraryxxxxx.xxxpredictive
190Libraryxxxx/xxxxxxx.xpredictive
191Libraryxxx/predictive
192Libraryxxx/xxxxxx_xxxxx.xxxpredictive
193Libraryxxx/xxxxxxxxx.xxxpredictive
194Libraryxxx/xxxx.xxxpredictive
195Libraryxxx/xxxxxxxxx/xxxx/xxxx_xxx.xpredictive
196Libraryxxx/xxxx/xxxxxxxx.xpredictive
197Libraryxxx/xxxxxxxxxx/xxx/xxxxxx/xxxxxx.xxpredictive
198Libraryxxxxxxx_xxxx_xxx.xxxpredictive
199Libraryxxxxxxx_xxx.xxxpredictive
200Libraryxxx.xxxpredictive
201Libraryxxxxxxx.xxxpredictive
202Libraryxxxxxxxxxxx.xxxpredictive
203Libraryxxxxxxxxxxxxx.xxxpredictive
204Libraryxxxxx.xpredictive
205Argument$xxxxxxx['xxxxx_xxxx_xxxx']['xxx']['xxxxxxxx']predictive
206Argument$_xxxxxx[$xxxx->_xxxxxxxx]predictive
207Argument$_xxxxxx['xxx_xxxx']predictive
208Argument-xpredictive
209Argumentx/x/xpredictive
210Argumentxxxxxxpredictive
211Argumentxxxxxxpredictive
212Argumentxxxpredictive
213Argumentxxxxxx xxx xxxxxx[xxxxxx_xxxxx]predictive
214Argumentxxxxxxx_xxxxpredictive
215Argumentxxxxxxx_xxxx/xxxxxxxxpredictive
216Argumentxxx=xxxpredictive
217Argumentxxxxpredictive
218Argumentxxxxxxpredictive
219Argumentxxxxxxxxxxxpredictive
220Argumentxxxxxxxxpredictive
221Argumentxxxpredictive
222Argumentxxx_xxxpredictive
223Argumentx_xxxxpredictive
224Argumentxxxxpredictive
225Argumentxxxx_xxxxpredictive
226Argumentxxxx/xxxxxxxpredictive
227Argumentxxxxpredictive
228Argumentxxxx%xxxx_xx%xxpredictive
229Argumentxxxxxxxxpredictive
230Argumentxxpredictive
231Argumentxxpredictive
232Argumentx_xxxxxxxxpredictive
233Argumentx/xx/xxxpredictive
234Argumentxxxxxx[xxxx]predictive
235Argumentxxxx_xxx_xxpredictive
236Argumentxxxxxxpredictive
237Argumentxxxxxxpredictive
238Argumentxxxxxxpredictive
239Argumentxxxxxxxxpredictive
240Argumentxxxxxxxxpredictive
241Argumentxxxxx_xxxxxx_xxx/xxxxx_xxxx_xxxxxxxxpredictive
242Argumentxxxxpredictive
243Argumentxxxxxxxxxxxxxxxxxpredictive
244Argumentxxxxpredictive
245Argumentxxxxxxxxpredictive
246Argumentxxxx[xxxxxxxx]predictive
247Argumentxxxxxxxxpredictive
248Argumentxxxxxxxxpredictive
249Argumentxxxxpredictive
250Argumentxxx_xxpredictive
251Argumentxxxxxxpredictive
252Argumentxxx_xxxxxxpredictive
253Argumentxxxxxxpredictive
254Argumentxxxxxxx_xxxxxxxpredictive
255Argumentxxxxxxxxx_predictive
256Argumentxxxxxxpredictive
257Argumentxxxxxxpredictive
258Argumentxxxxxxpredictive
259Argumentxxxpredictive
260Argumentxxxxxxxpredictive
261Argumentxxxxxxx[xxxx]predictive
262Argumentxxxxxxxxxxpredictive
263Argumentxxxpredictive
264Argumentxxx-xxxxxxxxpredictive
265Argumentxxx[xxxxxx]predictive
266Argumentxxxxxxxxxxpredictive
267Argumentxxxxxpredictive
268Argumentxxxxx/xxxxxxx/xxxxxxxx/xxxxxxxpredictive
269Argumentxxxx/xxxxxxxpredictive
270Argumentx_xxxxpredictive
271Argumentxxxpredictive
272Argumentxxxx/xxxxxxxxpredictive
273Argumentxxxxxxxxpredictive
274Argumentxxxxxxx_xxxpredictive
275Argumentxxxxxxxpredictive
276Argument['xxxxxx']['xxxxx_xxxxxxxx']predictive
277Argument_xxxxxpredictive
278Input Value..predictive
279Input Value/xxxx#xxxxpredictive
280Input Valuexxxxpredictive
281Input Valuexxxxx"][xxxxxx]xxxxx('xxx')[/xxxxxx]predictive
282Input Value<?xxx xxxxxxx();?>predictive
283Input Valuexxxxxxxxxxxx%xxxxxx%xxxxxxxxxxx%xxpredictive
284Input Valuexxxxxxxxxxxxxxxpredictive
285Patternx|xx|x|xx|_|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|x|xx|predictive
286Network Portxxx/xxxxpredictive
287Network Portxxx/xxxxpredictive
288Network Portxxx xxxxxx xxxxpredictive

参考 (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!