Monero Miner Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (6)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en	4
de	2

Country

DE: Germany	6

Actors

CoinMiner	2

Activities

Interest

Timeline

Type

Not Defined	4
Connectivity Software	2

Vendor

PyPA	2
Not Defined	2
Citrix	2

Product

PyPA setuptools	2
NSClient++	2
Citrix ADC	2
Citrix Gateway	2

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#	Vulnerability	Base	Temp	0day	Today	Exp	Cou	KEV	EPSS	CTI	CVE
1	OpenSSH Binary Packet Protocol Terrapin inadequate encryption	5.7	5.6	$5k-$25k	$0-$5k	Not defined	Official fix	possible	0.67021	0.06	CVE-2023-48795
2	PyPA setuptools HTML Package Handler/PackageIndex Page resource consumption	5.4	5.3	$0-$5k	$0-$5k	Not defined	Official fix		0.00318	0.07	CVE-2022-40897
3	Citrix ADC/Gateway VPN Gateway/AAA Virtual Server resource consumption	5.3	5.1	$0-$5k	$0-$5k	Not defined	Official fix		0.00670	0.00	CVE-2021-22955
4	Microsoft Exchange Server ProxyShell server-side request forgery	9.5	9.1	$25k-$100k	$5k-$25k	Attacked	Official fix	verified	0.94302	0.00	CVE-2021-34473
5	NSClient++ program.exe unquoted search path	6.5	6.3	$0-$5k	$0-$5k	Not defined	Official fix		0.00060	0.08	CVE-2018-6384
6	TVT NVMS-1000 GET Request path traversal	7.4	7.4	$0-$5k	$0-$5k	Attacked	Not defined	verified	0.93648	0.07	CVE-2019-20085

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	46.59.210.69	46.59.210.69.dynamic-pppoe.dt.ipv4.wtnet.de	Monero Miner	06/05/2024	verified	Very Low
2	XX.XX.XXX.XX	xx.xx.xxx.xx.xxxxxxx-xxxxx.xx.xxxx.xxxxx.xx	Xxxxxx Xxxxx	06/05/2024	verified	Very Low
3	XX.XX.XX.XXX	xx.xx.xx.xxx.xxxxxxx-xxxxx.xx.xxxx.xxxxx.xx	Xxxxxx Xxxxx	06/05/2024	verified	Very Low
4	XXX.XX.XX.XXX		Xxxxxx Xxxxx	08/29/2018	verified	Low
5	XXX.XXX.XXX.XX		Xxxxxx Xxxxx	10/28/2024	verified	Very High

TTP - Tactics, Techniques, Procedures (3)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	High
2	TXXXX.XXX		CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	High
3	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (2)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	program.exe	predictive	Medium
2	Input Value	/..	predictive	Low

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!