LilacSquid Analysisinfo

IOB - Indicator of Behavior (441)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en356
it54
de10
fr8
sv4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Microsoft Windows18
Microsoft Edge12
Google Chrome10
Microsoft IIS8
Joomla CMS6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#VulnerabilityBaseTemp0dayTodayExpCouKEVEPSSCTICVE
1Microsoft IIS uncpath cross site scripting5.25.0$5k-$25k$0-$5kProof-of-ConceptOfficial fix 0.013870.00CVE-2017-0055
2nginx request smuggling6.96.9$0-$5k$0-$5kNot definedNot defined 0.000000.17CVE-2020-12440
3OpenSSH Authentication Username information disclosure5.34.8$5k-$25k$0-$5kHighOfficial fixexpected0.924870.06CVE-2016-6210
4Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaroundpossible0.029560.00CVE-2007-1192
5DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial fix 0.009700.03CVE-2010-0966
6Apache HTTP Server mod_ssl ap_hook_process_connection null pointer dereference7.57.4$5k-$25kCalculatingNot definedOfficial fixpossible0.413790.02CVE-2017-3169
7Oracle E-Business Suite access control5.35.2$5k-$25k$0-$5kNot definedOfficial fixexpected0.874450.05CVE-2018-3167
8VISAGESOFT Expert Pdf Viewer Activex ActiveX Control VSPDFViewerX.ocx input validation9.18.9$0-$5k$0-$5kFunctionalUnavailable 0.026360.00CVE-2008-4919
9Gallarific PHP Photo Gallery script gallery.php sql injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot defined 0.001100.02CVE-2011-0519
10OpenWrt LuCI cross site scripting4.44.3$0-$5k$0-$5kNot definedOfficial fix 0.003430.00CVE-2019-25015
11Fortinet FortiOS SSL-VPN out-of-bounds write9.89.7$100k and more$25k-$100kAttackedOfficial fixverified0.916020.08CVE-2024-21762
12Gocloud S2A_WL/S2A/S3A K2P MTK/S3A/ISP3000 Ping diag_ping os command injection7.57.5$0-$5k$0-$5kNot definedNot defined 0.040100.06CVE-2020-8949
13Microsoft Windows LDAP Remote Code Execution9.88.9$25k-$100k$5k-$25kUnprovenOfficial fix 0.068080.00CVE-2022-29130
14PHP Header mail double free6.96.8$5k-$25k$0-$5kNot definedOfficial fix 0.035220.00CVE-2019-11049
15BestXsoftware Best Free Keylogger syscrb.exe untrusted search path6.56.5$0-$5k$0-$5kNot definedNot defined 0.001650.03CVE-2018-18519
16VMware Server vmware-authd.exe format string5.34.8$5k-$25k$0-$5kProof-of-ConceptOfficial fix 0.012790.00CVE-2009-4811
17Microsoft IIS IP/Domain Restriction access control6.55.7$25k-$100k$0-$5kUnprovenOfficial fix 0.155470.03CVE-2014-4078
18ZTE ZXDSL 831CII HTTP Basic Authentication connoppp.cgi improper authentication7.47.0$0-$5k$0-$5kProof-of-ConceptNot defined 0.278170.07CVE-2017-16953
