ScanBox Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (102)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	72
zh	22
jp	4
de	2
ja	2

Country

CN: China	52
US: USA	40
CA: Canada	6
TH: Thailand	4

Actors

ScanBox	10
UAC-0010	1
Emotet	1
PhotoLoader	1
Shuckworm	1

Activities

Interest

Timeline

Type

Not Defined	36
Content Management System	16
Operating System	14
Firewall Software	4
Project Management Software	2

Vendor

Not Defined	40
Linux	6
Apple	6
Cisco	4
Joomla	4

Product

Linux Kernel	6
Apple Mac OS X Server	4
Joomla CMS	4
DeDeCMS	4
Project Worlds Car Rental Management System	2

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	October CMS fromData race condition	6.8	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00418	0.04	CVE-2022-24800
2	DeDeCMS recommend.php sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05810	0.00	CVE-2017-17731
3	Fabrice Bellard QEMU bits_per_pixel access control	5.7	5.0	$5k-$25k	Calculating	Unproven	Official Fix	0.86403	0.00	CVE-2014-7815
4	PrestaShop isCleanHTML cross site scripting	5.6	5.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00046	0.05	CVE-2023-39527
5	OpenSSL ASN.1 X509_get1_ocsp out-of-bounds	5.5	5.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00352	0.05	CVE-2021-3712
6	PbootCMS cross site scripting	3.6	3.6	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00052	0.00	CVE-2024-1018
7	Docker Swarm Plugin Dashboard View cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00090	0.07	CVE-2023-40350
8	Fortinet FortiOS/FortiPAM/FortiProxy HTTP Request out-of-bounds write	9.8	9.6	$25k-$100k	$25k-$100k	Not Defined	Official Fix	0.00091	0.08	CVE-2023-42789
9	Oracle Identity Management Suite Apache Log4j deserialization	9.8	9.7	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.87384	0.00	CVE-2017-5645
10	VMware Cloud Director Privilege Escalation	7.2	6.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00252	0.02	CVE-2022-22966
11	Google Android Lockscreen KeyguardServiceWrapper.java race condition	2.0	1.9	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00042	0.00	CVE-2022-20006
12	Boa Webserver GET wapopen path traversal	6.4	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.73540	0.05	CVE-2017-9833
13	Microsoft ASP.NET Forms Authentication path traversal	9.8	9.4	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.93976	0.03	CVE-2004-0847
14	Oracle MySQL Enterprise Monitor Monitoring path traversal	9.1	8.9	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.00127	0.04	CVE-2022-37865
15	SpringBlade sql injection	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00171	0.04	CVE-2022-27360
16	Cuppa CMS File Manager copy access control	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00205	0.04	CVE-2022-25401
17	JCK Editor links.php sql injection	8.5	8.3	$0-$5k	$0-$5k	High	Not Defined	0.81623	0.04	CVE-2018-17254
18	Yii Yii2 path traversal	7.6	7.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00091	0.05	CVE-2015-5467
19	Umbraco FeedProxy.aspx.cs Page_Load server-side request forgery	7.7	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00511	0.00	CVE-2015-8813
20	WPS Hide Login Plugin Secret Login Page options.php access control	6.9	6.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04098	0.00	CVE-2021-24917

