ScanBox Analysis

IOB - Indicator of Behavior (97)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en80
zh16
de2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

cn54
us38
ca4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Linux Kernel6
QNAP QTS4
Apple Mac OS X Server4
DeDeCMS4
Dahua DHI-HCVR7216A-S32

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1October CMS fromData race condition6.86.7$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00405CVE-2022-24800
2DeDeCMS recommend.php sql injection8.58.5$0-$5k$0-$5kNot DefinedNot Defined0.020.02129CVE-2017-17731
3Fortinet FortiOS/FortiPAM/FortiProxy HTTP Request out-of-bounds write9.89.6$25k-$100k$5k-$25kNot DefinedOfficial Fix0.020.00091CVE-2023-42789
4Oracle Identity Management Suite Apache Log4j deserialization9.89.7$25k-$100k$5k-$25kNot DefinedOfficial Fix0.020.81948CVE-2017-5645
5VMware Cloud Director Privilege Escalation7.26.9$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.00222CVE-2022-22966
6Google Android Lockscreen KeyguardServiceWrapper.java race condition2.01.9$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00042CVE-2022-20006
7Boa Webserver GET wapopen path traversal6.46.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.030.73540CVE-2017-9833
8Microsoft ASP.NET Forms Authentication path traversal9.89.4$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.020.93976CVE-2004-0847
9Oracle MySQL Enterprise Monitor Monitoring path traversal9.18.9$25k-$100k$5k-$25kNot DefinedOfficial Fix0.040.00127CVE-2022-37865
10SpringBlade sql injection6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.020.00171CVE-2022-27360
11Cuppa CMS File Manager copy access control5.55.3$0-$5k$0-$5kNot DefinedNot Defined0.020.00205CVE-2022-25401
12JCK Editor links.php sql injection8.58.3$0-$5k$0-$5kHighNot Defined0.020.81623CVE-2018-17254
13Yii Yii2 path traversal7.67.5$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00091CVE-2015-5467
14Umbraco FeedProxy.aspx.cs Page_Load server-side request forgery7.77.4$0-$5kCalculatingNot DefinedOfficial Fix0.040.00511CVE-2015-8813
15WPS Hide Login Plugin Secret Login Page options.php access control6.96.7$0-$5k$0-$5kNot DefinedOfficial Fix0.050.02933CVE-2021-24917
16jeecg-boot information disclosure6.46.4$0-$5k$0-$5kNot DefinedNot Defined0.070.00703CVE-2021-37304
17SSH SSH-1 Protocol cryptographic issues7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00258CVE-2001-1473
18Linux Kernel nftables nft_byteorder.c nft_byteorder out-of-bounds write6.56.4$0-$5k$0-$5kNot DefinedOfficial Fix0.040.00046CVE-2023-35001
19emlog index.php information disclosure5.55.2$0-$5kCalculatingProof-of-ConceptNot Defined0.020.00300CVE-2021-3293
20Linux Kernel DECnet Socket null pointer dereference5.45.2$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.000.00504CVE-2023-3338

IOC - Indicator of Compromise (26)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
11.9.5.38ScanBox12/24/2020verifiedHigh
245.77.237.24345.77.237.243.vultrusercontent.comScanBox02/16/2024verifiedHigh
350.2.24.211ScanBox12/24/2020verifiedHigh
466.197.231.62ScanBox01/01/2021verifiedHigh
569.197.146.80ScanBox01/01/2021verifiedHigh
669.197.183.142us-mci1-16.renders.prerender.ioScanBox01/01/2021verifiedHigh
7XX.XXX.XXX.XXXXxxxxxx01/01/2021verifiedHigh
8XX.XXX.XXX.XXXXxxxxxx01/01/2021verifiedHigh
9XX.XXX.XXX.XXXxx-xxxx-xx.xxxxxxx.xxxxxxxxx.xxXxxxxxx01/01/2021verifiedHigh
10XX.XX.XXX.XXXxxxxxxxxxxxxxxxxxxxxxxxxx.xxxXxxxxxx12/24/2020verifiedHigh
11XXX.XX.XXX.XXXXxxxxxx12/24/2020verifiedHigh
12XXX.XXX.XXX.XXXXxxxxxx12/24/2020verifiedHigh
13XXX.XX.XX.XXXXxxxxxx12/24/2020verifiedHigh
14XXX.XX.XX.XXXXxxxxxx01/01/2021verifiedHigh
15XXX.XX.XX.XXXXxxxxxx02/16/2024verifiedHigh
16XXX.XXX.XXX.XXXxxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxxx02/16/2024verifiedHigh
17XXX.XXX.XXX.XXxxx-xxx-xxx-xx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxxx02/16/2024verifiedHigh
18XXX.XXX.XXX.XXxx.xx.xxxx.xxxxxx.xxxxxxxxx.xxxXxxxxxx12/24/2020verifiedHigh
19XXX.XX.XX.XXXxxxxxxx.xxxxxxxxxxxxxx.xx.xxXxxxxxx01/01/2021verifiedHigh
20XXX.XX.XXX.XXXxxx-xx-xxx-x.xx.xxx.xxxxx-xxxxx.xxxxxxxxxx.xxxXxxxxxx01/01/2021verifiedHigh
21XXX.XX.XX.Xxxx-xx-xx-x.xx.xxxxxx.xxxxx-xxxxxx.xxxxxxxxxx.xxxXxxxxxx01/01/2021verifiedHigh
22XXX.XX.XXX.XXXxxx-xx-xxx-x.xx.xxxxxx.xxxxx-xxxxx.xxxxxxxxxx.xxxXxxxxxx01/01/2021verifiedHigh
23XXX.XXX.XX.XXx.x.xxxxx.xxXxxxxxx01/01/2021verifiedHigh
24XXX.XX.XX.XXXxxx.xx.xx.xxx.xxxxxxxxxxxxxxxx.xxxXxxxxxx02/16/2024verifiedHigh
25XXX.X.XXX.XXXxxxxxx01/01/2021verifiedHigh
26XXX.X.XXX.XXXxxxxxx01/01/2021verifiedHigh