19Modern Events Calendar Lite Plugin File Import unrestricted upload6.36.2$0-$5k$0-$5kHighOfficial fixexpected0.910470.08CVE-2021-24145
20Hikvision DVR DS-7204HGHI-F1 capabilities User excessive authentication4.54.5$0-$5k$0-$5kNot definedNot defined 0.003270.03CVE-2020-7057

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
145.9.251.14LilacSquid05/30/2024verifiedHigh
2XX.XXX.XXX.Xxxxxxx.xxxxxxx.xxx.xxXxxxxxxxxx05/30/2024verifiedHigh
3XXX.XXX.XXX.XXXXxxxxxxxxx05/30/2024verifiedHigh
4XXX.XXX.XXX.XXXXxxxxxxxxx05/30/2024verifiedHigh

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (252)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File.htaccesspredictiveMedium
2File/.vnc/sesman_${username}_passwdpredictiveHigh
3File/add_classes.phppredictiveHigh
4File/admin/communitymanagement.phppredictiveHigh
5File/admin/departments/view_department.phppredictiveHigh
6File/admin/maintenance/view_designation.phppredictiveHigh
7File/application/index/controller/File.phppredictiveHigh
8File/application/index/controller/Screen.phppredictiveHigh
9File/b2b-supermarket/shopping-cartpredictiveHigh
10File/bin/boapredictiveMedium
11File/boafrm/formMapDelDevicepredictiveHigh
12File/bsms_ci/index.php/user/edit_user/predictiveHigh
13File/category.phppredictiveHigh
14File/cgi-bin/cstecgi.cgipredictiveHigh
15File/cgi-bin/touchlist_sync.cgipredictiveHigh
16File/cms/category/listpredictiveHigh
17File/cms/print.phppredictiveHigh
18File/collection/allpredictiveHigh
19File/debug/pprofpredictiveMedium
20File/DesignTools/CssEditor.aspxpredictiveHigh
21File/exportpredictiveLow
22File/fileman/php/downloaddir.phppredictiveHigh
23File/filex/proxy-downloadpredictiveHigh
24File/forum/away.phppredictiveHigh
25File/goform/SetOnlineDevNamepredictiveHigh
26File/htdocs/upnpinc/gena.phppredictiveHigh
27File/html/portal/flash.jsppredictiveHigh
28File/log/decodmail.phppredictiveHigh
29File/loginpredictiveLow
30File/xxxxxxxxxxxx/xxxxxxxxpredictiveHigh
31File/xxxxxx/xxx/xxxxxxx.xxxpredictiveHigh
32File/xxx.xxxpredictiveMedium
33File/xxxxxpredictiveLow
34File/xxxxxpredictiveLow
35File/xxxxxx.xxxpredictiveMedium
36File/xx_xxx.xxxpredictiveMedium
37File/xxxxxxx/predictiveMedium
38File/xxx/xxxxx/xxxpredictiveHigh
39File/xxx-xxx/xxxxxxx/*.xxxxxpredictiveHigh
40File/xxxx/?xxxx=xx_xxxxxxxxpredictiveHigh
41Filex.x.x\xxxxxx.xxxpredictiveHigh
42Filexxxxxxx_xxxx_xxxxx.xxxpredictiveHigh
43Filexxx_xxxx.xxxpredictiveMedium
44Filexxx_xxxxxxx.xxxpredictiveHigh
45Filexxxxx-xxxx.xxxpredictiveHigh
46Filexxxxx.xxxpredictiveMedium
47Filexxxxx.xxxpredictiveMedium
48Filexxxxx/xxxxxxx.xxxpredictiveHigh
49Filexxxxx/xxxxx.xxxpredictiveHigh
50Filexxxxx/xxxxx.xxx?xxxx=xxxxxx_xxxpredictiveHigh
