Shamoon 2 Analysisinfo

IOB - Indicator of Behavior (55)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Language

en46
ru8
zh2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

LibTIFF8
IBM Rational Collaborative Lifecycle Management6
IBM Rational Quality Manager6
IBM Rational Team Concert6
IBM Rational DOORS Next Generation6

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

These are the vulnerabilities that we have identified as researched, approached, or attacked.

#VulnerabilityBaseTemp0dayTodayExpCouKEVEPSSCTICVE
1ClamAV Antivirus AutoIt Module denial of service7.57.3$5k-$25k$0-$5kNot definedOfficial fix 0.015970.05CVE-2023-20212
2Microsoft SharePoint access control6.15.9$5k-$25k$0-$5kNot definedOfficial fix 0.088890.00CVE-2017-8569
3ALPACA improper authentication5.65.4$0-$5k$0-$5kNot definedOfficial fix 0.004500.03CVE-2021-3618
4Ditty Plugin cross site scripting3.53.4$0-$5k$0-$5kNot definedOfficial fix 0.025420.00CVE-2022-0533
5Moxa TN-4900/TN-5900 command injection7.27.2$0-$5k$0-$5kNot definedNot defined 0.003010.08CVE-2023-34217
6D-Link DAP-2660 GET Request adv_resource buffer overflow5.55.3$5k-$25k$5k-$25kNot definedNot defined 0.019140.00CVE-2023-39749
7TP-LINK TL-WR841N/TL-WR940N/TL-WR941ND WlanSecurityRpm buffer overflow7.67.5$0-$5k$0-$5kNot definedNot defined 0.145070.04CVE-2023-39747
8TP-LINK TL-WR841N/TL-WR940N/TL-WR941ND GET Request AccessCtrlAccessRulesRpm buffer overflow5.55.4$0-$5k$0-$5kNot definedNot defined 0.000840.02CVE-2023-39745
9TP-LINK TL-WR1041N V2 GET Request NetworkCfgRpm denial of service5.55.4$0-$5k$0-$5kNot definedNot defined 0.000690.08CVE-2023-39748
10Private Internet Access unquoted search path8.88.0$0-$5k$0-$5kProof-of-ConceptNot defined 0.000000.05CVE-2022-27092
11ASUS RT-AC88U Download Master Title task.asp injection5.95.3$0-$5k$0-$5kProof-of-ConceptOfficial fix 0.002380.00CVE-2020-29655
12Mole Adult Portal Script profile.php sql injection7.37.3$0-$5k$0-$5kHighUnavailablepossible0.003730.02CVE-2009-4673
134images categories.php cross site scripting4.34.3$0-$5k$0-$5kNot definedNot defined 0.002250.00CVE-2015-7708
144homepages 4images member.php cross site scripting3.53.4$0-$5k$0-$5kHighOfficial fixpossible0.010150.00CVE-2009-2131
15Kentico CMS CMS Administration Dashboard install.aspx access control8.58.2$0-$5k$0-$5kNot definedOfficial fixexpected0.895140.04CVE-2017-17736
16FileZilla Server PORT confused deputy4.34.1$0-$5k$0-$5kNot definedOfficial fix 0.000830.04CVE-2015-10003
17Microsoft SharePoint Content input validation6.36.0$5k-$25k$0-$5kNot definedOfficial fix 0.287640.00CVE-2015-1700
18Microsoft SharePoint Server cross site scripting4.84.7$0-$5k$0-$5kNot definedOfficial fix 0.023180.00CVE-2017-0107
19Microsoft SharePoint Server cross site scripting4.44.3$0-$5k$0-$5kNot definedOfficial fix 0.011020.00CVE-2017-8654
20Microsoft Excel memory corruption7.06.9$5k-$25k$0-$5kNot definedOfficial fixpossible0.432140.00CVE-2016-7236

