Mekotio Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (1000)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	788
es	166
zh	18
de	16
fr	6

Country

us	898
cn	30
gb	8
ir	6
wf	6

Actors

Mekotio	23
Cobalt Strike	7
Mirai	5
RedLine Stealer	4
AsyncRAT	3

Activities

Interest

Timeline

Type

Not Defined	288
Smartphone Operating System	90
Operating System	78
Content Management System	62
Image Processing Software	32

Vendor

Not Defined	348
Apple	86
Google	62
Oracle	50
Microsoft	44

Product

Google Android	56
Apple macOS	40
Apple iOS	28
Microsoft Windows	24
Oracle E-Business Suite	20

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Philip Chinery Guestbook HTML Field guestbook.pl cross site scripting	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.03091	CVE-2002-0730
2	Carbonize Lazarus Guestbook template.class.php file inclusion	9.8	8.8	$0-$5k	Calculating	Proof-of-Concept	Official Fix	0.00	0.04617	CVE-2007-1486
3	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
4	SPIP filtres.php encoder_contexte_ajax code injection	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00582	CVE-2016-3154
5	OpenCart Program Extension Upload Temporary unrestricted upload	6.7	6.7	$0-$5k	Calculating	Not Defined	Not Defined	0.00	0.00081	CVE-2018-11494
6	Myupb UPB cross site scripting	4.3	4.3	$0-$5k	$0-$5k	High	Unavailable	0.00	0.00297	CVE-2008-6727
7	VeronaLabs wp-statistics Plugin API Endpoint Blind sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00250	CVE-2019-13275
8	OpenCart cross-site request forgery	4.3	4.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.00000
9	Palo Alto PAN-OS Web Interface race condition	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00068	CVE-2023-0008
10	RoundCube Webmail Email Message rcube_string_replacer.php linkref_addindex cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00612	CVE-2020-35730
11	FreePBX Operator Panel Module index_inc.php information disclosure	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00082	CVE-2019-11407
12	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.53	0.00943	CVE-2010-0966
13	SPIP spip_login.php3 cross site scripting	4.3	4.1	$0-$5k	Calculating	Proof-of-Concept	Not Defined	0.00	0.00587	CVE-2005-4494
14	Rocklobster Contact Form 7 unrestricted upload	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.85054	CVE-2020-35489
15	S-Cms cross-site request forgery	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00130	CVE-2018-19332
16	Peplink Balance Cookie admin.cgi sql injection	8.5	7.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.01457	CVE-2017-8835
17	SOYAL AR-727H/AR-829Ev5 CGI Program improper authentication	7.4	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00276	CVE-2019-6451
18	Innovaphone PBX observable response discrepancy	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00043	CVE-2024-24720
19	Atlassian Confluence Data Center cross site scripting	6.0	5.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00043	CVE-2024-21678
20	FusionPBX contact_times.php Reflected cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00084	CVE-2019-16974

