UNC2198 Analysis

IOB - Indicator of Behavior (380)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en346
de10
ja4
fr4
zh4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us70
cn26
ir20
pw14
ru10

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Microsoft Windows12
Hindu Matrimonial Script8
Apple iOS6
Apple iPadOS6
Palo Alto PAN-OS4

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25k$0-$5kHighWorkaround0.040.01847CVE-2007-1192
2Redis Lua sandbox6.36.3$0-$5k$0-$5kNot DefinedNot Defined0.070.97299CVE-2022-0543
3SourceCodester Online Computer and Laptop Store sql injection6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.060.00063CVE-2023-1958
4NCH Axon PBX cross site scripting3.53.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.030.00058CVE-2021-37456
5Image Sharing Script postComment.php Stored cross site scripting3.53.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.040.00000
6Image Sharing Script searchpin.php Reflected cross site scripting3.53.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.000.00000
7Oracle Enterprise Manager Application Testing Suite deserialization9.89.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.030.00374CVE-2016-5019
8Oracle Retail Order Broker Order Broker Foundation xml external entity reference6.56.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.05948CVE-2015-0250
9Oracle Communications Network Intelligence deserialization9.19.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.060.00982CVE-2015-7501
10Image Sharing Script followBoard.php Error sql injection6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.000.00000
11Image Sharing Script categorypage.php Reflected cross site scripting3.53.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.000.00000
12Business Networking Script home.php cross site scripting3.53.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.010.00000
13Oracle Enterprise Manager deserialization9.89.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.060.00374CVE-2016-5019
14ningzichun Student Management System Password Reset resetPassword.php password recovery7.67.4$0-$5k$0-$5kProof-of-ConceptNot Defined0.070.00258CVE-2023-3007
15SourceCodester Online Payroll System cashadvance_row.php sql injection7.57.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.000.00077CVE-2023-1849
16Apple iOS/iPadOS IOMobileFrameBuffer memory corruption7.87.5$25k-$100k$0-$5kHighOfficial Fix0.040.00083CVE-2021-30807
17PHP Scripts Mall PHP Multivendor Ecommerce my_wishlist.php cross site scripting5.24.8$0-$5k$0-$5kNot DefinedNot Defined0.040.00087CVE-2017-17958
18Oracle MySQL Server Logging denial of service4.03.9$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00047CVE-2017-3317
