PakistanChatMessenger Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (341)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	308
es	14
ru	8
de	4
pt	2

Country

US: USA	232
NL: Netherland	6
DE: Germany	4
GB: Great Britain	2
RU: Russia	2

Actors

PakistanChatMessenger	3
Lazarus	2
Cobalt Strike	2
Conti	2
Silence	1

Activities

Interest

Timeline

Type

Not Defined	138
Content Management System	26
Smartphone Operating System	26
Multimedia Player Software	22
Operating System	20

Vendor

Not Defined	108
Apple	40
Adobe	26
SourceCodester	14
IBM	12

Product

Apple iOS	26
Adobe Flash Player	20
Apple Mac OS X	14
WordPress	12
PHP	8

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Foxit PDF Reader exportXFAData Local Privilege Escalation	5.3	5.1	$0-$5k	Calculating	Not Defined	Official Fix	0.00198	0.05	CVE-2023-27363
2	php-revista articulo.php sql injection	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01900	0.03	CVE-2006-4608
3	SourceCodester Facebook News Feed Like Post unrestricted upload	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00091	0.04	CVE-2024-1027
4	Tongda OA 2017 delete.php sql injection	6.9	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00063	0.00	CVE-2023-6885
5	D-Link DAR-7000 workidajax.php sql injection	6.9	6.8	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00063	0.04	CVE-2023-6581
6	Totolink X5000R cstecgi.cgi setWizardCfg os command injection	6.9	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00074	0.08	CVE-2023-6612
7	SourceCodester Online Exam System GET Parameter updateCourse.php sql injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00164	0.08	CVE-2023-2642
8	Simple File List Plugin ee-downloader.php path traversal	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.37939	0.05	CVE-2022-1119
9	Quirm SAXON Error Message news.php information disclosure	5.3	4.6	$0-$5k	$0-$5k	Unproven	Official Fix	0.00838	0.00	CVE-2007-4861
10	DouPHP article.php cross site scripting	4.1	4.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00047	0.00	CVE-2023-30205
11	Solidweb Novus notas.asp sql injection	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00147	0.00	CVE-2007-5123
12	Synacor Zimbra Webmail Subsystem upload unrestricted upload	6.7	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00466	0.07	CVE-2020-12846
13	IBM HTTP Server memory corruption	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00359	0.00	CVE-2015-4947
14	WordPress WP_Query class-wp-query.php sql injection	8.5	8.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00318	0.06	CVE-2017-5611
15	GPAC MP4Box isoffin_read.c isoffin_process infinite loop	3.3	3.1	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00044	0.04	CVE-2024-6061
16	Emerson Dixell XWEB-500 logo_extra_upload.cgi access control	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.07334	0.06	CVE-2021-45420
17	Filseclab Twister Antivirus IoControlCode ffsmon.sys 0x220017 denial of service	4.8	4.6	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00042	0.08	CVE-2023-0907
18	Campcodes Complete Web-Based School Management System show_student1.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.09	CVE-2024-4906
19	Campcodes Online Laundry Management System manage_laundry.php sql injection	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.26	CVE-2024-4793
20	Campcodes Legal Case Management System expense-type cross site scripting	3.5	3.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00045	0.22	CVE-2024-4729

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	5.2.78.240		PakistanChatMessenger	05/31/2021	verified	Low
2	XX.XXX.XXX.XXX	xx-xxx-xxx.xxxxxxxx.xxxx	Xxxxxxxxxxxxxxxxxxxxx	05/31/2021	verified	Low
3	XXX.XXX.XX.XX		Xxxxxxxxxxxxxxxxxxxxx	05/31/2021	verified	Low
4	XXX.XX.XXX.XXX		Xxxxxxxxxxxxxxxxxxxxx	05/31/2021	verified	Low