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (83)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/cgi-bin/wapopenpredictiveHigh
2File/proc/self/setgroupspredictiveHigh
3File/secure/QueryComponent!Default.jspapredictiveHigh
4File/userRpm/PingIframeRpm.htmpredictiveHigh
5File/webman/info.cgipredictiveHigh
6File/wp-admin/options.phppredictiveHigh
7Fileadclick.phppredictiveMedium
8Fileaddentry.phppredictiveMedium
9Fileand/orpredictiveLow
10Filexxxxxx.xxxxxx.xxxpredictiveHigh
11Filexxx.xxxpredictiveLow
12Filexxxxxx.xpredictiveMedium
13Filexxx-xxx/xxxxxxpredictiveHigh
14Filexxxxxx.xxx.xxxpredictiveHigh
15Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
16Filexxxx-xxxxx.xxxpredictiveHigh
17Filexxxxxxxxx.xxx.xxxpredictiveHigh
18Filexxxxxxx.xxxpredictiveMedium
19Filexxxxxxxxxxxx_xxxx.xxxpredictiveHigh
20Filexxxxxxx/xxxxxxxxxxx.xxxpredictiveHigh
21Filexxx/xxxxxx.xxxpredictiveHigh
22Filexxxxx.xxxpredictiveMedium
23Filexxxx_xxxx.xxxpredictiveHigh
24Filexxx.xxxxpredictiveMedium
25Filexxxxxxxxx/xxxxxxx/xxxxx.xxxpredictiveHigh
26Filexxxxxx/xxx/xxxxxxxx.xpredictiveHigh
27Filexxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
28Filexxxxxx.xxxpredictiveMedium
29Filexxx/xxxxxxxxx.xxpredictiveHigh
30Filexxxxxx.xxxpredictiveMedium
31Filexxx/xxx/xx_xxx.xpredictiveHigh
32Filexxx/xxxxxxxxx/xxx_xxxxxxxxx.xpredictiveHigh
33Filexxxxxxx.xxxpredictiveMedium
34Filexxxxxxxxxx.xxxpredictiveHigh
35Filexxxx/xxxxxxxxx.xxxpredictiveHigh
36Filexxxxx.xxxpredictiveMedium
37Filexxxxxxxxxxxxxxx.xxxpredictiveHigh
38Filexxxxxxxxxxxxxxxxxx.xxxpredictiveHigh
39Filexxxxxxxx.xxxpredictiveMedium
40Filexxxxxxxxxxxxxxx.xxxpredictiveHigh
41Filex/xxxxx.xxxpredictiveMedium
42Filexxx_xxxx_xxxxxx.xxxpredictiveHigh
43Filexxxxxxx.xxx/xxxxxxx.xxxxxxxxxxxx/xxxxxxx/xxxxxxxxx/xxxxxxxxx.xxxx.xxpredictiveHigh
44Filexxxx-xxxxxxx.xxxpredictiveHigh
45Filexxxx.xxxxx.xxxxxxpredictiveHigh
46Filexx-xxxxx.xxxpredictiveMedium
47Libraryxxx/xxxxxxxxx.xxpredictiveHigh
48Libraryxxxx.xxxxxpredictiveMedium
49Argument$_xxxxxpredictiveLow
50Argumentxxxxx_xxxxpredictiveMedium
51ArgumentxxxxxxxxpredictiveMedium
52ArgumentxxxxxxxxpredictiveMedium
53ArgumentxxxxxxxxxxpredictiveMedium
54ArgumentxxxxxpredictiveLow
55Argumentxxxx_xxpredictiveLow
56ArgumentxxxxxxxxxxxxxxxxpredictiveHigh
57Argumentx_xxpredictiveLow
58ArgumentxxxxxxxxxxpredictiveMedium
59ArgumentxxxxxxxxpredictiveMedium
60ArgumentxxxxpredictiveLow
61Argumentxxxx/xxxxxx/xxxpredictiveHigh
62ArgumentxxpredictiveLow
63ArgumentxxxxxxxxpredictiveMedium
64Argumentxxx_xxxxxxx_xxxpredictiveHigh
65Argumentxxxx/xxxxxxxx/xxx/xxx/xxxxxxxx/xxxxxxxpredictiveHigh
66ArgumentxxxxxxxxxxxxxxxxxxxxxxxpredictiveHigh
67ArgumentxxxxxxpredictiveLow
68ArgumentxxxxpredictiveLow
69ArgumentxxxxxxxxpredictiveMedium
70ArgumentxxxxxxpredictiveLow
71Argumentxxxx_xxxxxpredictiveMedium
72Argumentxxxxxxxxxx_xxxxpredictiveHigh
73ArgumentxxxxxxxxxxxpredictiveMedium
74ArgumentxxxxpredictiveLow
75ArgumentxxxxxxpredictiveLow
76Argumentxxxxxxxxx: xpredictiveMedium
77ArgumentxxxpredictiveLow
78ArgumentxxxxxxpredictiveLow
79ArgumentxxxxxxxxpredictiveMedium
80Argumentxxxxxxxx/xxxxxxxxpredictiveHigh
81ArgumentxxxxpredictiveLow
82Input Value../..predictiveLow
83Network Portxxx/xxxxpredictiveMedium

References (4)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!