Novter Analysis

IOB - Indicator of Behavior (703)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

pl	448
en	188
zh	46
ru	10
de	6

Country

pl	448
cn	102
us	66
ru	24
gb	4

Actors

Novter	11
SideWinder	3
Conti	2
Bunitu	2
Cobalt Strike	1

Activities

Interest

Timeline

Type

Not Defined	164
Operating System	18
WordPress Plugin	16
Content Management System	12
Application Server Software	10

Vendor

Not Defined	92
Microsoft	26
Apple	8
Apache	8
Joomla	6

Product

Microsoft Windows	12
Microsoft IIS	8
Apple macOS	6
Joomla CMS	6
Redis	4

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Hiox India Guest Book gb.php memory corruption	7.3	6.4	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.09	0.07687	CVE-2007-1998
2	Visual Form Builder Plugin csv injection	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.06	0.01440	CVE-2022-0142
3	jax guestbook jax_guestbook.php cross site scripting	4.3	4.2	$0-$5k	Calculating	High	Unavailable	0.02	0.01917	CVE-2005-4879
4	Lars Ellingsen Guestserver guestbook.cgi cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.21	0.01055	CVE-2005-4222
5	ASPjar ASPjar Guestbook login.asp sql injection	5.3	5.3	$0-$5k	Calculating	Not Defined	Not Defined	0.00	0.01213	CVE-2005-0423
6	DM Guestbook admin.guestbook.php path traversal	7.3	6.9	$0-$5k	Calculating	Proof-of-Concept	Not Defined	0.02	0.07197	CVE-2007-5821
7	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.04	0.04187	CVE-2007-1192
8	Qt-cute QuickTalk guestbook qtg_msg_view.php sql injection	7.3	7.1	$0-$5k	Calculating	High	Unavailable	0.02	0.01213	CVE-2007-3538
9	Professional Home Page Tools Professional Home Page Tools Guestbook delcookie.php unknown vulnerability	5.3	4.6	$0-$5k	Calculating	Unproven	Official Fix	0.01	0.01018	CVE-2006-3837
10	XAMPP Apache Distribution cds.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01	0.01917	CVE-2005-1077
11	Papoo guestbook.php sql injection	6.3	6.0	$0-$5k	Calculating	Proof-of-Concept	Not Defined	0.03	0.00000
12	AN Guestbook sign1.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	High	Official Fix	0.01	0.01213	CVE-2009-0424
13	FAC Guestbook information disclosure	9.8	9.5	$0-$5k	Calculating	High	Unavailable	0.02	0.01136	CVE-2007-2101
14	AFGB AFGB GUESTBOOK add.php file inclusion	7.3	6.7	$0-$5k	Calculating	Proof-of-Concept	Unavailable	0.07	0.10995	CVE-2006-5307
15	SignKorn Guestbook preview.php privileges management	5.3	5.3	$0-$5k	Calculating	Not Defined	Not Defined	0.02	0.00000
16	episodex episodex guestbook default.asp cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.01055	CVE-2005-1684
17	Planetmoon Guestbook passwd.txt Password access control	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.06790	CVE-2003-1541
18	MPM Guestbook cross site scripting	4.3	4.3	$0-$5k	Calculating	Not Defined	Not Defined	0.01	0.01917	CVE-2003-1182
19	MPC SoftWeb Guestbook insertguest.asp cross site scripting	4.3	4.3	$0-$5k	Calculating	Not Defined	Not Defined	0.00	0.00000
20	Big Sam Guestbook bigsam_guestbook.php denial of service	3.3	3.2	$0-$5k	Calculating	Proof-of-Concept	Not Defined	0.01	0.00000

