RuRAT Analysis

IOB - Indicator of Behavior (474)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en250
de182
it34
es6
fr2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

WordPress18
PHP4
Phorum2
PHPWind2
D-Link DWR-932B2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25kCalculatingHighWorkaround0.020160.00CVE-2007-1192
2DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.009430.62CVE-2010-0966
3Woltlab Burning Board register.php cross site scripting4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.005460.04CVE-2007-1443
4Magic Photo Storage Website register.php privileges management5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.00
5YaBB register.pl memory corruption10.08.7$0-$5k$0-$5kUnprovenOfficial Fix0.173480.05CVE-2007-3208
6WordPress wp-register.php cross site scripting4.34.2$5k-$25k$0-$5kHighUnavailable0.005380.05CVE-2007-5105
7Phpwebgallery register.php cross site scripting4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.005730.07CVE-2007-1109
8Expinion.net News Manager Lite comment_add.asp cross site scripting4.33.8$0-$5k$0-$5kUnprovenOfficial Fix0.006070.00CVE-2004-1845
9Phorum register.php cross site scripting6.36.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.016010.00CVE-2007-0769
10SSReader Ultra Star Reader ActiveX Control pdg2.dll Register memory corruption10.09.4$0-$5k$0-$5kProof-of-ConceptNot Defined0.073930.05CVE-2007-5892
11SSReader Ultra Star Reader ActiveX Control register memory corruption7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.036170.00CVE-2007-5807
12StoreSprite register.php cross site scripting4.34.1$0-$5k$0-$5kProof-of-ConceptNot Defined0.030260.00CVE-2007-4307
13AlstraSoft AskMe Pro register.php cross site scripting3.53.5$0-$5k$0-$5kNot DefinedNot Defined0.000000.04
14Microsoft Register Server denial of service5.35.3$5k-$25k$0-$5kNot DefinedNot Defined0.004950.00CVE-2007-3658
15Scribe forum.php register code injection7.36.6$0-$5k$0-$5kProof-of-ConceptUnavailable0.025220.00CVE-2007-5822
16WordPress wp-register.php cross site scripting4.34.2$5k-$25k$0-$5kHighUnavailable0.008110.05CVE-2007-5106
17Andys Chat register.php memory corruption10.010.0$0-$5k$0-$5kNot DefinedUnavailable0.031060.00CVE-2006-7036
18PBSite register.php Local Privilege Escalation5.35.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.00
19LushiWarPlaner register.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.007840.04CVE-2007-0864
20TeamCal register.php path traversal3.33.3$0-$5k$0-$5kNot DefinedNot Defined0.000000.05

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
186.104.15.123cphost07.qhoster.netRuRAT08/04/2022verifiedHigh
2XXX.XXX.XX.XXXxxxxx-x.xxx-xxxxxxx.xxxXxxxx08/04/2022verifiedMedium

