Sality Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (42)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en	32
ru	4
pl	2
it	2
de	2

Country

US: USA	14
RU: Russia	12
PT: Portugal	8
DE: Germany	2

Actors

Sality	2
SmokeLoader	1
StealthWorker	1
Cobalt Strike	1
RisePro	1

Activities

Interest

Timeline

Type

Not Defined	10
Document Reader Software	6
Operating System	6
Jenkins Plugin	2
Mail Client Software	2

Vendor

Adobe	6
Microsoft	6
Not Defined	4
Roundcube	2
Pixel Motion	2

Product

Adobe Acrobat Reader	6
Microsoft Windows	4
TestLink Plugin	2
Roundcube webmail	2
Pixel Motion Blog	2

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#	Vulnerability	Base	Temp	0day	Today	Exp	Cou	KEV	EPSS	CTI	CVE
1	WordPress wp-trackback.php mb_convert_encoding cryptographic issues	5.3	5.1	$5k-$25k	$0-$5k	Not defined	Official fix		0.09434	0.09	CVE-2009-3622
2	Dragon Path Bharti Airtel Routers Hardware BDT-121 Admin Page cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not defined	Not defined		0.00061	0.08	CVE-2022-28507
3	woo-variation-swatches Plugin admin.php cross site scripting	5.2	5.2	$0-$5k	$0-$5k	Not defined	Not defined		0.00190	0.04	CVE-2019-14774
4	Apple watchOS protection mechanism	5.0	5.0	$5k-$25k	$0-$5k	Not defined	Official fix		0.00150	0.00	CVE-2024-44296
5	YaPiG view.php cross site scripting	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Official fix		0.01649	0.05	CVE-2005-1886
6	WordPress wp-register.php cross site scripting	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	possible	0.01575	0.00	CVE-2007-5105
7	MetInfo URL Redirector login.php redirect	6.6	6.6	$0-$5k	$0-$5k	Not defined	Not defined		0.00199	0.00	CVE-2017-11718
8	phpRaid register.php privileges management	5.3	5.3	$0-$5k	$0-$5k	Not defined	Not defined		0.00000	0.05
9	vu Mass Mailer Login Page redir.asp sql injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Not defined		0.00435	0.08	CVE-2007-6138
10	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official fix		0.00970	0.07	CVE-2010-0966
11	Symantec Endpoint Protection Manager SAP XML Parser xml external entity reference	7.3	6.6	$5k-$25k	$0-$5k	High	Official fix	expected	0.86196	0.00	CVE-2013-5014
12	Mozilla Firefox/Thunderbird/Firefox ESR NPAPI Plugin cross-site request forgery	6.5	6.4	$5k-$25k	$0-$5k	Not defined	Official fix		0.00501	0.00	CVE-2019-11712
13	Linux Kernel oom_kill.c __oom_reap_task_mm use after free	4.7	4.7	$0-$5k	$0-$5k	Not defined	Official fix		0.00109	0.00	CVE-2017-18202
14	Node.js HTTP Header resource consumption	6.4	6.3	$0-$5k	$0-$5k	Not defined	Official fix		0.02044	0.00	CVE-2018-12121
15	TestLink Plugin summary.jelly cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not defined	Not defined		0.00058	0.00	CVE-2018-1000113
16	Microsoft Windows Windows Media Player information disclosure	2.5	2.4	$5k-$25k	$0-$5k	Not defined	Official fix		0.01123	0.00	CVE-2017-11768
17	W3C Jigsaw Host Header cross site scripting	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official fix		0.01052	0.00	CVE-2002-1053
18	Microsoft Windows Subsystem for Linux access control	6.4	5.8	$25k-$100k	$0-$5k	Proof-of-Concept	Official fix		0.07840	0.00	CVE-2018-0743
19	Microsoft Windows DirectX information disclosure	5.1	4.9	$25k-$100k	$0-$5k	Not defined	Official fix		0.00978	0.00	CVE-2019-0837
20	WordPress wpdb->prepare sql injection	8.5	8.4	$5k-$25k	$0-$5k	Not defined	Official fix		0.04381	0.00	CVE-2017-16510