IOC - Indicator of Compromise (68)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Type	Confidence
1	1.88.24.27		Novter	verified	High
2	2.58.80.150		Novter	verified	High
3	2.196.217.25		Novter	verified	High
4	3.128.83.132	ec2-3-128-83-132.us-east-2.compute.amazonaws.com	Novter	verified	Medium
5	5.61.40.95		Novter	verified	High
6	5.61.42.103		Novter	verified	High
7	5.61.42.111	box.invfx.eu	Novter	verified	High
8	5.61.42.116		Novter	verified	High
9	5.61.48.155		Novter	verified	High
10	5.61.48.156	192.64.119.156	Novter	verified	High
11	6.217.158.104		Novter	verified	High
12	7.130.244.4		Novter	verified	High
13	13.158.242.227		Novter	verified	High
14	20.56.162.154		Novter	verified	High
15	XX.XX.XXX.XX		Xxxxxx	verified	High
16	XX.XXX.XX.XX		Xxxxxx	verified	High
17	XX.XXX.XX.XXX		Xxxxxx	verified	High
18	XX.XXX.XXX.XXX		Xxxxxx	verified	High
19	XX.XX.XX.XXX	xxx.xx.xx.xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxx	verified	Medium
20	XX.X.XXX.XXX		Xxxxxx	verified	High
21	XX.XXX.X.XX	xxxxxxxxxxx.xxx	Xxxxxx	verified	High
22	XX.XXX.XX.XX		Xxxxxx	verified	High
23	XX.XX.XXX.XX		Xxxxxx	verified	High
24	XX.XXX.XXX.XX		Xxxxxx	verified	High
25	XX.XXX.X.XX		Xxxxxx	verified	High
26	XX.XX.XX.XXX	xx-xx-xx-xxx-xxxxxx.xxx.xxxxxxxxxxxxxxx.xxx	Xxxxxx	verified	High
27	XX.XX.XX.XXX		Xxxxxx	verified	High
28	XX.XXX.XXX.XXX	xx-xxx-xxx-xxx.xxxxxxxxxx.xxxxxx.xxxxxxxxx.xxx	Xxxxxx	verified	High
29	XX.XXX.XXX.XXX		Xxxxxx	verified	High
30	XX.XX.XX.XX		Xxxxxx	verified	High
31	XX.XX.XXX.XX	x-xx-xx-xxx-xx.xxxx.xx.xxxxxxx.xxx	Xxxxxx	verified	High
32	XX.XX.XXX.XXX	xxxxxxxxxxx-xxx-x-xx-xxx.xxx-xx.xxx.xxxxxxx.xx	Xxxxxx	verified	High
33	XX.XX.XXX.X	xxxxx-xx-xxx-x.xxxxx.xxx-xxx.xx	Xxxxxx	verified	High
34	XX.XXX.XX.XX	xxxxxxxxxx.xxx	Xxxxxx	verified	High
35	XX.XXX.XX.XX	xxxxxxxxxx.xxx	Xxxxxx	verified	High
36	XX.XXX.XX.XX	xxxx.xxxxxxxxxxxxx.xxx	Xxxxxx	verified	High
37	XX.XX.XXX.XXX	xxxx-xxx-xxx-xxx-xxx.xxx.xxx.xxxxx.xxxxxxxx-xx.xx	Xxxxxx	verified	High
38	XX.XX.X.XXX		Xxxxxx	verified	High
39	XXX.XX.XXX.XX	xxxx-xxx-xx-xxx-xx.xxxxxx.xxxx.xxxxxxx.xxx	Xxxxxx	verified	High
40	XXX.XXX.X.XX		Xxxxxx	verified	High
41	XXX.XXX.XX.XX	xxxxxxxxxxxxxxxxxxxx.xxxxx.xxx	Xxxxxx	verified	High
42	XXX.XXX.XXX.XX	xxxxxxxxxxxxxxxxxxxx.xxxxx.xxx	Xxxxxx	verified	High
43	XXX.XX.XXX.XXX		Xxxxxx	verified	High
44	XXX.XXX.XX.XXX		Xxxxxx	verified	High
45	XXX.XXX.XX.XX		Xxxxxx	verified	High
46	XXX.XXX.XX.XXX		Xxxxxx	verified	High
47	XXX.XXX.XXX.XXX		Xxxxxx	verified	High
48	XXX.XX.XX.XX	xxxx-xxx-xxx.xx-xxxxxxxx.xx	Xxxxxx	verified	High
49	XXX.XXX.XXX.XXX		Xxxxxx	verified	High
50	XXX.XX.X.XXX		Xxxxxx	verified	High
51	XXX.XX.XX.X		Xxxxxx	verified	High
52	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxxxxxxx.xxxxxx.xxx.xx	Xxxxxx	verified	High
53	XXX.XX.XXX.XXX		Xxxxxx	verified	High
54	XXX.XXX.XXX.XX		Xxxxxx	verified	High
55	XXX.XX.XX.XXX		Xxxxxx	verified	High
56	XXX.XXX.XX.XX	xx-xx-xxx-xxx.xxxxxxx.xxx.xx	Xxxxxx	verified	High
57	XXX.XX.XXX.XXX		Xxxxxx	verified	High
58	XXX.X.XXX.XXX	xxxxxxxxx.xxxx-xxxxx.xx	Xxxxxx	verified	High
59	XXX.XXX.XXX.XX	xxxxxx.xxxxxxxxxx.xxx	Xxxxxx	verified	High
60	XXX.XX.XXX.XXX		Xxxxxx	verified	High
61	XXX.XX.XXX.XXX		Xxxxxx	verified	High
62	XXX.XXX.XXX.XX		Xxxxxx	verified	High
63	XXX.XX.XXX.XXX		Xxxxxx	verified	High
64	XXX.XXX.XX.XXX	xxx.xx.xxx.xxx.xxxxx.xx.xx.xxxxxxx.xxxxxxx.xxx.xx	Xxxxxx	verified	High
65	XXX.XXX.XXX.XXX		Xxxxxx	verified	High
66	XXX.XX.XX.XX		Xxxxxx	verified	High
67	XXX.XX.XX.X		Xxxxxx	verified	High
68	XXX.XXX.XXX.XXX		Xxxxxx	verified	High