IOC - Indicator of Compromise (26)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	1.9.5.38		ScanBox	12/24/2020	verified	Low
2	45.77.237.243	45.77.237.243.vultrusercontent.com	ScanBox	02/16/2024	verified	High
3	50.2.24.211		ScanBox	12/24/2020	verified	Low
4	66.197.231.62		ScanBox	01/01/2021	verified	Low
5	69.197.146.80		ScanBox	01/01/2021	verified	Low
6	69.197.183.142	us-mci1-16.renders.prerender.io	ScanBox	01/01/2021	verified	Low
7	XX.XXX.XXX.XXX		Xxxxxxx	01/01/2021	verified	Low
8	XX.XXX.XXX.XXX		Xxxxxxx	01/01/2021	verified	Low
9	XX.XXX.XXX.XXX	xx-xxxx-xx.xxxxxxx.xxxxxxxxx.xx	Xxxxxxx	01/01/2021	verified	Low
10	XX.XX.XXX.XXX	xxxxxxxxxxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	12/24/2020	verified	Low
11	XXX.XX.XXX.XXX		Xxxxxxx	12/24/2020	verified	Low
12	XXX.XXX.XXX.XXX		Xxxxxxx	12/24/2020	verified	Low
13	XXX.XX.XX.XXX		Xxxxxxx	12/24/2020	verified	Low
14	XXX.XX.XX.XXX		Xxxxxxx	01/01/2021	verified	Low
15	XXX.XX.XX.XXX		Xxxxxxx	02/16/2024	verified	Very High
16	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx	02/16/2024	verified	High
17	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx.xx.xxxxxxxxxxxxxxxxx.xxx	Xxxxxxx	02/16/2024	verified	High
18	XXX.XXX.XXX.XX	xx.xx.xxxx.xxxxxx.xxxxxxxxx.xxx	Xxxxxxx	12/24/2020	verified	Low
19	XXX.XX.XX.XXX	xxxxxxx.xxxxxxxxxxxxxx.xx.xx	Xxxxxxx	01/01/2021	verified	Low
20	XXX.XX.XXX.XXX	xxx-xx-xxx-x.xx.xxx.xxxxx-xxxxx.xxxxxxxxxx.xxx	Xxxxxxx	01/01/2021	verified	Low
21	XXX.XX.XX.X	xxx-xx-xx-x.xx.xxxxxx.xxxxx-xxxxxx.xxxxxxxxxx.xxx	Xxxxxxx	01/01/2021	verified	Low
22	XXX.XX.XXX.XXX	xxx-xx-xxx-x.xx.xxxxxx.xxxxx-xxxxx.xxxxxxxxxx.xxx	Xxxxxxx	01/01/2021	verified	Low
23	XXX.XXX.XX.XX	x.x.xxxxx.xx	Xxxxxxx	01/01/2021	verified	Very Low
24	XXX.XX.XX.XXX	xxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxx	02/16/2024	verified	High
25	XXX.X.XXX.XX		Xxxxxxx	01/01/2021	verified	Low
26	XXX.X.XXX.XX		Xxxxxxx	01/01/2021	verified	Low

