RuRAT 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (474)

言語

en	228
de	208
it	30
es	8

国・地域

us	470

アクター

RuRAT	2

関心

タイプ

Not Defined	42
Content Management System	22
Forum Software	16
Programming Language Software	6
Operating System	4

ベンダー

Not Defined	56
Russcom Network	2
Total PC	2
Expinion.net	2
WordPress	2

製品

WordPress	10
Phorum	4
PHP	4
Russcom Network Loginphp	2
FLDS	2

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash 情報の漏洩	5.3	5.2	$5k-$25k	計算中	High	Workaround	0.02016	0.00	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.26	CVE-2010-0966
3	Woltlab Burning Board register.php クロスサイトスクリプティング	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00957	0.00	CVE-2007-1443
4	Magic Photo Storage Website register.php 特権昇格	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
5	YaBB register.pl メモリ破損	10.0	8.7	$0-$5k	$0-$5k	Unproven	Official Fix	0.17348	0.05	CVE-2007-3208
6	WordPress wp-register.php クロスサイトスクリプティング	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.00322	0.00	CVE-2007-5105
7	Phpwebgallery register.php クロスサイトスクリプティング	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00573	0.03	CVE-2007-1109
8	Expinion.net News Manager Lite comment_add.asp クロスサイトスクリプティング	4.3	3.8	$0-$5k	$0-$5k	Unproven	Official Fix	0.00607	0.00	CVE-2004-1845
9	Phorum register.php クロスサイトスクリプティング	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01601	0.02	CVE-2007-0769
10	SSReader Ultra Star Reader ActiveX Control pdg2.dll Register メモリ破損	10.0	9.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.07057	0.05	CVE-2007-5892
11	SSReader Ultra Star Reader ActiveX Control register メモリ破損	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03617	0.00	CVE-2007-5807
12	StoreSprite register.php クロスサイトスクリプティング	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01850	0.02	CVE-2007-4307
13	AlstraSoft AskMe Pro register.php クロスサイトスクリプティング	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
14	Microsoft Register Server サービス拒否	5.3	5.3	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00350	0.00	CVE-2007-3658
15	Scribe forum.php register 特権昇格	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.02434	0.00	CVE-2007-5822
16	WordPress wp-register.php クロスサイトスクリプティング	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.00533	0.05	CVE-2007-5106
17	Andys Chat register.php メモリ破損	10.0	10.0	$0-$5k	$0-$5k	Not Defined	Unavailable	0.03106	0.00	CVE-2006-7036
18	PBSite register.php Local Privilege Escalation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
19	LushiWarPlaner register.php SQLインジェクション	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00821	0.05	CVE-2007-0864
20	TeamCal register.php ディレクトリトラバーサル	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	キャンペーン	Identified	タイプ	信頼度
1	86.104.15.123	cphost07.qhoster.net	RuRAT		2022年08月04日	verified	高
2	XXX.XXX.XX.XXX	xxxxx-x.xxx-xxxxxxx.xxx	Xxxxx		2022年08月04日	verified	高

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	高
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	高
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
5	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
6	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
7	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
8	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	高
9	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
10	TXXXX.XXX	CAPEC-	CWE-XX	Xxxxxxxxxxxxx	predictive	高
11	TXXXX	CAPEC-157	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高