TTP - Tactics, Techniques, Procedures (16)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22, CWE-23	Pathname Traversal	predictive	High
2	T1055	CWE-74	Injection	predictive	High
3	T1059	CWE-94	Cross Site Scripting	predictive	High
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX.XXX	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	High
7	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxx	predictive	High
8	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
10	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
11	TXXXX	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	High
12	TXXXX	CWE-XXX	Xxx.xxx Xxxxxxxxxxxxxxxx: Xxxxxxxx Xx Xxxxxxxxxxxxx Xxxx	predictive	High
13	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
14	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx	predictive	High
15	TXXXX	CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxxxxxxxx Xxxxxxx Xxxxxxxxxx	predictive	High
16	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (170)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	.htaccess	predictive	Medium
2	File	/adfs/ls	predictive	Medium
3	File	/carbon/mediation_secure_vault/properties/ajaxprocessor.jsp	predictive	High
4	File	/getcfg.php	predictive	Medium
5	File	/Home/debit_credit_p	predictive	High
6	File	/index.php/weblinks-categories	predictive	High
7	File	/iwguestbook/admin/messages_edit.asp	predictive	High
8	File	/login/index.php	predictive	High
9	File	/odfs/classes/Master.php?f=delete_team	predictive	High
10	File	/public/plugins/	predictive	High
11	File	/scripts/iisadmin/bdir.htr	predictive	High
12	File	/wp-content/plugins/updraftplus/admin.php	predictive	High
13	File	add.php	predictive	Low
14	File	admin.cgi/config.cgi	predictive	High
15	File	admin/admin.guestbook.php	predictive	High
16	File	admin/auth.php	predictive	High
17	File	admin/backupdb.php	predictive	High
18	File	admin/login.asp	predictive	High
19	File	admin/preview.php	predictive	High
20	File	administrator/components/com_media/helpers/media.php	predictive	High
21	File	archive_read_support_format_rar.c	predictive	High
22	File	xxxx.xx	predictive	Low
23	File	xxxxxxxxxxxx.xxx	predictive	High
24	File	xxxx/xxxx_xxx.xxx	predictive	High
25	File	xxxxxx_xxxxxxxxx.xxx	predictive	High
26	File	xxx.xxx	predictive	Low
27	File	xxxxxxx.xxxx	predictive	Medium
28	File	xxxxxxxxxxxxxxxx.xxx	predictive	High
29	File	xxxxxxx/xxxxxxxxxx.xxx	predictive	High
30	File	xxxxxxx/xxxx/xxxxxx/xxxxxx.x	predictive	High
31	File	xxxxx-xxxxxxx.xxx	predictive	High
32	File	x_xxxxxx	predictive	Medium
33	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
34	File	xx/xx.xxx	predictive	Medium
35	File	xxxxxxx.xxx	predictive	Medium
36	File	xxxxxxxxx.xxx	predictive	High
37	File	xxxx.xxx	predictive	Medium
38	File	xxxxx.xxx	predictive	Medium
