Handymanny Analysis

IOB - Indicator of Behavior (57)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	52
ru	4
fr	2

Country

us	30
ru	12
pl	4
cn	2
fr	2

Actors

Handymanny	1

Activities

Interest

Timeline

Type

Not Defined	16
Web Server	8
Operating System	4
Content Management System	4
Network Camera Software	2

Vendor

Not Defined	28
Microsoft	8
Seafile	2
Google	2
Tencent	2

Product

lighttpd	4
Seafile Server	2
Seafile Server Professional Edition	2
Wireless IP Camera WIFICAM	2
Microsoft Windows	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.04	0.04187	CVE-2007-1192
2	HoYoVerse Genshin Impact Anti-Cheat Driver Function Call mhyprot2.sys Privilege Escalation	7.7	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.06	0.01365	CVE-2020-36603
3	Wireless IP Camera WIFICAM RTSP Server improper authentication	6.4	6.2	$0-$5k	$0-$5k	Not Defined	Workaround	0.04	0.00885	CVE-2017-8223
4	XiongMai uc-httpd memory corruption	8.5	8.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.06	0.08382	CVE-2018-10088
5	Amazon Web Services FreeRTOS ARP Packet eARPProcessPacket information disclosure	5.7	5.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00954	CVE-2018-16600
6	Oracle Fusion Middleware MapViewer Apache Batik input validation	6.7	6.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.01	0.03032	CVE-2020-11987
7	Matomo safemode.twig Path information disclosure	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.08	0.00885	CVE-2019-12215
8	Microsoft Windows BitLocker Local Privilege Escalation	6.1	5.3	$25k-$100k	$0-$5k	Unproven	Official Fix	0.06	0.02427	CVE-2021-38632
9	Zen Cart ajax.php path traversal	8.1	8.1	$0-$5k	Calculating	High	Not Defined	0.05	0.08382	CVE-2015-8352
10	Email Subscribers / Newsletters Administrative Dashboard wp_ajax privileges management	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00885	CVE-2019-19980
11	OpenStack Dashboard Package quantum.conf Password information disclosure	4.4	4.4	$0-$5k	Calculating	Not Defined	Not Defined	0.03	0.00890	CVE-2012-5476
12	ReviewBoard unrestricted upload	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.01440	CVE-2013-4796
13	SonicWALL Viewpoint Security Dashboard Reflected cross site scripting	3.5	3.2	$0-$5k	Calculating	Not Defined	Official Fix	0.00	0.00000
14	Woltlab Burning Board Path information disclosure	4.3	3.9	$0-$5k	Calculating	Proof-of-Concept	Not Defined	0.04	0.00000
15	Forumer / IPB Board Show Topic index.php sql injection	7.3	7.1	$0-$5k	Calculating	Not Defined	Not Defined	0.01	0.00000
16	IW Guestbook messages_edit.asp sql injection	6.3	5.7	$0-$5k	Calculating	Proof-of-Concept	Not Defined	0.01	0.00000
17	IW Guestbook badwords_edit.asp sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00000
18	OmniSecure AddUrlShield index.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.04	0.00000
19	nginx request smuggling	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	6.85	0.00000	CVE-2020-12440
20	Auto-Surf Traffic Exchange Script register.php cross site scripting	3.5	3.5	$0-$5k	Calculating	Not Defined	Not Defined	0.08	0.00000

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Type	Confidence
1	185.112.82.89	server-185-112-82-89.creanova.org	Handymanny		verified	High
2	XXX.XXX.XX.XXX		Xxxxxxxxxx		verified	High

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22	Pathname Traversal	predictive	High
2	T1055	CWE-74	Injection	predictive	High
3	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
4	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
6	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
7	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
8	TXXXX	CWE-XXX	Xxxxxxxxxxxxx	predictive	High
9	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (43)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/cfg	predictive	Low
2	File	/etc/quantum/quantum.conf	predictive	High
3	File	/index.php	predictive	Medium
4	File	/iwguestbook/admin/badwords_edit.asp	predictive	High
5	File	/iwguestbook/admin/messages_edit.asp	predictive	High
6	File	admin.php?m=backup&c=backup&a=doback	predictive	High
7	File	xxxxx/xxxx.xxx	predictive	High
8	File	xxxx.xxx	predictive	Medium
9	File	xx/xxxxxx_xxx.xxx	predictive	High
10	File	xxxxxxxx.xxx	predictive	Medium
11	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
12	File	xxxx_xxxx.x	predictive	Medium
13	File	xxxxx.xxx	predictive	Medium
14	File	xxxxxxxxxxx/xxxxxxx.x	predictive	High
15	File	xxx_xxxxx_xxxxx.x	predictive	High
16	File	xxx/xxxxx.xxxx	predictive	High
17	File	xxxxxxx/xxxxxxxxxxxxxxxx/xxxxxxxxx/xxxxxxxx.xxxx	predictive	High
18	File	xxxxxxxx.xxx	predictive	Medium
19	File	xxxxxxxxx-xxxxxxxxxxxx-xxx/xxxx/xxxxx-xxxx.xxx	predictive	High
20	File	xxx/xxxxxxx.x	predictive	High
21	File	xxxxxx.x	predictive	Medium
22	File	xx-xxxxx/xxxxxxxx/xxxxx-xx-xxxxx-xxxx-xxxxx.xxx	predictive	High
23	File	xx-xxxxx/xxxxxxxx/xxxxx-xx-xxxxx-xxxx.xxx	predictive	High
24	Library	xxxxxxxx.xxx	predictive	Medium
25	Argument	xxx	predictive	Low
26	Argument	xxxxx[]	predictive	Low
27	Argument	xxx	predictive	Low
28	Argument	xxxxxxxx	predictive	Medium
29	Argument	xx	predictive	Low
30	Argument	xxxxx	predictive	Low
31	Argument	xxx	predictive	Low
32	Argument	xxxxxxxxx	predictive	Medium
33	Argument	x[]	predictive	Low
34	Argument	xxxxxxx[]	predictive	Medium
35	Argument	xxx	predictive	Low
36	Argument	xxxxxxxx/xxxx	predictive	High
37	Argument	_xxxxx_xxxxxxx_xxxxxxxxx_xxxxxxx-xxx	predictive	High
38	Input Value	..	predictive	Low
39	Input Value	../	predictive	Low
40	Input Value	x+xxxxx+xxxxxx+x,xxxxxxx,xxxxxxxxxxx+xxxx+xxxxx#	predictive	High
41	Input Value	xxx=/&xxx	predictive	Medium
42	Input Value	xxx	predictive	Low
43	Network Port	xxx/xxxxx	predictive	Medium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!