IOA - Indicator of Attack (85)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/index.php	predictive	中
2	File	/rom-0	predictive	低
3	File	/uncpath/	predictive	中
4	File	adclick.php	predictive	中
5	File	add_comment.php	predictive	高
6	File	base_maintenance.php	predictive	高
7	File	comment_add.asp	predictive	高
8	File	data/gbconfiguration.dat	predictive	高
9	File	drivers/block/floppy.c	predictive	高
10	File	email.php	predictive	中
11	File	EmployeeSearch.cc	predictive	高
12	File	exit.php	predictive	中
13	File	forum.php	predictive	中
14	File	goto.php	predictive	中
15	File	xxxxxxxxx.xxx	predictive	高
16	File	xxx/xxxxxx.xxx	predictive	高
17	File	xxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxx	predictive	高
18	File	xxxxxxx/xxxxxxx/xxxxxxxx_xxxxxxxx.xxx.xxx	predictive	高
19	File	xxxxx.xxx	predictive	中
20	File	xxxxx.xxx.xxx	predictive	高
21	File	xxxxx.xxx	predictive	中
22	File	xxxxx.xxx	predictive	中
23	File	xxxxx.xxx	predictive	中
24	File	xxxxxxxx.xxx	predictive	中
25	File	xxxxxxxx.xxxx	predictive	高
26	File	xxxxxxxx.xxx	predictive	中
27	File	xxxxxxxx.xxx	predictive	中
28	File	xxxxxxxx.xx	predictive	中
29	File	xxxxxxxx_xxxxxx.xxx	predictive	高
30	File	xxxxxxx_xxx_xxxxx_xxxxxx.xxxx	predictive	高
31	File	xxxxxxxxxx/xxxxxxxxxx_xxxxxxxxxx.xxx	predictive	高
32	File	xxxxxx/xxxxxxxx.xxx	predictive	高
33	File	xxxxxx.xxx	predictive	中
34	File	xxxxxxx/xxxxxxxx.xxx	predictive	高
35	File	xxxx-xxxxxxxx.xxx	predictive	高
36	File	xxxx/xxxxxxxx.xxx	predictive	高
37	File	xxxxx/xxxxxxxx.xxx	predictive	高
38	File	xxxx/xxxxxxxx.xxx	predictive	高
39	File	xx-xxxxx/xxxxx-xxxx.xxx?xx-xxxxx-xxxxxx[]=xxxxxxxx	predictive	高
40	File	xx-xxxxx.xxx	predictive	中
41	File	xx-xxxxxxxx.xxx	predictive	高
42	File	xxxxxx.xxx	predictive	中
43	Library	xxxx.xxx	predictive	中
44	Argument	xxxxxxx	predictive	低
45	Argument	xxxxxx	predictive	低
46	Argument	xxxxxxxx	predictive	中
47	Argument	xxxxxxx	predictive	低
48	Argument	xxxx	predictive	低
49	Argument	xxxxx	predictive	低
50	Argument	xxxxx	predictive	低
51	Argument	xxxxxxx=xxxxxxxx	predictive	高
52	Argument	xxxx	predictive	低
53	Argument	xxxx_xxxxx	predictive	中
54	Argument	xxxxxxxx	predictive	中
55	Argument	xx	predictive	低
56	Argument	xx_xxxxxxxx	predictive	中
57	Argument	xxxxxxx_xxxx	predictive	中
58	Argument	xxxxxxxxx-xxxxxxx/xxxxxxxxx/xxxxxxxxxx	predictive	高
59	Argument	xxxx	predictive	低
60	Argument	xxxxxxxxxxxxx	predictive	高
61	Argument	xxxxxxx	predictive	低
62	Argument	xxxx	predictive	低
63	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	高
64	Argument	xxxx	predictive	低
65	Argument	xxxx	predictive	低
66	Argument	xxxx	predictive	低
67	Argument	xxxxxxxx	predictive	中
68	Argument	xxxx_xxxx	predictive	中
69	Argument	xxx_xxxx	predictive	中
70	Argument	xxxxxx	predictive	低
71	Argument	xxxxxxxxxxxx	predictive	中
72	Argument	xxxxxx	predictive	低
73	Argument	xxxxxxxxxx	predictive	中
74	Argument	xxx	predictive	低
75	Argument	xxxxx	predictive	低
76	Argument	xxx	predictive	低
77	Argument	xxxxxxxx	predictive	中
78	Argument	xxxx_xxxxx	predictive	中
79	Argument	xxxx_xxxxx	predictive	中
80	Argument	xxx	predictive	低
81	Argument	_xxxxxx[xxxx_xxxx]	predictive	高
82	Input Value	xxxx	predictive	低
83	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	高
84	Input Value	xxxx	predictive	低
85	Network Port	xxx xxxxxx xxxx	predictive	高

参考 (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Do you need the next level of professionalism?

Upgrade your account now!