IOC - Indicator of Compromise (82)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	4.240.84.251		Mekotio	05/08/2023	verified	High
2	5.181.156.86	5-181-156-86.mivocloud.com	Mekotio	12/08/2023	verified	High
3	13.66.15.167		Mekotio	02/10/2022	verified	High
4	15.228.13.156	ec2-15-228-13-156.sa-east-1.compute.amazonaws.com	Mekotio	05/12/2023	verified	Medium
5	15.228.16.45	ec2-15-228-16-45.sa-east-1.compute.amazonaws.com	Mekotio	08/06/2023	verified	Medium
6	15.228.46.182	ec2-15-228-46-182.sa-east-1.compute.amazonaws.com	Mekotio	01/14/2023	verified	Medium
7	15.229.1.40	ec2-15-229-1-40.sa-east-1.compute.amazonaws.com	Mekotio	12/20/2023	verified	Medium
8	15.229.26.142	ec2-15-229-26-142.sa-east-1.compute.amazonaws.com	Mekotio	02/17/2023	verified	Medium
9	18.118.78.11	ec2-18-118-78-11.us-east-2.compute.amazonaws.com	Mekotio	05/20/2023	verified	Medium
10	18.223.102.186	ec2-18-223-102-186.us-east-2.compute.amazonaws.com	Mekotio	05/12/2023	verified	Medium
11	18.231.161.239	ec2-18-231-161-239.sa-east-1.compute.amazonaws.com	Mekotio	05/12/2023	verified	Medium
12	20.5.65.48		Mekotio	04/28/2023	verified	High
13	20.25.181.202		Mekotio	05/12/2023	verified	High
14	20.38.37.160		Mekotio	08/06/2023	verified	High
15	20.121.119.89		Mekotio	05/20/2023	verified	High
16	20.206.121.1		Mekotio	02/10/2022	verified	High
17	20.239.166.4		Mekotio	05/08/2023	verified	High
18	XX.XXX.XX.XX		Xxxxxxx	09/19/2023	verified	High
19	XX.XXX.XX.XXX		Xxxxxxx	03/08/2023	verified	High
20	XX.XXX.XX.XX	xx-xxx-xx-xx.xxxxxxxxxxx.xxx	Xxxxxxx	05/12/2023	verified	High
21	XX.XXX.XXX.XXX		Xxxxxxx	12/08/2023	verified	High
22	XX.XXX.XXX.XXX		Xxxxxxx	09/23/2023	verified	High
23	XX.XX.XXX.XXX	xxx.xxx.xx.xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	11/10/2023	verified	Medium
24	XX.XXX.X.XXX	xxx.x.xxx.xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	03/26/2024	verified	Medium
25	XX.XXX.XXX.XXX	xxx.xxx.xxx.xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	09/19/2023	verified	Medium
26	XX.XXX.XXX.XX		Xxxxxxx	06/22/2023	verified	High
27	XX.XXX.XXX.XXX	xxxxxx.xxxxxx-xxx-xxxxxx.xx	Xxxxxxx	05/08/2023	verified	High
28	XX.XXX.XXX.XXX	xxx-xxx-xxx-xx.xxxxxxx.xxxxxxxxxxxxxxx.xxx	Xxxxxxx	12/03/2022	verified	High
29	XX.XXX.XXX.XXX	xxxxxxxx.xxxxxx-xxxx-xxxxx.xxxxxx	Xxxxxxx	02/09/2023	verified	High
30	XX.XXX.XXX.XXX		Xxxxxxx	12/03/2022	verified	High
31	XX.XX.XX.XXX		Xxxxxxx	12/20/2023	verified	High
32	XX.XX.XX.XXX		Xxxxxxx	05/12/2023	verified	High
33	XX.XX.XXX.XX		Xxxxxxx	02/10/2022	verified	High
34	XX.XX.X.X	x.xx.xx.x.x.xxxxxxx.xxxxxxxx.xxx	Xxxxxxx	04/04/2023	verified	High
35	XX.XX.XX.XXX	xx-xx-xx-xxx.xxxxxxxxxxx.xxx	Xxxxxxx	12/08/2023	verified	High
36	XX.XX.XXX.XX		Xxxxxxx	08/06/2023	verified	High
37	XX.XX.XXX.XX	xxxxxxxxx.xxxxx.xxx.xx	Xxxxxxx	02/08/2023	verified	High
38	XX.XXX.XXX.XXX		Xxxxxxx	05/12/2023	verified	High
