Ursu Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (54)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	32
ja	10
zh	8
fr	2
jp	2

Country

cn	18
jp	14
us	10
ru	8

Actors

Ursu	6
Nanocore RAT	1
Cobalt Strike	1

Activities

Interest

Timeline

Type

Not Defined	14
Smartphone Operating System	8
Groupware Software	4
Social Network Software	4
Content Management System	4

Vendor

Not Defined	20
Google	8
Intel	4
Splunk	2
Zarafa	2

Product

Google Android	8
Dolphin	4
Unisoc T610	4
Unisoc T606	4
Unisoc T760	4

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	CTI	EPSS	CVE
1	Google Android Qualcomm Bootloader access control	8.3	8.0	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00	0.00062	CVE-2016-10276
2	Synacor Zimbra Collaboration xml external entity reference	8.5	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00441	CVE-2016-9924
3	Asus AsusWRT start_apply.htm os command injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.01350	CVE-2018-20334
4	Movable Type sql injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00249	CVE-2016-5742
5	Google Android Pendingintent access control	7.3	6.1	$25k-$100k	$0-$5k	Unproven	Official Fix	0.02	0.00103	CVE-2014-8609
6	Simple Machines Forum LogInOut.php code injection	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00489	CVE-2016-5727
7	Thymeleaf/spring-boot-admin HTML File sandbox	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00055	CVE-2023-38286
8	Lapce race condition	7.0	7.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00053	CVE-2023-3891
9	Intel QAT Driver out-of-bounds write	8.0	7.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00043	CVE-2022-21804
10	node-uuid GUID entropy	5.6	5.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.02	0.00246	CVE-2015-8851
11	Microsoft Windows SmartScreen authorization	5.2	5.0	$25k-$100k	$5k-$25k	Functional	Official Fix	0.02	0.00499	CVE-2023-24880
12	Brave Browser ipfs Scheme denial of service	5.4	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.08	0.00138	CVE-2022-47932
13	Quassel quasselcore datastreampeer.cpp processMessage(const memory corruption	8.5	8.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.01620	CVE-2018-1000178
14	Unisoc S8000 WLAN Driver stack-based overflow	6.0	6.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00042	CVE-2022-44448
15	PostgreSQL Non-Temporary Object sql injection	7.2	7.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00239	CVE-2022-1552
16	Ivanti Pulse Connect Secure Header request smuggling	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.07	0.00053	CVE-2022-21826
17	Intel Wireless Bluetooth/Killer Bluetooth out-of-bounds	5.7	5.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00044	CVE-2021-23179
18	Zoom Client for Meetings Auto Update data authenticity	8.5	8.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00042	CVE-2022-28757
19	Dolphin photos_gallery.php privileges management	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.43987	CVE-2006-4189
20	Dolphin profile_video.php privileges management	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.43987	CVE-2006-4189

