Gustuff Analysis

IOB - Indicator of Behavior (69)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en68
pl2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

de68
me2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

MK-AUTH4
Microsoft Windows4
IBM Lotus Domino2
DZCP deV!L`z Clanportal2
OpenSSL2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1MK-AUTH auth os command injection9.89.8$0-$5k$0-$5kNot DefinedNot Defined0.000.00289CVE-2020-14072
2Yii ActiveRecord.php findByCondition sql injection8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.030.00119CVE-2018-7269
3Microsoft IIS cross site scripting5.24.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.040.00548CVE-2017-0055
4SolarWinds Dameware Mini Remote Client Agent SmartCard Authentication DWRCS.exe input validation8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.020.01347CVE-2019-3980
5JCK Editor links.php sql injection8.58.3$0-$5k$0-$5kHighNot Defined0.030.81623CVE-2018-17254
6IBM Lotus Domino domcfg.nsf information disclosure5.35.0$5k-$25k$0-$5kProof-of-ConceptNot Defined0.020.00000
7Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25k$0-$5kHighWorkaround0.020.02016CVE-2007-1192
8DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.710.00943CVE-2010-0966
9Cisco ASA Authentication input validation6.46.3$5k-$25k$0-$5kHighOfficial Fix0.030.97429CVE-2018-0296
10Apple watchOS WebKit cross-domain policy4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00089CVE-2023-38572
11Phpletter Ajax File/Image Manager code injection7.37.0$0-$5k$0-$5kHighOfficial Fix0.020.96910CVE-2011-4825
12Microsoft Azure Stack Edge privileges management10.08.7$100k and more$25k-$100kUnprovenOfficial Fix0.040.00188CVE-2022-37968
13Apache HTTP Server mod_rewrite redirect6.76.7$25k-$100k$5k-$25kNot DefinedNot Defined0.000.00258CVE-2020-1927
14MK-AUTH Web Login executar_login.php hard-coded credentials8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.000.00341CVE-2020-14070
15PHP enchant.c enchant_broker_request_dict memory corruption7.36.4$5k-$25k$0-$5kUnprovenOfficial Fix0.000.18929CVE-2014-9705
16OpenSSL Certificate Chain Verification certificate validation6.56.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.00260CVE-2021-3450
17IBM Aspera Connect DLL privileges management7.57.5$5k-$25k$5k-$25kNot DefinedNot Defined0.000.00299CVE-2020-4545
18GetSimple CMS xml external entity reference5.34.9$0-$5kCalculatingNot DefinedNot Defined0.030.00814CVE-2014-8790
19Microsoft ASP.NET Core Kestrel Web Application password recovery8.07.9$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.02783CVE-2018-0787
20PHP EXIF exif_process_IFD_in_TIFF memory corruption9.89.6$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.02863CVE-2019-9641

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (12)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (21)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/authpredictiveLow
2File/uncpath/predictiveMedium
3Fileadmin/executar_login.phppredictiveHigh
4Filexxxxxxx/xxxxxxxxxx.xxxpredictiveHigh
5Filexxxxx/xxxx/xxxxxxxxxx/xxxxxxxxxxx.xxxpredictiveHigh
6Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
7Filexxxxxx.xxxpredictiveMedium
8Filexxxxx.xxxpredictiveMedium
9Filexxxxxxx.xpredictiveMedium
10Filexxxxxxxxx/xx/xxxxxxxxxxxx.xxxpredictiveHigh
11Filexxx/xxxxxx.xxxpredictiveHigh
12Filexxxxxxxxx/xxxxxxx/xxxxx.xxxpredictiveHigh
13Filexxxxxxxxxxxxxxx.xxxpredictiveHigh
14Filexxxxxxx/xxxxxxxxxxxxxxxx/xxxxxxxxx/xxxxxxxx.xxxxpredictiveHigh
15Filexxxxxx.xxxpredictiveMedium
16Libraryxxxxxxxxxxxxxx.xxxxxxx.xxxxxxxxxxxxxxx.xxxpredictiveHigh
17Argument-xpredictiveLow
18ArgumentxxxxxxxxpredictiveMedium
19ArgumentxxxxpredictiveLow
20ArgumentxxxxxxpredictiveLow
21Argumentxxxxxxxx_xxxxxpredictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!