PakistanChatMessenger Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (322)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	270
es	26
ru	10
ja	10
de	4

Country

us	222
de	4
cn	2
ru	2
nl	2

Actors

PakistanChatMessenger	3
Lazarus	2
Cobalt Strike	2
Conti	2
Silence	1

Activities

Interest

Timeline

Type

Not Defined	124
Content Management System	34
Operating System	24
Multimedia Player Software	18
Programming Language Software	18

Vendor

Not Defined	96
Apple	34
Adobe	24
SourceCodester	18
IBM	12

Product

Adobe Flash Player	18
Apple iOS	16
Apple Mac OS X	14
WordPress	14
PHP	8

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Foxit PDF Reader exportXFAData Local Privilege Escalation	5.3	5.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00000	CVE-2023-27363
2	php-revista articulo.php sql injection	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.01900	CVE-2006-4608
3	SourceCodester Facebook News Feed Like Post unrestricted upload	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00091	CVE-2024-1027
4	Tongda OA 2017 delete.php sql injection	6.9	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.08	0.00063	CVE-2023-6885
5	D-Link DAR-7000 workidajax.php sql injection	6.9	6.8	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00063	CVE-2023-6581
6	Totolink X5000R cstecgi.cgi setWizardCfg os command injection	6.9	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00138	CVE-2023-6612
7	SourceCodester Online Exam System GET Parameter updateCourse.php sql injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	0.00063	CVE-2023-2642
8	Simple File List Plugin ee-downloader.php path traversal	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.42222	CVE-2022-1119
9	Quirm SAXON Error Message news.php information disclosure	5.3	4.6	$0-$5k	Calculating	Unproven	Official Fix	0.00	0.00796	CVE-2007-4861
10	DouPHP article.php cross site scripting	4.1	4.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00046	CVE-2023-30205
11	Solidweb Novus notas.asp sql injection	7.3	7.1	$0-$5k	Calculating	High	Unavailable	0.03	0.00079	CVE-2007-5123
12	Synacor Zimbra Webmail Subsystem upload unrestricted upload	6.7	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00466	CVE-2020-12846
13	IBM HTTP Server memory corruption	6.3	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.00359	CVE-2015-4947
14	WordPress WP_Query class-wp-query.php sql injection	8.5	8.4	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.00318	CVE-2017-5611
15	Totolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflow	9.8	9.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.03	0.00045	CVE-2024-1783
16	Tongda OA 2017 delete.php sql injection	5.5	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.07	0.00063	CVE-2024-1251
17	openBI Icon Screen.php uploadIcon unrestricted upload	8.1	7.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00253	CVE-2024-1036
18	openBI File.php uploadFile unrestricted upload	8.1	7.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00063	CVE-2024-1034
19	openBI Setting.php dlfile os command injection	8.1	7.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00055	CVE-2024-1115
20	Totolink LR1200GB cstecgi.cgi setParentalRules stack-based overflow	9.1	8.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.05	0.00084	CVE-2024-0574

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	5.2.78.240		PakistanChatMessenger	05/31/2021	verified	High
2	XX.XXX.XXX.XXX	xx-xxx-xxx.xxxxxxxx.xxxx	Xxxxxxxxxxxxxxxxxxxxx	05/31/2021	verified	High
3	XXX.XXX.XX.XX		Xxxxxxxxxxxxxxxxxxxxx	05/31/2021	verified	High
4	XXX.XX.XXX.XXX		Xxxxxxxxxxxxxxxxxxxxx	05/31/2021	verified	High

