Orchard Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (824)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	736
fr	22
zh	22
de	12
es	8

Country

us	570
cn	36
ir	6
de	2
ru	2

Actors

Orchard	4
Mirai	3
BumbleBee	3
Cobalt Strike	3
Bashlite	3

Activities

Interest

Timeline

Type

Not Defined	250
WordPress Plugin	54
Content Management System	32
Web Browser	28
Operating System	24

Vendor

Not Defined	198
Google	34
Microsoft	34
Apple	16
IBM	16

Product

Google Chrome	22
Microsoft Windows	16
Apple iOS	8
Apple iPadOS	8
Google Android	8

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	Calculating	High	Workaround	0.00	0.01847	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	2.21	0.00954	CVE-2010-0966
3	jforum User input validation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.00289	CVE-2019-7550
4	jforum cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00165	CVE-2012-5337
5	JForum Login input validation	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.08	0.00181	CVE-2012-5338
6	MGB OpenSource Guestbook email.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.66	0.03468	CVE-2007-0354
7	School Club Application System cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	0.00070	CVE-2022-1288
8	Serendipity exit.php privileges management	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.73	0.00000
9	LogicBoard CMS away.php redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	2.28	0.00000
10	Xintian Smart Table Integrated Management System AddUpdateRole.aspx sql injection	5.5	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	0.00077	CVE-2023-4712
11	Microsoft Windows Server Service unrestricted upload	8.8	8.1	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.04	0.80595	CVE-2022-30216
12	Kamailio SIP Message build_res_buf_from_sip_req input validation	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.87480	CVE-2018-14767
13	HTC One/Sense Mail Client certificate validation	4.8	4.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.09	0.00120	CVE-2013-10001
14	Samsung Smartphone RPMB ldfw buffer overflow	5.3	5.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00044	CVE-2022-23431
15	Apache HTTP Server mod_lua Multipart Parser r:parsebody out-of-bounds write	8.5	8.4	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.03	0.16909	CVE-2021-44790
16	OpenBSD OpenSSH X11 Forwarding 7pk security	9.8	9.1	$25k-$100k	$0-$5k	Unproven	Official Fix	0.04	0.00365	CVE-2016-1908
17	Linux Foundation Xen EFLAGS Register SYSENTER input validation	6.2	5.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.04	0.00062	CVE-2013-1917
18	phpPgAds adclick.php unknown vulnerability	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.40	0.00317	CVE-2005-3791
19	Gallery add_comment.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00414	CVE-2005-0219
20	Esoftpro Online Guestbook Pro ogp_show.php sql injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.07	0.00108	CVE-2009-4935

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Actor	Identified	Type	Confidence
1	45.61.185.36	Orchard	08/05/2022	verified	High
2	45.61.185.231	Orchard	08/05/2022	verified	High
3	XX.XX.XXX.XX	Xxxxxxx	08/05/2022	verified	High
4	XX.XX.XXX.X	Xxxxxxx	08/06/2022	verified	High
5	XX.XX.XXX.XXX	Xxxxxxx	08/05/2022	verified	High
6	XXX.XXX.XXX.XXX	Xxxxxxx	08/05/2022	verified	High

