Magento-analytics Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (69)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en	60
zh	6
de	2
pl	2

Country

US: USA	38
CN: China	24
GB: Great Britain	6
AU: Australia	2

Actors

magento-analytics	8
Cobalt Strike	2
Emotet	2
Magecart	1
WarmCookie	1

Activities

Interest

Timeline

Type

Not Defined	18
Programming Language Software	6
Web Server	4
Forum Software	4
WordPress Plugin	2

Vendor

Not Defined	22
HP	4
Oracle	4
Joomla	2
Apple	2

Product

PHP	4
nginx	2
Ajax Load More Plugin	2
Joomla CMS	2
Apple macOS	2

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#	Vulnerability	Base	Temp	0day	Today	Exp	Cou	KEV	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	possible	0.02956	0.00	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official fix		0.00970	0.40	CVE-2010-0966
3	Wireless IP Camera WIFICAM ini File access control	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Official fix	possible	0.75566	0.02	CVE-2017-8225
4	HP Color LaserJet Pro M280-M281 Multifunction Printer Embedded Web Server Reflected cross site scripting	5.2	5.2	$5k-$25k	$0-$5k	Not defined	Not defined		0.00351	0.02	CVE-2019-6323
5	HP DeskJet 3630 cross-site request forgery	6.2	6.2	$5k-$25k	$0-$5k	Not defined	Not defined		0.00155	0.00	CVE-2019-6319
6	D-Link DIR-850L code injection	8.0	7.9	$5k-$25k	$5k-$25k	Not defined	Not defined		0.01497	0.04	CVE-2023-49004
7	ThemeNectar Salient Core Plugin Shortcode nectar_icon filename control	6.2	6.1	$0-$5k	$0-$5k	Not defined	Not defined		0.01232	0.00	CVE-2024-3812
8	HP Print/Digital Sending Link-Local Multicast Name Resolution buffer overflow	6.3	6.3	$5k-$25k	$5k-$25k	Not defined	Not defined		0.03507	0.05	CVE-2021-3942
9	HP inkjet/LaserJet Pro/PageWide Pro privilege escalation	8.0	8.0	$5k-$25k	$5k-$25k	Not defined	Not defined		0.03684	0.00	CVE-2022-28721
10	Oracle HTTP Server SSL Module out-of-bounds write	9.8	9.6	$100k and more	$25k-$100k	Not defined	Official fix	possible	0.70998	0.03	CVE-2022-23943
11	Zoho ManageEngine Desktop Central ZIP Archive improper authentication	6.3	6.0	$0-$5k	$0-$5k	Not defined	Official fix	possible	0.38574	0.04	CVE-2021-44757
12	Zoho ManageEngine ServiceDesk Plus MSP web.xml path traversal	6.5	6.4	$0-$5k	$0-$5k	Not defined	Official fix		0.01824	0.02	CVE-2022-32551
13	SUSE Rancher improper authorization	7.5	7.5	$5k-$25k	$0-$5k	Not defined	Official fix		0.00158	0.00	CVE-2022-31247
14	Rabbitmq Docker Image hard-coded password	9.8	9.8	$0-$5k	$0-$5k	Not defined	Official fix		0.02014	0.05	CVE-2020-35196
15	JetBrains IntelliJ IDEA privilege escalation	6.3	6.0	$0-$5k	$0-$5k	Not defined	Official fix		0.00005	0.00	CVE-2021-45977
16	Oracle Communications Policy Management CMP code injection	9.8	9.7	$25k-$100k	$5k-$25k	High	Official fix	verified	0.94464	0.00	CVE-2022-22965
17	Microsoft Windows Hyper-V privilege escalation	8.0	7.3	$100k and more	$5k-$25k	Unproven	Official fix		0.00063	0.00	CVE-2022-24537
18	Watchguard Firebox/XTM Remote Code Execution	8.6	8.5	$0-$5k	$0-$5k	High	Official fix	verified	0.92762	0.04	CVE-2022-26318
19	node-ipc backdoor	8.0	7.9	$0-$5k	$0-$5k	Not defined	Official fix		0.03333	0.02	CVE-2022-23812
20	Cisco ASA SSL VPN exceptional condition	6.2	6.1	$5k-$25k	$0-$5k	Not defined	Official fix		0.01048	0.00	CVE-2019-12677

IOC - Indicator of Compromise (11)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	1.125.125.5		Magento-analytics	05/09/2019	verified	Low
2	45.76.75.35	45.76.75.35.vultrusercontent.com	magento-analytics	08/10/2022	verified	Low
3	89.32.251.136	maildc1526907690.mihandns.com	magento-analytics	02/11/2022	verified	Low
4	XX.XXX.XXX.XXX		Xxxxxxx-xxxxxxxxx	02/11/2022	verified	Low
5	XX.XXX.XXX.XX	xx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	Low
6	XX.XXX.XXX.XX	xx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	Low
7	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	Low
8	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	Low
9	XXX.XXX.X.XX	xxx.xxx.x.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	Low
10	XXX.XXX.X.XXX	xxx.xxx.x.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	Low
11	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx-xxxxxxxxx	08/10/2022	verified	Low

TTP - Tactics, Techniques, Procedures (12)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Basic Cross Site Scripting	predictive	High
4	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX.XXX		CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	High
6	TXXXX	CAPEC-XXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
8	TXXXX		CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
9	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
10	TXXXX.XXX	CAPEC-X	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxxxxxx	predictive	High
12	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (24)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	//	predictive	Low
2	File	/interceptor/OutgoingChainInterceptor.java	predictive	High
3	File	/uncpath/	predictive	Medium
4	File	/wp-admin/admin-ajax.php	predictive	High
5	File	xxxxxxxxx.x	predictive	Medium
6	File	xxxxxxx_xxx.xxx	predictive	High
7	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
8	File	xxxx.xxx	predictive	Medium
9	File	xxx/xxxxxx.xxx	predictive	High
10	File	xxxxx.xxx	predictive	Medium
11	File	xxxxx.xxxx	predictive	Medium
12	File	xxxxxxxxxx.xxx	predictive	High
13	File	xxxxxxxx.xxx	predictive	Medium
14	File	xxxxxx.xxx	predictive	Medium
15	File	xxxxxx/xxx.xxx	predictive	High
16	Argument	xxxx	predictive	Low
17	Argument	xxxxxxxx	predictive	Medium
18	Argument	xx	predictive	Low
19	Argument	xxxxxxxxx-xxxxxxx/xxxxxxxxx/xxxxxxxxxx	predictive	High
20	Argument	xxxxxx_xx	predictive	Medium
21	Argument	xxxxxxxx	predictive	Medium
22	Argument	xx	predictive	Low
23	Argument	xxxxxxxx	predictive	Medium
24	Argument	xxx	predictive	Low

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!