Mekotio Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (167)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	114
zh	18
de	12
ru	8
fr	6

Country

US: USA	86
CN: China	20
GB: Great Britain	18
WF: Wallis and Futuna	6
BR: Brazil	4

Actors

Mekotio	25
Cobalt Strike	9
Mirai	5
RedLine Stealer	5
Bashlite	4

Activities

Interest

Timeline

Type

Not Defined	68
Content Management System	12
Operating System	12
WordPress Plugin	8
Programming Language Software	6

Vendor

Not Defined	76
Microsoft	14
Keenetic	4
WordPress	2
Qualcomm	2

Product

Microsoft Windows	8
Keenetic KN-1010	4
Keenetic KN-1410	4
Keenetic KN-1711	4
Keenetic KN-1810	4

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	SPIP filtres.php encoder_contexte_ajax code injection	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00446	0.03	CVE-2016-3154
2	SPIP spip.php cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00193	1.06	CVE-2022-28959
3	Myupb UPB cross site scripting	4.3	4.3	$0-$5k	$0-$5k	High	Unavailable	0.00503	0.04	CVE-2008-6727
4	Project Worlds Student Project Allocation System Admin Login Module admin_login.php cross site scripting	4.9	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00071	0.07	CVE-2024-0726
5	Simple Art Gallery adminHome.php sliderPicSubmit unrestricted upload	7.1	7.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00325	0.04	CVE-2023-1415
6	FreePBX cdr Cdr.class.php ajaxHandler sql injection	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00576	0.04	CVE-2020-36630
7	WordPress sql injection	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00576	0.09	CVE-2022-21664
8	Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Version Data version.js information disclosure	5.3	5.1	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00045	0.04	CVE-2024-4022
9	Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Configuration Setting ndmComponents.js information disclosure	5.3	5.1	$0-$5k	$0-$5k	Proof-of-Concept	Workaround	0.00045	0.04	CVE-2024-4021
10	Palo Alto PAN-OS Web Interface race condition	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00116	0.02	CVE-2023-0008
11	RoundCube Webmail Email Message rcube_string_replacer.php linkref_addindex cross site scripting	5.2	5.2	$0-$5k	$0-$5k	High	Official Fix	0.02548	0.02	CVE-2020-35730
12	FreePBX Operator Panel Module index_inc.php information disclosure	5.7	5.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00085	0.00	CVE-2019-11407
13	OpenCart Program Extension Upload Temporary unrestricted upload	6.7	6.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00225	0.00	CVE-2018-11494
14	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02820	0.24	CVE-2010-0966
15	SPIP spip_login.php3 cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01006	0.06	CVE-2005-4494
16	Rocklobster Contact Form 7 unrestricted upload	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.15907	0.08	CVE-2020-35489
17	PHPGurukul Job Portal unrestricted upload	8.3	8.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00050	0.00	CVE-2024-8463
18	Four-Faith F3x24/F3x36 apply.cgi os command injection	7.2	7.2	$0-$5k	$0-$5k	High	Not Defined	0.00046	0.05	CVE-2024-12856
19	Redmine sql injection	6.4	6.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01534	0.04	CVE-2019-18890
20	Webmin CGI command injection	9.3	9.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00043	0.06	CVE-2024-12828