51Filexxxxx/xxxxxxx/xxxxxxx.xxxpredictiveHigh
52Filexxxxxxxxxxxxx.xxxpredictiveHigh
53Filexxxxxxxx_xxxxxxxx_xxxxxxx.xxxpredictiveHigh
54Filexxx/xxxxxxxxxxx.xxxpredictiveHigh
55Filexxxxxxxxxxxxxx.xxxpredictiveHigh
56Filexxxxxxxxxxx/xxxxxxxxxx/xxxxxxxxxxxxxxxxxxx.xxxpredictiveHigh
57Filexxxxxxxxxxxxxxxxxxx.xxxpredictiveHigh
58Filexxxxxxxx.xxxxxxx.xxxpredictiveHigh
59Filexxxxxx/xxx/xxxxxxxxx-xxxxxxxx.xxxpredictiveHigh
60Filexxxxxxxx.xxxpredictiveMedium
61Filexxx-xxx/xxxxxxx.xxpredictiveHigh
62Filexxx-xxx/xxxxx/xxxxx/xxxxx/xxx_xxxx/xxxx_xxxx/predictiveHigh
63Filexxxxx_xxxxxxx.xxxpredictiveHigh
64Filexxxxxxxxx.xxxxxxx.xxxpredictiveHigh
65Filexxxxxxxx.xxxpredictiveMedium
66Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
67Filexxxxxx-xxxxxxxxxxx.xxxpredictiveHigh
68Filexxxxxx_xxxxxxx.xxxpredictiveHigh
69Filexxxxxx.xxxpredictiveMedium
70Filexxxxxx.xxxpredictiveMedium
71Filexxxxxxx/xxx/xxxxxxxx.xpredictiveHigh
72Filexxxxxxx.xxxxpredictiveMedium
73Filexxxxxx.xxxpredictiveMedium
74Filexxxxxx_xxxx.xxxpredictiveHigh
75Filexxxx/xxxxx/xxxxxxx/xxxxx.xxxpredictiveHigh
76Filexxxx.xxxpredictiveMedium
77Filexxxxx.xxxpredictiveMedium
78Filexxxxxxx.xxxpredictiveMedium
79Filexxxxxxxxx.xxxpredictiveHigh
80Filexxxxxxxxxx.xxxxpredictiveHigh
81Filexxxxxxxxxx.xxxpredictiveHigh
82Filexxx/xxxxxx.xxxpredictiveHigh
83Filexxx/xxxxxx/xxxxx.xxxpredictiveHigh
84Filexxxxx.xxxpredictiveMedium
85Filexxxx_xx.xxxpredictiveMedium
86Filexxxxx/xxxxxxxx/xxxxxxxxxxxx/xxxxxxxxxxxxpredictiveHigh
87Filexx.xxpredictiveLow
88Filexxxxxxxxxx/xxxxxxxx.xpredictiveHigh
89Filexxxxxxxxx/xxxxxxx/xxxxxx/xxxxxxxxxx.xxxpredictiveHigh
90Filexxxxxxxxxxxxx.xxxpredictiveHigh
91Filexxxxx.xxxxpredictiveMedium
92Filexxxxx_xxx.xxxpredictiveHigh
93Filexxxxxxxx.xxpredictiveMedium
94Filexxxx.xxxpredictiveMedium
95Filexxxxxx.xxxpredictiveMedium
96Filexxxxxxxxxx.xxxpredictiveHigh
97Filexxxxxxxxx.xpredictiveMedium
98Filexxxxxxx/xxxxxxxx/xxxxxxx/xxxxxxx.xxxx_xxxxxx.xxx/xxxx_xxxxxx.xxxpredictiveHigh
99Filexxxxxx-xxxxxx/xxxxx/xxxxxxxxx/xxxxxxx/xxx_xxxxx.xxxpredictiveHigh
100Filexxx/xxx/xxxx.xpredictiveHigh
101Filexxx/xxxxx.xxxxpredictiveHigh
102Filexxxxxxxxxxxxxxxxxxxxx.xxxpredictiveHigh
103Filexxxxxxxxxxxxx.xxxpredictiveHigh
104Filexxx.xxxpredictiveLow
105Filexxxxx.xxxpredictiveMedium
106Filexxxxxxx.xxxxxx.xxxpredictiveHigh
107Filexxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]predictiveHigh
108Filexxxxxxxxxxxxxx.xxxpredictiveHigh
109Filexxxxxxx.xxpredictiveMedium
110Filexxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxxpredictiveHigh
111Filexxx/xxx_xxxpredictiveMedium
112Filexxx.xxxpredictiveLow
113Filexxxxxx/xxxxxxxxxxxx.xxxpredictiveHigh
114Filexxxxx.xxxpredictiveMedium