39	XX.XXX.XX.XXX	xx-xxx-xx-xxx.xxxxxxxxxxx.xxx	Xxxxxxx	05/12/2023	verified	High
40	XX.XXX.XXX.X		Xxxxxxx	04/28/2023	verified	High
41	XX.XX.XXX.XXX	xxx-xx-xx-xxx-xxx.xx-xxxx-x.xxxxxxx.xxxxxxxxx.xxx	Xxxxxxx	05/12/2023	verified	Medium
42	XX.XX.XXX.XXX	xxx-xxx-xx-xx.xxxxxxx-xxx	Xxxxxxx	02/08/2023	verified	High
43	XX.XXX.XXX.XXX	xxx.xxx.xxx.xx.xxxx.xxxxxxxxxxxx.xxx	Xxxxxxx	09/19/2023	verified	High
44	XX.XXX.XXX.XXX	xxx.xxx.xxx.xx.xxxx.xxxxxxxxxxxx.xxx	Xxxxxxx	12/08/2023	verified	High
45	XX.XX.XXX.XX	xxxxxx.xxxxxxx.xxxx	Xxxxxxx	05/08/2023	verified	High
46	XX.XX.XXX.XX	xxxxxxxxx.xxxxx.xxx.xx	Xxxxxxx	02/08/2023	verified	High
47	XX.XX.XXX.XX	xxxxxxxxx.xxxxx.xxx.xx	Xxxxxxx	01/24/2023	verified	High
48	XX.XXX.XX.XX	xxxxxxx.xxxxxxxxxxx.xxx	Xxxxxxx	12/08/2023	verified	High
49	XXX.XX.XXX.XXX		Xxxxxxx	12/20/2023	verified	High
50	XXX.XX.XXX.XXX		Xxxxxxx	05/12/2023	verified	High
51	XXX.XX.XXX.XXX		Xxxxxxx	02/16/2023	verified	High
52	XXX.XX.XXX.XX		Xxxxxxx	02/16/2023	verified	High
53	XXX.XXX.XX.XXX		Xxxxxxx	05/12/2023	verified	High
54	XXX.XXX.XX.XX		Xxxxxxx	01/06/2023	verified	High
55	XXX.XXX.XXX.XX		Xxxxxxx	07/05/2023	verified	High
56	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	12/08/2023	verified	High
57	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	08/06/2023	verified	High
58	XXX.XX.XXX.XXX		Xxxxxxx	12/08/2023	verified	High
59	XXX.X.XX.XX		Xxxxxxx	10/28/2023	verified	High
60	XXX.X.XX.XX		Xxxxxxx	10/28/2023	verified	High
61	XXX.XX.XXX.XXX	xxxxxxxx.xxxxxxxxxxx.xxx.xx	Xxxxxxx	07/05/2023	verified	High
62	XXX.XXX.X.XXX	xxxxxxxx.xxxxxxxxxxx.xxx.xx	Xxxxxxx	05/20/2023	verified	High
63	XXX.XX.XX.XXX		Xxxxxxx	08/07/2023	verified	High
64	XXX.XXX.XX.XX		Xxxxxxx	01/10/2023	verified	High
65	XXX.XXX.XX.XXX		Xxxxxxx	12/08/2023	verified	High
66	XXX.XX.XXX.XX	xxx-xx-xxx-xx.xxxxxxxxxxx.xxx	Xxxxxxx	05/12/2023	verified	High
67	XXX.XX.XXX.X	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxxxxx	12/08/2023	verified	High
68	XXX.XXX.XX.XX		Xxxxxxx	01/24/2023	verified	High
69	XXX.XXX.XX.XX		Xxxxxxx	08/06/2023	verified	High
70	XXX.XXX.XX.XX		Xxxxxxx	12/03/2022	verified	High
71	XXX.XXX.XX.XXX	xxxxxxxx.xxxxxxxxx-xxxxx.xxxxxx	Xxxxxxx	01/24/2023	verified	High
72	XXX.XXX.XX.XXX	xxxx.xxxxxx.xx	Xxxxxxx	12/03/2022	verified	High
73	XXX.XXX.XX.XXX	xxxxx.xxxxx-xxxx.xxxx	Xxxxxxx	01/24/2023	verified	High
74	XXX.XXX.XX.XXX	xxxxxx.xxx	Xxxxxxx	01/24/2023	verified	High
75	XXX.XXX.XX.XXX	xxx.xxxxxxxxxx.xx	Xxxxxxx	01/10/2023	verified	High
76	XXX.XXX.XX.XXX	xxxxx.xxxxxx-xxxxxxx.xxx	Xxxxxxx	03/08/2023	verified	High
77	XXX.XXX.XX.XX	xxxxxxxxxxxxx.xxx	Xxxxxxx	04/28/2023	verified	High
78	XXX.XXX.XX.XXX	xxxxxxx.xxx	Xxxxxxx	04/28/2023	verified	High
79	XXX.XXX.XX.XXX	xxxxxxxx.xxxxx.xxxx	Xxxxxxx	02/17/2023	verified	High
80	XXX.XXX.XX.XXX		Xxxxxxx	05/08/2023	verified	High
81	XXX.XXX.XXX.XXX		Xxxxxxx	05/12/2023	verified	High
82	XXX.X.XXX.XXX	xxxxxx.xxxx.xxx	Xxxxxxx	12/08/2023	verified	High