19SourceCodester AC Repair and Services System HTTP POST Request sql injection6.35.7$0-$5k$0-$5kProof-of-ConceptNot Defined0.770.00076CVE-2023-3619
20SmartWeb Infotech Job Board My Profile Page account unrestricted upload7.57.3$0-$5k$0-$5kProof-of-ConceptNot Defined0.280.00091CVE-2023-3504

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (241)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/+CSCOE+/logon.htmlpredictiveHigh
2File/.dbus-keyringspredictiveHigh
3File/?p=productspredictiveMedium
4File/addQuestion.phppredictiveHigh
5File/admin/predictiveLow
6File/admin/addemployee.phppredictiveHigh
7File/admin/api/theme-edit/predictiveHigh
8File/admin/attendance_row.phppredictiveHigh
9File/admin/cashadvance_row.phppredictiveHigh
10File/admin/cms.phppredictiveHigh
11File/admin/deduction_row.phppredictiveHigh
12File/admin/employee_row.phppredictiveHigh
13File/admin/featured.phppredictiveHigh
14File/admin/login.phppredictiveHigh
15File/admin/maintenance/brand.phppredictiveHigh
16File/admin/payment.phppredictiveHigh
17File/admin/photo.phppredictiveHigh
18File/admin/read.php?mudi=getSignalpredictiveHigh
19File/admin/searchview.phppredictiveHigh
20File/admin/students/manage.phppredictiveHigh
21File/ajax-files/followBoard.phppredictiveHigh
22File/ajax-files/postComment.phppredictiveHigh
23File/ajax.php?action=read_msgpredictiveHigh
24File/anony/mjpg.cgipredictiveHigh
25File/api/wechat/app_authpredictiveHigh
26File/artist-display.phppredictiveHigh
27File/bsms_ci/index.phppredictiveHigh
28File/xxxxxxxxxxxx.xxxpredictiveHigh
29File/xxx-xxx/xxxxxxxx.xxxpredictiveHigh
30File/xxxxxxx/xxxxxx.xxx?x=xxxxxx_xxx_xxxxxxxxpredictiveHigh
31File/xxxxxxx/xxxxx.xxx?x=xxxxpredictiveHigh
32File/xxxxxxpredictiveLow
33File/xxxx/xxxxx-xxxxx.xxxpredictiveHigh
34File/xxxxx/xxxxxxxx-xxxxxxx.xxxpredictiveHigh
35File/xxxx.xxxpredictiveMedium
36File/xxxxx.xxxpredictiveMedium
37File/xxxx/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxpredictiveHigh
38File/xxx/xxxxx?xxxxx=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&xxxxx=xxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxpredictiveHigh
39File/xxxxxx-xxxxxxxxx.xxxpredictiveHigh
40File/xxxxxxxxxx/xxx/xxx_xxxxxxxxxx/xxxxxx_xxxxxx_xxxxxpredictiveHigh
41File/xxxxxxxxx.xxxpredictiveHigh
42File/xxxxx-xxxxxx-xxxxxxxx-xxxxxx/xxxxxxx-xxxx.xxxpredictiveHigh
43File/xxx-xxx/xxxxx/predictiveHigh
44File/xxxxxxx/xxxxxxxxxxxxxx.xxx?xxxx=xpredictiveHigh
45File/xxxx-xxxxxx-xxxxxx/xxxxxx_xxxxxxxx.xxxpredictiveHigh
46File/xxxxxxxx.xxxpredictiveHigh
47File/xxxxxxxxx.xxxpredictiveHigh
48File/xxxx_xxxxx.xxx?xxxxxxxxx=xxxxxxxpredictiveHigh
49File/xxxxxxxx/xxxx/xxxxxxxxpredictiveHigh
50File/xxxxxxxx/xxxxxxxpredictiveHigh
51File/xxxxxxx.xxxpredictiveMedium