115Filexxxxx.xxxpredictiveMedium
116Filexxxx-xxxxxx.xpredictiveHigh
117Filexxxx.xxxpredictiveMedium
118Filexxxx/xxxxxx.xxxpredictiveHigh
119Filexxxxxxxxx.xxxpredictiveHigh
120Filexxxx_xxxxxxx.xpredictiveHigh
121Filexxxx.xxx?xxxxxxx=xxxxxxxxxxpredictiveHigh
122Filexxx/xx.xpredictiveMedium
123Filexxx/xxxxxxx/xxxxxxxxxxxxx.xxxpredictiveHigh
124Filexxxxx_xxxx.xxxpredictiveHigh
125Filexxxxx/xxxx/xxxx.xxxpredictiveHigh
126Filexxxx.xxxpredictiveMedium
127Filexxxxxxxx.xxxpredictiveMedium
128Filexxxxxx.xxxpredictiveMedium
129Filexxxxxx_xxxxxxxx.xxxpredictiveHigh
130Filexxxxxxxx/xxxxxxxxpredictiveHigh
131Filexxxxx.xpredictiveLow
132Filexxxxxxxxx.xxxpredictiveHigh
133Filexxxxxxx.xxxpredictiveMedium
134Filexxxxxx-xxxxx.xxxpredictiveHigh
135Filexxxxxxxxxxxx.xxxpredictiveHigh
136Filexxxxxxxx.xxxpredictiveMedium
137Filexx-xxxxx/xxxxx-xxxx.xxxpredictiveHigh
138Filexx-xxxxx/xxxx.xxx?xxxx_xxxx=xxxxxxx&xxxx=xxxxxxx_xxxxxxxxpredictiveHigh
139Filexx-xxxxxx.xxxpredictiveHigh
140Filexx-xxxxxxxx/xxxxxxxxx.xxxpredictiveHigh
141Filexx-xxxxx.xxxpredictiveMedium
142File\xxx\xxxxxx\xxxxxxxxxx\xxxxxxxxxxxxxx.xxxxx.xxxpredictiveHigh
143File\xxxxx\xxxxxx.xxxx.xxxpredictiveHigh
144Library/xxxxxxxxx/xxxxxx.xxxpredictiveHigh
145Library/_xxx_xxx/xxxxx.xxxpredictiveHigh
146Libraryxxxx.xxxxxxxxxpredictiveHigh
147Libraryxxxxxx.xxxpredictiveMedium
148Libraryxxxxxx.xxxpredictiveMedium
149Argument$_xxxxxxx['xx']['xxxx_xxxx']predictiveHigh
150Argument--xxxxxx/--xxxxxxxxpredictiveHigh
151Argument-x/-xpredictiveLow
152Argument/.xxx/xxxxxx_${xxxxxxxx}_xxxxxxpredictiveHigh
153ArgumentxxxxxxxxxpredictiveMedium
154ArgumentxxxxxxxpredictiveLow
155Argumentxxxxx_xxpredictiveMedium
156ArgumentxxxxxxxxpredictiveMedium
157ArgumentxxxxxxxxxxxxpredictiveMedium
158ArgumentxxxxxxxxpredictiveMedium
159Argumentxxxx_xxxpredictiveMedium
160ArgumentxxxxxxpredictiveLow
161ArgumentxxxpredictiveLow
162ArgumentxxxxxxxxpredictiveMedium
163ArgumentxxxpredictiveLow
164ArgumentxxxxxxxxxxxxxxxpredictiveHigh
165Argumentxxxxx xxxxpredictiveMedium
166Argumentxxxxxxx[x][xxxx]predictiveHigh
167ArgumentxxxxxxpredictiveLow
168Argumentxxxxxx[xxxx_xxx_xxxxxxx]predictiveHigh
169Argumentxxxxxxx-xxxxxxxxxxxpredictiveHigh
170ArgumentxxxxxxxxxxxpredictiveMedium
171ArgumentxxxxxpredictiveLow
172ArgumentxxxxpredictiveLow
173ArgumentxxxxxxxpredictiveLow
174Argumentxxxxxxxxxxxx_xxxx_xxxx[x]predictiveHigh
175Argumentx_xxxxpredictiveLow
176ArgumentxxxxxpredictiveLow
177Argumentxx_xxxxx_xxpredictiveMedium
178ArgumentxxxxxpredictiveLow
179Argumentxxxxxxxx[xxxxxxx_xx]predictiveHigh
180ArgumentxxxxpredictiveLow
181Argumentxxxx/xxpredictiveLow
182Argumentxxxx_xxpredictiveLow
