pymafka Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (43)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	26
zh	16
ko	2

Country

CN: China	40

Actors

pymafka	1
Cobalt Strike	1

Activities

Interest

Timeline

Type

Operating System	12
Web Server	4
Not Defined	4
Web Browser	4
Multimedia Player Software	2

Vendor

Microsoft	10
Not Defined	8
Linux	6
Google	6
RealNetworks	2

Product

Microsoft Windows	6
Linux Kernel	6
Microsoft IIS	4
Google Chrome	4
RealNetworks RealPlayer	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Linux Kernel IPv6 ipv6_renew_options memory leak	5.4	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.08	CVE-2022-3524
2	Plone lxml Parser server-side request forgery	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00178	0.05	CVE-2021-33511
3	SpringSource Spring Framework class.classLoader.URLs[0] code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02820	0.05	CVE-2010-1622
4	Microsoft Windows win32k.sys xxxMenuWindowProc denial of service	5.5	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Unavailable	0.00000	0.00
5	Linux Kernel Netlink Message scsi_transport_iscsi.c iscsi_if_recv_msg out-of-bounds	6.3	6.0	$5k-$25k	Calculating	Not Defined	Official Fix	0.00088	0.00	CVE-2021-27364
6	Array Networks Array AG/vxAG SSL VPN Gateway improper authentication	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00321	0.05	CVE-2023-28461
7	jQuery cross site scripting	4.8	4.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00045	0.09	CVE-2020-23064
8	Easy Bootstrap Shortcode Plugin Shortcode Attribute cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00058	0.00	CVE-2022-4576
9	Sophos Web Appliance Warn-proceed command injection	9.8	9.7	$0-$5k	$0-$5k	High	Official Fix	0.96222	0.03	CVE-2023-1671
10	Linux Kernel ksmbd auth.c ksmbd_decode_ntlmssp_auth_blob memory corruption	7.5	6.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00467	0.04	CVE-2023-0210
11	Linux Kernel fs-writeback.c inode_cgwb_move_to_attached use after free	6.6	6.4	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00071	0.00	CVE-2023-26605
12	Linux Kernel bitmap.c ntfs_trim_fs use after free	6.6	6.4	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00052	0.00	CVE-2023-26606
13	Linux Kernel attrib.c ntfs_attr_find out-of-bounds	6.3	6.0	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00071	0.03	CVE-2023-26607
14	WordPress sql injection	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00467	0.04	CVE-2022-21664
15	dedecmdv6 file_manage_control.php Privilege Escalation	8.0	7.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00468	0.00	CVE-2022-44118
16	dedecmdv6 sys_sql_query.php sql injection	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00142	0.00	CVE-2022-44120
17	Microsoft Windows Graphics integer overflow	8.1	7.9	$100k and more	$25k-$100k	High	Official Fix	0.55161	0.00	CVE-2023-21823
18	ArcGIS Server sql injection	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00073	0.04	CVE-2021-29099
19	RealNetworks RealPlayer G2 Control cross site scripting	3.5	3.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00373	0.00	CVE-2022-32269
20	Microsoft Windows Common Log File System Driver Privilege Escalation	8.3	7.3	$100k and more	$5k-$25k	Unproven	Official Fix	0.00043	0.00	CVE-2021-43226

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	39.106.227.92		pymafka	07/30/2022	verified	Medium
2	XX.XXX.XXX.XX		Xxxxxxx	07/30/2022	verified	Medium
3	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx	07/30/2022	verified	Low

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
2	T1059.007	CAPEC-209	CWE-79	Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	High
6	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
7	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (13)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	auth.c	predictive	Low
2	File	class.classLoader.URLs[0]=jar	predictive	High
3	File	xxxxxxx/xxxx/xxxx_xxxxxxxxx_xxxxx.x	predictive	High
4	File	xxxx_xxxxxx_xxxxxxx.xxx	predictive	High
5	File	xx/xx-xxxxxxxxx.x	predictive	High
6	File	xx/xxxx/xxxxxx.x	predictive	High
7	File	xx/xxxxx/xxxxxx.x	predictive	High
8	File	xxxxx.xxx	predictive	Medium
9	File	xxx_xxx_xxxxx.xxx	predictive	High
10	Library	xxxxxx.xxx	predictive	Medium
11	Argument	xxxxx.xxxxxxxxxxx.xxxx[x]=xxx	predictive	High
12	Argument	xx_xxx	predictive	Low
13	Argument	xxxxxxxx	predictive	Medium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!