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22, CWE-23, CWE-37	Path Traversal	predictive	High
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CWE-94	Argument Injection	predictive	High
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
5	T1068	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	High
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
7	TXXXX.XXX	CWE-XXX	Xxx-xxx Xxxx Xxxxxxx Xxxx	predictive	High
8	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
10	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
11	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
12	TXXXX	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	High
13	TXXXX	CWE-XX, CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	High
14	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
15	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
16	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
17	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	High
18	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
19	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
20	TXXXX.XXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High
21	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (344)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	..\WWWRoot\CustomPages\aspshell.asp	predictive	High
2	File	/account/details.php	predictive	High
3	File	/admin/	predictive	Low
4	File	/admin/ajax.php?action=save_window	predictive	High
5	File	/admin/general/change-lang	predictive	High
6	File	/admin/group	predictive	Medium
7	File	/admin/launch_time.php	predictive	High
8	File	/admin/moduleinterface.php	predictive	High
9	File	/admin/payment.php	predictive	High
10	File	/artist-display.php	predictive	High
11	File	/BRS_netgear_success.html	predictive	High
12	File	/controllers/MgrDiagnosticTools.php	predictive	High
13	File	/czarnews/cn_users.php	predictive	High
14	File	/designer/add/layout	predictive	High
15	File	/dev/zero	predictive	Medium
16	File	/etc/waipass	predictive	Medium
17	File	/index.php	predictive	Medium
18	File	/manager/index.php	predictive	High
19	File	/message/ajax/send/	predictive	High
20	File	/mgmt/tm/util/bash	predictive	High
21	File	/myAccount	predictive	Medium
22	File	/real-estate-script/search_property.php	predictive	High
23	File	/recordings/index.php	predictive	High
24	File	/roomtype-details.php	predictive	High
25	File	/search.php	predictive	Medium
26	File	/searchJob.php	predictive	High
27	File	/secure/QueryComponent!Default.jspa	predictive	High
28	File	/see_more_details.php	predictive	High
29	File	/StartingPage/link_req_2.php	predictive	High
30	File	/storage.html	predictive	High
31	File	/tools/required/files/importers/imageeditor	predictive	High
32	File	/uncpath/	predictive	Medium
33	File	/uploads/tags.php	predictive	High
34	File	/userman/inbox.php	predictive	High
35	File	/UserSelfServiceSettings.jsp	predictive	High
36	File	/usr/local/contego/scripts/hostname.sh	predictive	High
37	File	/var/run/docker.sock	predictive	High
38	File	/video-sharing-script/watch-video.php	predictive	High
39	File	/vmi/manager/engine/management/commands/apns_worker.py	predictive	High
40	File	/xx-xxxxxxx/xxxxxxx/xxxxxxxxxxx/xxxxxxxxx/xxxxxx/xxxxx/	predictive	High
41	File	xxx/xxxx/xxxxx.xxxxxxx.xxx	predictive	High
42	File	xxxxxxx.xxx	predictive	Medium
43	File	xxxxx/xxxx.xxx?xxxx=xxxxxx&xxxxxx=xxx	predictive	High