TTP - Tactics, Techniques, Procedures (21)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22, CWE-24	Path Traversal	predictive	High
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CWE-94	Argument Injection	predictive	High
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
5	T1068	CWE-264, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	High
6	TXXXX.XXX	CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
9	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
10	TXXXX	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
11	TXXXX.XXX	CWE-XXXX	Xxxxxxxxxxx Xxxxxxx Xxxxxxxxxx Xxxxxxxxxx	predictive	High
12	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
13	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
14	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
15	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
16	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
17	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	High
18	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
19	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	High
20	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
21	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (182)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin/about-us.php	predictive	High
2	File	/admin/article.php	predictive	High
3	File	/admin/countrymanagement.php	predictive	High
4	File	/admin/transactions/track_shipment.php	predictive	High
5	File	/admin/user/manage_user.php	predictive	High
6	File	/administration/settings_registration.php	predictive	High
7	File	/ajax-files/postComment.php	predictive	High
8	File	/application/index/controller/File.php	predictive	High
9	File	/application/index/controller/Screen.php	predictive	High
10	File	/application/websocket/controller/Setting.php	predictive	High
11	File	/auth/auth.php?user=1	predictive	High
12	File	/blog	predictive	Low
13	File	/categorypage.php	predictive	High
14	File	/cgi-bin/cstecgi.cgi	predictive	High
15	File	/cgi-bin/cstecgi.cgi?action=login	predictive	High
16	File	/classes/Master.php	predictive	High
17	File	/collection/all	predictive	High
18	File	/general/email/outbox/delete.php	predictive	High
19	File	/home.php	predictive	Medium
20	File	/list_temp_photo_pin_upload.php	predictive	High
21	File	/login	predictive	Low
22	File	/nova/bin/detnet	predictive	High
23	File	/print.php	predictive	Medium
24	File	/searchpin.php	predictive	High
25	File	/xxxxxxx/xxxxxx	predictive	High
26	File	/xxxxxxxx/xxxx/xxxxxxxx	predictive	High
27	File	/xxxx_xxxxx_xxxxxxx.xxx	predictive	High
28	File	/xxxx/xxx/xxxx	predictive	High
29	File	/xxxx/xxx/xxxxxxxxxx.xxx	predictive	High
30	File	/xxxx/xxxxxxx	predictive	High
31	File	/xxxx/xxxxxx/xxxxxx	predictive	High
32	File	/xxxx/?xxxx=xxxxxx_xxxxxxx	predictive	High
33	File	xxxxx/xxxxxxx.xxx	predictive	High
34	File	xxxxxxxxxx/xxxxx/xxxxxxx_xxxxx/xxxxxxxxxxxx.xxx	predictive	High
35	File	xxxxx\xxxxx\xxxxxxx\xxxxxxxx.xxx	predictive	High
36	File	xxxxxxxxxxx/xxxxxxxxxxx/xxxxxxxx.xxx	predictive	High
37	File	xxxxxxxx.xxx	predictive	Medium
38	File	xxx_xxxxxxx.xxx	predictive	High
39	File	xxxxxxx.xxx	predictive	Medium
40	File	xxxxx.xxx	predictive	Medium