TTP - Tactics, Techniques, Procedures (26)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-21, CWE-22, CWE-23	Pathname Traversal	predictive	High
2	T1040	CWE-294, CWE-319	Authentication Bypass by Capture-replay	predictive	High
3	T1055	CWE-74	Injection	predictive	High
4	T1059	CWE-94, CWE-1321	Cross Site Scripting	predictive	High
5	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
6	T1068	CWE-264, CWE-269, CWE-284	J2EE Misconfiguration: Weak Access Permissions for EJB Methods	predictive	High
7	TXXXX.XXX	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	High
8	TXXXX	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	High
9	TXXXX.XXX	CWE-XXX, CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxx	predictive	High
10	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxxxxxx	predictive	High
11	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
12	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
13	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
14	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
15	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
16	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxx.xxx Xxxxxxxxxxxxxxxx: Xxxxxxxx Xx Xxxxxxxxxxxxx Xxxx	predictive	High
17	TXXXX	CWE-XXX	Xxxxxxxx Xxxxxxxxx Xx X Xxxxxxxxxxx'x Xxxxx Xx Xxxxx	predictive	High
18	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
19	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	High
20	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
21	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	High
22	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx	predictive	High
23	TXXXX	CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxxxxxxxx Xxxxxxx Xxxxxxxxxx	predictive	High
24	TXXXX.XXX	CWE-XXX, CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High
25	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx Xxxxxx	predictive	High
26	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (214)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin.php/news/admin/lists/zhuan	predictive	High
2	File	/admin/bookings/view_details.php	predictive	High
3	File	/admin/edit.php	predictive	High
4	File	/admin/maintenance/view_designation.php	predictive	High
5	File	/admin/profile/save_profile	predictive	High
6	File	/admin/reports.php	predictive	High
7	File	/api/v1/chat.getThreadsList	predictive	High
8	File	/App_Resource/UEditor/server/upload.aspx	predictive	High
9	File	/bin/sh	predictive	Low
10	File	/cgi-bin/luci/api/diagnose	predictive	High
11	File	/classes/conf/db.properties&config=filemanager.config.js	predictive	High
12	File	/coders/palm.c	predictive	High
13	File	/collection/all	predictive	High
14	File	/dcim/rack/	predictive	Medium
15	File	/EditEventTypes.php	predictive	High
16	File	/etc/groups	predictive	Medium
17	File	/file/upload/1	predictive	High
18	File	/formSetPortTr	predictive	High
19	File	/forum/away.php	predictive	High
20	File	/goform/wlanPrimaryNetwork	predictive	High