IOC - Indicator of Compromise (84)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	4.240.84.251		Mekotio	05/08/2023	verified	High
2	5.181.156.86	5-181-156-86.mivocloud.com	Mekotio	12/08/2023	verified	Medium
3	13.66.15.167		Mekotio	02/10/2022	verified	Low
4	15.228.13.156	ec2-15-228-13-156.sa-east-1.compute.amazonaws.com	Mekotio	05/12/2023	verified	Medium
5	15.228.16.45	ec2-15-228-16-45.sa-east-1.compute.amazonaws.com	Mekotio	08/06/2023	verified	Medium
6	15.228.46.182	ec2-15-228-46-182.sa-east-1.compute.amazonaws.com	Mekotio	01/14/2023	verified	Low
7	15.229.1.40	ec2-15-229-1-40.sa-east-1.compute.amazonaws.com	Mekotio	12/20/2023	verified	Medium
8	15.229.26.142	ec2-15-229-26-142.sa-east-1.compute.amazonaws.com	Mekotio	02/17/2023	verified	Low
9	18.118.78.11	ec2-18-118-78-11.us-east-2.compute.amazonaws.com	Mekotio	05/20/2023	verified	Medium
10	18.223.102.186	ec2-18-223-102-186.us-east-2.compute.amazonaws.com	Mekotio	05/12/2023	verified	Medium
11	18.231.161.239	ec2-18-231-161-239.sa-east-1.compute.amazonaws.com	Mekotio	05/12/2023	verified	Medium
12	20.5.65.48		Mekotio	04/28/2023	verified	High
13	20.25.181.202		Mekotio	05/12/2023	verified	High
14	20.38.37.160		Mekotio	08/06/2023	verified	High
15	20.121.119.89		Mekotio	05/20/2023	verified	High
16	20.206.121.1		Mekotio	02/10/2022	verified	Low
17	20.239.166.4		Mekotio	05/08/2023	verified	High
18	XX.XXX.XX.XX		Xxxxxxx	09/19/2023	verified	High
19	XX.XXX.XX.XXX		Xxxxxxx	03/08/2023	verified	High
20	XX.XXX.XX.XX	xx-xxx-xx-xx.xxxxxxxxxxx.xxx	Xxxxxxx	05/12/2023	verified	High
21	XX.XXX.XXX.XXX		Xxxxxxx	12/08/2023	verified	High
22	XX.XXX.XXX.XXX		Xxxxxxx	09/23/2023	verified	High
23	XX.XX.XXX.XXX	xxx.xxx.xx.xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	11/10/2023	verified	Medium
24	XX.XXX.X.XXX	xxx.x.xxx.xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	03/26/2024	verified	High
25	XX.XXX.XXX.XXX	xxx.xxx.xxx.xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	09/19/2023	verified	Medium
26	XX.XXX.XXX.XX		Xxxxxxx	06/22/2023	verified	High
27	XX.XXX.XXX.XX	xx.xxx.xxx.xx.xxxx.xxxxxxxxxxxx.xxx	Xxxxxxx	10/28/2024	verified	Very High
28	XX.XXX.XXX.XXX	xxxxxx.xxxxxx-xxx-xxxxxx.xx	Xxxxxxx	05/08/2023	verified	High
29	XX.XXX.XXX.XXX	xxx-xxx-xxx-xx.xxxxxxx.xxxxxxxxxxxxxxx.xxx	Xxxxxxx	12/03/2022	verified	Medium
30	XX.XXX.XXX.XXX	xxxxxxxx.xxxxxx-xxxx-xxxxx.xxxxxx	Xxxxxxx	02/09/2023	verified	Medium
31	XX.XXX.XXX.XXX		Xxxxxxx	12/03/2022	verified	Medium
32	XX.XX.XX.XXX		Xxxxxxx	12/20/2023	verified	High
33	XX.XX.XX.XXX		Xxxxxxx	05/12/2023	verified	High
34	XX.XX.XXX.XX		Xxxxxxx	02/10/2022	verified	Low
35	XX.XX.X.X	x.xx.xx.x.x.xxxxxxx.xxxxxxxx.xxx	Xxxxxxx	04/04/2023	verified	High
36	XX.XX.XX.XXX	xx-xx-xx-xxx.xxxxxxxxxxx.xxx	Xxxxxxx	12/08/2023	verified	High
37	XX.XX.XXX.XX		Xxxxxxx	08/06/2023	verified	High
38	XX.XX.XXX.XX	xxxxxxxxx.xxxxx.xxx.xx	Xxxxxxx	02/08/2023	verified	Medium
39	XX.XXX.XXX.XXX		Xxxxxxx	05/12/2023	verified	High
40	XX.XX.XXX.X	x.xxx.xx.xx.xxxx.xxxxxxxxxxxx.xxx	Xxxxxxx	10/28/2024	verified	Very High