41	File	xxxx/xxx_xxxxxx.x	predictive	High
42	File	xxxx-xxx.xxx	predictive	Medium
43	File	xxxxxxxx.xxx	predictive	Medium
44	File	xxxxxxxxxx.xxx	predictive	High
45	File	xxxxxxxxxx/xxxxxxx.xxxx	predictive	High
46	File	xxxxxx/xxxx.x	predictive	High
47	File	xxxxxx/xxx.x	predictive	Medium
48	File	xxx.xxx.xxxx	predictive	Medium
49	File	xxxxxxx.xxx	predictive	Medium
50	File	xxxxxx/xxxxx/xxxxxxx.x	predictive	High
51	File	xxxxxxx.xxx	predictive	Medium
52	File	xxxxxx.xxx	predictive	Medium
53	File	xxxx_xxx.xxx	predictive	Medium
54	File	xxxxxxxxxx_xxxxxx.xxx	predictive	High
55	File	xxxx.xxx	predictive	Medium
56	File	xxxxx_xxxxx.xxx	predictive	High
57	File	xxxx_xxxxxxxx_xxxxxxxxx.x	predictive	High
58	File	xxxxxxxxx.xxx	predictive	High
59	File	xxxxxxx.xxx	predictive	Medium
60	File	xxxxxxx/xxxx/xxxxxx/xxxxxx.xxx	predictive	High
61	File	xxx_xxxx.xxx	predictive	Medium
62	File	xxxxxx/xxxxx_xxxx_xxxxxxx	predictive	High
63	File	xxxxx_xxxxxxxxx.xxx	predictive	High
64	File	xxxx.xxxx.xxx	predictive	High
65	File	xxxxxxxxxxx.x	predictive	High
66	File	xxxxxx_xxxxxxx.xxxx	predictive	High
67	File	xxxxxxxxxxxx.xxx	predictive	High
68	File	xxx/xxxxx/xxxxx.xxxx.xxx	predictive	High
69	File	xxxxxxxx/xxxxx-xxxxxxxxxx-xxxx.xxx	predictive	High
70	File	xxxxx.xxx	predictive	Medium
71	File	xxxxx.xxx?xxxxxx=xxx&xxxxxx=xxxx&x=xxxxxx	predictive	High
72	File	xxxxx/xxxxx.xxx	predictive	High
73	File	x_xxxxxxxx_xxxxx	predictive	High
74	File	xxxxxxxxxx/xxxx.x	predictive	High
75	File	xxxxxxx/xxxxxxx.x	predictive	High
76	File	xxxxx.xxx	predictive	Medium
77	File	xxxxxxxxxx.xxx	predictive	High
78	File	xxxxxxxxxxxxxx.xxx	predictive	High
79	File	xxxx/xxx_xxxxxxxxx.x	predictive	High
80	File	xxxxxx_xxxxxx.xxx	predictive	High
81	File	xxxxxxxxxxx/xxxxxxxxx/xxxxxxxxx/xxxxxxx/xxxxxx.xxx	predictive	High
82	File	xx.xxxxxxxxxx.xxxx	predictive	High
83	File	xxx/xxxx/xxx_xxxxxxxxx.x	predictive	High
84	File	xxxx.xxx	predictive	Medium
85	File	xxxxx.xxx	predictive	Medium
86	File	xxxxxxxx-xxxxxxxx.xxx	predictive	High
87	File	xxxxxx_xxxxxxxxxx_xxxxx.xxx	predictive	High
88	File	xxxxx.xxx	predictive	Medium
89	File	xxxx.xxx	predictive	Medium
90	File	xxxxxx.xxx	predictive	Medium
91	File	xxxxxxxx/xxxxxx_xxxxxxxx.xxx	predictive	High
92	File	xxxxxxxx.x	predictive	Medium
93	File	xxxx_xxxxxxx_xxxxxxx.xxx	predictive	High
94	File	xxx/xxx.xxxxxxx/xxxxxxxx.xxx	predictive	High
95	File	xxx/xxxx/xxxx/xxx/xxx/xxx/xxxxxxxxxx/xxxxxxxxxxxxxx.xxxx	predictive	High
96	File	xxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxx_xxx.xxxx	predictive	High
97	File	xxxxx.x	predictive	Low
98	File	xx_xxxxxx.xxx	predictive	High
99	File	xxxx.xxx	predictive	Medium
100	File	xx-xxxxx/xxxxxxxx/xxxxx-xx-xxxxxx.xxx	predictive	High
101	File	xx-xxxxx/xxxxxx-xxxx.xxx	predictive	High
102	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
103	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
104	File	xx-xxxxxxxx/xx-xxxxxxxxx.xxx	predictive	High
105	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	High
106	File	xx-xxxx.xxx	predictive	Medium
107	File	xxxx/xxxxxxx/xxxxxxxxxxxxxx	predictive	High
108	File	~/xxxxxxxx/xx-xxxxxxxxxx.xxx	predictive	High
109	Library	xxxxxxxx/xxxxxxx/xxx.xxx	predictive	High