21	File	/index.php?module=help_pages/pages&entities_id=24	predictive	High
22	File	/it-IT/splunkd/__raw/services/get_snapshot	predictive	High
23	File	/nova/bin/user	predictive	High
24	File	/novel-admin/src/main/java/com/java2nb/common/controller/FileController.java	predictive	High
25	File	/plesk-site-preview/	predictive	High
26	File	/public/admin/profile/update.html	predictive	High
27	File	/xxxxxxxx/xxx	predictive	High
28	File	/xxxx/xxx/x/xxxxxx	predictive	High
29	File	/xxxx/xxxxx/	predictive	Medium
30	File	/xxx/xxx/xxx/xxx_xxxxxx.x	predictive	High
31	File	/xxxxxxxxx/xxxxxxxxxxxxx.xxxx	predictive	High
32	File	/xxxxxx/xxxxxxx.xx	predictive	High
33	File	/xxx	predictive	Low
34	File	/xxxxxxx/	predictive	Medium
35	File	/xxxxxx	predictive	Low
36	File	/xxx/xxxx/xxxxx	predictive	High
37	File	/xxxxxxxx_xxxxx/xxxxxxx/xxxxxx.xxx?x=xxxxxx_xxxxxxxx	predictive	High
38	File	xxx/xxxx_xxxx.xxx	predictive	High
39	File	xxxxxxxxxxxxxxx.xxxx	predictive	High
40	File	xxxxxxx.xxx	predictive	Medium
41	File	xxx_xxxxxxx.xxx	predictive	High
42	File	xxxxx.xxx?xxxx=xxxx-xxxxx	predictive	High
43	File	xxxxx/xxxxxxxxxxxxx/xxxxxx.xxx	predictive	High
44	File	xxxxx/xxxxx.xxx	predictive	High
45	File	xxxxx_xxxxxxx.xxx	predictive	High
46	File	xxxx/xxxxxxxxx.xxx	predictive	High
47	File	xxxxxxxxxxxxxxx.xxx	predictive	High
48	File	xxxxxxxxxxx.xxx	predictive	High
49	File	xxx/xxxxxx/xxxx.xx	predictive	High
50	File	xxx\xxxxxx\xxxxxxxxxx\xxxxxxxxxxxxxxxxxx.xxxxx.xxx	predictive	High
51	File	x/xx/xxxxx/xxxxxxxx.x	predictive	High
52	File	x:\xxxxxxx xxxxx (xxx)\xxxxxxxxxxxxx\xxxxxx.xxx	predictive	High
53	File	xxxxxxxxxxxxxx.xxx	predictive	High
54	File	xxxxxxxxx.xxx	predictive	High
55	File	xxxxxx.xxx	predictive	Medium
56	File	xxxxxxx/xxxxx-xxx-xxxxxxxx.xxx	predictive	High
57	File	xxx.xxxxxxx.xxxxxx.xxx.xxxxxxxxxxxxx.xxxx	predictive	High
58	File	xxxxxxx_xxx.xxx	predictive	High
59	File	xxxxxxxxxxx.x	predictive	High
60	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
61	File	xxxxxxxxxxxxxxxxxxxxxxx.xx	predictive	High
62	File	xxxxxxxxxxxxxxx.xxxx	predictive	High
63	File	xxxx_xxx.xxx	predictive	Medium
64	File	xxxx/xxxxx.xx	predictive	High
65	File	xxxxxxxxxxx.xxx	predictive	High
66	File	xxxxxxx/xxx/xxxx/xxxx.x	predictive	High
67	File	xxxxx.xxx	predictive	Medium
68	File	xxxxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	High
69	File	xxxx.xxx	predictive	Medium
70	File	xxxxxxxx/xxxx.xx	predictive	High
71	File	xxxx_xxxxxxx.x	predictive	High
72	File	xxx.xxx	predictive	Low
73	File	xxxx.xxx	predictive	Medium
74	File	xxxxxxxxx.xxx	predictive	High
75	File	xxxxxxxxxxxxxxxxx.xxx	predictive	High
76	File	xxx/xxxxxx.xxx	predictive	High
77	File	xxx/xxxxxxxxxxx/xxxxxxx.xxx	predictive	High
78	File	xxx/xxxxxxx/xxxxxxxxxxxxx/xxxxx.xxx	predictive	High
79	File	xxxxxxxx/xxxxx-xx-xxxxxxxxx.xxx	predictive	High
80	File	xxxxx.xxx	predictive	Medium
81	File	xxxxxx/xxxxxx/xxx_x.xxx	predictive	High
82	File	xx_xxxxx.xxx	predictive	Medium
83	File	xxx/xxxxxxx/xxxx/xxxxxxx_xxxx.xx	predictive	High