IOC - Indicator of Compromise (31)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	5.101.0.44		Sality	04/12/2022	verified	Medium
2	20.53.203.50		Sality	08/01/2022	verified	Medium
3	20.72.235.82		Sality	08/01/2022	verified	Medium
4	20.81.111.85		Sality	08/01/2022	verified	Medium
5	20.84.181.62		Sality	08/01/2022	verified	Medium
6	20.103.85.33		Sality	08/01/2022	verified	Medium
7	20.109.209.108		Sality	08/01/2022	verified	Medium
8	XX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxxxxx	08/01/2022	verified	Medium
9	XX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxxxxx	08/01/2022	verified	Medium
10	XX.XXX.XXX.XX		Xxxxxx	04/08/2022	verified	Low
11	XX.XX.XXX.XXX	xxxxxxxxxxx.xxxxxxx-xxxx.xxx.xxx	Xxxxxx	04/12/2022	verified	Medium
12	XX.XX.X.XX	xxxxxxx.x.xxxxxxxxx.xxx	Xxxxxx	04/12/2022	verified	Medium
13	XX.XXX.XXX.XX		Xxxxxx	04/08/2022	verified	Low
14	XX.XX.XXX.XXX	xxxxxxxxx.xxxxxxxxxxx.xxx	Xxxxxx	04/08/2022	verified	Very Low
15	XX.XXX.XXX.XXX		Xxxxxx	04/12/2022	verified	Medium
16	XX.XXX.XX.XXX	xx-xxx-xx-xxx-xxxxxx.xxxxxxx.xxx	Xxxxxx	10/29/2023	verified	High
17	XX.XXX.XXX.XX	xx-xxxxx.xx.xxxxxxxxxxxxx.xx	Xxxxxx	04/12/2022	verified	Low
18	XX.XX.XXX.XXX	xx-xx-xxx-xxx.xxxxx.xxx.xx	Xxxxxx	04/12/2022	verified	Medium
19	XXX.XX.XX.XX	xxxxxxxxxxx.x.xxxxxxxxx.xxx	Xxxxxx	04/12/2022	verified	Medium
20	XXX.XXX.XXX.XXX	xx-xxx-xxx.xxxxx.xxx	Xxxxxx	04/12/2022	verified	Medium
21	XXX.XXX.XX.XXX	xx-xxx-xxx-xx-xxx.xx.xxxxxxxxxxxx.xxx	Xxxxxx	04/12/2022	verified	Medium
22	XXX.X.XXX.XXX		Xxxxxx	04/12/2022	verified	Medium
23	XXX.XXX.XX.XX	x.xx.xxxx.xxx.xxxxxx.xx-xxxxxxx.xxx	Xxxxxx	04/12/2022	verified	Medium
24	XXX.XX.XXX.X	xx-xxxxx.xxx.xx.xx	Xxxxxx	04/12/2022	verified	Medium
25	XXX.XX.XX.XXX		Xxxxxx	04/08/2022	verified	Low
26	XXX.XX.XXX.XXX		Xxxxxx	04/08/2022	verified	Low
27	XXX.XX.XXX.XXX		Xxxxxx	04/08/2022	verified	Low
28	XXX.XXX.XX.XXX	xxxx-x.xxxxxxxxxxxx	Xxxxxx	04/08/2022	verified	Low
29	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxx.xxxx-xxxx.xxx	Xxxxxx	04/08/2022	verified	Low
30	XXX.XX.XX.XX	xxxx.xxxxxxx.xx	Xxxxxx	04/08/2022	verified	Low
31	XXX.XX.XX.XXX	xxx.xxxxxxx.xx	Xxxxxx	04/12/2022	verified	Medium

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
2	T1059.007	CAPEC-209	CWE-79, CWE-80	Basic Cross Site Scripting	predictive	High
3	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
4	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
5	TXXXX		CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
6	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
7	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
8	TXXXX		CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (37)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/getcfg.php	predictive	Medium
2	File	/settings/avatar	predictive	High
3	File	bin/icinga	predictive	Medium
4	File	inc/config.php	predictive	High
5	File	index.php	predictive	Medium
6	File	xxxxxx/xxxxx.xxx	predictive	High
7	File	xxxxxx.xx	predictive	Medium
8	File	xx/xxx_xxxx.x	predictive	High
9	File	xxx.xxx	predictive	Low
10	File	xxxxx.xxx	predictive	Medium
11	File	xxxxxxxx.xxx	predictive	Medium
12	File	xxxxxxxxxxxxxxxxxxx/xxxxxxx.xxxxx	predictive	High
13	File	xxxxxxxxx.xx	predictive	Medium
14	File	xxxx/xxxxxxxxxxxx.x	predictive	High
15	File	xxxx.xxx	predictive	Medium
16	File	xx-xxxxx/xxxxx.xxx?xxxx=xxx-xxxxxxxxx-xxxxxxxx-xxxxxxxx	predictive	High
17	File	xx-xxxxxxxx.xxx	predictive	High
18	File	xx-xxxxxxxxx.xxx	predictive	High
19	Argument	xxxxxxxx	predictive	Medium
20	Argument	xxxxxxxxx	predictive	Medium
21	Argument	xxxxxxx	predictive	Low
22	Argument	xxxxxxxxxxx	predictive	Medium
23	Argument	xxxxx	predictive	Low
24	Argument	xx	predictive	Low
25	Argument	xxxxxx	predictive	Low
26	Argument	xxxxxxxx	predictive	Medium
27	Argument	xxxx	predictive	Low
28	Argument	xxxxxxx_xxx	predictive	Medium
29	Argument	xxxxxxxx	predictive	Medium
30	Argument	xxx	predictive	Low
31	Argument	xxxxxxxxxxxxx	predictive	High
32	Argument	xxxx_xxxxx	predictive	Medium
33	Argument	_xxxxxxx	predictive	Medium
34	Input Value	xxxx -x xxxxxxxx=xxxxxx.xxxxxxx xxxx://xxx.xxx.x.x/xxxxxx.xxx	predictive	High
35	Pattern	\|xx\|xx\|xx\|	predictive	Medium
36	Network Port	xxx/xxxx (xxxx) / xxx/xxxx (xxxxx)	predictive	High
37	Network Port	xxx xxxxxx xxxx	predictive	High

References (6)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!