Ducktail Analysisinfo

IOB - Indicator of Behavior (14)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en6
zh4
sv2
pl2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

MyCMS2
nemo-appium2
ubi-reader2
Softbiz FAQ Script2
Gallery2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1ASP-DEv XM Forum register.asp sql injection6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.00
2h2oai h2o-3 POJO Model Import code injection9.99.9$0-$5k$0-$5kNot DefinedNot Defined0.008820.00CVE-2023-6016
3Microsoft Edge4.34.2$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000880.00CVE-2023-36026
4Mercedes me App Booking Maintenance Order information disclosure4.84.6$0-$5k$0-$5kProof-of-ConceptNot Defined0.000630.00CVE-2023-47393
5BestWebSoft Contact Form Plugin bws_menu.php bws_add_menu_render cross site scripting4.44.3$0-$5k$0-$5kNot DefinedOfficial Fix0.000920.08CVE-2014-125095
6nemo-appium module.exports.setup command injection7.57.4$0-$5k$0-$5kNot DefinedOfficial Fix0.003680.00CVE-2022-21129
7ubi-reader UBIFS File ubireader_extract_files path traversal5.95.8$0-$5k$0-$5kNot DefinedOfficial Fix0.000760.00CVE-2023-0591
8MyCMS Visitors Module view.php build_view cross site scripting4.44.3$0-$5k$0-$5kNot DefinedOfficial Fix0.000890.07CVE-2022-4892
9Kingsoft WPS Office Registry wpsupdater.exe access control5.55.3$0-$5k$0-$5kNot DefinedNot Defined0.012390.00CVE-2022-24934
10Gallery add_comment.php cross site scripting4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.004140.00CVE-2005-0219
11Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.021470.00CVE-2007-1192
12Softbiz FAQ Script add_comment.php sql injection6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.011810.00CVE-2005-3938
13Wheatblog add_comment.php cross site scripting5.45.2$0-$5k$0-$5kHighUnavailable0.006770.00CVE-2006-5921

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
123.88.71.29static.29.71.88.23.clients.your-server.deDucktail01/08/2024verifiedVery High
2XXX.XXX.X.XXXxxxxxx.xxx.x.xxx.xxx.xxxxxxx.xxxx-xxxxxx.xxXxxxxxxx01/08/2024verifiedVery High

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (9)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1Fileadd_comment.phppredictiveHigh
2Filebws_menu/bws_menu.phppredictiveHigh
3Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
4Filexxx/xxxxx/xxxx.xxxpredictiveHigh
5Filexxxxxxxx.xxxpredictiveMedium
6Filexxxxxxxxxx.xxxpredictiveHigh
7Argumentxxxxx_xxxx_xxxxxpredictiveHigh
8ArgumentxxpredictiveLow
9Argumentxxxxxxxx/xxxxxxxxxpredictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

This view requires CTI permissions

Just purchase a CTI license today!