39	File	xxx/xxxx/xxxx.x	predictive	High
40	File	xxxxxxx.xxx	predictive	Medium
41	File	xxxxx/xxxxxx.xxx	predictive	High
42	File	xx_xxxxxxx	predictive	Medium
43	File	xxxxx/xxxxx_xxxxx_x	predictive	High
44	File	xxxxxxxx/xxxxxxx/xxxxxxxxxxxx.xxx	predictive	High
45	File	xx.xxx	predictive	Low
46	File	xxxxx.xxx	predictive	Medium
47	File	xxxxxx/xxxxxxxx	predictive	High
48	File	xxxx_xxxxxxx.xxx.xxx	predictive	High
49	File	xxxxxxxxxxxxxxxxxxxxxxxxx.xxxxx	predictive	High
50	File	xxxxxxxxx.xxx	predictive	High
51	File	xxxxxxxxx.xxx	predictive	High
52	File	xxxxxxxxx/xxxxxxxxx.xxx.xxx	predictive	High
53	File	xxxxxxxxxxxx.xxx	predictive	High
54	File	xxxxxxxxx.xxx	predictive	High
55	File	xxxx/xx/xxxxxxxxxx.xxx	predictive	High
56	File	xxxxxxxx.xxx	predictive	Medium
57	File	xxxxxxxxx.xx	predictive	Medium
58	File	xxx/xxxxxx.xxx	predictive	High
59	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	High
60	File	xxxxxxx/xxxxxxx/xxxxxxxx_xxxxxxxx.xxx.xxx	predictive	High
61	File	xxxxxxxx/xxxxxxxxx.xxxxx.xxx	predictive	High
62	File	xxxxxxxx/xxxxxx/xxxx/xxxxx.xxx.xxx	predictive	High
63	File	xxxxx.xxx	predictive	Medium
64	File	xxxxxxxxxxx.xxx	predictive	High
65	File	xxxxxxxx/xxx_xxxx_xxxx.x	predictive	High
66	File	xxx/xxxxxxxx.xxx	predictive	High
67	File	xxx_xxxxxxxxx.xxx	predictive	High
68	File	xxx.x/xxxxxx.x	predictive	High
69	File	xxx.x	predictive	Low
70	File	xxxxxxxxxxxxxxxxxxxx.xxxx	predictive	High
71	File	xxxxx.xxx	predictive	Medium
72	File	xxxxxxxx_xxxxxx.xxx	predictive	High
73	File	xxx/xxxx/xxxxxx.x	predictive	High
74	File	xxx_xxxx_xxx_xxxxxxxxxx.x	predictive	High
75	File	xxx_xxxx.xxx	predictive	Medium
76	File	xxxxxxxxxxx.xxx	predictive	High
77	File	xxxxxxxxxxxx.xxx	predictive	High
78	File	xxxxxx.xxx	predictive	Medium
79	File	xxxxxxx\xxx_xxxxxx.xxx	predictive	High
80	File	xxx_xxx_xxxx.xxx	predictive	High
81	File	xx.xxx	predictive	Low
82	File	xxxxxx/xxx/xx/xxx.xx	predictive	High
83	File	xxxxxxxxx.xxxx	predictive	High
84	File	xxxxxx.xxx	predictive	Medium
85	File	xxxx_xxxxx.xxx	predictive	High
86	File	xxxxxxxxxxxx.xxx	predictive	High
87	File	xxxxxxxxx.xxx	predictive	High
88	File	xxxx-xxx/	predictive	Medium
89	File	xxxxx.xxx	predictive	Medium
90	File	xxxxxxxx_xxxxxxxxx.xxx	predictive	High
91	File	xxxxx.xxx	predictive	Medium
92	File	xxxxxx_xxx.xxx	predictive	High
93	File	xxxxxxx.xxxx	predictive	Medium
94	File	xxxxxx.xxx	predictive	Medium
95	File	xxxxxxxxxx.xxxx	predictive	High
96	File	xx-xxxxx/xxxx.xxx	predictive	High
97	File	xx-xxxxx.xxx	predictive	Medium
98	File	xxxxxx.xxx	predictive	Medium
99	File	xxxxxxxxxxxxx.xxx	predictive	High
100	Library	/xxxxx/xxxxxxxx/xxxxxxx.xxx	predictive	High
101	Library	xxxxxx-xx/xxx/xxx-xxxxxx-xxxxx-xx.xxx	predictive	High
102	Library	xxxxxxx.xxx.xx.xxx	predictive	High
103	Library	xxxxxx.xxx	predictive	Medium
