APT38 Analysisinfo

IOB - Indicator of Behavior (37)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en38

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Google Chrome8
Google Android4
Microsoft Windows4
Microsoft Edge2
Kingsoft WPS Office2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#VulnerabilityBaseTemp0dayTodayExpCouKEVEPSSCTICVE
1Microsoft Windows DNSAPI DNSAPI.dll access control8.37.9$50k-$100k$10k-$25kNot definedOfficial fixpossible0.382640.02CVE-2017-11779
2Microsoft Windows DNSAPI DNSAPI.dll access control8.18.0$50k-$100k$10k-$25kNot definedOfficial fixpossible0.549610.02CVE-2018-8225
3Google Chrome IPC/Gamepad API/V8 code7.36.4$50k-$100k$0-$1kUnprovenOfficial fix 0.287210.00CVE-2015-1233
4Google Chrome Blink doSerialize privileges management7.36.4$50k-$100k$0-$1kProof-of-ConceptOfficial fix 0.000000.00
5Google Chrome v8 json-stringifier.h SerializeJSArray memory corruption7.37.0$50k-$100k$10k-$25kNot definedOfficial fix 0.137190.06CVE-2015-6764
6nginx request smuggling6.96.9$2k-$5k$0-$1kNot definedNot defined 0.000000.05CVE-2020-12440
7Microsoft Word memory corruption7.06.7$10k-$25k$0-$1kNot definedOfficial fix 0.123980.09CVE-2019-1201
8Microsoft Edge AppContainer Sandbox access control6.56.2$50k-$100k$5k-$10kNot definedOfficial fix 0.006630.00CVE-2019-0938
9WordPress Thumbnail input validation7.57.5$10k-$25k$5k-$10kNot definedNot defined 0.288680.02CVE-2018-1000773
10Google Chrome Catalog Service input validation8.07.9$25k-$50k$0-$1kProof-of-ConceptOfficial fix 0.005980.07CVE-2018-6055
11Sir GNUboard sql injection6.35.7$1k-$2k$0-$1kProof-of-ConceptNot defined 0.001780.06CVE-2014-2339
12Zakkis Technology Php Excel Parser file inclusion7.36.6$2k-$5k$0-$1kProof-of-ConceptUnavailable 0.050790.00CVE-2007-2857
13Microsoft Windows DNSAPI DNSAPI.dll data processing5.25.1$25k-$50k$0-$1kNot definedOfficial fix 0.176780.05CVE-2018-8304
14Oracle HTTP Server Web Listener memory corruption5.35.1$10k-$25k$0-$1kHighOfficial fixexpected0.876000.04CVE-2010-0425
15Kingsoft WPS Office Free WpsCloudSvr access control6.16.1$1k-$2k$0-$1kNot definedNot defined 0.000470.00CVE-2018-6400
16Kingsoft WPS Office kso.dll _alloc_iostr_data input validation4.44.4$0-$1k$0-$1kNot definedNot defined 0.002350.00CVE-2018-6217
17Google Chrome Sandbox memory corruption5.34.6$50k-$100k$5k-$10kUnprovenOfficial fix 0.012410.00CVE-2015-1252
18Microsoft Office memory corruption7.57.2$10k-$25k$0-$1kNot definedOfficial fix 0.318950.06CVE-2018-0795
19OpenSSH Authentication Username information disclosure5.34.8$10k-$25k$0-$1kHighOfficial fixexpected0.924870.14CVE-2016-6210
20Dell EMC Avamar Server/Integrated Data Protection Appliance Installation Manager credentials management8.58.2$10k-$25k$0-$1kProof-of-ConceptOfficial fix 0.230850.05CVE-2018-1217

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
1175.45.176.APT3812/12/2020verifiedLow
2XXX.XX.XXX.Xxxxx12/12/2020verifiedLow
3XXX.XX.XXX.Xxxxx12/12/2020verifiedLow
4XXX.XX.XXX.Xxxxx12/12/2020verifiedLow
5XXX.XX.XXX.Xxxxx12/12/2020verifiedLow

TTP - Tactics, Techniques, Procedures (6)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueClassVulnerabilitiesAccess VectorTypeConfidence
1T1055CAPEC-10CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveHigh
2T1068CAPEC-122CWE-264, CWE-269, CWE-284Execution with Unnecessary PrivilegespredictiveHigh
3TXXXXCAPEC-XXXCWE-XXXxx XxxxxxxxxpredictiveHigh
4TXXXXCWE-XXXXxxxxxxxxxx XxxxxxxxxxpredictiveHigh
5TXXXXCAPEC-XXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveHigh
6TXXXX.XXXCWE-XXXxxxxxxxxxxxxpredictiveHigh

IOA - Indicator of Attack (13)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1Filejson-stringifier.hpredictiveHigh
2Filemm/memory.cpredictiveMedium
3File\\.\pipe\WPSCloudSvr\WpsCloudSvrpredictiveHigh
4Libraryxxxxxx.xxxpredictiveMedium
5Libraryxxx.xxxpredictiveLow
6Libraryxxxxxx.xxxpredictiveMedium
7Libraryxxxxxx/xxxxxxxxx/xxxxx.xxxpredictiveHigh
8ArgumentxxxxxxxpredictiveLow
9Argumentxxxxx->xxxxpredictiveMedium
10Argumentxxxxxxxx.xxxxpredictiveHigh
11Argumentxxxxxx_xxxxpredictiveMedium
12ArgumentxxxxxxxxpredictiveMedium
13Input Valuexx-xxxx://predictiveMedium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

This view requires CTI permissions

Just purchase a CTI license today!