EvilGnome Analysisinfo

IOB - Indicator of Behavior (49)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en46
zh4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

WordPress4
SUSE Linux Enterprise Server2
SUSE Manager Server2
Mailman2
Dahuasecurity Dvr54082

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.021470.00CVE-2007-1192
2Veritas NetBackup bpcd access control8.58.4$0-$5k$0-$5kNot DefinedOfficial Fix0.004700.00CVE-2015-6550
3cnoa OA index.php hard-coded password7.57.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.001190.27CVE-2023-2799
4SUSE Linux Enterprise Server/Manager Server rmt-server-regsharing Service default permission8.38.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.000420.00CVE-2022-31254
5Signiant Manager+Agents xml external entity reference5.55.3$0-$5k$0-$5kNot DefinedOfficial Fix0.002440.00CVE-2021-46660
6Philips Engage Software access control2.92.8$0-$5k$0-$5kNot DefinedOfficial Fix0.000540.00CVE-2021-23173
7b2evolution CMS User Login sql injection8.07.9$0-$5k$0-$5kNot DefinedNot Defined0.002220.00CVE-2021-31632
8WordPress Sandbox flashmediaelement.swf Cross-Domain input validation6.05.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.000810.00CVE-2016-9263
9Oracle MySQL Server Encryption information disclosure5.35.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.001670.00CVE-2019-2923
10Notepad++ Scintilla SciLexer.dll input validation7.06.9$0-$5k$0-$5kNot DefinedOfficial Fix0.006210.04CVE-2019-16294
11Omron CX-One CX-Programmer Password Storage information disclosure5.95.7$0-$5k$0-$5kNot DefinedOfficial Fix0.000420.00CVE-2015-0988
12Dahuasecurity Dvr5408 Authorization access control9.89.8$0-$5k$0-$5kNot DefinedNot Defined0.003960.03CVE-2013-5754
13Dahua IP Camera/IP PTZ Temporary Password cryptographic issues7.47.4$0-$5k$0-$5kNot DefinedNot Defined0.005580.04CVE-2017-9315
14Mailman input validation6.56.3$0-$5k$0-$5kNot DefinedOfficial Fix0.001600.03CVE-2018-13796
15WordPress pluggable.php wp_validate_redirect8.07.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.006500.00CVE-2016-2221
16Axesstel MU553S ConfigSet cross-site request forgery6.56.5$0-$5k$0-$5kNot DefinedNot Defined0.000710.00CVE-2017-11350
17Microsoft Office data processing7.06.9$5k-$25k$0-$5kHighOfficial Fix0.388690.00CVE-2017-0262
18Google Chrome URI access control5.44.9$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.001630.00CVE-2012-4906
19Joomla CMS sql injection7.36.9$5k-$25k$0-$5kProof-of-ConceptNot Defined0.002640.04CVE-2013-1453
20Joomla CMS Password Reset access control7.37.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.003010.04CVE-2012-1598

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
1195.62.52.10152-101.static.ipcserver.netEvilGnome02/12/2024verifiedVery High

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueClassVulnerabilitiesAccess VectorTypeConfidence
1T1068CAPEC-19CWE-264, CWE-284Execution with Unnecessary PrivilegespredictiveHigh
2T1078.001CWE-259Use of Hard-coded PasswordpredictiveHigh
3TXXXX.XXXCAPEC-XXXCWE-XXXXxxx XxxxxxxxpredictiveHigh
4TXXXXCAPEC-XCWE-XXXXxxxxxxxxx XxxxxxpredictiveHigh
5TXXXXCAPEC-XXXCWE-XXXxx XxxxxxxxxpredictiveHigh
6TXXXXCAPEC-XXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveHigh
7TXXXXCWE-XXXXxxxxxxxxxxxx XxxxxxpredictiveHigh

IOA - Indicator of Attack (8)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/index.php?app=main&func=passport&action=loginpredictiveHigh
2Filecgi-bin/ConfigSetpredictiveHigh
3Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
4Filexxxxxxxxxxxxxxxxx.xxxpredictiveHigh
5Filexx-xxxxxxxx/xxxxxxxxx.xxxpredictiveHigh
6Libraryxxxxxxxx.xxxpredictiveMedium
7ArgumentxxxxxxxxxxxxpredictiveMedium
8ArgumentxxxxxxxxxpredictiveMedium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

This view requires CTI permissions

Just purchase a CTI license today!