84	File	xxx/xxxxxxxxxx/xxxxxxx/xxxxxxx_xxxxxxxxx.xx	predictive	High
85	File	xxxxxxxxxxxx.xx	predictive	High
86	File	xxxxxxxxxxxxxx.xxx	predictive	High
87	File	xxxxxxxxxxxxxxxx.x	predictive	High
88	File	xxxxxxx/xxxxxxx/xxxxxx/xxxxxxxxx_xxxxxxx.xxx	predictive	High
89	File	xxxxxxxx.xxx	predictive	Medium
90	File	xxx_xxxx.xxx	predictive	Medium
91	File	xxxxxxx.xxxx	predictive	Medium
92	File	xxxxx/xxxxxxxxxxx/xxxxxxxxxx_xxxxxxxxxxx.xxx	predictive	High
93	File	xxxxxxx/x/x?xxxx=x&xxxxx=x&	predictive	High
94	File	xxxxxxxxx.xxx	predictive	High
95	File	xxxxx.xxx	predictive	Medium
96	File	xxxxx.xxx	predictive	Medium
97	File	xxxxxxxxxx.xxx	predictive	High
98	File	xxxxxxxx.xxx	predictive	Medium
99	File	xxxxxxxx.xxx?xxxx=xxxxxxxxxxx	predictive	High
100	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	predictive	High
101	File	xxxxxx.x	predictive	Medium
102	File	xxxx_xxxxxx.xxx	predictive	High
103	File	xxxxxxxxxx_xxxxx.xxxxxx	predictive	High
104	File	xxx.xxxxx/xxxxxxx/xxxxxx_xxxxx.xxx	predictive	High
105	File	xxxxxxxxxx/xxxx_xxxxxxxxxx.x	predictive	High
106	File	xxxx-xxx/xxxxxxxx.xxx?xxxx=xxxxxxxxx_xxxxxxx.xxx	predictive	High
107	File	xxxx-xxx/xxxxxxxx.xxx?xxxx=xxx_xxxxxxxx.xxx	predictive	High
108	File	xxxxxxxxxxxxxxxxx.xxxx	predictive	High
109	File	xxxx.xxx	predictive	Medium
110	File	xxxxxxxxxxxxx.xx	predictive	High
111	File	xxxxxxxxxxxxxxxxxx.xxxx	predictive	High
112	File	xxxx-xxxxx.xxx	predictive	High
113	File	xxxx/xxxxxxxxxxxxxxxx.xx	predictive	High
114	File	xxxxxx_xxxxxxxxxxxxx_xxxx.xxx	predictive	High
115	File	xxxxxx.x	predictive	Medium
116	File	xxx-xxxxx.xxx	predictive	High
117	File	xxxxxx/xxxxxxxxxxx/xxxx_xxxxxx.xxx	predictive	High
118	File	xx-xxxxx/xxxxx-xxxx.xxx	predictive	High
119	File	xx-xxxxxxxxxxx.xxx	predictive	High
120	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	High
121	File	xx-xxxxxxxx.xxx	predictive	High
122	File	\xxxxx\xxxxxxxxx_xxxx.xxx	predictive	High
123	File	~/xxxxxxxx/xxxxx-xx-xxxxxxxxxx-xxxx.xxx	predictive	High
124	File	~/xxxxxxxx/xxxxxxxx/xxxxxx/xxxx/xxxx/xxxxxxxx.xxx	predictive	High
125	File	~/xxx-xxx-xxxx.xxx	predictive	High
126	File	~/xxxx	predictive	Low
127	Library	/xxx/xxx/xxxxxx/xxxxx/xxxxxxxxxx.xxxxx.xxx	predictive	High
128	Library	xx_xxxxxx.xxx	predictive	High
129	Library	xxxxxx.xxx	predictive	Medium
130	Library	xxxxxxxxxxxxxx.xxx	predictive	High
131	Library	xxxxxx.xx	predictive	Medium
132	Library	xxxxxxxxxxxxxxx.xxx	predictive	High
133	Library	xxxxxxx.xxx	predictive	Medium
134	Argument	$_xxxxxx["xxx_xxxx"]	predictive	High
135	Argument	xxxxxx	predictive	Low
136	Argument	xxx xxxxxxxx	predictive	Medium
137	Argument	xxxxxxxxxxxxxxxx.xxxxxxxxxxx	predictive	High
138	Argument	xxxxxxxx	predictive	Medium
139	Argument	xxxxxxxx	predictive	Medium
140	Argument	xxxxx_xxxxxxxxxxx	predictive	High
141	Argument	xxxxxxx-xxxxx	predictive	High
142	Argument	xxxxx	predictive	Low
143	Argument	xxxxxxxx	predictive	Medium
144	Argument	xxxxxxx	predictive	Low
145	Argument	xxxxxxxxxxx_xxx_xxxx	predictive	High
