IMG Files Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (9)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

de	6
en	2
zh	2

Country

DE: Germany	4
US: USA	4
CN: China	2

Actors

Mekotio	1
Nanocore RAT	1

Activities

Interest

Timeline

Type

Multimedia Processing Software	2
Game Console	2
Web Server	2
Programming Language Software	2
Not Defined	2

Vendor

Not Defined	2
Sony	2
Microsoft	2
Maran	2
VMware	2

Product

GStreamer	2
Sony Playstation 3	2
Microsoft IIS	2
Maran PHP Shop	2
VMware RabbitMQ	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Oracle MySQL Server Packaging information disclosure	7.5	7.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00104	0.04	CVE-2022-43551
2	VMware RabbitMQ AMQP Client denial of service	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00119	0.03	CVE-2021-22116
3	RabbitMQ Management UI cross site scripting	2.4	2.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00234	0.00	CVE-2021-32718
4	Boxoft WAV to MP3 Converter memory corruption	5.3	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.00
5	Sony Playstation 3 Save Game PARAM.SFO privileges management	7.4	7.0	$25k-$100k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.02
6	GStreamer ID3v2 Tag memory corruption	7.3	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00000	0.00
7	Maran PHP Shop prod.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00137	0.04	CVE-2008-4879
8	Microsoft IIS uncpath cross site scripting	5.2	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.31138	0.02	CVE-2017-0055
9	OpenLDAP LDAP Authentication krbv4_ldap_auth memory corruption	7.3	6.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.15133	0.00	CVE-2006-6493

IOC - Indicator of Compromise (1)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Identified	Type	Confidence
1	185.101.94.172	kruxaw.de	IMG Files		01/16/2020	verified	Low

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059.007	CAPEC-209	CWE-79, CWE-80	Basic Cross Site Scripting	predictive	High
2	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
3	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
4	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (4)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/uncpath/	predictive	Medium
2	File	xxxxx.xxx	predictive	Medium
3	File	xxxx.xxx	predictive	Medium
4	Argument	xxx	predictive	Low

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!