TTP - Tactics, Techniques, Procedures (22)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22, CWE-24	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
4	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
5	T1068	CAPEC-122	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	High
6	TXXXX.XXX	CAPEC-16	CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
7	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
8	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
9	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
10	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-492	CWE-XXXX	Xxxxxxxxxxx Xxxxxxx Xxxxxxxxxx Xxxxxxxxxx	predictive	High
12	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
13	TXXXX	CAPEC-50	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
14	TXXXX	CAPEC-37	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
15	TXXXX	CAPEC-38	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
16	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
17	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	High
18	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
19	TXXXX.XXX	CAPEC-	CWE-XX	Xxxxxxxxxxxxx	predictive	High
20	TXXXX	CAPEC-112	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
21	TXXXX.XXX	CAPEC-	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High
22	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (197)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/?g=log_import_save	predictive	High
2	File	/admin/about-us.php	predictive	High
3	File	/admin/article.php	predictive	High
4	File	/admin/countrymanagement.php	predictive	High
5	File	/admin/expense-type	predictive	High
6	File	/admin/transactions/track_shipment.php	predictive	High
7	File	/admin/user/manage_user.php	predictive	High
8	File	/administration/settings_registration.php	predictive	High
9	File	/ajax-files/postComment.php	predictive	High
10	File	/application/index/controller/File.php	predictive	High
11	File	/application/index/controller/Screen.php	predictive	High
12	File	/application/websocket/controller/Setting.php	predictive	High
13	File	/auth/auth.php?user=1	predictive	High
14	File	/blog	predictive	Low
15	File	/categorypage.php	predictive	High
16	File	/cgi-bin/cstecgi.cgi	predictive	High
17	File	/cgi-bin/cstecgi.cgi?action=login	predictive	High
18	File	/cgi-bin/logo_extra_upload.cgi	predictive	High
19	File	/classes/Master.php	predictive	High
20	File	/collection/all	predictive	High
21	File	/general/email/outbox/delete.php	predictive	High
22	File	/home.php	predictive	Medium
23	File	/list_temp_photo_pin_upload.php	predictive	High
24	File	/login	predictive	Low
25	File	/manage_laundry.php	predictive	High
26	File	/manage_receiving.php	predictive	High
27	File	/xxxx/xxx/xxxxxx	predictive	High
28	File	/xxxxx.xxx	predictive	Medium
29	File	/xxxxxxxxx.xxx	predictive	High
30	File	/xxxxxxx/xxxxxx	predictive	High
31	File	/xxxxxxxx/xxxx/xxxxxxxx	predictive	High
32	File	/xxxx_xxxxx_xxxxxxx.xxx	predictive	High
33	File	/xxxx/xxx/xxxx	predictive	High
34	File	/xxxx/xxx/xxxxxxxxxx.xxx	predictive	High
35	File	/xxxx/xxxxxxx	predictive	High
36	File	/xxxx/xxxxxx/xxxxxx	predictive	High
37	File	/xxxx/xxxxx_xxxxx_xxxx.xxx	predictive	High
38	File	/xxxx/xxxx_xxxxxxxx.xxx	predictive	High
39	File	/xxxx/?xxxx=xxxxxx_xxxxxxx	predictive	High
40	File	xxxxx/xxxxxxx.xxx	predictive	High
41	File	xxxxxxxxxx/xxxxx/xxxxxxx_xxxxx/xxxxxxxxxxxx.xxx	predictive	High
42	File	xxxxx\xxxxx\xxxxxxx\xxxxxxxx.xxx	predictive	High