41	XX.XXX.XX.XXX	xx-xxx-xx-xxx.xxxxxxxxxxx.xxx	Xxxxxxx	05/12/2023	verified	High
42	XX.XXX.XXX.X		Xxxxxxx	04/28/2023	verified	High
43	XX.XX.XXX.XXX	xxx-xx-xx-xxx-xxx.xx-xxxx-x.xxxxxxx.xxxxxxxxx.xxx	Xxxxxxx	05/12/2023	verified	Medium
44	XX.XX.XXX.XXX	xxx-xxx-xx-xx.xxxxxxx-xxx	Xxxxxxx	02/08/2023	verified	Medium
45	XX.XXX.XXX.XXX	xxx.xxx.xxx.xx.xxxx.xxxxxxxxxxxx.xxx	Xxxxxxx	09/19/2023	verified	High
46	XX.XXX.XXX.XXX	xxx.xxx.xxx.xx.xxxx.xxxxxxxxxxxx.xxx	Xxxxxxx	12/08/2023	verified	High
47	XX.XX.XXX.XX	xxxxxx.xxxxxxx.xxxx	Xxxxxxx	05/08/2023	verified	Medium
48	XX.XX.XXX.XX	xxxxxxxxx.xxxxx.xxx.xx	Xxxxxxx	02/08/2023	verified	Medium
49	XX.XX.XXX.XX	xxxxxxxxx.xxxxx.xxx.xx	Xxxxxxx	01/24/2023	verified	Medium
50	XX.XXX.XX.XX	xxxxxxx.xxxxxxxxxxx.xxx	Xxxxxxx	12/08/2023	verified	High
51	XXX.XX.XXX.XXX		Xxxxxxx	12/20/2023	verified	High
52	XXX.XX.XXX.XXX		Xxxxxxx	05/12/2023	verified	High
53	XXX.XX.XXX.XXX		Xxxxxxx	02/16/2023	verified	Medium
54	XXX.XX.XXX.XX		Xxxxxxx	02/16/2023	verified	Medium
55	XXX.XXX.XX.XXX		Xxxxxxx	05/12/2023	verified	High
56	XXX.XXX.XX.XX		Xxxxxxx	01/06/2023	verified	Medium
57	XXX.XXX.XXX.XX		Xxxxxxx	07/05/2023	verified	High
58	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	12/08/2023	verified	Medium
59	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	08/06/2023	verified	Medium
60	XXX.XX.XXX.XXX		Xxxxxxx	12/08/2023	verified	High
61	XXX.X.XX.XX		Xxxxxxx	10/28/2023	verified	High
62	XXX.X.XX.XX		Xxxxxxx	10/28/2023	verified	High
63	XXX.XX.XXX.XXX	xxxxxxxx.xxxxxxxxxxx.xxx.xx	Xxxxxxx	07/05/2023	verified	Low
64	XXX.XXX.X.XXX	xxxxxxxx.xxxxxxxxxxx.xxx.xx	Xxxxxxx	05/20/2023	verified	Low
65	XXX.XX.XX.XXX		Xxxxxxx	08/07/2023	verified	High
66	XXX.XXX.XX.XX		Xxxxxxx	01/10/2023	verified	Medium
67	XXX.XXX.XX.XXX		Xxxxxxx	12/08/2023	verified	High
68	XXX.XX.XXX.XX	xxx-xx-xxx-xx.xxxxxxxxxxx.xxx	Xxxxxxx	05/12/2023	verified	High
69	XXX.XX.XXX.X	xxxxxxxxx.xxxxx-xxxxxxxxxx.xxxxxxxxx	Xxxxxxx	12/08/2023	verified	High
70	XXX.XXX.XX.XX		Xxxxxxx	01/24/2023	verified	Medium
71	XXX.XXX.XX.XX		Xxxxxxx	08/06/2023	verified	High
72	XXX.XXX.XX.XX		Xxxxxxx	12/03/2022	verified	Medium
73	XXX.XXX.XX.XXX	xxxxxxxx.xxxxxxxxx-xxxxx.xxxxxx	Xxxxxxx	01/24/2023	verified	Medium
74	XXX.XXX.XX.XXX	xxxx.xxxxxx.xx	Xxxxxxx	12/03/2022	verified	Medium
75	XXX.XXX.XX.XXX	xxxxx.xxxxx-xxxx.xxxx	Xxxxxxx	01/24/2023	verified	Medium
76	XXX.XXX.XX.XXX	xxxxxx.xxx	Xxxxxxx	01/24/2023	verified	Medium
77	XXX.XXX.XX.XXX	xxx.xxxxxxxxxx.xx	Xxxxxxx	01/10/2023	verified	Medium
78	XXX.XXX.XX.XXX	xxxxx.xxxxxx-xxxxxxx.xxx	Xxxxxxx	03/08/2023	verified	Medium
79	XXX.XXX.XX.XX	xxxxxxxxxxxxx.xxx	Xxxxxxx	04/28/2023	verified	High
80	XXX.XXX.XX.XXX	xxxxxxx.xxx	Xxxxxxx	04/28/2023	verified	High
81	XXX.XXX.XX.XXX	xxxxxxxx.xxxxx.xxxx	Xxxxxxx	02/17/2023	verified	Medium
82	XXX.XXX.XX.XXX		Xxxxxxx	05/08/2023	verified	High
83	XXX.XXX.XXX.XXX		Xxxxxxx	05/12/2023	verified	High
84	XXX.X.XXX.XXX	xxxxxx.xxxx.xxx	Xxxxxxx	12/08/2023	verified	High