146	Argument	xxxxxxx/xxxxxxx/xxxxxxx_xxxxxxxxxx/xxxxxxx_xxxxxx/xxxxxxxx/xxxx_xxxxx	predictive	High
147	Argument	xxxxxxx	predictive	Low
148	Argument	xxxxxxx_xxxx_xxxx	predictive	High
149	Argument	xx	predictive	Low
150	Argument	xxxxxxxx	predictive	Medium
151	Argument	xxxxxxx	predictive	Low
152	Argument	x-xxxx	predictive	Low
153	Argument	xx_xxxx	predictive	Low
154	Argument	xxxxxx	predictive	Low
155	Argument	xxx_xxxx_xxxx	predictive	High
156	Argument	xxxx	predictive	Low
157	Argument	xxxx/xxxxx	predictive	Medium
158	Argument	xxxxx xxxxxxx	predictive	High
159	Argument	xxxxxxxxx	predictive	Medium
160	Argument	xx	predictive	Low
161	Argument	xxxx_xxxxx	predictive	Medium
162	Argument	xxxxxxxx	predictive	Medium
163	Argument	xx	predictive	Low
164	Argument	xxx	predictive	Low
165	Argument	xxxxxxxx	predictive	Medium
166	Argument	xx	predictive	Low
167	Argument	xxxxxxxxxxxxxx.xxxxxxxxxxxxx	predictive	High
168	Argument	xxxxxx	predictive	Low
169	Argument	xxxxxxx_xx	predictive	Medium
170	Argument	xxxxxxxxxxxxxx	predictive	High
171	Argument	xxxxxx	predictive	Low
172	Argument	xxxxxxxxxx	predictive	Medium
173	Argument	xxxxxx xxx xxxxxx(x)	predictive	High
174	Argument	xxxx	predictive	Low
175	Argument	xxxx	predictive	Low
176	Argument	xxxxxxxx	predictive	Medium
177	Argument	xx	predictive	Low
178	Argument	xxxxxxx	predictive	Low
179	Argument	xxxxxxx	predictive	Low
180	Argument	xxxx	predictive	Low
181	Argument	xxxxxxxx	predictive	Medium
182	Argument	xxxxxxx_xxxx	predictive	Medium
183	Argument	xxxxxxxx	predictive	Medium
184	Argument	xxxx-xxxxxxx	predictive	Medium
185	Argument	xxxxx	predictive	Low
186	Argument	xxxxxxxxxxxx_xxxxxxxxx	predictive	High
187	Argument	xxxxxxxx	predictive	Medium
188	Argument	xxxxxxxxxx	predictive	Medium
189	Argument	xxxxxxx	predictive	Low
190	Argument	xxxxxx/xxxxxx_xxxxxx	predictive	High
191	Argument	xxxxxxxx	predictive	Medium
192	Argument	xxxxxxxxxxxxxxxxxxxx	predictive	High
193	Argument	xxxxxx	predictive	Low
194	Argument	xxxx_xxxx	predictive	Medium
195	Argument	xxxxxxxxxxxx/xxxxxxxxxxxxxxxx	predictive	High
196	Argument	xxx	predictive	Low
197	Argument	xxx	predictive	Low
198	Argument	xxxxxxxxxxxxxxxxxx/xxxxxxxxxxxxxxxxx	predictive	High
199	Argument	xxxx	predictive	Low
200	Argument	xxxxx	predictive	Low
201	Argument	xx	predictive	Low
202	Argument	xxxxx	predictive	Low
203	Argument	xxxxxxxxxxx	predictive	Medium
204	Argument	xxx	predictive	Low
205	Argument	xxx	predictive	Low
206	Argument	xxxx_xxxxx	predictive	Medium
207	Argument	xx_xxxx	predictive	Low
208	Argument	主题	predictive	Low
209	Input Value	%xx%xx%xxxxx%xxxxx=x%xxxxxxxxx=xxxxx(x)%xx	predictive	High
210	Input Value	<xxxxxxxx>\x	predictive	Medium
211	Input Value	<xxxxxx>xxxxx(x)</xxxxxx>	predictive	High
212	Input Value	><xxxxxx>xxxxx(x)</xxxxxx>	predictive	High
213	Input Value	xxx://xxxxxx/xxxx=xxxxxxx.xxxxxx-xxxxxx/xxxxxxxx=xxxxx_xxxxx	predictive	High
214	Network Port	xxx/xxxx	predictive	Medium

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!