Gustuff Analysis

IOB - Indicator of Behavior (68)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en66
pl2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

de66
me2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Microsoft Windows4
PHP4
Apache HTTP Server4
Oracle Database2
Cisco ASA2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1MK-AUTH auth os command injection9.89.8$0-$5k$0-$5kNot DefinedNot Defined0.030.01440CVE-2020-14072
2Yii ActiveRecord.php findByCondition sql injection8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.020.01055CVE-2018-7269
3Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.080.25090CVE-2017-0055
4SolarWinds Dameware Mini Remote Client Agent SmartCard Authentication DWRCS.exe input validation8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.000.09029CVE-2019-3980
5JCK Editor links.php sql injection8.58.3$0-$5k$0-$5kHighNot Defined0.030.10356CVE-2018-17254
6IBM Lotus Domino domcfg.nsf information disclosure5.35.0$5k-$25k$0-$5kProof-of-ConceptNot Defined0.000.00000
7Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25k$0-$5kHighWorkaround0.040.04187CVE-2007-1192
8DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.430.04187CVE-2010-0966
9Cisco ASA Authentication input validation6.46.1$25k-$100k$0-$5kHighOfficial Fix0.020.96113CVE-2018-0296
10Phpletter Ajax File/Image Manager code injection7.37.0$0-$5k$0-$5kHighOfficial Fix0.050.81845CVE-2011-4825
11Microsoft Azure Stack Edge privileges management10.08.7$100k and more$5k-$25kUnprovenOfficial Fix0.020.02251CVE-2022-37968
12Apache HTTP Server mod_rewrite redirect6.76.7$25k-$100k$5k-$25kNot DefinedNot Defined0.110.07767CVE-2020-1927
13MK-AUTH Web Login executar_login.php hard-coded credentials8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.020.00885CVE-2020-14070
14PHP enchant.c enchant_broker_request_dict memory corruption7.36.4$5k-$25k$0-$5kUnprovenOfficial Fix0.020.12248CVE-2014-9705
15OpenSSL Certificate Chain Verification certificate validation6.56.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.040.29373CVE-2021-3450
16IBM Aspera Connect DLL privileges management7.57.5$5k-$25k$5k-$25kNot DefinedNot Defined0.020.01611CVE-2020-4545
17GetSimple CMS xml external entity reference5.34.9$0-$5k$0-$5kNot DefinedNot Defined0.000.01213CVE-2014-8790
18Microsoft ASP.NET Core Kestrel Web Application password recovery8.07.7$25k-$100k$0-$5kNot DefinedOfficial Fix0.030.11247CVE-2018-0787
19PHP EXIF exif_process_IFD_in_TIFF memory corruption9.89.4$25k-$100k$0-$5kNot DefinedOfficial Fix0.020.01537CVE-2019-9641
20Ingenico Telium 2 TRACE Protocol code injection5.55.3$0-$5k$0-$5kNot DefinedOfficial Fix0.030.01559CVE-2018-17772

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (12)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (21)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/authpredictiveLow
2File/uncpath/predictiveMedium
3Fileadmin/executar_login.phppredictiveHigh
4Filexxxxxxx/xxxxxxxxxx.xxxpredictiveHigh
5Filexxxxx/xxxx/xxxxxxxxxx/xxxxxxxxxxx.xxxpredictiveHigh
6Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
7Filexxxxxx.xxxpredictiveMedium
8Filexxxxx.xxxpredictiveMedium
9Filexxxxxxx.xpredictiveMedium
10Filexxxxxxxxx/xx/xxxxxxxxxxxx.xxxpredictiveHigh
11Filexxx/xxxxxx.xxxpredictiveHigh
12Filexxxxxxxxx/xxxxxxx/xxxxx.xxxpredictiveHigh
13Filexxxxxxxxxxxxxxx.xxxpredictiveHigh
14Filexxxxxxx/xxxxxxxxxxxxxxxx/xxxxxxxxx/xxxxxxxx.xxxxpredictiveHigh
15Filexxxxxx.xxxpredictiveMedium
16Libraryxxxxxxxxxxxxxx.xxxxxxx.xxxxxxxxxxxxxxx.xxxpredictiveHigh
17Argument-xpredictiveLow
18ArgumentxxxxxxxxpredictiveMedium
19ArgumentxxxxpredictiveLow
20ArgumentxxxxxxpredictiveLow
21Argumentxxxxxxxx_xxxxxpredictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Might our Artificial Intelligence support you?

Check our Alexa App!