44	File	xxxxx/xxxx_xxxxx_xxxx.xxx	predictive	High
45	File	xxxxx/xxxxxxxxxxx.xxx	predictive	High
46	File	xxxxx/xxxx#/xxxxxx/	predictive	High
47	File	xxxxx/xxxxxxxx.xxx	predictive	High
48	File	xxxxx\xxxxx\xxxxxxx\xxxxxxxx.xxx	predictive	High
49	File	xxx/xxxxx/xxxxxxxxx.xxx	predictive	High
50	File	xxx/xxxxxx/xxxxxx.xx	predictive	High
51	File	xxx/xxxxxxxx_xxxxx/xxxxx_xxx.xxx	predictive	High
52	File	xxx\xxxxxxxx\xxxxxxx_xxxxx.xxx	predictive	High
53	File	xxxx/xxx/xxx/xxx.x	predictive	High
54	File	xxxxxxx_xxxx_xxxxxxx_xxxxxx_xxx.x	predictive	High
55	File	xxxx_xxxxx_xxx_xxxxx.x	predictive	High
56	File	xxxxx/xxxxx.x	predictive	High
57	File	xxxxxx.xxxxxxx.xxx	predictive	High
58	File	xxxxxxxxx.x	predictive	Medium
59	File	xxxxxxxx.xxx	predictive	Medium
60	File	xxxx/xxxxxxxxxxxxxxxxxxxxxxxxx.xxx:xxx	predictive	High
61	File	xxxxxxxxxxx.xxx	predictive	High
62	File	xxxxxx_xx.x	predictive	Medium
63	File	xxxxxx/xxxxx-xxx_xxxxxxxx.xxx	predictive	High
64	File	xxxxx_xxxxxxxx.x	predictive	High
65	File	xxx-xxx/	predictive	Medium
66	File	xxx-xxx/xxx.xxx	predictive	High
67	File	xxx-xxx/xxxxx/xxxxx.xxx	predictive	High
68	File	xxx-xxx/xxxxx.xxx	predictive	High
69	File	xxxxxx/xxxxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
70	File	xxxxxx/xxx.x	predictive	Medium
71	File	xxxxxx/xxx.x	predictive	Medium
72	File	xxxxxx/xxx.x	predictive	Medium
73	File	xxxxxx/xxx.x	predictive	Medium
74	File	xxxxxx/xxxx.x	predictive	High
75	File	xxxxx.x	predictive	Low
76	File	xxxxxxx=xxxxxxxxxx&xxxx=xxxx&xxxxxxxxxxxxx=/	predictive	High
77	File	xxxxxxxx_xxx.xxx	predictive	High
78	File	xxxxxx.xx	predictive	Medium
79	File	xxxxxx/xx/xxxxx_xxxx.x	predictive	High
80	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
81	File	xxxxxx/xxxxx-xxxxxxx.xx	predictive	High
82	File	xxxxxxxxx.x	predictive	Medium
83	File	xxxxxxx/xxxxxxxxxxxxxx	predictive	High
84	File	xxxxxxxxx.xxx	predictive	High
85	File	xxxxxxx/xxxx/xxxxxx_xxxxxxx.x	predictive	High
86	File	xxxxxxx/xxx/xxx/xxx/xxx_xxx.x	predictive	High
87	File	xxxxxxx/xxxxx/xxx/xxx-xxx-xx/xxx_xxx_xxxx.x	predictive	High
88	File	xxxxxxx/xxxxx/xxxxx/xxxx-xxxxx.x	predictive	High
89	File	xxxxxxx/xxxxx/xxxxx/xxxxxxxx-xxxx.x	predictive	High
90	File	xxxxxxx/xxx/xxxxxxxxxx/xxxxx.x	predictive	High
91	File	xxxxx_xxxx.x	predictive	Medium
92	File	xxxxxx/xxx/xxxxxxx.xxx	predictive	High
93	File	xxxxxxxx.x	predictive	Medium
94	File	xxxxxxxxxx/xxxxxxxxx.xxx	predictive	High
95	File	xxxx/xxxxxxxxxx/xxxxxxxxxx.xxx	predictive	High
96	File	xxxx/xxxxxxxxxx/xxxx-xxx.x	predictive	High
97	File	xxxx/xxxxxxxxxx/xxxxxx-xxxxx.x	predictive	High
98	File	xxxx/xxxxxxxxxx/xxxxxx-xxx.x	predictive	High
99	File	xxxx/xxxxxxxxxx/xxxxxx-xxx.x	predictive	High
100	File	xxxx/xxxxxxxxxx/xxxxxx-xxxx.x	predictive	High
101	File	xxxx/xxxxxxxxxx/xxxxxx-xxxx.x	predictive	High
102	File	xxxxxxxxx	predictive	Medium
103	File	xxx/xxxx/xxxx.x	predictive	High
104	File	xxx/xxxx/xxxx.x	predictive	High
105	File	xxxxxxx.x	predictive	Medium
106	File	xxxxxxxx.x	predictive	Medium
107	File	xxxx.x	predictive	Low
108	File	xxxx/xxxxxx.x	predictive	High
109	File	xxxxxxxxxxxxx.xxx	predictive	High
110	File	xxxxxxxxx/xx/xxxxxxxxxxxx.xxx	predictive	High
111	File	xx/xxxxxx/xxxxxx.x	predictive	High
112	File	xx/xx-xx.x	predictive	Medium
113	File	xx_xx.x	predictive	Low
114	File	xxxxxxx.xxx	predictive	Medium
115	File	xxxx.xx	predictive	Low
116	File	xxx/xxx/xxxxxxxxx.x	predictive	High
117	File	xxxxx/xxxx/xxxxxx	predictive	High
