RuRAT Analysis

IOB - Indicator of Behavior (474)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	238
de	210
it	24
es	2

Country

us	468
ir	2

Actors

RuRAT	2

Activities

Interest

Timeline

Type

Not Defined	32
Content Management System	26
Forum Software	22
Operating System	6
Photo Gallery Software	4

Vendor

Not Defined	56
Linux	4
Microsoft	4
McAfee	2
CONTROLzx	2

Product

WordPress	16
Linux Kernel	4
Phorum	4
McAfee Network Security Management	2
cpCommerce	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.04	0.04187	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	1.06	0.04187	CVE-2010-0966
3	Woltlab Burning Board register.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.06	0.01319	CVE-2007-1443
4	Magic Photo Storage Website register.php privileges management	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.04	0.00000
5	YaBB register.pl memory corruption	10.0	8.7	$0-$5k	$0-$5k	Unproven	Official Fix	0.04	0.08263	CVE-2007-3208
6	WordPress wp-register.php cross site scripting	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.07	0.02945	CVE-2007-5105
7	Phpwebgallery register.php cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.07	0.01319	CVE-2007-1109
8	Expinion.net News Manager Lite comment_add.asp cross site scripting	4.3	3.8	$0-$5k	$0-$5k	Unproven	Official Fix	0.01	0.03129	CVE-2004-1845
9	Phorum register.php cross site scripting	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.05	0.01213	CVE-2007-0769
10	SSReader Ultra Star Reader ActiveX Control pdg2.dll Register memory corruption	10.0	9.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01	0.06523	CVE-2007-5892
11	SSReader Ultra Star Reader ActiveX Control register memory corruption	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03	0.04679	CVE-2007-5807
12	StoreSprite register.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.05	0.01955	CVE-2007-4307
13	AlstraSoft AskMe Pro register.php cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.06	0.00000
14	Microsoft Register Server denial of service	5.3	5.3	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00	0.06118	CVE-2007-3658
15	Scribe forum.php register code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.07	0.01408	CVE-2007-5822
16	WordPress wp-register.php cross site scripting	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.00	0.01213	CVE-2007-5106
17	Andys Chat register.php memory corruption	10.0	10.0	$0-$5k	$0-$5k	Not Defined	Unavailable	0.07	0.06523	CVE-2006-7036
18	PBSite register.php Local Privilege Escalation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00000
19	LushiWarPlaner register.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.04	0.01139	CVE-2007-0864
20	TeamCal register.php path traversal	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.04	0.00000

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Campaigns	Type	Confidence
1	86.104.15.123	cphost07.qhoster.net	RuRAT		verified	High
2	XXX.XXX.XX.XXX	xxxxx-x.xxx-xxxxxxx.xxx	Xxxxx		verified	High

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22	Pathname Traversal	predictive	High
2	T1059	CWE-94	Cross Site Scripting	predictive	High
3	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
4	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
5	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxx	predictive	High
6	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxxxxxx	predictive	High
7	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
8	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
9	TXXXX	CWE-XXX	Xxxxxxxxxxxxx	predictive	High
10	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	High
11	TXXXX	CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxxxxxxxx Xxxxxxx Xxxxxxxxxx	predictive	High

