DetaRAT Analysis

IOB - Indicator of Behavior (68)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en50
de18

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us22
de14
ca4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Vlad Alexa Mancini PHPFootball4
PowerScripts PowerNews2
Play Framework2
Linux Foundation Xen2
RoundCube2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.040.04187CVE-2007-1192
2Joomla CMS com_easyblog sql injection6.36.1$5k-$25k$5k-$25kNot DefinedNot Defined1.440.00000
3DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.610.04187CVE-2010-0966
4Tiki Admin Password tiki-login.php improper authentication8.07.7$0-$5k$0-$5kNot DefinedOfficial Fix0.590.09029CVE-2020-15906
5DolphinPHP User Management Page cross site scripting3.53.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.060.00885CVE-2022-1086
6LogicBoard CMS away.php redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable1.390.00000
7vu Mass Mailer Login Page redir.asp sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.080.01139CVE-2007-6138
8Mozilla Firefox/Thunderbird SetOffsets resource management7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.090.08228CVE-2013-1677
9IBM InfoSphere Master Data Management cross site scripting3.53.4$5k-$25kCalculatingNot DefinedOfficial Fix0.020.01055CVE-2015-1968
10IBM Rational Collaborative Lifecycle Management Jazz Foundation cross site scripting3.53.4$5k-$25kCalculatingNot DefinedOfficial Fix0.000.01055CVE-2015-0130
11McAfee ePolicy Orchestrator cross site scripting4.34.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.050.01136CVE-2015-4559
12Moodle configonlylib.php min_get_slash_argument path traversal6.36.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.050.01132CVE-2015-1493
13WordPress Shortcodes/Post Content server-side request forgery6.35.7$5k-$25kCalculatingProof-of-ConceptOfficial Fix0.020.36555CVE-2013-0235
14Moodle Contacts/Messages information disclosure5.34.6$5k-$25kCalculatingUnprovenOfficial Fix0.020.01061CVE-2015-2266
15Moodle mdeploy.php access control6.35.5$5k-$25k$0-$5kUnprovenOfficial Fix0.030.01061CVE-2015-2267
16Moodle Regular Expression resource management5.34.6$5k-$25k$0-$5kUnprovenOfficial Fix0.040.01061CVE-2015-2268
17Adobe Flash Player use after free10.08.7$25k-$100k$0-$5kUnprovenOfficial Fix0.040.04219CVE-2015-0342
18WhatsApp Messenger Profile Image information disclosure5.35.0$5k-$25k$0-$5kProof-of-ConceptUnavailable0.040.00000
19Linux Foundation Xen GIC Logging Rate Limit resource management4.03.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.00950CVE-2015-1563
20WordPress cross site scripting4.34.1$5k-$25kCalculatingNot DefinedOfficial Fix0.010.01213CVE-2013-0236

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsTypeConfidence
1173.212.224.110vmi587275.contaboserver.netDetaRATverifiedHigh
2XXX.XXX.XX.XXXxxxxxxxxx.xxxxxxxxxxxxx.xxxXxxxxxxverifiedHigh

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (29)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/forum/away.phppredictiveHigh
2File/wordpress/wp-admin/admin.phppredictiveHigh
3Fileadmin/index.phppredictiveHigh
4Filedata/gbconfiguration.datpredictiveHigh
5Filexxxxxx.xxxpredictiveMedium
6Filexxx/xxxxxx.xxxpredictiveHigh
7Filexxx/xxxx/xxx.x/xxxx_xxxxxx.xpredictiveHigh
8Filexxxxx.xxxpredictiveMedium
9Filexxxxxxx.xxxpredictiveMedium
10Filexxxxxxxxx/xxxx-xxxxpredictiveHigh
11Filexxxx.xxxpredictiveMedium
12Filexxxxx/xxxxxxx/predictiveHigh
13Filexxxxxx.xxxpredictiveMedium
14Filexxxxx.xxxpredictiveMedium
15Filexxxxxxxxxxxxxx.xxxpredictiveHigh
16Filexxxxx.xxxpredictiveMedium
17Filexxxx-xxxxx.xxxpredictiveHigh
18Libraryxxx/xxxxxxxxxxxxx.xxxpredictiveHigh
19ArgumentxxxxxxxxpredictiveMedium
20ArgumentxxxxxxxpredictiveLow
21ArgumentxxxxpredictiveLow
22ArgumentxxpredictiveLow
23ArgumentxxxxxxxxxxpredictiveMedium
24ArgumentxxxxxxpredictiveLow
25ArgumentxxxxxxxxpredictiveMedium
26Argumentxxxxxxx_xxpredictiveMedium
27ArgumentxxxxxxxpredictiveLow
28ArgumentxxxxpredictiveLow
29ArgumentxxxxxpredictiveLow

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Want to stay up to date on a daily basis?

Enable the mail alert feature now!