TTP - Tactics, Techniques, Procedures (12)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22, CWE-23, CWE-37	Path Traversal	predictive	High
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Basic Cross Site Scripting	predictive	High
4	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX.XXX		CWE-XXX	Xxx-xxx Xxxx Xxxxxxx Xxxx	predictive	High
6	TXXXX	CAPEC-XXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
8	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	predictive	High
9	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
10	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxxxxxx	predictive	High
11	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
12	TXXXX.XXX	CAPEC-X	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (87)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/?page=reports	predictive	High
2	File	/admin/ajax.php?action=save_window	predictive	High
3	File	/api/v1/snapshots	predictive	High
4	File	/cgi-bin/cstecgi.cgi	predictive	High
5	File	/manager/index.php	predictive	High
6	File	/mgmt/tm/util/bash	predictive	High
7	File	/ndmComponents.js	predictive	High
8	File	/secure/QueryComponent!Default.jspa	predictive	High
9	File	/spip.php	predictive	Medium
10	File	/swdHGFizaW.php/general/attachment/edit/ids/4?dialog=1	predictive	High
11	File	/xxxxxxx/	predictive	Medium
12	File	/xxxxxx-xxxxxx.xxx	predictive	High
13	File	/xxxxxxx/xxxx.xxx	predictive	High
14	File	/xxxxxxxxxxxxxxxxxxxxxxx.xxx	predictive	High
15	File	/xxx/xxx/xxxxxx.xxxx	predictive	High
16	File	/xxxxxxx.xx	predictive	Medium
17	File	/xxxx/xxx/xxxxxxx/xxx_xxxxxx.xxx	predictive	High
18	File	/[xxxxxx_xxx].xxx/xxxxxxx/xxxxxxxxxx/xxxx/xxx/x?xxxxxx=x	predictive	High
19	File	xxxxxxx.xxx	predictive	Medium
20	File	xxxxxxxxx.xxx	predictive	High
21	File	xxxxx_xxxxx.xxx	predictive	High
22	File	xxx/xxxxx/xxxxxxxxx.xxx	predictive	High
23	File	xxx/xxxxxxxx_xxxxx/xxxxx_xxx.xxx	predictive	High
24	File	xxxxx.xxx	predictive	Medium
25	File	xxx\xxxxxxxx\xxxxxxx_xxxxx.xxx	predictive	High
26	File	xxxx_xxxxx_xxx_xxxxx.x	predictive	High
27	File	xxxxxx/xxxxxxx/xxxx/xxxxxxx/xxxxxxx/xxxx_xxxxxxx.xxx	predictive	High
28	File	xxxxxx/xxxxx-xxx_xxxxxxxx.xxx	predictive	High
29	File	xxxxxxx=xxxxxxxxxx&xxxx=xxxx&xxxxxxxxxxxxx=/	predictive	High
30	File	xxxxxx/xxx/xxxxxxx.xxx	predictive	High
31	File	xxx/xxxxxx.xxx	predictive	High
32	File	xxxxx.xxxx	predictive	Medium
33	File	xxxxx.xxx	predictive	Medium
34	File	xxxxx.xxxx	predictive	Medium
35	File	xxxxxx/xxxxxxx/xxxxxx_xxxxxxxx.xxx	predictive	High
