ActionRAT Analysis

IOB - Indicator of Behavior (76)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en56
de16
ru2
it2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Linux Foundation Xen4
Linksys WAG54GS4
Vlad Alexa Mancini PHPFootball2
Joomla CMS2
Moodle2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.020160.00CVE-2007-1192
2DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009430.53CVE-2010-0966
3Tiki Admin Password tiki-login.php improper authentication8.07.7$0-$5k$0-$5kNot DefinedOfficial Fix0.009362.35CVE-2020-15906
4Joomla CMS com_easyblog sql injection6.36.1$5k-$25k$5k-$25kNot DefinedNot Defined0.000000.28
5Michael Salzer Guestbox gbshow.php cross site scripting4.33.9$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.004350.00CVE-2006-0860
6DolphinPHP User Management Page cross site scripting3.53.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.000530.03CVE-2022-1086
7LogicBoard CMS away.php redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable0.000001.86
8vu Mass Mailer Login Page redir.asp sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.002710.03CVE-2007-6138
9Mozilla Firefox/Thunderbird SetOffsets resource management7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.090520.00CVE-2013-1677
10IBM InfoSphere Master Data Management cross site scripting3.53.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000630.00CVE-2015-1968
11IBM Rational Collaborative Lifecycle Management Jazz Foundation cross site scripting3.53.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000630.00CVE-2015-0130
12McAfee ePolicy Orchestrator cross site scripting4.34.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.001920.02CVE-2015-4559
13Moodle configonlylib.php min_get_slash_argument path traversal6.36.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.001770.06CVE-2015-1493
14WordPress Shortcodes/Post Content server-side request forgery6.35.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.141630.00CVE-2013-0235
15Moodle Contacts/Messages information disclosure5.34.6$5k-$25k$0-$5kUnprovenOfficial Fix0.001240.05CVE-2015-2266
16Moodle mdeploy.php access control6.35.5$5k-$25k$0-$5kUnprovenOfficial Fix0.001120.05CVE-2015-2267
17Moodle Regular Expression resource management5.34.6$5k-$25k$0-$5kUnprovenOfficial Fix0.002820.00CVE-2015-2268
18Adobe Flash Player use after free10.08.7$25k-$100k$0-$5kUnprovenOfficial Fix0.030410.00CVE-2015-0342
19WhatsApp Messenger Profile Image information disclosure5.35.0$5k-$25k$0-$5kProof-of-ConceptUnavailable0.000000.05
20Linux Foundation Xen GIC Logging Rate Limit resource management4.03.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.000620.00CVE-2015-1563

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (37)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/forum/away.phppredictiveHigh
2File/wordpress/wp-admin/admin.phppredictiveHigh
3Fileadmin/index.phppredictiveHigh
4Filebooks.phppredictiveMedium
5Filedata/gbconfiguration.datpredictiveHigh
6Filexxxxxx.xxxpredictiveMedium
7Filexxxxxx.xxxpredictiveMedium
8Filexxxxxxxxx.xxxpredictiveHigh
9Filexxx/xxxxxx.xxxpredictiveHigh
10Filexxx/xxxx/xxx.x/xxxx_xxxxxx.xpredictiveHigh
11Filexxxxx.xxxpredictiveMedium
12Filexxxxxxx.xxxpredictiveMedium
13Filexxxxxxxxx/xxxx-xxxxpredictiveHigh
14Filexxxx.xxxpredictiveMedium
15Filexxxxx/xxxxxxx/predictiveHigh
16Filexxxxxx.xxxpredictiveMedium
17Filexxxxx.xxxpredictiveMedium
18Filexxxxxxxx.xxxpredictiveMedium
19Filexxxxxxxx_xxxx.xxxpredictiveHigh
20Filexxxxxxxxxxxxxx.xxxpredictiveHigh
21Filexxxxx.xxxpredictiveMedium
22Filexxxx-xxxxx.xxxpredictiveHigh
23Libraryxxx/xxxxxxxxxxxxx.xxxpredictiveHigh
24ArgumentxxxxxxxxpredictiveMedium
25ArgumentxxxxxxpredictiveLow
26ArgumentxxxxxxxpredictiveLow
27ArgumentxxxxpredictiveLow
28ArgumentxxxxxxxxpredictiveMedium
29ArgumentxxpredictiveLow
30ArgumentxxxxxxxxxxpredictiveMedium
31ArgumentxxxxxxxxpredictiveMedium
32ArgumentxxxxxxpredictiveLow
33ArgumentxxxxxxxxpredictiveMedium
34Argumentxxxxxxx_xxpredictiveMedium
35ArgumentxxxxxxxpredictiveLow
36ArgumentxxxxpredictiveLow
37ArgumentxxxxxpredictiveLow

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!