SparkRAT 解析

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (224)

言語

en	212
ja	2
ar	2
de	2
es	2

国・地域

sc	132
us	18
kr	2
cn	2
pt	2

アクター

SparkRAT	3
Cobalt Strike	2
WatchDog	1
IcedID	1
Candiru	1

関心

タイプ

Not Defined	100
Chip Software	14
Web Server	10
Operating System	8
Programming Language Software	6

ベンダー

Not Defined	84
Qualcomm	14
Synology	6
Apple	6
Apache	6

製品

Qualcomm Snapdragon Auto	14
Qualcomm Snapdragon Industrial IOT	14
Qualcomm Snapdragon Compute	12
Qualcomm Snapdragon Mobile	12
Qualcomm Snapdragon Connectivity	10

脆弱性

#	脆弱性	Base	Temp	0day	本日	悪	修復	EPSS	CTI	CVE
1	vu Mass Mailer Login Page redir.asp SQLインジェクション	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00238	0.04	CVE-2007-6138
2	Micro Focus Solutions Business Manager 弱い認証	5.9	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2019-18946
3	Qualcomm Snapdragon Auto NFC メモリ破損	6.5	6.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00044	0.00	CVE-2019-14024
4	c-blosc2 ndlz8x8.c ndlz8_decompress メモリ破損	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00045	0.77	CVE-2024-3203
5	Linux Kernel ext4 kill_bdev サービス拒否	5.7	5.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00045	0.00	CVE-2021-47119
6	Schoolbox Calendar クロスサイトスクリプティング	5.4	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00043	0.00	CVE-2024-28097
7	Cisco IOS/IOS XE SSH 特権昇格	7.3	7.2	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00110	0.04	CVE-2022-20920
8	Progress Sitefinity Page Editing Area クロスサイトスクリプティング	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00043	0.04	CVE-2024-1636
9	Starbox Plugin 特権昇格	4.9	4.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00053	0.04	CVE-2024-0366
10	WooCommerce Product Enquiry Plugin クロスサイトスクリプティング	4.8	4.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00046	0.04	CVE-2023-7151
11	Cainor Calendarinho Redirect	5.0	5.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00052	0.00	CVE-2023-49281
12	GoDaddy Email Marketing Plugin 特権昇格	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02	CVE-2023-49156
13	Apache HTTP Server FilesMatch 特権昇格	7.7	7.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.96163	0.00	CVE-2017-15715
14	Tracker Software PDF-XChange Editor EMF File Parser メモリ破損	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00046	0.00	CVE-2023-42050
15	Apache Guacamole RDP Audio メモリ破損	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00215	0.04	CVE-2023-30576
16	LG LED Assistant ディレクトリトラバーサル	8.5	8.4	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.01854	0.05	CVE-2023-4613
17	HTTP Auth Plugin 未知の脆弱性	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00058	0.00	CVE-2023-27435
18	Onepage Builder Plugin SQLインジェクション	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00050	0.00	CVE-2023-38391
19	Metform Elementor Contact Form Builder Plugin Shortcode 情報の漏洩	5.4	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00064	0.00	CVE-2023-0688
20	XWiki Platform 特権昇格	8.3	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00096	0.00	CVE-2023-32069

キャンペーン (1)

These are the campaigns that can be associated with the actor:

CVE-2024-27198 / CVE-2024-27199

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IPアドレス	Hostname	アクター	キャンペーン	Identified	タイプ	信頼度
1	38.54.94.13		SparkRAT	CVE-2024-27198 / CVE-2024-27199	2024年04月02日	verified	高
2	43.140.252.169		SparkRAT		2023年09月07日	verified	高
3	XX.XXX.XX.XX	xxx-xx-xxx-xx-xx.xx-xxxxxxxxx-x.xxxxxxx.xxxxxxxxx.xxx	Xxxxxxxx		2023年05月31日	verified	中
4	XX.XX.XXX.XXX		Xxxxxxxx		2024年03月18日	verified	高
5	XX.XXX.XXX.XX	xxxxxx.xxxxxxxxxxxxxx.xxx	Xxxxxxxx		2024年05月03日	verified	高
6	XX.XX.XX.XXX	xxx.xx.xx.xx.xx.xxx.xx	Xxxxxxxx	Xxx-xxxx-xxxxx / Xxx-xxxx-xxxxx	2024年04月02日	verified	高
7	XXX.XXX.XXX.XXX	xx.xxxxxxxxxx.xxx	Xxxxxxxx		2023年05月08日	verified	高