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsIdentifiedTypeConfidence
15.254.100.200Shamoon 202/15/2024verifiedHigh
245.63.10.9945.63.10.99.vultrusercontent.comShamoon 202/15/2024verifiedHigh
3XX.XX.XXX.XXxx.xx.xxx.xx.xxxxx.xxxXxxxxxx X12/23/2020verifiedVery Low
4XX.XX.XXX.XXXxx.xx.xxx.xxx.xxxxx.xxxXxxxxxx X12/23/2020verifiedVery Low
5XX.XX.XXX.XXXxxxxxx X02/15/2024verifiedHigh
6XXX.XXX.XXX.XXXxxxxxxxxxxx.xxxXxxxxxx X02/15/2024verifiedHigh
7XXX.XXX.XXX.XXXxxxxxxxxxxxx.xxxxxxx.xxxxXxxxxxx X02/15/2024verifiedHigh

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueClassVulnerabilitiesAccess VectorTypeConfidence
1T1040CAPEC-102CWE-294Authentication Bypass by Capture-replaypredictiveHigh
2T1055CAPEC-10CWE-74Improper Neutralization of Data within XPath ExpressionspredictiveHigh
3TXXXX.XXXCAPEC-XXXCWE-XX, CWE-XXXxxxx Xxxxx Xxxx XxxxxxxxxpredictiveHigh
4TXXXXCAPEC-XXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
5TXXXXCAPEC-XXXCWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx XxxxxxxxxpredictiveHigh
6TXXXXCWE-XXX7xx Xxxxxxxx XxxxxxxxpredictiveHigh
7TXXXXCAPEC-XXXCWE-XXXxx XxxxxxxxxpredictiveHigh
8TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxx XxxxpredictiveHigh
9TXXXXCAPEC-XXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxpredictiveHigh

IOA - Indicator of Attack (30)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/adv_resourcepredictiveHigh
2File/Main_Login.asp?flag=1&productname=RT-AC88U&url=/downloadmaster/task.asppredictiveHigh
3File/userRpm/AccessCtrlAccessRulesRpmpredictiveHigh
4File/userRpm/NetworkCfgRpmpredictiveHigh
5File/xxxxxxx/xxxxxxxxxxxxxxxpredictiveHigh
6File/xxxxxx/xx/xxxxxxxxxxx.xxxpredictiveHigh
7Filexxxxx/xxxxxxxxxx.xxxpredictiveHigh
8Filexxxxxxxx.xxxpredictiveMedium
9Filexxxxxxxxxx/xxxxxxx.xxxxpredictiveHigh
10Filexxxxx.xxx/xxxx/xxxxx/xxxx/xxxx.xxxpredictiveHigh
11Filexxxxxx.xxxpredictiveMedium
12Filexxxxxxx.xxxpredictiveMedium
13Filexxx.xxx~xxxxxxxxxxxxxx!xxx/xxxxxxxxxpredictiveHigh
14Filexxx.xxx~xx~xxxx~xxx~xxxxxxx~xxxxxxxx~xxx/xxxxxxxxxxxpredictiveHigh
15Filexxx_xxxxxxxx.xpredictiveHigh
16Filexxx_xxxxxxx.xpredictiveHigh
17Filexxx_xxxxx.xpredictiveMedium
18Filexxxxx/xxxxxxxx.xpredictiveHigh
19Filexxxxx/xxxxxx.xpredictiveHigh
20Filexxxxx/xxxxxxxx.xpredictiveHigh
21Argumentxxx_xxxxxxxxxxxpredictiveHigh
22ArgumentxxxpredictiveLow
23ArgumentxxxxxpredictiveLow
24ArgumentxxxxpredictiveLow
25ArgumentxxxxxxxxxxxpredictiveMedium
26ArgumentxxxxxxxxxxxxpredictiveMedium
27Argumentxxxx_xxxxxxxxpredictiveHigh
28Argumentxxxx_xxpredictiveLow
29Input Value<xxxxxx>xxxxx(x)</xxxxxx>predictiveHigh
30Network Portxxx/xxxxpredictiveMedium

References (3)

The following list contains external sources which discuss the actor and the associated activities:

This view requires CTI permissions

Just purchase a CTI license today!