118	File	xxxxxxxxx.xx	predictive	Medium
119	File	xxxx.x	predictive	Low
120	File	xxxx/.xxxxxxxxxxxxxxx	predictive	High
121	File	xxxx/xxxx/xxxxxxx/xxxxxxxx.xxxx	predictive	High
122	File	xxxx/xxxxxxx.xxx	predictive	High
123	File	xxxxx-xxxxxx.x	predictive	High
124	File	xx/xxxxxxx/xxxxxx-xxx.x	predictive	High
125	File	xxxxxxxxxxxxxx.xxx	predictive	High
126	File	xxxxxxxx.xxx	predictive	Medium
127	File	xxxxxx-xxxx.x	predictive	High
128	File	xxx/xxxxxx.xxx	predictive	High
129	File	xxx/xx/xxxx/xxxx.xxxxx.xxx	predictive	High
130	File	xxxxxxx/xxxxxxxxx_xxxxxxx.xxx.xxx	predictive	High
131	File	xxxxx.xxxx	predictive	Medium
132	File	xxxxx.xxx	predictive	Medium
133	File	xxxxx-xxx.x	predictive	Medium
134	File	xxxxxxx/xxxxx.xxx	predictive	High
135	File	xxxxx.xxxxxxx.xxx	predictive	High
136	File	xxxxx-xxxx/xxxxxx/xx/xx-xxxxx.x	predictive	High
137	File	xxx_xxxxx.x	predictive	Medium
138	File	xxxxxxxxxxxxxx.xxx	predictive	High
139	File	xx/xx/xxxxxxxxxxxxxxx.xx	predictive	High
140	File	xxxxxx.x	predictive	Medium
141	File	xxxxx.x	predictive	Low
142	File	xxxxxxxx-xxxxxxxxxx-xxxxxxx/xxxxxxxxxxx	predictive	High
143	File	xxxxxx.xxx	predictive	Medium
144	File	xxxxxx/xxxxxxxx.xx	predictive	High
145	File	xxxxxxxxxx/xxx.x	predictive	High
146	File	xxxxxxxxx/xxx/xxx_xxx.x	predictive	High
147	File	xxxxxxxxxx/xxxxx_xxx.x	predictive	High
148	File	xxxxxxx/xxxx/xxxxx.xxxxx.xxx	predictive	High
149	File	xxxxxxx/xx.x	predictive	Medium
150	File	xxxxx.xxxx	predictive	Medium
151	File	xxx-xxxxx/xxx/xxxxxxx.x	predictive	High
152	File	xxx/xxx_xxxx_xxx.x	predictive	High
153	File	xxxxxx/xxxxxx.x	predictive	High
154	File	xxxxxxxxxx/xxxxx-xxxxxxxx.x	predictive	High
155	File	xxxxxx/xxxxxxx/xxxxxx_xxxxxxxx.xxx	predictive	High
156	File	xxxxxx.x	predictive	Medium
157	File	xxxxxxxxx.xxx	predictive	High
158	File	xxxxxxx/xxxx/xxxx/xxxxxxxxxxxxx/xxxxxx_xxxxxxxxxxx.xxx	predictive	High
159	File	xxxxxxx/xxxxxxxxxxx/xxxxxx.xxxxxx.xxx	predictive	High
160	File	xxxx_xxxxxxxxxxx_xxxx.xxx	predictive	High
161	File	xxxx-xxxx.x	predictive	Medium
162	File	xxxxxxxxxxx.xxxx	predictive	High
163	File	xxx/xxxxxxxxx/xxxxx_xxxx.x	predictive	High
164	File	xxx/xxxx/xxxxxx.x	predictive	High
165	File	xxxxxx_xxx.x	predictive	Medium
166	File	xxxx.xx-xxxxxx/xxxxx.xxx	predictive	High
167	File	xxx_xxxxx_xx_xxxxxxxxx/xx	predictive	High
168	File	xxxxxxxx.xxx	predictive	Medium
169	File	xxxx.x	predictive	Low
170	File	xxxxx.xxx	predictive	Medium
171	File	xxxxx.x	predictive	Low
172	File	xxxx_xxx_xxxxxxx.x	predictive	High
173	File	xxxxxxxx.xxx	predictive	Medium
174	File	xxxxxxxxxxxx.xxx	predictive	High
175	File	xxxx.xxx	predictive	Medium
176	File	xxxxxxxxxxxxxxxxxx.xxx	predictive	High
177	File	xxxxx-xxx.x	predictive	Medium
178	File	xxxxx-xxxxx.x	predictive	High
179	File	xxxxx-xxx.x	predictive	Medium
180	File	xxxxx-xxxxxx.x	predictive	High
181	File	xxxxx-xxxxxxx.x	predictive	High
182	File	xxxxx-xxx.x	predictive	Medium
183	File	xxxxx-xxxxxx.x	predictive	High
184	File	xxxxx/xxxxxxxxxxx/xxxxxxxxxx_xxxxxxxxxxx.xxx	predictive	High
185	File	xxxxx/xxxxxxxx.x	predictive	High
186	File	xxxxxxx/xxxxx/xxxx/##/xxxxx/	predictive	High
187	File	xxxx.xxx	predictive	Medium
188	File	xxxxx_xxxxxx_xxxxxxxx.xxx	predictive	High
189	File	xxxxxxxx.xxx	predictive	Medium
190	File	xxxxxxx.x	predictive	Medium
191	File	xxxxx.xxx	predictive	Medium
192	File	xxxxx.xxx	predictive	Medium
193	File	xxxxxxxxxx.xxx	predictive	High
