Space Pirates Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (183)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	152
zh	12
ja	6
es	4
sv	4

Country

us	106
cn	64
jp	4
it	2

Actors

Space Pirates	12
Cobalt Strike	5
Magniber	1
Shuckworm	1
PlugX	1

Activities

Interest

Timeline

Type

Not Defined	50
Content Management System	10
Programming Language Software	6
Router Operating System	6
Database Administration Software	4

Vendor

Not Defined	58
Microsoft	4
Cisco	4
Tencent	4
Apache	4

Product

WordPress	8
PHP	6
phpMyAdmin	4
EyouCMS	4
Wowza Streaming Engine	4

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.04	0.01847	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	1.51	0.00954	CVE-2010-0966
3	PHP phpinfo cross site scripting	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.14	0.08985	CVE-2006-0996
4	WordPress URL Validator redirect	6.6	6.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00995	CVE-2018-10101
5	WordPress get_the_generator cross site scripting	5.2	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.01059	CVE-2018-10102
6	PHP phpinfo cross site scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	1.59	0.00917	CVE-2007-1287
7	Google Chrome V8 Remote Code Execution	6.3	6.0	$25k-$100k	$5k-$25k	Not Defined	Official Fix	0.05	0.39318	CVE-2020-16040
8	WordPress Login Page redirect	6.2	6.0	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.01424	CVE-2018-10100
9	Wondershare Filmora NativePushService unquoted search path	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.06	0.00052	CVE-2023-31747
10	Apache RocketMQ Broker path traversal	6.3	6.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.03	0.00058	CVE-2019-17572
11	Nfec.de RechnungsZentrale authent.php4 sql injection	5.3	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.04	0.01513	CVE-2006-1954
12	Synacor Zimbra Collaboration Suite WebEx Zimlet server-side request forgery	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.72496	CVE-2020-7796
13	Basti2web Book Panel books.php sql injection	7.3	7.0	$0-$5k	$0-$5k	High	Official Fix	0.03	0.00064	CVE-2009-4889
14	Genetechsolutions Pie-Register wp-login.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00904	CVE-2013-4954
15	vsftpd deny_file unknown vulnerability	3.7	3.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.07	0.00312	CVE-2015-1419
16	DotNetNuke Cookie input validation	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.97064	CVE-2017-9822
17	Apple Mac OS X Server Profile Manager input validation	7.5	6.5	$5k-$25k	$0-$5k	Unproven	Official Fix	0.03	0.02526	CVE-2013-0269
18	Tigran Abrahamyan PHPEcho CMS Smarty.class.php fetch code injection	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00635	CVE-2008-7034
19	Observium Network Monitor rrdtool.inc.php command injection	6.3	6.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.05	0.00000
20	Harbor improper authentication	6.9	6.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00065	CVE-2022-46463

IOC - Indicator of Compromise (17)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	45.76.145.22	45.76.145.22.vultrusercontent.com	Space Pirates	07/28/2022	verified	High
2	45.77.16.91	45.77.16.91.vultrusercontent.com	Space Pirates	07/28/2022	verified	High
3	47.108.89.169		Space Pirates	07/28/2022	verified	High
4	103.27.109.234		Space Pirates	07/28/2022	verified	High
5	XXX.XXX.XXX.XXX		Xxxxx Xxxxxxx	07/28/2022	verified	High
6	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxxxx	07/28/2022	verified	High
7	XXX.XX.XXX.XXX		Xxxxx Xxxxxxx	07/28/2022	verified	High
8	XXX.XX.XXX.XXX		Xxxxx Xxxxxxx	07/28/2022	verified	High
9	XXX.X.XXX.XX		Xxxxx Xxxxxxx	07/28/2022	verified	High
10	XXX.XXX.XX.XX	xxx.xxx.xx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxxxx	07/28/2022	verified	High
11	XXX.XX.XX.XXX		Xxxxx Xxxxxxx	07/28/2022	verified	High
12	XXX.XXX.XXX.XXX		Xxxxx Xxxxxxx	07/28/2022	verified	High
13	XXX.XXX.XX.XXX		Xxxxx Xxxxxxx	07/28/2022	verified	High
14	XXX.XXX.XXX.XXX		Xxxxx Xxxxxxx	07/28/2022	verified	High
15	XXX.XXX.XXX.XXX		Xxxxx Xxxxxxx	07/28/2022	verified	High
16	XXX.XXX.XX.XX	xxx.xxx.xx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxxxx	07/28/2022	verified	High
17	XXX.XXX.XXX.XX	xxx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxx Xxxxxxx	07/28/2022	verified	High