IOC - Indicator of Compromise (50)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	14.0.32.88		Ursu	07/22/2021	verified	High
2	14.0.63.141		Ursu	07/22/2021	verified	High
3	14.11.5.18	M014011005018.v4.enabler.ne.jp	Ursu	07/22/2021	verified	High
4	15.11.35.18		Ursu	07/22/2021	verified	High
5	23.3.13.88	a23-3-13-88.deploy.static.akamaitechnologies.com	Ursu	07/22/2021	verified	High
6	27.254.66.8	asn4.hostneverdie.com	Ursu	06/19/2022	verified	High
7	34.117.237.239	239.237.117.34.bc.googleusercontent.com	Ursu	08/29/2021	verified	Medium
8	35.162.37.28	ec2-35-162-37-28.us-west-2.compute.amazonaws.com	Ursu	07/22/2021	verified	Medium
9	44.230.33.128	ec2-44-230-33-128.us-west-2.compute.amazonaws.com	Ursu	07/22/2021	verified	Medium
10	44.236.48.31	ec2-44-236-48-31.us-west-2.compute.amazonaws.com	Ursu	08/29/2021	verified	Medium
11	XX.XXX.X.XXX	xx-xxx-x-xxx.xxxxx-xx.xxxxx.xxx	Xxxx	12/18/2021	verified	High
12	XX.XXX.XXX.XXX	xxx.xxx.xxx.xx.xx.xxx	Xxxx	07/22/2021	verified	High
13	XX.XXX.XXX.XX	xxxx.xxxxxxx.xxx	Xxxx	05/22/2022	verified	High
14	XX.XX.XXX.XXX	xxx.xxxxx.xx	Xxxx	07/22/2021	verified	High
15	XXX.XX.XXX.XX		Xxxx	04/08/2022	verified	High
16	XXX.XXX.XXX.X		Xxxx	03/21/2023	verified	High
17	XXX.XXX.XXX.X		Xxxx	03/21/2023	verified	High
18	XXX.XXX.XXX.X		Xxxx	03/21/2023	verified	High
19	XXX.XXX.XXX.XX		Xxxx	03/21/2023	verified	High
20	XXX.XXX.XXX.XX		Xxxx	03/21/2023	verified	High
21	XXX.XXX.XXX.XX		Xxxx	03/21/2023	verified	High
22	XXX.XXX.XXX.XXX		Xxxx	03/21/2023	verified	High
23	XXX.XXX.XXX.X		Xxxx	03/21/2023	verified	High
24	XXX.XXX.XXX.X		Xxxx	03/21/2023	verified	High
25	XXX.XXX.XXX.X		Xxxx	03/21/2023	verified	High
26	XXX.XXX.XXX.X		Xxxx	03/21/2023	verified	High
27	XXX.XXX.XXX.XX		Xxxx	03/21/2023	verified	High
28	XXX.XXX.XXX.XX		Xxxx	03/21/2023	verified	High
29	XXX.XX.XXX.XXX		Xxxx	05/22/2022	verified	High
30	XXX.XXX.XX.XXX	xxxxxxxx-xx-xxx.xxxxx.xxx	Xxxx	12/18/2021	verified	High
31	XXX.XX.XXX.X		Xxxx	03/21/2023	verified	High
32	XXX.XX.XXX.X		Xxxx	03/21/2023	verified	High
33	XXX.XX.XXX.X		Xxxx	03/21/2023	verified	High
34	XXX.XX.XXX.X		Xxxx	03/21/2023	verified	High
35	XXX.XX.XXX.XX		Xxxx	03/21/2023	verified	High
36	XXX.XX.XXX.XX		Xxxx	03/21/2023	verified	High
37	XXX.XX.XXX.XX		Xxxx	03/21/2023	verified	High
38	XXX.XX.XXX.XXX		Xxxx	03/21/2023	verified	High
39	XXX.XX.XXX.XXX		Xxxx	03/21/2023	verified	High
40	XXX.XX.XXX.XXX		Xxxx	03/21/2023	verified	High
41	XXX.XX.XXX.XXX		Xxxx	03/21/2023	verified	High
42	XXX.XX.XXX.XX	xxxx.xxxxxxxxxxx.xxx	Xxxx	07/22/2021	verified	High
43	XXX.XXX.XX.XX		Xxxx	07/23/2021	verified	High
44	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx-xxxx.xxxxxxxxxxxx.xxx	Xxxx	07/22/2021	verified	High
45	XXX.XX.XX.XX		Xxxx	07/22/2021	verified	High
46	XXX.XXX.XXX.XX	xxxx.xxxxx.xxx	Xxxx	07/22/2021	verified	High
47	XXX.XXX.XX.XXX	xxx.xxx.xx.xxx.xxxxx.xxx	Xxxx	07/22/2021	verified	Medium
48	XXX.XXX.XX.XXX	xxxxx.xxx-xxx-xx.xxxxxx.xxxxxxxxxxxx.xxx	Xxxx	07/23/2021	verified	High
49	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx.xxxxx-xx.xxxxx.xxx	Xxxx	12/18/2021	verified	High
50	XXX.XXX.XXX.XXX	xxx-xxx-xxx-xxx.xxxxx-xx.xxxxx.xxx	Xxxx	12/18/2021	verified	High

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1059	CWE-94	Argument Injection	predictive	High
2	T1059.007	CWE-79	Cross Site Scripting	predictive	High
3	T1068	CWE-264, CWE-269	Execution with Unnecessary Privileges	predictive	High
4	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
5	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
6	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
7	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
8	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
9	TXXXX.XXX	CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High
10	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High
11	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxx	predictive	High

IOA - Indicator of Attack (21)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	$SPLUNK_HOME/etc/splunk-launch.conf	predictive	High
2	File	/config/getuser	predictive	High
3	File	/start_apply.htm	predictive	High
4	File	xxxxxxxxxxxxxx.xxx	predictive	High
5	File	xxxxxxx_xxxx.xxxx.xxx/xxxxxxx_xxxx.xxx	predictive	High
6	File	xxxxxx.xxxx	predictive	Medium
7	File	xxxxxxxx.xxx	predictive	Medium
8	File	xxxxxx_xxxxxxx.xxx	predictive	High
9	File	xxxxxxx_xxxxx.xxx	predictive	High
10	File	xxxxxx.xxx	predictive	Medium
11	File	xxxxxxxxxxxx.xxx	predictive	High
12	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	predictive	High
13	File	xxxxxx.xxx	predictive	Medium
14	Argument	$_xxxxxx['xxxx_xxxx_xxxxx']	predictive	High
15	Argument	xxxxxxxxxxxxx/xxxxxxxxxxxxx	predictive	High
16	Argument	xxxxxxx-xxxxxx	predictive	High
17	Argument	xxx[xxx]	predictive	Medium
18	Argument	xx_xxxxx	predictive	Medium
19	Argument	xxxxx_xxx	predictive	Medium
20	Input Value	xxx.xxx[xxxxx]	predictive	High
21	Pattern	\|xx\|xx\|xx\|	predictive	Medium

References (10)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!