104	Library	xxx/xxx/xxxx/	predictive	High
105	Argument	xxxxxxx	predictive	Low
106	Argument	xxxxxxxx	predictive	Medium
107	Argument	xxxxx	predictive	Low
108	Argument	xxxxxxxx	predictive	Medium
109	Argument	xxx	predictive	Low
110	Argument	xxxxxxx	predictive	Low
111	Argument	xxxxxxxxxxxxx	predictive	High
112	Argument	xxxxxx	predictive	Low
113	Argument	xxxxxxx	predictive	Low
114	Argument	xxxxxxx_xxxx_xxx_xxxxxx	predictive	High
115	Argument	xxxxx	predictive	Low
116	Argument	xxx_xxxx	predictive	Medium
117	Argument	xxxxxxx	predictive	Low
118	Argument	xxxx_xxxxx_xxxx	predictive	High
119	Argument	xxxx	predictive	Low
120	Argument	xx_xx	predictive	Low
121	Argument	xx_xxxx	predictive	Low
122	Argument	xx	predictive	Low
123	Argument	x_xxxxxxx	predictive	Medium
124	Argument	xxxx	predictive	Low
125	Argument	xxxxx	predictive	Low
126	Argument	xx	predictive	Low
127	Argument	xxxxx	predictive	Low
128	Argument	xxx	predictive	Low
129	Argument	xxx_xxx	predictive	Low
130	Argument	xxxxx	predictive	Low
131	Argument	xxxxxxx_xxxx	predictive	Medium
132	Argument	xxxxxx	predictive	Low
133	Argument	xxx	predictive	Low
134	Argument	xxxxxx	predictive	Low
135	Argument	xxxxxxx	predictive	Low
136	Argument	xxxxxxxxx	predictive	Medium
137	Argument	xxx_xx	predictive	Low
138	Argument	xxxx	predictive	Low
139	Argument	xxxxxx	predictive	Low
140	Argument	xxxxx	predictive	Low
141	Argument	xxxx	predictive	Low
142	Argument	xxxx[xx]	predictive	Medium
143	Argument	xxxxx_xxxx_xxxx	predictive	High
144	Argument	xxxxxx	predictive	Low
145	Argument	xxx-xxxxxx	predictive	Medium
146	Argument	xxxxxx/xxxxxx_xxxxxx	predictive	High
147	Argument	xxxxxx_xxxxxx	predictive	High
148	Argument	xxxxxx_xxxxx	predictive	Medium
149	Argument	xxxxxx_xxxx	predictive	Medium
150	Argument	xxxxxxxx	predictive	Medium
151	Argument	xxxx	predictive	Low
152	Argument	xxxx_xx	predictive	Low
153	Argument	xxx	predictive	Low
154	Argument	xxxxx	predictive	Low
155	Argument	xxxxxxx	predictive	Low
156	Argument	xxxxx	predictive	Low
157	Argument	xxxxxxxxx	predictive	Medium
158	Argument	xxxxxxxxxxx	predictive	Medium
159	Argument	xxxxxx	predictive	Low
160	Argument	xxxxxxxx	predictive	Medium
161	Argument	xxxxx/xxxxxx	predictive	Medium
162	Argument	xxx_xxx_xxxxxxxx_xxx	predictive	High
163	Argument	x_xxxxxxxx	predictive	Medium
164	Input Value	x%xx%xx%xxxxxxx%xxxxxxxx%xxxxxxxxxx%xxxxxx%xx%xxxxxxx_xxxxx%xx%xx--%xx%xx	predictive	High
165	Input Value	x+xxxxx+xxxxxx+x,xxxxxxx,xxxxxxxxxxx+xxxx+xxxxx#	predictive	High
166	Input Value	??x:\	predictive	Low
167	Input Value	xxxx -x xxxxxxxx=xxxxxx.xxxxxxx xxxx://xxx.xxx.x.x/xxxxxx.xxx	predictive	High
168	Network Port	xxx/xx (xxx)	predictive	Medium
169	Network Port	xxx/xxxx	predictive	Medium
170	Network Port	xxx xxxxxx xxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!