TTP - Tactics, Techniques, Procedures (20)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	クラス	脆弱性	アクセスベクター	タイプ	信頼度
1	T1006	CAPEC-126	CWE-22, CWE-23	Path Traversal	predictive	高
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	高
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	高
4	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	高
5	TXXXX	CAPEC-104	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
6	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	高
7	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	高
8	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	高
9	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	高
10	TXXXX	CAPEC-1	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	高
11	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	高
12	TXXXX	CAPEC-102	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
13	TXXXX	CAPEC-37	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
14	TXXXX.XXX	CAPEC-154	CWE-XXX	Xxxxxxxxxxxx	predictive	高
15	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	高
16	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	高
17	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	高
18	TXXXX	CAPEC-116	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	高
19	TXXXX	CAPEC-157	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	高
20	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	高

IOA - Indicator of Attack (97)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	クラス	Indicator	タイプ	信頼度
1	File	/.vnc/sesman_${username}_passwd	predictive	高
2	File	/asms/classes/Master.php?f=delete_transaction	predictive	高
3	File	/cgi-bin/editBookmark	predictive	高
4	File	/goform/addressNat	predictive	高
5	File	/goform/aspForm	predictive	高
6	File	/include/menu_v.inc.php	predictive	高
7	File	/librarian/lab.php	predictive	高
8	File	/omos/admin/?page=user/list	predictive	高
9	File	/opt/zimbra/jetty/webapps/zimbra/public	predictive	高
10	File	/panel/fields/add	predictive	高
11	File	/patient/settings.php	predictive	高
12	File	/xxxx/*/xxxxxxx"	predictive	高
13	File	/xxxx/xxx/xxxxxxx	predictive	高
14	File	/xxxx/xxxx_xxxxxxx	predictive	高
15	File	/xxx/x-xxxxxx/xxxxxxx/xxxxxx/xxxx/xxxxxxx.x	predictive	高
16	File	/xxxxxxx/	predictive	中
17	File	/xxx/xxx/xxx/xxxxxxx.xx	predictive	高
18	File	xxxxx/xxxxxx.xxx	predictive	高
19	File	xxx.xxx	predictive	低
20	File	xxx/xxxxx/xxxxxxxxxx/xxxx.xxx	predictive	高
21	File	xxx\xxxxxxxxxx_xxxxxxxx\xxxxxxxxxx_xxxxxxx_xxxxxxx.xxx	predictive	高
22	File	xxx-xxxxxx-xxxxxx.x	predictive	高
23	File	x:\xxxxxx	predictive	中
24	File	x:\xxxxxxxx	predictive	中
25	File	x:\xxxxxxx\xxxxxxxx.xxx	predictive	高
26	File	xxxxxxxxxxxxxxxx.xxxx	predictive	高
27	File	xxxxxxxxxx/xxxxxxx/xxxxxxxx.xxx	predictive	高
28	File	xxxxxxx/xxxxxxxxxx/xx/xxxx/xxxx.x	predictive	高
29	File	xxx.x	predictive	低
30	File	xxxxx_xxxxxx.xxxx.xxx	predictive	高