110	Library	xxxxxxxxxx.xxx	predictive	High
111	Library	xxx/xxxxx.xxx	predictive	High
112	Library	xxx/xxxxxx.xxx	predictive	High
113	Library	xxx/xxxxxxxx.xx	predictive	High
114	Library	xxx/xxxxxxxxxxxxxxxx.xxx	predictive	High
115	Library	xxxx/xxxxxxxxxxxx/xxxxx/xxxxx.xx	predictive	High
116	Argument	xxxxxxx	predictive	Low
117	Argument	xxxxxxxx	predictive	Medium
118	Argument	xxxxx	predictive	Low
119	Argument	xxx	predictive	Low
120	Argument	xxxxxxxx	predictive	Medium
121	Argument	xxx	predictive	Low
122	Argument	xxxxx	predictive	Low
123	Argument	xxxx_xx	predictive	Low
124	Argument	xxxxxxx	predictive	Low
125	Argument	xxxxxxx/xxxxxx	predictive	High
126	Argument	xxxxxxx/xxxxxxxxxxx	predictive	High
127	Argument	xxxxxxxxx=xxxx	predictive	High
128	Argument	xxxxxx_xxx	predictive	Medium
129	Argument	xxx	predictive	Low
130	Argument	x_xxx	predictive	Low
131	Argument	xxxxxx	predictive	Low
132	Argument	xxxxxx	predictive	Low
133	Argument	xxxxx	predictive	Low
134	Argument	xxxx	predictive	Low
135	Argument	xxxxxxxx	predictive	Medium
136	Argument	xxxxx_xxxx	predictive	Medium
137	Argument	xxxx	predictive	Low
138	Argument	xx_xxxxxxxx	predictive	Medium
139	Argument	xxx	predictive	Low
140	Argument	xxxx_xxxx	predictive	Medium
141	Argument	xx	predictive	Low
142	Argument	xxxxx	predictive	Low
143	Argument	xx_xxxxxxxx	predictive	Medium
144	Argument	xx_xxxxx	predictive	Medium
145	Argument	x_xxxxxxxx	predictive	Medium
146	Argument	xxxxxxxx	predictive	Medium
147	Argument	xxxx x xxxx	predictive	Medium
148	Argument	xxxxxxx	predictive	Low
149	Argument	xxxx	predictive	Low
150	Argument	xxxx/xxxxxxx	predictive	Medium
151	Argument	xxx_xxxxxxxx	predictive	Medium
152	Argument	xxxxxx	predictive	Low
153	Argument	xxxx_xx	predictive	Low
154	Argument	xxxx	predictive	Low
155	Argument	xxxxxxx	predictive	Low
156	Argument	xxxxxxxx/xxxx/xxxxx/xxxx/xxxxxxxxx/xxxxxxxxxxxx/xx	predictive	High
157	Argument	xxxxxxx	predictive	Low
158	Argument	xxx	predictive	Low
159	Argument	xxxxxxx_xxxxxxx	predictive	High
160	Argument	xxxxxxxxxxxx	predictive	Medium
161	Argument	xxxxxxx_xxx	predictive	Medium
162	Argument	xxx	predictive	Low
163	Argument	xxx_xxxx	predictive	Medium
164	Argument	xxxxx	predictive	Low
165	Argument	xxxxx	predictive	Low
166	Argument	xxx	predictive	Low
167	Argument	xxxxxxx_xx	predictive	Medium
168	Argument	xxxx	predictive	Low
169	Argument	xxxxx	predictive	Low
170	Argument	xxxxx	predictive	Low
171	Argument	xxxxxx_xx	predictive	Medium
172	Argument	xxx	predictive	Low
173	Argument	xxxxxxxx	predictive	Medium
174	Input Value	"><xxx xxx=x xxxxxxx=xxxxxx(x)>	predictive	High
175	Input Value	'"--></xxxxx></xxxxxx><xxxxxx>xxxxx(x)</xxxxxx>	predictive	High
176	Input Value	' xxx (xxxxxx xxxx xxxx(xxxxxx xxxxx(),xxxxxx(xxxxxxxxxxxx,(xxxxxx (xxx(xxxx=xxxx,x))),xxxxxxxxxxxx,xxxxx(xxxx(x)x))x xxxx xxxxxxxxxxx_xxxxxx.xxxxxxxxx_xxxx xxxxx xx x)x) xxx 'xxxx'='xxxx	predictive	High
177	Input Value	' xx 'x'='x	predictive	Medium
178	Input Value	../	predictive	Low
179	Input Value	<xxx xxx=x xxxxxxx=xxxxxx(x)>	predictive	High
180	Input Value	xxx	predictive	Low
181	Network Port	xxx/xxxxx	predictive	Medium
182	Network Port	xxx xxxxxx xxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!