52File/xxxxxxxx/xxxxpredictiveHigh
53File/xxxpredictiveLow
54File/xxxxxxxxxx.xxxpredictiveHigh
55File/xxxx/?xxxx=xx_xxxxxxxxpredictiveHigh
56Filexxxxx.xxx&x=xxxxxxx/xxxxxxxxxxxx/xxxxpredictiveHigh
57Filexxxxx/predictiveLow
58Filexxxxx/xxxx-xxxxx.xxxpredictiveHigh
59Filexxxxx/xxxxxxxx.xxx?xxxx=xxxxxxxxxxpredictiveHigh
60Filexxxxx/xxxxxx/xxxxxxxx/xxxxxxxxx_xxxxxxpredictiveHigh
61Filexxxxx\xxxxxxxxx\xxxx_xxxxxxx.xxxpredictiveHigh
62Filexxxxx/xxxxxxxx/xx-xxx/xx_xxxxxxx.xpredictiveHigh
63Filexxxxxxxxxxxxx.xxxpredictiveHigh
64Filexxxxxxxxx.xpredictiveMedium
65Filexxx/xxxxxxxxxx/xx/xxxxxxxxxxxxxxxx.xxxpredictiveHigh
66Filexxx/xxxxxx/xxxxxxxx.xxpredictiveHigh
67Filexxxx-xxxxxxx.xpredictiveHigh
68Filexxxxx-xxxx/xxxxxx.xpredictiveHigh
69Filexxxxxxx/xxxxx/xxxxxxxxpredictiveHigh
70Filexxxxxxx.xxxpredictiveMedium
71Filexxx_xxxxxxxxx.xxxpredictiveHigh
72Filexxxx.xxxpredictiveMedium
73Filexxxxxxxxx.xxxpredictiveHigh
74Filexxx/xxxxx/xxxxxxxxx/xxxxxxxxxx/xxxxxxxxxxxxxpredictiveHigh
75Filexxxxxxxxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
76Filexxxx/xxxxxxxxxxxxxxx.xxxpredictiveHigh
77Filexxxxxx.xxxpredictiveMedium
78Filexxxxxx.xxxxpredictiveMedium
79Filexxxxxxxxxxx.xxxpredictiveHigh
80Filexxx/xxxx/xxxx.xpredictiveHigh
81Filexxxx.xxxpredictiveMedium
82Filexxxxxx/xxxxxxxxpredictiveHigh
83Filexxx-xxxxx.xxxxpredictiveHigh
84Filexxxxxx/xxxxxxxxxx/xxxxxxx/xxxxx.xxxpredictiveHigh
85Filexxxxxx.xxxpredictiveMedium
86Filexxxxxxxxxx/xxxxxx/xxxxxxxxxxx.xxpredictiveHigh
87Filexxxxxxx.xxx.xxxpredictiveHigh
88Filexxxxx.xxxpredictiveMedium
89Filexx/xxxxxxx.xpredictiveMedium
90Filexx/xxxxxx.xxxpredictiveHigh
91Filexxx.xxxpredictiveLow
92Filexxxxxx/xxxx/xxxxx-xxxxxx.xpredictiveHigh
93Filexxxxx/xxx_xxx.xpredictiveHigh
94Filexxxxxxxxxx/xxxxxxxx.xpredictiveHigh
95Filexxxxxxxxxx/xxx.xpredictiveHigh
96Filexxxxxxxxxx/xxxx.xpredictiveHigh
97Filexxxxxxx/xxx_xxx.xpredictiveHigh
98Filexxxx/xxxxxxx/xxxxx_x.xxpredictiveHigh
99Filexxxxx.xxxpredictiveMedium
100Filexxxxxx_xxxxxx.xxxpredictiveHigh
101Filexxxxxx.xxx?x=xxxx_xxxxxxxpredictiveHigh
102Filexxxx.xxxxpredictiveMedium
103Filexxxxxxxx.xxpredictiveMedium
104Filexx/xxx.xpredictiveMedium
105Filexxxxxxx/xxxxxxx/xxx_xxxxxxx.xpredictiveHigh
106Filexxx_xxxxx.xpredictiveMedium
107Filexx_xxxxxxxx.xxxpredictiveHigh
108FilexxxxpredictiveLow
109Filexxx/xxxxxxxxx/xxxxx_xxxx.xpredictiveHigh
110Filexxx/xxxx/xxxxxxx.xpredictiveHigh
111Filexxxx/xxxxx.xxxpredictiveHigh
112Filexxxxxxx.xxxpredictiveMedium
113Filexxxxxxx/xxxxxx.xxxxxxxxx/xxxxxxxxxxxxxxxx.xxxpredictiveHigh
114Filexxxxxxx/xxxx.xxxxxx/xxx/xxxxxxxxxxxxxxxxx.xxxpredictiveHigh
115Filexxxxx_xxxxxx.xxxpredictiveHigh
116Filexxxxxxxx/xxxxxxxxxxxxxxxxxxx.xxxxpredictiveHigh
117Filexxxxx.xxxpredictiveMedium