36	File	xxx/xxxxxxxxx/xxxxx_xxxx.x	predictive	High
37	File	xxxxx.xxx	predictive	Medium
38	File	xxxxx/xxxxxxxxxxx/xxxxxxxxxx_xxxxxxxxxxx.xxx	predictive	High
39	File	xxxxxxx/xxxxxxxx.xxx	predictive	High
40	File	xxxxx_xxxxxx_xxxxxxxx.xxx	predictive	High
41	File	xxxxx.xxx	predictive	Medium
42	File	xxxxx.xxx	predictive	Medium
43	File	xxxxxxxxxx.xxx	predictive	High
44	File	xxxx_xxxxx.xxxx	predictive	High
45	File	xxxxxxxxxxx.xxx	predictive	High
46	File	xxxx-xxxxx.xxx	predictive	High
47	File	xxxx-xxxxxxxx.xxx	predictive	High
48	File	xxx/xxx.xxxxx.xxx	predictive	High
49	File	xxxxxx.xxx	predictive	Medium
50	File	xxxxxxxxxxxx.xxx	predictive	High
51	File	xxxx_xxxxx.xxx	predictive	High
52	File	xxxx.x	predictive	Low
53	File	xxxxxxxxxxx.xxx	predictive	High
54	Argument	xxxxxxxx	predictive	Medium
55	Argument	xxx	predictive	Low
56	Argument	xxxxxxxx	predictive	Medium
57	Argument	xxx_xxxxxxxxx_xxxx	predictive	High
58	Argument	xxxxxx	predictive	Low
59	Argument	xxxxxxx/xxxxxxx/xxxxxxx_xxxxxxxxxx/xxxxxxx_xxxxxx/xxxxxxxx/xxxx_xxxxx	predictive	High
60	Argument	xxxx	predictive	Low
61	Argument	xx	predictive	Low
62	Argument	xxxx	predictive	Low
63	Argument	xxxxxxxx	predictive	Medium
64	Argument	xxx_xxx	predictive	Low
65	Argument	xx	predictive	Low
66	Argument	xxx	predictive	Low
67	Argument	xxxxx/xxxxxx	predictive	Medium
68	Argument	xxx	predictive	Low
69	Argument	xxxx	predictive	Low
70	Argument	xxxxx	predictive	Low
71	Argument	xxxx	predictive	Low
72	Argument	xxxxxxxx	predictive	Medium
73	Argument	xxx_xxx	predictive	Low
74	Argument	xxxxxxxxxxxxx	predictive	High
75	Argument	xxxxxxx-xxx-xxx	predictive	High
76	Argument	xxxxxxxx	predictive	Medium
77	Argument	xxx[xxx]/xxx[xxxxxxxxxx]/xxx[xxxxxxxxxxx]	predictive	High
78	Argument	xxx_xxx	predictive	Low
79	Argument	xxxxxxxxxxxxxxxxx	predictive	High
80	Argument	xxx_xxxxx	predictive	Medium
81	Argument	xxxxxxxx/xxxxxxxx	predictive	High
82	Argument	xxxxx	predictive	Low
83	Argument	xxx	predictive	Low
84	Argument	xxxxxxxx/xxxxxxxx	predictive	High
85	Argument	xxxx	predictive	Low
86	Argument	_xxxxxx	predictive	Low
87	Input Value	xxxx%xx%xxxxxxxx%xxxxxxx(%xxxxxxxx%xx)%xx/xxxxxx%xx	predictive	High

References (27)

The following list contains external sources which discuss the actor and the associated activities:

Samples (27)

The following list contains associated samples:

https://bazaar.abuse.ch/sample/cb5538b08c11ad4a004b1f5668ce77a38fe574c2fb8ccaf0ebf06a548ad4144d/

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!