Cryptbot Analysis

IOB - Indicator of Behavior (12)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	10
ar	2

Country

de	12

Actors

Raccoon Stealer	1
Cryptbot	1

Activities

Interest

Timeline

Type

Not Defined	8
Web Server	2
Social Network Software	2

Vendor

TOTOLINK	4
Goahead Software	2
Apache	2
Huawei	2
Facebook	2

Product

Goahead Software Webserver	2
Apache Commons Configuration	2
Huawei ACXXXX	2
Huawei SXXXX	2
Facebook WhatsApp	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Goahead Software Webserver HTTP Request aux denial of service	5.3	4.9	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.06	0.06790	CVE-2001-0385
2	Facebook WhatsApp Video Call heap-based overflow	8.0	7.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.01156	CVE-2022-36934
3	SourceCodester Simple Parking Management System cross site scripting	3.9	3.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	0.00885	CVE-2022-2363
4	Snipe-IT Update Branding Settings unrestricted upload	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.04	0.01773	CVE-2022-32060
5	TOTOLINK EX300 MQTT Data Packet setLanguageCfg command injection	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.06	0.02055	CVE-2022-32449
6	IBM Security Access Manager Appliance inadequate encryption	5.7	5.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.06	0.00885	CVE-2022-22464
7	Apache Commons Configuration Variable Interpolation Privilege Escalation	8.0	7.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.04	0.53745	CVE-2022-33980
8	TOTOLINK A800R/A810R/A830R/A950RG/A3000RU/A3100R command injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.02055	CVE-2022-28935
9	Huawei ACXXXX/SXXXX SSH Packet input validation	7.5	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.07	0.01055	CVE-2014-8572
10	libvirt libxl Driver locking	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01	0.00885	CVE-2021-4147
11	Zabbix SAML authentication spoofing	8.2	8.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.09	0.16531	CVE-2022-23131
12	VMware Spring Framework neutralization for logs	4.5	4.5	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00	0.00890	CVE-2021-22096

IOC - Indicator of Compromise (16)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Type	Confidence
1	8.248.153.254		Cryptbot	verified	High
2	8.248.163.254		Cryptbot	verified	High
3	8.248.167.254		Cryptbot	verified	High
4	8.249.223.254		Cryptbot	verified	High
5	X.XXX.XXX.XXX		Xxxxxxxx	verified	High
6	X.XXX.XX.XXX		Xxxxxxxx	verified	High
7	X.XXX.XXX.XXX		Xxxxxxxx	verified	High
8	X.XXX.XXX.XXX		Xxxxxxxx	verified	High
9	XX.XXX.XXX.XXX	xxx.xxx.xxx.xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxxx	verified	Medium
10	XX.XXX.XX.XXX	xx-xx.xxx	Xxxxxxxx	verified	High
11	XX.XXX.X.X	xxxxx-xx-xxx-x-x.xxx.xxxx.xxx	Xxxxxxxx	verified	High
12	XX.XXX.X.XXX	xxxxx-xx-xxx-x-xxx.xxx.xxxx.xxx	Xxxxxxxx	verified	High
13	XX.XX.XX.XX	xxxxxx.xx.xx.xx.xx.xxxxxxx.xxxx-xxxxxx.xx	Xxxxxxxx	verified	High
14	XXX.XXX.XXX.X		Xxxxxxxx	verified	High
15	XXX.X.XXX.XX	xx-xx-xxxx.xxx-xxxxxxx.xxx	Xxxxxxxx	verified	High
16	XXX.XX.XXX.X	xx-xxx.xxx	Xxxxxxxx	verified	High

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1059.007	CWE-79	Cross Site Scripting	predictive	High
2	TXXXX	CWE-XX	Xxxxxxx Xxxxxxxxx	predictive	High
3	TXXXX	CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxxxxxxxx Xxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (5)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/aux	predictive	Low
2	File	/ci_spms/admin/search/searching/	predictive	High
3	Argument	xxxxxxxx	predictive	Medium
4	Argument	xxxxxx	predictive	Low
5	Input Value	"><xxxxxx>xxxxx("xxx")</xxxxxx>	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!