183ArgumentxxxxxxxxxpredictiveMedium
184ArgumentxxxxxxxxxpredictiveMedium
185ArgumentxxxxpredictiveLow
186ArgumentxxxxpredictiveLow
187Argumentxxxx/xxxxxxxpredictiveMedium
188Argumentxxxx_xxxxpredictiveMedium
189ArgumentxxpredictiveLow
190ArgumentxxxxxxxxxxpredictiveMedium
191ArgumentxxxxxxxpredictiveLow
192ArgumentxxpredictiveLow
193ArgumentxxxpredictiveLow
194ArgumentxxxxxxxxpredictiveMedium
195ArgumentxxxxxpredictiveLow
196ArgumentxxxpredictiveLow
197ArgumentxxxxxxxxpredictiveMedium
198ArgumentxxxxxxpredictiveLow
199Argumentxxxx xxxxpredictiveMedium
200Argumentxxx_xxpredictiveLow
201Argumentxxxxxxxxx_xxxxxxxx_xxxxpredictiveHigh
202ArgumentxxxxxpredictiveLow
203Argumentxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxpredictiveHigh
204Argumentxxxx_xxxxpredictiveMedium
205Argumentxxx_xxxxxxpredictiveMedium
206Argumentxxxxx_xxpredictiveMedium
207ArgumentxxxxpredictiveLow
208ArgumentxxxxxxpredictiveLow
209ArgumentxxxxxxxxpredictiveMedium
210ArgumentxxxxxxxxpredictiveMedium
211ArgumentxxxxxxxxpredictiveMedium
212ArgumentxxxxxxxxxxpredictiveMedium
213ArgumentxxxxxxxxxxpredictiveMedium
214ArgumentxxxxxxxpredictiveLow
215ArgumentxxxxxxxxxxpredictiveMedium
216Argumentxx_xxxxpredictiveLow
217ArgumentxxxxxxxxxxxpredictiveMedium
218ArgumentxxxpredictiveLow
219ArgumentxxpredictiveLow
220ArgumentxxxxxxxxpredictiveMedium
221ArgumentxxxxpredictiveLow
222Argumentxxxxxx-xxxpredictiveMedium
223Argumentxxx/xxx_xxxxx_xxxxxpredictiveHigh
224ArgumentxxxpredictiveLow
225ArgumentxxxxxxxxxpredictiveMedium
226ArgumentxxxxpredictiveLow
227ArgumentxxxxpredictiveLow
228Argumentx_xxxxpredictiveLow
229ArgumentxxxpredictiveLow
230ArgumentxxxpredictiveLow
231ArgumentxxxxxxpredictiveLow
232ArgumentxxxxxxxxpredictiveMedium
233Argumentxxxxxxxx/xxxxpredictiveHigh
234Argumentxxxxxxxx/xxxxxxxx xx/xxxxxpredictiveHigh
235Argumentxxxxx/xxxxpredictiveMedium
236Argumentxxxx_xxxx_xxxxpredictiveHigh
237ArgumentxxxxxxxxxxxxxpredictiveHigh
238Argumentxxx_xxxxpredictiveMedium
239Argument\xxxxxx\predictiveMedium
240Input Value%xx%xxxxxxxx%xx%xxpredictiveHigh
241Input Value%xxpredictiveLow
242Input Value..predictiveLow
243Input Value../predictiveLow
244Input Value./../../../predictiveMedium
245Input Value::$xxxxx_xxxxxxxxxxpredictiveHigh
246Input Value?<!xxxxxx?predictiveMedium
247Pattern|xx xx xx|predictiveMedium
248Network Portxxx/xx (xxx)predictiveMedium
249Network Portxxx/xx (xxx)predictiveMedium
250Network Portxxx/xxxpredictiveLow
251Network Portxxx/xxxxpredictiveMedium
252Network Portxxx xxxxxx xxxxpredictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

This view requires CTI permissions

Just purchase a CTI license today!