194	File	xxxxxxxx.x	predictive	Medium
195	File	xxxxxxxxxxxx.xx	predictive	High
196	File	xxxxxx/xxxxxxx/xxxxxxxx/xxxxxxxx.xxx	predictive	High
197	File	xxxxxxx/xxxxx/xxxx-xxx/xxxxxx.x	predictive	High
198	File	xxxxxxxxxxx.xxx	predictive	High
199	File	xxxxx.xxxxxx	predictive	Medium
200	File	xxxx_xxxxx.xxxx	predictive	High
201	File	xxx/xxxxxxxxxx.x	predictive	High
202	File	xxxxxxxx.x	predictive	Medium
203	File	xxx_xxxx.x	predictive	Medium
204	File	xxxxxxxxxxx.xxx	predictive	High
205	File	xxx.x	predictive	Low
206	File	xxxxxxxx.xxxxx.xxx	predictive	High
207	File	xxxxxxxxx/xxxxx/xxxx/xxx_xxxxxxx/xxxxxxx/xxxxxxx.xxx	predictive	High
208	File	xxx_xxx.x	predictive	Medium
209	File	xxxx-xxxxxxxx.xxx	predictive	High
210	File	xxxxx/xxxxxx	predictive	Medium
211	File	xxxxxxxx/xxxxxxx.x	predictive	High
212	File	xxxxxxxxxx.xxx	predictive	High
213	File	xxx/xxx.xxxxx.xxx	predictive	High
214	File	xx_xxxxx.xxx	predictive	Medium
215	File	xxxxxx.xxx	predictive	Medium
216	File	xxxxxx.xxx	predictive	Medium
217	File	xxxxxxxxxxxx.xxx	predictive	High
218	File	xxxx_xxxx_xxxxxxx.xxx	predictive	High
219	File	xxxx_xxxxx.xxx	predictive	High
220	File	xxxx.x	predictive	Low
221	File	xxxxxxxxxxx.xxxx	predictive	High
222	File	xxxxx/xxx.xxx	predictive	High
223	File	xxxx.x	predictive	Low
224	File	xxxxxx/xxxxxxx/xxxxxxxxxxxxx.xxx	predictive	High
225	File	xxxxxxxxx.xxxxx	predictive	High
226	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	High
227	File	xx-xxxxx/xxxxxxxx/xxxxx-xx-xxxxx-xxxx-xxxxx.xxx	predictive	High
228	File	xx-xxxxx/xxxxxxxx/xxxxx-xx-xxxxx-xxxx.xxx	predictive	High
229	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
230	File	xxxxxxxxxxx.xxx	predictive	High
231	Library	xxx/xxxxxx.x	predictive	Medium
232	Library	xxx/xxx-xxxxx.x	predictive	High
233	Library	xxx/xxx.x	predictive	Medium
234	Library	xxx/xxxxxx.xx	predictive	High
235	Library	xxx/xxx.x	predictive	Medium
236	Library	xxxxxxx.xxx	predictive	Medium
237	Library	xxxxxxxx.xxx	predictive	Medium
238	Library	xxxxxxx\xxxxx\xxxxxxx_xxxxxx.xxx	predictive	High
239	Library	xxxxxxxx.xxx	predictive	Medium
240	Library	xxxxxx.xxx	predictive	Medium
241	Argument	$xxxx->xxxxx->xxxxxxxxxxxxxx)	predictive	High
242	Argument	$_xxxxxx['xxxxxxx_xxx']	predictive	High
243	Argument	xxx	predictive	Low
244	Argument	xxxxxxxxx	predictive	Medium
245	Argument	xxxxx	predictive	Low
246	Argument	xxxxxx	predictive	Low
247	Argument	xxxxxxxx	predictive	Medium
248	Argument	xxxxx	predictive	Low
249	Argument	xxxxxxxxxxxxx	predictive	High
250	Argument	xxxxxxx/xxxxxxxx	predictive	High
251	Argument	xxxxxx	predictive	Low
252	Argument	xxx	predictive	Low
253	Argument	xxxxxxxx/xxxx/xxx/xxxxxxxxxxx/xxxxx	predictive	High
254	Argument	xxx_xx	predictive	Low
255	Argument	xxxxxxxxxxxxx	predictive	High
256	Argument	xxx_xxxxxxxxx_xxxx	predictive	High
257	Argument	xxxx	predictive	Low
258	Argument	xxxxxxxxx	predictive	Medium
259	Argument	xxxxxx	predictive	Low
260	Argument	xxxxxxx/xxxxxxx/xxxxxxx_xxxxxxxxxx/xxxxxxx_xxxxxx/xxxxxxxx/xxxx_xxxxx	predictive	High
261	Argument	xxxxx	predictive	Low
262	Argument	xxxxxx	predictive	Low
263	Argument	xxx_xxxxxxxxx	predictive	High
264	Argument	xxx	predictive	Low
265	Argument	xxx	predictive	Low
266	Argument	xx	predictive	Low
267	Argument	xxxxx	predictive	Low
268	Argument	xxxxxxx	predictive	Low
269	Argument	xxxx	predictive	Low
270	Argument	xxxxxxxx	predictive	Medium
271	Argument	xxxxxx	predictive	Low