IOA - Indicator of Attack (85)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/index.php	predictive	Medium
2	File	/rom-0	predictive	Low
3	File	/uncpath/	predictive	Medium
4	File	adclick.php	predictive	Medium
5	File	add_comment.php	predictive	High
6	File	base_maintenance.php	predictive	High
7	File	comment_add.asp	predictive	High
8	File	data/gbconfiguration.dat	predictive	High
9	File	drivers/block/floppy.c	predictive	High
10	File	email.php	predictive	Medium
11	File	EmployeeSearch.cc	predictive	High
12	File	exit.php	predictive	Medium
13	File	forum.php	predictive	Medium
14	File	goto.php	predictive	Medium
15	File	xxxxxxxxx.xxx	predictive	High
16	File	xxx/xxxxxx.xxx	predictive	High
17	File	xxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxx	predictive	High
18	File	xxxxxxx/xxxxxxx/xxxxxxxx_xxxxxxxx.xxx.xxx	predictive	High
19	File	xxxxx.xxx	predictive	Medium
20	File	xxxxx.xxx.xxx	predictive	High
21	File	xxxxx.xxx	predictive	Medium
22	File	xxxxx.xxx	predictive	Medium
23	File	xxxxx.xxx	predictive	Medium
24	File	xxxxxxxx.xxx	predictive	Medium
25	File	xxxxxxxx.xxxx	predictive	High
26	File	xxxxxxxx.xxx	predictive	Medium
27	File	xxxxxxxx.xxx	predictive	Medium
28	File	xxxxxxxx.xx	predictive	Medium
29	File	xxxxxxxx_xxxxxx.xxx	predictive	High
30	File	xxxxxxx_xxx_xxxxx_xxxxxx.xxxx	predictive	High
31	File	xxxxxxxxxx/xxxxxxxxxx_xxxxxxxxxx.xxx	predictive	High
32	File	xxxxxx/xxxxxxxx.xxx	predictive	High
33	File	xxxxxx.xxx	predictive	Medium
34	File	xxxxxxx/xxxxxxxx.xxx	predictive	High
35	File	xxxx-xxxxxxxx.xxx	predictive	High
36	File	xxxx/xxxxxxxx.xxx	predictive	High
37	File	xxxxx/xxxxxxxx.xxx	predictive	High
38	File	xxxx/xxxxxxxx.xxx	predictive	High
39	File	xx-xxxxx/xxxxx-xxxx.xxx?xx-xxxxx-xxxxxx[]=xxxxxxxx	predictive	High
40	File	xx-xxxxx.xxx	predictive	Medium
41	File	xx-xxxxxxxx.xxx	predictive	High
42	File	xxxxxx.xxx	predictive	Medium
43	Library	xxxx.xxx	predictive	Medium
44	Argument	xxxxxxx	predictive	Low
45	Argument	xxxxxx	predictive	Low
46	Argument	xxxxxxxx	predictive	Medium
47	Argument	xxxxxxx	predictive	Low
48	Argument	xxxx	predictive	Low
49	Argument	xxxxx	predictive	Low
50	Argument	xxxxx	predictive	Low
51	Argument	xxxxxxx=xxxxxxxx	predictive	High
52	Argument	xxxx	predictive	Low
53	Argument	xxxx_xxxxx	predictive	Medium
54	Argument	xxxxxxxx	predictive	Medium
55	Argument	xx	predictive	Low
56	Argument	xx_xxxxxxxx	predictive	Medium
57	Argument	xxxxxxx_xxxx	predictive	Medium
58	Argument	xxxxxxxxx-xxxxxxx/xxxxxxxxx/xxxxxxxxxx	predictive	High
59	Argument	xxxx	predictive	Low
60	Argument	xxxxxxxxxxxxx	predictive	High
61	Argument	xxxxxxx	predictive	Low
62	Argument	xxxx	predictive	Low
63	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	High
64	Argument	xxxx	predictive	Low
65	Argument	xxxx	predictive	Low
66	Argument	xxxx	predictive	Low
67	Argument	xxxxxxxx	predictive	Medium
68	Argument	xxxx_xxxx	predictive	Medium
69	Argument	xxx_xxxx	predictive	Medium
70	Argument	xxxxxx	predictive	Low
71	Argument	xxxxxxxxxxxx	predictive	Medium
72	Argument	xxxxxx	predictive	Low
73	Argument	xxxxxxxxxx	predictive	Medium
74	Argument	xxx	predictive	Low
75	Argument	xxxxx	predictive	Low
76	Argument	xxx	predictive	Low
77	Argument	xxxxxxxx	predictive	Medium
78	Argument	xxxx_xxxxx	predictive	Medium
79	Argument	xxxx_xxxxx	predictive	Medium
80	Argument	xxx	predictive	Low
81	Argument	_xxxxxx[xxxx_xxxx]	predictive	High
82	Input Value	xxxx	predictive	Low
83	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	High
84	Input Value	xxxx	predictive	Low
85	Network Port	xxx xxxxxx xxxx	predictive	High

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!