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (85)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/index.phppredictiveMedium
2File/rom-0predictiveLow
3File/uncpath/predictiveMedium
4Fileadclick.phppredictiveMedium
5Fileadd_comment.phppredictiveHigh
6Filebase_maintenance.phppredictiveHigh
7Filecomment_add.asppredictiveHigh
8Filedata/gbconfiguration.datpredictiveHigh
9Filedrivers/block/floppy.cpredictiveHigh
10Fileemail.phppredictiveMedium
11FileEmployeeSearch.ccpredictiveHigh
12Fileexit.phppredictiveMedium
13Fileforum.phppredictiveMedium
14Filegoto.phppredictiveMedium
15Filexxxxxxxxx.xxxpredictiveHigh
16Filexxx/xxxxxx.xxxpredictiveHigh
17Filexxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxxpredictiveHigh
18Filexxxxxxx/xxxxxxx/xxxxxxxx_xxxxxxxx.xxx.xxxpredictiveHigh
19Filexxxxx.xxxpredictiveMedium
20Filexxxxx.xxx.xxxpredictiveHigh
21Filexxxxx.xxxpredictiveMedium
22Filexxxxx.xxxpredictiveMedium
23Filexxxxx.xxxpredictiveMedium
24Filexxxxxxxx.xxxpredictiveMedium
25Filexxxxxxxx.xxxxpredictiveHigh
26Filexxxxxxxx.xxxpredictiveMedium
27Filexxxxxxxx.xxxpredictiveMedium
28Filexxxxxxxx.xxpredictiveMedium
29Filexxxxxxxx_xxxxxx.xxxpredictiveHigh
30Filexxxxxxx_xxx_xxxxx_xxxxxx.xxxxpredictiveHigh
31Filexxxxxxxxxx/xxxxxxxxxx_xxxxxxxxxx.xxxpredictiveHigh
32Filexxxxxx/xxxxxxxx.xxxpredictiveHigh
33Filexxxxxx.xxxpredictiveMedium
34Filexxxxxxx/xxxxxxxx.xxxpredictiveHigh
35Filexxxx-xxxxxxxx.xxxpredictiveHigh
36Filexxxx/xxxxxxxx.xxxpredictiveHigh
37Filexxxxx/xxxxxxxx.xxxpredictiveHigh
38Filexxxx/xxxxxxxx.xxxpredictiveHigh
39Filexx-xxxxx/xxxxx-xxxx.xxx?xx-xxxxx-xxxxxx[]=xxxxxxxxpredictiveHigh
40Filexx-xxxxx.xxxpredictiveMedium
41Filexx-xxxxxxxx.xxxpredictiveHigh
42Filexxxxxx.xxxpredictiveMedium
43Libraryxxxx.xxxpredictiveMedium
44ArgumentxxxxxxxpredictiveLow
45ArgumentxxxxxxpredictiveLow
46ArgumentxxxxxxxxpredictiveMedium
47ArgumentxxxxxxxpredictiveLow
48ArgumentxxxxpredictiveLow
49ArgumentxxxxxpredictiveLow
50ArgumentxxxxxpredictiveLow
51Argumentxxxxxxx=xxxxxxxxpredictiveHigh
52ArgumentxxxxpredictiveLow
53Argumentxxxx_xxxxxpredictiveMedium
54ArgumentxxxxxxxxpredictiveMedium
55ArgumentxxpredictiveLow
56Argumentxx_xxxxxxxxpredictiveMedium
57Argumentxxxxxxx_xxxxpredictiveMedium
58Argumentxxxxxxxxx-xxxxxxx/xxxxxxxxx/xxxxxxxxxxpredictiveHigh
59ArgumentxxxxpredictiveLow
60ArgumentxxxxxxxxxxxxxpredictiveHigh
61ArgumentxxxxxxxpredictiveLow
62ArgumentxxxxpredictiveLow
63Argumentxxxxxxxxx_xxxxxxxx_xxxxpredictiveHigh
64ArgumentxxxxpredictiveLow
65ArgumentxxxxpredictiveLow
66ArgumentxxxxpredictiveLow
67ArgumentxxxxxxxxpredictiveMedium
68Argumentxxxx_xxxxpredictiveMedium
69Argumentxxx_xxxxpredictiveMedium
70ArgumentxxxxxxpredictiveLow
71ArgumentxxxxxxxxxxxxpredictiveMedium
72ArgumentxxxxxxpredictiveLow
73ArgumentxxxxxxxxxxpredictiveMedium
74ArgumentxxxpredictiveLow
75ArgumentxxxxxpredictiveLow
76ArgumentxxxpredictiveLow
77ArgumentxxxxxxxxpredictiveMedium
78Argumentxxxx_xxxxxpredictiveMedium
79Argumentxxxx_xxxxxpredictiveMedium
80ArgumentxxxpredictiveLow
81Argument_xxxxxx[xxxx_xxxx]predictiveHigh
82Input ValuexxxxpredictiveLow
83Input Valuexxxxxxxxx' xxx 'x'='xpredictiveHigh
84Input ValuexxxxpredictiveLow
85Network Portxxx xxxxxx xxxxpredictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you want to use VulDB in your project?

Use the official API to access entries easily!