43	File	xxxxxxxxxxx/xxxxxxxxxxx/xxxxxxxx.xxx	predictive	High
44	File	xxxxxxxx.xxx	predictive	Medium
45	File	xxx_xxxxxxx.xxx	predictive	High
46	File	xxxxxxx.xxx	predictive	Medium
47	File	xxxxx.xxx	predictive	Medium
48	File	xxxx/xxx_xxxxxx.x	predictive	High
49	File	xxxx-xxx.xxx	predictive	Medium
50	File	xxxxxxxx.xxx	predictive	Medium
51	File	xxxxxxxxxx.xxx	predictive	High
52	File	xxxxxxxxxx/xxxxxxx.xxxx	predictive	High
53	File	xxxxxx/xxxx.x	predictive	High
54	File	xxxxxx/xxx.x	predictive	Medium
55	File	xxx.xxx.xxxx	predictive	Medium
56	File	xxxxxxx.xxx	predictive	Medium
57	File	xxxxxx/xxxxx/xxxxxxx.x	predictive	High
58	File	xxxxxxx.xxx	predictive	Medium
59	File	xxxxxx.xxx	predictive	Medium
60	File	xxxx_xxx.xxx	predictive	Medium
61	File	xxxxxxxxxx_xxxxxx.xxx	predictive	High
62	File	xxxx.xxx	predictive	Medium
63	File	xxxxx_xxxxx.xxx	predictive	High
64	File	xxxx_xxxxxxxx_xxxxxxxxx.x	predictive	High
65	File	xxxxxxxxx.xxx	predictive	High
66	File	xxxxxxx.xxx	predictive	Medium
67	File	xxxxxxx/xxxx/xxxxxx/xxxxxx.xxx	predictive	High
68	File	xxx_xxxx.xxx	predictive	Medium
69	File	xxxxxx/xxxxx_xxxx_xxxxxxx	predictive	High
70	File	xxxxx_xxxxxxxxx.xxx	predictive	High
71	File	xxxx.xxxx.xxx	predictive	High
72	File	xxxxxxxxxxx.x	predictive	High
73	File	xxxxxx_xxxxxxx.xxxx	predictive	High
74	File	xxxxxxxxxxxx.xxx	predictive	High
75	File	xxx/xxxxx/xxxxx.xxxx.xxx	predictive	High
76	File	xxxxxxxx/xxxxx-xxxxxxxxxx-xxxx.xxx	predictive	High
77	File	xxxxx.xxx	predictive	Medium
78	File	xxxxx.xxx?xxxxxx=xxx&xxxxxx=xxxx&x=xxxxxx	predictive	High
79	File	xxxxx/xxxxx.xxx	predictive	High
80	File	x_xxxxxxxx_xxxxx	predictive	High
81	File	xxxxxxxxxx/xxxx.x	predictive	High
82	File	xxxxxxx/xxxxxxx.x	predictive	High
83	File	xxxxx.xxx	predictive	Medium
84	File	xxxxxxxxxx.xxx	predictive	High
85	File	xxxxxxxxxxxxxx.xxx	predictive	High
86	File	xxxx/xxx_xxxxxxxxx.x	predictive	High
87	File	xxxxxx_xxxxxx.xxx	predictive	High
88	File	xxxxxxxx_xxxx.xxx	predictive	High
89	File	xxxxxxxxxxx/xxxxxxxxx/xxxxxxxxx/xxxxxxx/xxxxxx.xxx	predictive	High
90	File	xx.xxxxxxxxxx.xxxx	predictive	High
91	File	xxx/xxxx/xxx_xxxxxxxxx.x	predictive	High
92	File	xxxx.xxx	predictive	Medium
93	File	xxxxx.xxx	predictive	Medium
94	File	xxxxxxxx-xxxxxxxx.xxx	predictive	High
95	File	xxxxxx_xxxxxxxxxx_xxxxx.xxx	predictive	High
96	File	xxxxx.xxx	predictive	Medium
97	File	xxxx.xxx	predictive	Medium
98	File	xxxxxx.xxx	predictive	Medium
99	File	xxxxxxxx/xxxxxx_xxxxxxxx.xxx	predictive	High
100	File	xxxxxxxx.x	predictive	Medium
101	File	xxxx_xxxxxxx_xxxxxxx.xxx	predictive	High
102	File	xxx/xxxxxxx/xxxxxxx_xxxx.x	predictive	High
103	File	xxx/xxx.xxxxxxx/xxxxxxxx.xxx	predictive	High
104	File	xxx/xxxx/xxxx/xxx/xxx/xxx/xxxxxxxxxx/xxxxxxxxxxxxxx.xxxx	predictive	High
105	File	xxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxx_xxx.xxxx	predictive	High
106	File	xxxxx.x	predictive	Low
107	File	xx_xxxxxx.xxx	predictive	High
108	File	xxxx.xxx	predictive	Medium
109	File	xx-xxxxx/xxxxxxxx/xxxxx-xx-xxxxxx.xxx	predictive	High
110	File	xx-xxxxx/xxxxxx-xxxx.xxx	predictive	High
111	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
112	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
113	File	xx-xxxxxxxx/xx-xxxxxxxxx.xxx	predictive	High
114	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	High
115	File	xx-xxxx.xxx	predictive	Medium
116	File	xxxx/xxxxxxx/xxxxxxxxxxxxxx	predictive	High
117	File	~/xxxxxxxx/xx-xxxxxxxxxx.xxx	predictive	High
