Echobot Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (57)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	56
fr	2

Country

US: USA	38
IR: Iran	16
RU: Russia	2

Actors

Echobot	3
Baldr	2
Dridex	2
BazarBackdoor	1
Cobalt Strike	1

Activities

Interest

Timeline

Type

Not Defined	10
Operating System	6
Firewall Software	4
Connectivity Software	2
Content Management System	2

Vendor

Not Defined	12
Cisco	6
Microsoft	6
Asus	2
Thomas R. Pasawicz	2

Product

Cisco ASA	4
Microsoft Windows	4
OpenSSH	2
WordPress	2
Asus GT-AX11000	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02820	0.34	CVE-2010-0966
2	Apple Mac OS X TCP/IP Stack denial of service	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02510	0.02	CVE-2004-0171
3	Microsoft IIS IP/Domain Restriction access control	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.00817	0.02	CVE-2014-4078
4	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.03828	0.00	CVE-2007-1192
5	FUSE fusermount access control	6.5	6.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00146	0.06	CVE-2018-10906
6	Asus GT-AX11000 CAPTCHA excessive authentication	3.7	3.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01556	0.02	CVE-2021-41435
7	Oracle GlassFish Server Java Server Faces path traversal	5.3	4.8	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.58063	0.03	CVE-2013-3827
8	Microsoft Windows win32k.sys access control	7.3	7.2	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00349	0.00	CVE-2013-1340
9	PHPSHE pay.php sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00512	0.00	CVE-2019-9762
10	Microsoft IIS uncpath cross site scripting	5.2	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.31138	0.04	CVE-2017-0055
11	IPTV Smarters Web TV Player Upload unrestricted upload	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01219	0.05	CVE-2020-9380
12	Microsoft Windows Background Intelligent Transfer Service information disclosure	3.3	3.3	$25k-$100k	$0-$5k	Not Defined	Workaround	0.00000	0.00
13	NetworkManager AdHoc Mode missing authentication	4.4	4.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00055	0.00	CVE-2012-2736
14	jforum username User input validation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00318	0.04	CVE-2019-7550
15	Citrix NetScaler ADC/NetScaler Gateway information disclosure	7.4	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00224	0.00	CVE-2018-6808
16	Citrix NetScaler ADC/NetScaler Gateway SSH Login Prompt command injection	7.4	7.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00112	0.00	CVE-2018-5314
17	Cisco ASA WebVPN Login Page resource management	4.3	4.1	$5k-$25k	$0-$5k	High	Official Fix	0.01066	0.00	CVE-2014-2124
18	Cisco ASA WebVPN Login Page logon.html cross site scripting	5.3	5.2	$5k-$25k	$0-$5k	High	Official Fix	0.00871	0.03	CVE-2014-2120
19	WordPress wp-trackback.php sql injection	7.3	6.6	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.04942	0.05	CVE-2007-0233
20	PHP PHP-FPM resource consumption	5.9	5.8	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00576	0.00	CVE-2015-9253

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Actor	Identified	Type	Confidence
1	5.59.249.236	Echobot	09/22/2024	verified	Very High
2	XX.XX.XXX.XXX	Xxxxxxx	10/20/2023	verified	High
3	XX.XX.XX.XXX	Xxxxxxx	10/20/2023	verified	High
4	XX.XX.XX.XXX	Xxxxxxx	10/20/2023	verified	High
5	XXX.XXX.XXX.XXX	Xxxxxxx	10/20/2023	verified	High

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Basic Cross Site Scripting	predictive	High
4	TXXXX	CAPEC-XX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX.XXX	CAPEC-XX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
6	TXXXX	CAPEC-XXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
8	TXXXX		CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
9	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
10	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-X	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (26)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/+CSCOE+/logon.html	predictive	High
2	File	/download	predictive	Medium
3	File	/forum/away.php	predictive	High
4	File	/uncpath/	predictive	Medium
5	File	xxxxxxxxxxx.xxx	predictive	High
6	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
7	File	xxxxxxxxxxxxx.xxx	predictive	High
8	File	xxx/xxxxxx.xxx	predictive	High
9	File	xxxxxxx/xxxxxx/xxxxxxx/xxxxxx/xxx.xxx	predictive	High
10	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	High
11	File	xxxxx.xxx	predictive	Medium
12	File	xxxxxx.xxx	predictive	Medium
13	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	High
14	File	xx-xxxxxxxxx.xxx	predictive	High
15	Argument	xxxxxxxx	predictive	Medium
16	Argument	xxxxx	predictive	Low
17	Argument	xxxxxxxx	predictive	Medium
18	Argument	xx	predictive	Low
19	Argument	xxxx	predictive	Low
20	Argument	xxxxxxxx	predictive	Medium
21	Argument	xxxx_xxxx	predictive	Medium
22	Argument	xxxxxx_xxxx	predictive	Medium
23	Argument	xx_xx	predictive	Low
24	Argument	xxxxxxxx	predictive	Medium
25	Argument	xxxxxxxx/xxxx	predictive	High
26	Network Port	xxx/xxx (xxx)	predictive	High

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!