Shamoon 2 Analysis

IOB - Indicator of Behavior (54)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en48
ru4
zh2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us46
ru4
cn2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

LibTIFF8
IBM Rational Collaborative Lifecycle Management4
IBM Rational Quality Manager4
IBM Rational Team Concert4
IBM Rational DOORS Next Generation4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemEPSSCTICVE
1ClamAV Antivirus AutoIt Module denial of service7.57.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.000630.02CVE-2023-20212
2Microsoft SharePoint access control6.15.9$5k-$25kCalculatingNot DefinedOfficial Fix0.004710.00CVE-2017-8569
3Ditty Plugin cross site scripting3.53.4$0-$5k$0-$5kNot DefinedOfficial Fix0.001000.00CVE-2022-0533
4Moxa TN-4900/TN-5900 command injection7.27.2$0-$5k$0-$5kNot DefinedNot Defined0.000460.00CVE-2023-34217
5D-Link DAP-2660 GET Request adv_resource buffer overflow5.55.3$5k-$25k$5k-$25kNot DefinedNot Defined0.000820.03CVE-2023-39749
6TP-LINK TL-WR841N/TL-WR940N/TL-WR941ND WlanSecurityRpm buffer overflow7.67.5$0-$5k$0-$5kNot DefinedNot Defined0.000460.04CVE-2023-39747
7TP-LINK TL-WR841N/TL-WR940N/TL-WR941ND GET Request AccessCtrlAccessRulesRpm buffer overflow5.55.4$0-$5k$0-$5kNot DefinedNot Defined0.000460.03CVE-2023-39745
8TP-LINK TL-WR1041N V2 GET Request NetworkCfgRpm denial of service5.55.4$0-$5k$0-$5kNot DefinedNot Defined0.000460.00CVE-2023-39748
9Private Internet Access unquoted search path8.88.0$0-$5k$0-$5kProof-of-ConceptNot Defined0.000440.00CVE-2022-27092
10ASUS RT-AC88U Download Master Title injection5.95.3$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.000730.05CVE-2020-29655
11Mole Adult Portal Script profile.php sql injection7.37.3$0-$5k$0-$5kHighUnavailable0.001290.00CVE-2009-4673
124images categories.php cross site scripting4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.002150.05CVE-2015-7708
134homepages 4images member.php cross site scripting3.53.4$0-$5k$0-$5kHighOfficial Fix0.001110.00CVE-2009-2131
14Kentico CMS CMS Administration Dashboard install.aspx access control8.58.2$0-$5k$0-$5kNot DefinedOfficial Fix0.148300.04CVE-2017-17736
15FileZilla Server PORT confused deputy4.34.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000520.03CVE-2015-10003
16Microsoft SharePoint Content input validation6.36.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.047570.00CVE-2015-1700
17Microsoft SharePoint Server cross site scripting4.84.6$0-$5k$0-$5kNot DefinedOfficial Fix0.010350.00CVE-2017-0107
18Microsoft SharePoint Server cross site scripting4.44.3$0-$5k$0-$5kNot DefinedOfficial Fix0.001870.00CVE-2017-8654
19Microsoft Excel memory corruption7.06.9$5k-$25k$0-$5kNot DefinedOfficial Fix0.485590.02CVE-2016-7236
20ownCloud scan.php information disclosure8.58.3$0-$5k$0-$5kNot DefinedOfficial Fix0.004390.03CVE-2016-1499

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueClassVulnerabilitiesAccess VectorTypeConfidence
1T1040CAPEC-102CWE-294Authentication Bypass by Capture-replaypredictiveHigh
2T1055CAPEC-10CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveHigh
3TXXXX.XXXCAPEC-209CWE-XX, CWE-XXXxxxx Xxxx XxxxxxxxxpredictiveHigh
4TXXXXCAPEC-19CWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
5TXXXXCAPEC-136CWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveHigh
6TXXXXCAPEC-CWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveHigh
7TXXXXCAPEC-108CWE-XXXxx XxxxxxxxxpredictiveHigh
8TXXXX.XXXCAPEC-CWE-XXXXxxxxxxx Xxxxxx XxxxpredictiveHigh
9TXXXXCAPEC-116CWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveHigh

IOA - Indicator of Attack (30)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/adv_resourcepredictiveHigh
2File/Main_Login.asp?flag=1&productname=RT-AC88U&url=/downloadmaster/task.asppredictiveHigh
3File/userRpm/AccessCtrlAccessRulesRpmpredictiveHigh
4File/userRpm/NetworkCfgRpmpredictiveHigh
5File/xxxxxxx/xxxxxxxxxxxxxxxpredictiveHigh
6File/xxxxxx/xx/xxxxxxxxxxx.xxxpredictiveHigh
7Filexxxxx/xxxxxxxxxx.xxxpredictiveHigh
8Filexxxxxxxx.xxxpredictiveMedium
9Filexxxxxxxxxx/xxxxxxx.xxxxpredictiveHigh
10Filexxxxx.xxx/xxxx/xxxxx/xxxx/xxxx.xxxpredictiveHigh
11Filexxxxxx.xxxpredictiveMedium
12Filexxxxxxx.xxxpredictiveMedium
13Filexxx.xxx~xxxxxxxxxxxxxx!xxx/xxxxxxxxxpredictiveHigh
14Filexxx.xxx~xx~xxxx~xxx~xxxxxxx~xxxxxxxx~xxx/xxxxxxxxxxxpredictiveHigh
15Filexxx_xxxxxxxx.xpredictiveHigh
16Filexxx_xxxxxxx.xpredictiveHigh
17Filexxx_xxxxx.xpredictiveMedium
18Filexxxxx/xxxxxxxx.xpredictiveHigh
19Filexxxxx/xxxxxx.xpredictiveHigh
20Filexxxxx/xxxxxxxx.xpredictiveHigh
21Argumentxxx_xxxxxxxxxxxpredictiveHigh
22ArgumentxxxpredictiveLow
23ArgumentxxxxxpredictiveLow
24ArgumentxxxxpredictiveLow
25ArgumentxxxxxxxxxxxpredictiveMedium
26ArgumentxxxxxxxxxxxxpredictiveMedium
27Argumentxxxx_xxxxxxxxpredictiveHigh
28Argumentxxxx_xxpredictiveLow
29Input Value<xxxxxx>xxxxx(x)</xxxxxx>predictiveHigh
30Network Portxxx/xxxxpredictiveMedium

References (3)

The following list contains external sources which discuss the actor and the associated activities:

Might our Artificial Intelligence support you?

Check our Alexa App!