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-22, CWE-23	Path Traversal	predictive	High
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	High
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
7	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
8	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	High
9	TXXXX	CAPEC-108	CWE-XX, CWE-XX	Xxx Xxxxxxxxx	predictive	High
10	TXXXX	CAPEC-50	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	High
12	TXXXX.XXX	CAPEC-133	CWE-XXX	Xxxxxxxx	predictive	High
13	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
14	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
15	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (85)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/admin.php?p=/Area/index#tab=t2	predictive	High
2	File	/cgi-bin/wapopen	predictive	High
3	File	/proc/self/setgroups	predictive	High
4	File	/secure/QueryComponent!Default.jspa	predictive	High
5	File	/userRpm/PingIframeRpm.htm	predictive	High
6	File	/webman/info.cgi	predictive	High
7	File	/wp-admin/options.php	predictive	High
8	File	adclick.php	predictive	Medium
9	File	addentry.php	predictive	Medium
10	File	and/or	predictive	Low
11	File	xxxxxx.xxxxxx.xxx	predictive	High
12	File	xxx.xxx	predictive	Low
13	File	xxxxxx.x	predictive	Medium
14	File	xxx-xxx/xxxxxx	predictive	High
15	File	xxxxxx.xxx.xxx	predictive	High
16	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
17	File	xxxx-xxxxx.xxx	predictive	High
18	File	xxxxxxxxx.xxx.xxx	predictive	High
19	File	xxxxxxx.xxx	predictive	Medium
20	File	xxxxxxxxxxxx_xxxx.xxx	predictive	High
21	File	xxxxxxx/xxxxxxxxxxx.xxx	predictive	High
22	File	xxx/xxxxxx.xxx	predictive	High
23	File	xxxxx.xxx	predictive	Medium
24	File	xxxx_xxxx.xxx	predictive	High
25	File	xxx.xxxx	predictive	Medium
26	File	xxxxxxxxx/xxxxxxx/xxxxx.xxx	predictive	High
27	File	xxxxxx/xxx/xxxxxxxx.x	predictive	High
28	File	xxxxxxxxxxxxxxxxxxxxxx.xxxx	predictive	High
29	File	xxxxxx.xxx	predictive	Medium
30	File	xxx/xxxxxxxxx.xx	predictive	High
31	File	xxxxxx.xxx	predictive	Medium
32	File	xxx/xxx/xx_xxx.x	predictive	High
33	File	xxx/xxxxxxxxx/xxx_xxxxxxxxx.x	predictive	High
34	File	xxxxxxx.xxx	predictive	Medium
35	File	xxxxxxxxxx.xxx	predictive	High
36	File	xxxx/xxxxxxxxx.xxx	predictive	High
37	File	xxxxx.xxx	predictive	Medium
38	File	xxxxxxxxxxxxxxx.xxx	predictive	High
39	File	xxxxxxxxxxxxxxxxxx.xxx	predictive	High
40	File	xxxxxxxx.xxx	predictive	Medium
41	File	xxxxxxxxxxxxxxx.xxx	predictive	High
42	File	x/xxxxx.xxx	predictive	Medium
43	File	xxx_xxxx_xxxxxx.xxx	predictive	High
44	File	xxxxxxx.xxx/xxxxxxx.xxxxxxxxxxxx/xxxxxxx/xxxxxxxxx/xxxxxxxxx.xxxx.xx	predictive	High
45	File	xxxx-xxxxxxx.xxx	predictive	High
46	File	xxxx.xxxxx.xxxxxx	predictive	High
47	File	xx-xxxxx.xxx	predictive	Medium
48	Library	xxx/xxxxxxxxx.xx	predictive	High
49	Library	xxxx.xxxxx	predictive	Medium
50	Argument	$_xxxxx	predictive	Low
51	Argument	xxxxx_xxxx	predictive	Medium
52	Argument	xxxxxxxx	predictive	Medium
53	Argument	xxxxxxxx	predictive	Medium
54	Argument	xxxxxxxxxx	predictive	Medium
55	Argument	xxxxx	predictive	Low
56	Argument	xxxx_xx	predictive	Low
57	Argument	xxxxxxxxxxxxxxxx	predictive	High
58	Argument	x_xx	predictive	Low
59	Argument	xxxxxxxxxx	predictive	Medium
60	Argument	xxxxxxxx	predictive	Medium
61	Argument	xxxx	predictive	Low
62	Argument	xxxx/xxxxxx/xxx	predictive	High
63	Argument	xx	predictive	Low
64	Argument	xxxxxxxx	predictive	Medium
65	Argument	xxx_xxxxxxx_xxx	predictive	High
66	Argument	xxxx	predictive	Low
67	Argument	xxxx/xxxxxxxx/xxx/xxx/xxxxxxxx/xxxxxxx	predictive	High
68	Argument	xxxxxxxxxxxxxxxxxxxxxxx	predictive	High
69	Argument	xxxxxx	predictive	Low
70	Argument	xxxx	predictive	Low
71	Argument	xxxxxxxx	predictive	Medium
72	Argument	xxxxxx	predictive	Low
73	Argument	xxxx_xxxxx	predictive	Medium
74	Argument	xxxxxxxxxx_xxxx	predictive	High
75	Argument	xxxxxxxxxxx	predictive	Medium
76	Argument	xxxx	predictive	Low
77	Argument	xxxxxx	predictive	Low
78	Argument	xxxxxxxxx: x	predictive	Medium
79	Argument	xxx	predictive	Low
80	Argument	xxxxxx	predictive	Low
81	Argument	xxxxxxxx	predictive	Medium
82	Argument	xxxxxxxx/xxxxxxxx	predictive	High
83	Argument	xxxx	predictive	Low
84	Input Value	../..	predictive	Low
85	Network Port	xxx/xxxx	predictive	Medium

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!