118Filexxxxxx/xxxx/xxxxxxx/xxxxx.xxpredictiveHigh
119Filexxxxxxxxxxxxx.xxxpredictiveHigh
120Filexxxxxx.xxxpredictiveMedium
121Filexxxxxxxxxxxxxxxx.xxxpredictiveHigh
122Filexxxxx.xxxpredictiveMedium
123Filexxxxxxxxxx/xx/xxxxxx.xxpredictiveHigh
124Filexxxxxxxxxxxxxxxxxxx?xxxxxx=xxxxxxxxxxxxxxxxxxxpredictiveHigh
125Filexxx/xxxxxxx-xxxx.xxxpredictiveHigh
126Filexxxxx_xxxxx.xxxpredictiveHigh
127Filexxxxxxx.xxxpredictiveMedium
128Filexxxxx_xxxxxxxxxx.xxxpredictiveHigh
129Filexxxxxxxxxxxxxxxxxx.xxxpredictiveHigh
130Filexxxxxxxxxxxxxxxxxx/xxxxx.xxpredictiveHigh
131Filexxxxxxxxx.xxxpredictiveHigh
132Filexxxxxx.xxxpredictiveMedium
133Filexxxxx/xxxxxxxxxxxx.xxxpredictiveHigh
134Filexxxx/xxxxxxxx/xxxxxxxx.xxxxpredictiveHigh
135Filexxxxx.xpredictiveLow
136Filexxxx-xxxxxxx.xxxpredictiveHigh
137Filexxxxx/xxxxxxxxxx.xxpredictiveHigh
138Filexxxxxxxxxxxxxx.xxxpredictiveHigh
139Filexx-xxxxx/xxxxx-xxx.xxx?xxxxxxx-xxxxxxxxpredictiveHigh
140Filexx-xxxxxxxxxxx.xxxpredictiveHigh
141Filexxxxxxx.xxxxpredictiveMedium
142Libraryxxxxxx[xxxxxx_xxxxpredictiveHigh
143Libraryxxxxx.xxxpredictiveMedium
144Libraryxxx/xxx/xxxxxx.xpredictiveHigh
145ArgumentxxxpredictiveLow
146Argumentxxxxxxxxx xxxxxxpredictiveHigh
147Argumentxxxxxxxxx xx xxxxxxxpredictiveHigh
148ArgumentxxxxxpredictiveLow
149Argumentxxxx/xxxxx/xxxxxxx/xxxxxxxxpredictiveHigh
150ArgumentxxxxxxxxxxxxxxxpredictiveHigh
151ArgumentxxxxxxxxxpredictiveMedium
152Argumentxx_xxxxxxxpredictiveMedium
153ArgumentxxxpredictiveLow
154Argumentxxx.xxxxxx.xxxxxxxx.xxxxxxxxxxxxxxxpredictiveHigh
155ArgumentxxxxxxxxxxxxxpredictiveHigh
156Argumentxxxxxx[xxxxxx_xxxx]predictiveHigh
157ArgumentxxxxxxxpredictiveLow
158Argumentxxxxxxxxxx.xxxxpredictiveHigh
159Argumentxxxxx_xxpredictiveMedium
160Argumentxxxxxxxxxxx_xxx_xxxxpredictiveHigh
161ArgumentxxxxpredictiveLow
162Argumentxxxx xx xxxxxxxpredictiveHigh
163ArgumentxxxxxpredictiveLow
164ArgumentxxxpredictiveLow
165ArgumentxxxxpredictiveLow
166ArgumentxxxxxxxxpredictiveMedium
167Argumentxxxxxxxxx/xxxxxxxxxx/xxxxxxxx/xxxxxxxxpredictiveHigh
168Argumentxxxxx_xxxxpredictiveMedium
169ArgumentxxxxxxxxpredictiveMedium
170Argumentxxxxx_xxpredictiveMedium
171ArgumentxxxxpredictiveLow
172Argumentxxxxxxx/xxxxxxxxxxxpredictiveHigh
173ArgumentxxpredictiveLow
174ArgumentxxxpredictiveLow
175ArgumentxxxxxxxpredictiveLow
176ArgumentxxxpredictiveLow
177ArgumentxxxxpredictiveLow
178Argumentxxx_xxpredictiveLow
179Argumentxxxx/xxxxxxxxxxxpredictiveHigh
180Argumentxxxxx_xxpredictiveMedium
181ArgumentxxxxpredictiveLow
182ArgumentxxxxxxxpredictiveLow
183ArgumentxxpredictiveLow
184Argumentxxxx_xxpredictiveLow
185Argumentxxxxxxxx_xxxpredictiveMedium
186ArgumentxxxxxpredictiveLow
187ArgumentxxxxxxxxpredictiveMedium
188ArgumentxxxxxxxxpredictiveMedium
