Daserf Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (17)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en	18

Country

CN: China	8
US: USA	6
KR: South Korea	4

Actors

Winnti	1
Daserf	1

Activities

Interest

Timeline

Type

Not Defined	6
Content Management System	4
Web Browser	2
Operating System	2
JavaScript Library	2

Vendor

Not Defined	10
Shenzhen Yunni Technology	2
Microsoft	2
Apple	2

Product

WordPress	4
ExpressVPN	2
Shenzhen Yunni Technology iLnkP2P	2
Microsoft Internet Explorer	2
Apple macOS	2

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#	Vulnerability	Base	Temp	0day	Today	Exp	Cou	KEV	EPSS	CTI	CVE
1	Coremail Document Attachment cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not defined	Not defined		0.00196	0.03	CVE-2015-6942
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	possible	0.02956	0.00	CVE-2007-1192
3	ExpressVPN Service Port 2015 Xvpnd.exe XVPN.SetPreference path traversal	6.2	6.0	$0-$5k	$0-$5k	Not defined	Workaround		0.00087	0.00	CVE-2018-15490
4	Shenzhen Yunni Technology iLnkP2P UID Generator random cryptographic issues	7.7	7.7	$0-$5k	$0-$5k	Not defined	Not defined		0.00356	0.06	CVE-2019-11219
5	Shenzhen Yunni Technology iLnkP2P Authentication improper authentication	7.7	7.7	$0-$5k	$0-$5k	Not defined	Not defined		0.00298	0.00	CVE-2019-11220
6	Hisilicon HI3510 Web Management Portal Credentials permission	6.5	6.5	$0-$5k	$0-$5k	Not defined	Not defined		0.00317	0.00	CVE-2019-10710
7	Hisilicon HI3510 RTSP Stream/Web Portal access control	6.4	6.3	$0-$5k	Calculating	Not defined	Workaround		0.00316	0.07	CVE-2019-10711
8	WordPress URL Validator redirect	6.6	6.5	$5k-$25k	$0-$5k	Not defined	Official fix		0.08454	0.04	CVE-2018-10101
9	WordPress Password Reset wp-login.php mail password recovery	6.1	6.0	$5k-$25k	$0-$5k	Proof-of-Concept	Not defined	possible	0.67006	0.04	CVE-2017-8295
10	WordPress Admin Shell privileges management	7.3	6.6	$25k-$100k	$0-$5k	Functional	Workaround		0.00000	0.03
11	My Link Trader out.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not defined		0.00000	0.05
12	Apple macOS AppleSMC null pointer dereference	7.8	7.6	$5k-$25k	$0-$5k	Not defined	Official fix		0.00054	0.06	CVE-2016-4678
13	Node.js ServerResponse#writeHead Split response splitting	6.1	5.9	$0-$5k	$0-$5k	Not defined	Official fix		0.00327	0.03	CVE-2016-5325
14	Microsoft Internet Explorer Garbage Collection jscript9.dll ProcessMark information disclosure	5.3	4.8	$25k-$100k	$0-$5k	Proof-of-Concept	Official fix		0.00000	0.00
15	IBM Java Virtual Machine information disclosure	5.3	5.1	$5k-$25k	$0-$5k	Not defined	Official fix		0.00250	0.00	CVE-2015-1914

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Actor	Identified	Type	Confidence
1	27.255.69.209	Daserf	03/27/2022	verified	Low
2	XX.XXX.XX.XXX	Xxxxxx	03/27/2022	verified	Low
3	XXX.XXX.X.XX	Xxxxxx	03/27/2022	verified	Low
4	XXX.XXX.XXX.XXX	Xxxxxx	03/27/2022	verified	Low
5	XXX.XXX.XXX.XX	Xxxxxx	03/27/2022	verified	Low

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059.007	CAPEC-209	CWE-79	Basic Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
5	TXXXX		CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
6	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-XX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
9	TXXXX		CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (9)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/out.php	predictive	Medium
2	File	data/gbconfiguration.dat	predictive	High
3	File	xx-xxxxx.xxx	predictive	Medium
4	File	xxxxx.xxx	predictive	Medium
5	Library	xxxxxxxx.xxx	predictive	Medium
6	Argument	xxxx	predictive	Low
7	Argument	xx	predictive	Low
8	Argument	xxxxxx	predictive	Low
9	Network Port	xxx/xxxx	predictive	Medium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!