118	Library	xxxxxxxx/xxxxxxx/xxx.xxx	predictive	High
119	Library	xxxxxx.xxx	predictive	Medium
120	Library	xxxxxxxxxx.xxx	predictive	High
121	Library	xxx/xxxxx.xxx	predictive	High
122	Library	xxx/xxxxxx.xxx	predictive	High
123	Library	xxx/xxxxxxxx.xx	predictive	High
124	Library	xxx/xxxxxxxxxxxxxxxx.xxx	predictive	High
125	Library	xxxx/xxxxxxxxxxxx/xxxxx/xxxxx.xx	predictive	High
126	Argument	xxxxxxx	predictive	Low
127	Argument	xxxxxxxx	predictive	Medium
128	Argument	xxxxx	predictive	Low
129	Argument	xxx	predictive	Low
130	Argument	xxxxxxxx	predictive	Medium
131	Argument	xxx	predictive	Low
132	Argument	xxxxx	predictive	Low
133	Argument	xxxx_xx	predictive	Low
134	Argument	xxxxxxx	predictive	Low
135	Argument	xxxxxxx/xxxxxx	predictive	High
136	Argument	xxxxxxx/xxxxxxxxxxx	predictive	High
137	Argument	xxxxxxxxx=xxxx	predictive	High
138	Argument	xxxxx	predictive	Low
139	Argument	xxxxxx_xxx	predictive	Medium
140	Argument	xxx	predictive	Low
141	Argument	x_xxx	predictive	Low
142	Argument	xxxxxx	predictive	Low
143	Argument	xxxxxx	predictive	Low
144	Argument	xxxxx	predictive	Low
145	Argument	xxxx	predictive	Low
146	Argument	xxxxxxxx	predictive	Medium
147	Argument	xxxxx_xxxx	predictive	Medium
148	Argument	xxxx	predictive	Low
149	Argument	xx_xxxxxxxx	predictive	Medium
150	Argument	xxx	predictive	Low
151	Argument	xxxxx	predictive	Low
152	Argument	xxxx_xxxx	predictive	Medium
153	Argument	xx	predictive	Low
154	Argument	xxxxx	predictive	Low
155	Argument	xx_xxxxxxxx	predictive	Medium
156	Argument	xx_xxxxx	predictive	Medium
157	Argument	xxxxxxxxxx	predictive	Medium
158	Argument	x_xxxxxxxx	predictive	Medium
159	Argument	xxxxxxxx	predictive	Medium
160	Argument	xxxx x xxxx	predictive	Medium
161	Argument	xxxxxxx	predictive	Low
162	Argument	xxxx	predictive	Low
163	Argument	xxxx/xxxxxxx	predictive	Medium
164	Argument	xxx_xxxxxxxx	predictive	Medium
165	Argument	xxxxxx	predictive	Low
166	Argument	xxxx_xx	predictive	Low
167	Argument	xxxx	predictive	Low
168	Argument	xxxxxxx	predictive	Low
169	Argument	xxxxxxxx/xxxx/xxxxx/xxxx/xxxxxxxxx/xxxxxxxxxxxx/xx	predictive	High
170	Argument	xxxxxxx	predictive	Low
171	Argument	xxx	predictive	Low
172	Argument	xxxxxxx_xxxxxxx	predictive	High
173	Argument	xxxxxxxxxxxx	predictive	Medium
174	Argument	xxxxxxx	predictive	Low
175	Argument	xxxxxxx_xxx	predictive	Medium
176	Argument	xxxxxx	predictive	Low
177	Argument	xxx	predictive	Low
178	Argument	xxx_xxxx	predictive	Medium
179	Argument	xxxxx	predictive	Low
180	Argument	xxxxx	predictive	Low
181	Argument	xxx	predictive	Low
182	Argument	xxxxxxx_xx	predictive	Medium
183	Argument	xxxx	predictive	Low
184	Argument	xxxxx	predictive	Low
185	Argument	xxxxx	predictive	Low
186	Argument	xxxxxx_xx	predictive	Medium
187	Argument	xxx	predictive	Low
188	Argument	xxxxxxxx	predictive	Medium
189	Input Value	"><xxx xxx=x xxxxxxx=xxxxxx(x)>	predictive	High
190	Input Value	'"--></xxxxx></xxxxxx><xxxxxx>xxxxx(x)</xxxxxx>	predictive	High
191	Input Value	' xxx (xxxxxx xxxx xxxx(xxxxxx xxxxx(),xxxxxx(xxxxxxxxxxxx,(xxxxxx (xxx(xxxx=xxxx,x))),xxxxxxxxxxxx,xxxxx(xxxx(x)x))x xxxx xxxxxxxxxxx_xxxxxx.xxxxxxxxx_xxxx xxxxx xx x)x) xxx 'xxxx'='xxxx	predictive	High
192	Input Value	' xx 'x'='x	predictive	Medium
193	Input Value	../	predictive	Low
194	Input Value	<xxx xxx=x xxxxxxx=xxxxxx(x)>	predictive	High
195	Input Value	xxx	predictive	Low
196	Network Port	xxx/xxxxx	predictive	Medium
197	Network Port	xxx xxxxxx xxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!