189ArgumentxxxxxxpredictiveLow
190ArgumentxxxxxxxpredictiveLow
191ArgumentxxxxxxxpredictiveLow
192ArgumentxxxxxxpredictiveLow
193Argumentxxxx_xxpredictiveLow
194Argumentxxxxxxx($xxxxxxxxxx)predictiveHigh
195ArgumentxxxxpredictiveLow
196ArgumentxxxxxxxxxpredictiveMedium
197ArgumentxxxxxxpredictiveLow
198ArgumentxxxpredictiveLow
199Argumentxxxx/xxxxpredictiveMedium
200Argumentxxxxxxxx->xxxxx_xxxxxxpredictiveHigh
201ArgumentxxxxxxxxxpredictiveMedium
202Argumentxxxxx_xxxxpredictiveMedium
203ArgumentxxxxxxpredictiveLow
204ArgumentxxxxpredictiveLow
205ArgumentxxxpredictiveLow
206ArgumentxxxxxpredictiveLow
207ArgumentxxxxxpredictiveLow
208ArgumentxxxxxpredictiveLow
209Argumentxxxx_xxpredictiveLow
210ArgumentxxxxxxpredictiveLow
211Argumentxxxx/xxxxpredictiveMedium
212ArgumentxxxxxxxxxxxxxxxpredictiveHigh
213ArgumentxxxxxxxxpredictiveMedium
214ArgumentxxxxxxxxpredictiveMedium
215Argumentxxxxxxxx/xxxxxxxxpredictiveHigh
216Argumentxxxxxxxx/xxxxxxxxpredictiveHigh
217ArgumentxxxxxxpredictiveLow
218Argumentx-xxxxxxxxx-xxxpredictiveHigh
219Argument__xxxxxxxxxpredictiveMedium
220Input Value"><xxx xxx=x xxxxxxx=xxxxxx(x)>predictiveHigh
221Input Value'"--></xxxxx></xxxxxx><xxxxxx>xxxxx(x)</xxxxxx>predictiveHigh
222Input Value'"><xxxxxx>xxxxx(/xxx/)</xxxxxx>predictiveHigh
223Input Value' xxx (xxxxxx xxxx xxxx(xxxxxx xxxxx(*),xxxxxx(xxxxxxxxxxxx,(xxxxxx (xxx(xxxx=xxxx,x))),xxxxxxxxxxxx,xxxxx(xxxx(x)*x))x xxxx xxxxxxxxxxx_xxxxxx.xxxxxxxxx_xxxx xxxxx xx x)x) xxx 'xxxx'='xxxxpredictiveHigh
224Input Value'xx''='predictiveLow
225Input Value(xxxxxxxxx(xxxx,xxxxxx(xxxx,xxxxxxxxxxxx,(xxxxxx (xxx(xxxx=xxxx,x))),xxxxxxxxxxxx),xxxx))predictiveHigh
226Input Value.%xx.../.%xx.../predictiveHigh
227Input Value../predictiveLow
228Input Value../../../../../xxx/xxx/xxxxx/xxxx/xxxxxxxx/xxxxx/xxx.xxxpredictiveHigh
229Input Valuex'||(xxxxxx xxxxxxxxxx xxxxx xxxx=xxxx xxx (xxxxxx xxxx xxxx(xxxxxx xxxxx(*),xxxxxx(xxxxxxxxxxxx,(xxxxxx (xxx(xxxx=xxxx,x))),xxxxxxxxxxxx,xxxxx(xxxx(x)*x))x xxxx xxxxxxxxxxx_xxxxxx.xxxxxxx xxxxx xx x)x))||'predictiveHigh
230Input Valuex' xxx xxxx=xxxx xxx 'xxxx'='xxxxpredictiveHigh
231Input ValuexxxxxxxxxxxxxxxxpredictiveHigh
232Input Value<xxx xxx=x xxxxxxx=xxxxxx(x)>predictiveHigh
233Input Value<xxxxxx>xxxxx(x)</xxxxxx>predictiveHigh
234Input Value=xx' xxx xxxx=xxxx xxx 'xxxx'='xxxxpredictiveHigh
235Input Valuexxxxx' xxx (xxxxxx xxxx xxxx (xxxxxx(xxxxx(x)))xxxx) xxx 'xxxx'='xxxx&xxxxxxxx=xxxxxxxxxxpredictiveHigh
236Input Valuexxxxx:xxxxxpredictiveMedium
237Input ValuexxxxxxpredictiveLow
238Network PortxxxxpredictiveLow
239Network Portxxx/xxxxpredictiveMedium
240Network Portxxx/xxxxpredictiveMedium
241Network Portxxx xxxxxx xxxxpredictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!