272	Argument	xxx_xxx	predictive	Low
273	Argument	xx_xxxx [xx][x]/xx_xxxx [xx][x]/xx_xxxx [xx][x]/xx_xxxx [xx][x]/xxxxx	predictive	High
274	Argument	xxxxxx_xxxxxx/xxx_xxxxxx	predictive	High
275	Argument	xxxxxxxx/xxxxxxxx/xxxxxxxx	predictive	High
276	Argument	xx	predictive	Low
277	Argument	xxxxxx	predictive	Low
278	Argument	xxxxx.xxx?xxxxxx=xxx_xxxxxxx/xxxx=xxxxxxx/xx=x/xxxxxxxx=xxxxx	predictive	High
279	Argument	xxxx_xx	predictive	Low
280	Argument	xx	predictive	Low
281	Argument	xx_xxxxxxxxxx.xxxxxxx	predictive	High
282	Argument	xxxxx/xxxxxx	predictive	Medium
283	Argument	xxxxx	predictive	Low
284	Argument	xxxxxxxxx	predictive	Medium
285	Argument	xx_xxxxxxxxxxx	predictive	High
286	Argument	xxxxxxxxxxxxxxxxx	predictive	High
287	Argument	xxxx	predictive	Low
288	Argument	xxxx/xxxxxxxxxxx	predictive	High
289	Argument	xxxx/xxxxx/xxxxxxxx	predictive	High
290	Argument	xxxx	predictive	Low
291	Argument	xxxxx	predictive	Low
292	Argument	xxxxxxxx/xxx	predictive	Medium
293	Argument	xxxx	predictive	Low
294	Argument	xxxxxxxx	predictive	Medium
295	Argument	xxx_xxx	predictive	Low
296	Argument	xxxxxxxxx	predictive	Medium
297	Argument	xxxxxxx-xxx-xxx	predictive	High
298	Argument	xxxxxxxx_xxx	predictive	Medium
299	Argument	xxxxxxxxx	predictive	Medium
300	Argument	xxxxxx	predictive	Low
301	Argument	xxxxxxxx	predictive	Medium
302	Argument	xxxxxxxx	predictive	Medium
303	Argument	xxxxxxxx_xxx	predictive	Medium
304	Argument	xxxxxxxxx	predictive	Medium
305	Argument	xx	predictive	Low
306	Argument	xxx_xxx	predictive	Low
307	Argument	x/x	predictive	Low
308	Argument	xxxxxx	predictive	Low
309	Argument	xxxxxxxxxxxxxxxxx	predictive	High
310	Argument	xxxxxxxxxxxxx	predictive	High
311	Argument	xxxx	predictive	Low
312	Argument	xxx_xxxxx	predictive	Medium
313	Argument	xxxxxxxx/xxxxxxxx	predictive	High
314	Argument	xxxxxxxx	predictive	Medium
315	Argument	xxxx	predictive	Low
316	Argument	xxxxxxxxxxxx	predictive	Medium
317	Argument	xxx	predictive	Low
318	Argument	xxxx	predictive	Low
319	Argument	xxxx	predictive	Low
320	Argument	xxx	predictive	Low
321	Argument	xxx	predictive	Low
322	Argument	xxxxxxxx	predictive	Medium
323	Argument	xxxxxxxx/xxxxxxxx	predictive	High
324	Argument	xxxxxxxx/xxxxxxxx	predictive	High
325	Argument	xxxxxxxx/xxxxxxxx	predictive	High
326	Argument	xxx_xxx	predictive	Low
327	Argument	xxxxx	predictive	Low
328	Argument	xxxx	predictive	Low
329	Argument	xxxxx/xxxxxx	predictive	Medium
330	Argument	xxxxx	predictive	Low
331	Argument	_xxxxxx	predictive	Low
332	Input Value	'>[xxx]	predictive	Low
333	Input Value	'xx''='	predictive	Low
334	Input Value	../	predictive	Low
335	Input Value	/xxxxxx/..%xx	predictive	High
336	Input Value	xxxxx	predictive	Low
337	Input Value	xxxxxxxx	predictive	Medium
338	Input Value	<xxxxxxxxx>xxx	predictive	High
339	Input Value	x" \|\| xxxx_xxxxxxx_xx_xxxxxxx \|\| "	predictive	High
340	Input Value	xxxxx%xx'xx''='	predictive	High
341	Input Value	xxxx	predictive	Low
342	Pattern	\|xx\|xx\|xx\|	predictive	Medium
343	Network Port	xxx/xxxx	predictive	Medium
344	Network Port	xxx	predictive	Low

References (25)

The following list contains external sources which discuss the actor and the associated activities:

Samples (1)

The following list contains associated samples:

https://bazaar.abuse.ch/sample/cb5538b08c11ad4a004b1f5668ce77a38fe574c2fb8ccaf0ebf06a548ad4144d/

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!