TTP - Tactics, Techniques, Procedures (14)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22	Pathname Traversal	predictive	High
2	T1055	CWE-74	Injection	predictive	High
3	T1059	CWE-94	Cross Site Scripting	predictive	High
4	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	High
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	X2xx Xxxxxxxxxxxxxxxx: Xxxx Xxxxxx Xxxxxxxxxxx Xxx Xxx Xxxxxxx	predictive	High
6	TXXXX.XXX	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	High
7	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxxxx Xxxxxxxx	predictive	High
8	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
12	TXXXX	CWE-XXX	Xxx.xxx Xxxxxxxxxxxxxxxx: Xxxxxxxx Xx Xxxxxxxxxxxxx Xxxx	predictive	High
13	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	High
14	TXXXX	CWE-XXX	Xxxxxxxxxxxxx	predictive	High

IOA - Indicator of Attack (71)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/controller/Index.php	predictive	High
2	File	/GetCSSashx/?CP=%2fwebconfig	predictive	High
3	File	/includes/rrdtool.inc.php	predictive	High
4	File	/login.php	predictive	Medium
5	File	/rom	predictive	Low
6	File	/srv/www/htdocs	predictive	High
7	File	admin/killsource	predictive	High
8	File	api_poller.php	predictive	High
9	File	xxxxxxxxxxx.xxx	predictive	High
10	File	xxxxxxx.xxxx	predictive	Medium
11	File	xxx/xxx.x	predictive	Medium
12	File	xxxxx.xxx	predictive	Medium
13	File	xxxxxxxx/xxxxxxxxxx.xxxx	predictive	High
14	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
15	File	xxxxxxxxx.xxx	predictive	High
16	File	xxxxxxx/xxxxxxxx.xxx	predictive	High
17	File	xxxxxxxxxxx.xxx	predictive	High
18	File	xxx/xxxxxx.xxx	predictive	High
19	File	xxxxxxx/xxx_xxxxx_xxxxxx.xxx	predictive	High
20	File	xxxxx.xxx	predictive	Medium
21	File	xxxxxxx/xxxxxxxxxxxxx.xxxx	predictive	High
22	File	xxxx_xxxx.xxx	predictive	High
23	File	xxxxxx.x	predictive	Medium
24	File	xxxx_xxxxxx.xxx	predictive	High
25	File	xxxxxxxxxxxx.xxx	predictive	High
26	File	xxxxxxx/xxxxxxxxxxxxxxxx/xxxxxxxxx/xxxxxxxx.xxxx	predictive	High
27	File	xxxxxxxxxx.xxx	predictive	High
28	File	xxxxxxxx_xxxx.xxx	predictive	High
29	File	xxxxxxx.x	predictive	Medium
30	File	xxxxxx.xxx	predictive	Medium
31	File	xxxx.xxx	predictive	Medium
32	File	xxxxxx/xxxxxx.xxxxx.xxx	predictive	High
33	File	xxx/xxxxxxxx.x	predictive	High
34	File	xxxxxxx_xxxxx.xxx	predictive	High
35	File	xxx_xxxxxx.xxx	predictive	High
36	File	xx-xxxxx/xxxxx.xxx?xxxx=xxxxxxxxx_xxxxxxxx_xxxxxxx&xxx=xxxxxxxx_xxxxx	predictive	High
37	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
38	File	xx-xxxxxxxx/xxxxxxxxx.xxx	predictive	High
39	File	xx-xxxxxxxx/xxxx-xxx/xxxxxxxxx/xxxxx-xx-xxxx-xxxxx-xxxxxxxxxx.xxx	predictive	High
40	File	xx-xxxxx.xxx	predictive	Medium
41	File	xx-xxxxxxxx.xxx	predictive	High
42	File	xxx/xxxx.xxx	predictive	Medium
43	File	xx_xxxxx/xxxxxx/xxxxxxxxx/xxxxxx_xxxx.xxx	predictive	High
44	Library	xxxxxxxxxx/xxxxx_xxx.x	predictive	High
45	Argument	xxx_xx	predictive	Low
46	Argument	xxxxxxxx	predictive	Medium
47	Argument	xxxxxx	predictive	Low
48	Argument	xxx	predictive	Low
49	Argument	xxxxxxxxxx	predictive	Medium
50	Argument	xxx	predictive	Low
51	Argument	xxxx_xx	predictive	Low
52	Argument	xxxxxx	predictive	Low
53	Argument	xxxxxxxx	predictive	Medium
54	Argument	xx	predictive	Low
55	Argument	xx	predictive	Low
56	Argument	xxxx	predictive	Low
57	Argument	xxx	predictive	Low
58	Argument	xxxxx	predictive	Low
59	Argument	xxxxx	predictive	Low
60	Argument	xxxxxxxx	predictive	Medium
61	Argument	xxx_xx	predictive	Low
62	Argument	xxx_xxxxx	predictive	Medium
63	Argument	xxx	predictive	Low
64	Argument	xxxx	predictive	Low
65	Argument	xxxx_xxxxx	predictive	Medium
66	Argument	\xxx\	predictive	Low
67	Argument	_xxxxx	predictive	Low
68	Argument	_xxxxxx_xxxxxxx_xxxx	predictive	High
69	Input Value	..	predictive	Low
70	Input Value	/xxxx.xxx	predictive	Medium
71	Network Port	xxx/xxxxx	predictive	Medium

References (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!