31	File	xxxxxxx.x	predictive	中
32	File	xxxxx_xxxx.xxx	predictive	高
33	File	xxxxxxxx.x	predictive	中
34	File	xxxxxxx.xxx	predictive	中
35	File	xxxxxxxx.xxx	predictive	中
36	File	xxxxxxxxxx/xxxxxxxxx.x	predictive	高
37	File	xxxxxxx/xxxxx/xx/xxxxxx/xxxxx.xxxxx.xxx	predictive	高
38	File	xxxxx.xxx	predictive	中
39	File	xxx-xxxxxxx.xxx	predictive	高
40	File	xxxxxxxxx.xxx.xxx	predictive	高
41	File	xxxxxxx.xxx	predictive	中
42	File	xxxxxx.xxx	predictive	中
43	File	xxxxxxx-xxxxxxxxx-xxxxxxxx.xxx	predictive	高
44	File	xxxxxxxxxxxxxxxxxxxxxx.xxx	predictive	高
45	File	xxxxx.xxx	predictive	中
46	File	xxxxxxxx/xxxx/xxxx.xxx?xxxxxx=xxxxxxxxxxxxxxxx	predictive	高
47	File	xxxx-xxxxxx.x	predictive	高
48	File	xxxxxxxxxxxxxxx/xxxxxxxxxxxx.xxx	predictive	高
49	File	xx_xxxx/xx_xxxx.x	predictive	高
50	File	xxxxxxx.xxx	predictive	中
51	File	xxx_xxxxxxxx.x	predictive	高
52	File	xxxxxx_xxxxxx.x	predictive	高
53	File	xxx/xxxxx/xxxxxx.xxx?xxxxxxx=xxxxxxx	predictive	高
54	File	xxxxx/xxxx.xx	predictive	高
55	File	xxxxxx/xxxxxxxxx.xxx	predictive	高
56	File	xxxxxxxxxxxxxx.xxx	predictive	高
57	Library	xxxxxxxx.xxx	predictive	中
58	Library	xxx/xxx/xxx_xxxxxx_xxx.x	predictive	高
59	Library	xxxxxxxxxxxxxxxx.xxx	predictive	高
60	Library	xxx/xx_xxx.x	predictive	中
61	Argument	-xx	predictive	低
62	Argument	/.xxx/xxxxxx_${xxxxxxxx}_xxxxxx	predictive	高
63	Argument	xxxxxxxx_xxx_xxx/xxxxxxxx_xxxxxxxx_xxx	predictive	高
64	Argument	xxx	predictive	低
65	Argument	xxx	predictive	低
66	Argument	xxxxxx/xxxxxxxxxxxx	predictive	高
67	Argument	xxxxx xxxx/xxxxxx xxxx/xxxx xxxx	predictive	高
68	Argument	xx	predictive	低
69	Argument	xxxxxx	predictive	低
70	Argument	xxxxxxx	predictive	低
71	Argument	xxx	predictive	低
72	Argument	xxxxx	predictive	低
73	Argument	xxxxxx	predictive	低
74	Argument	xxxxx_xxxxx_xx	predictive	高
75	Argument	xxxx	predictive	低
76	Argument	xxxx	predictive	低
77	Argument	xxxx	predictive	低
78	Argument	xxx.xxxxxxxxxxxxxxx.xxx.xxxxxxx.xxxx.xxxxxxxxxxxxxxxxxxxx.xxxxxx	predictive	高
79	Argument	xxxxxxx	predictive	低
80	Argument	xxxx	predictive	低
81	Argument	xxxxxxxx	predictive	中
82	Argument	xxxxxxxx	predictive	中
83	Argument	xxxxxxxxx	predictive	中
84	Argument	xxxxxxx	predictive	低
85	Argument	xxxxxxx_xxxxx	predictive	高
86	Argument	xxxxxxxxx	predictive	中
87	Argument	xxxxxx	predictive	低
88	Argument	xxxxx	predictive	低
89	Argument	xxxxxx	predictive	低
90	Argument	xxxxx	predictive	低
91	Argument	xxxx	predictive	低
92	Argument	xxxxxxxxx	predictive	中
93	Argument	_xxxxxxx	predictive	中
94	Input Value	//////////...	predictive	高
95	Input Value	<xxxx<xxxxxx>xx>xxxxx(x)</xxxx</xxxxxx>xx>	predictive	高
96	Pattern	\|xx xx xx\|	predictive	中
97	Network Port	xxx/xxxx	predictive	中

参考 (7)

The following list contains external sources which discuss the actor and the associated activities:

◂ 前概要次 ▸

Do you need the next level of professionalism?

Upgrade your account now!