Wiper Analysis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (773)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	410
de	190
fr	118
it	36
es	12

Country

us	460
fr	290
it	12
de	4
cn	2

Actors

Wiper	11
Cyclops Blink	3
RuRAT	2
Emotet	1

Activities

Interest

Timeline

Type

Not Defined	162
Operating System	50
Content Management System	28
Forum Software	14
Programming Language Software	14

Vendor

Not Defined	116
Microsoft	44
Apache	18
GNU	14
Red Hat	10

Product

Microsoft Windows	26
WordPress	8
Mozilla Firefox	6
PHP	6
Linux Kernel	6

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192
2	DZCP deV!L`z Clanportal config.php code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.86	CVE-2010-0966
3	Woltlab Burning Board register.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00957	0.00	CVE-2007-1443
4	Magic Photo Storage Website register.php privileges management	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.02
5	YaBB register.pl memory corruption	10.0	8.7	$0-$5k	$0-$5k	Unproven	Official Fix	0.17348	0.00	CVE-2007-3208
6	WordPress wp-register.php cross site scripting	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.00322	0.00	CVE-2007-5105
7	Phpwebgallery register.php cross site scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00759	0.03	CVE-2007-1109
8	Expinion.net News Manager Lite comment_add.asp cross site scripting	4.3	3.8	$0-$5k	$0-$5k	Unproven	Official Fix	0.00607	0.02	CVE-2004-1845
9	Phorum register.php cross site scripting	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01601	0.02	CVE-2007-0769
10	SSReader Ultra Star Reader ActiveX Control pdg2.dll Register memory corruption	10.0	9.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.07057	0.03	CVE-2007-5892
11	SSReader Ultra Star Reader ActiveX Control register memory corruption	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.03617	0.00	CVE-2007-5807
12	StoreSprite register.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01850	0.02	CVE-2007-4307
13	AlstraSoft AskMe Pro register.php cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00
14	Microsoft Register Server denial of service	5.3	5.3	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00350	0.00	CVE-2007-3658
15	Scribe forum.php register code injection	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.02434	0.00	CVE-2007-5822
16	WordPress wp-register.php cross site scripting	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.00533	0.04	CVE-2007-5106
17	Andys Chat register.php memory corruption	10.0	10.0	$0-$5k	$0-$5k	Not Defined	Unavailable	0.03106	0.00	CVE-2006-7036
18	PBSite register.php Local Privilege Escalation	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.05
19	LushiWarPlaner register.php sql injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.00821	0.08	CVE-2007-0864
20	TeamCal register.php path traversal	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.00

IOC - Indicator of Compromise (31)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	2.230.110.137	2-230-110-137.ip201.fastwebnet.it	Wiper	05/20/2022	verified	High
2	24.199.247.222	webmail.capefearclinic.org	Wiper	05/20/2022	verified	High
3	37.71.147.186	186.147.71.37.rev.sfr.net	Wiper	05/20/2022	verified	High
4	37.99.163.162	mail.futuregrp.org	Wiper	05/20/2022	verified	High
5	50.255.126.65	50-255-126-65-static.hfc.comcastbusiness.net	Wiper	05/20/2022	verified	High
6	58.185.154.99		Wiper	01/01/2021	verified	High
7	70.62.153.174	rrcs-70-62-153-174.central.biz.rr.com	Wiper	05/20/2022	verified	High
8	XX.XXX.XX.XXX	xx-xxx-xx-xxx.xxxxxx.xxxx.xx	Xxxxx	05/20/2022	verified	High
9	XX.XX.XXX.XXX	xxxxxxxx-xxx-x-xxx-xxx.xxx-xx.xxx.xxxxxxx.xx	Xxxxx	05/20/2022	verified	High
10	XX.XXX.XX.XXX	xxxxxxxxx.xxxx.x-xxxxxxxxx.xx	Xxxxx	05/20/2022	verified	High
11	XX.XXX.XX.XXX		Xxxxx	05/20/2022	verified	High
12	XX.X.XXX.XXX	xxxx.xxxxxx.xxx.xx	Xxxxx	05/20/2022	verified	High
13	XX.XXX.XX.XXX	xxxxxxxx.xxxxxxx.xxx	Xxxxx	05/20/2022	verified	High
14	XX.XX.XXX.XX	xx-xx-xxx-xx.xxxx.xxxxxxxx.xx	Xxxxx	01/01/2021	verified	High
15	XX.XX.XXX.XXX	xxxxxxxxxxxxxx-xxx-x-xxx-xxx.xxx-xx.xxx.xxxxxxx.xx	Xxxxx	05/20/2022	verified	High
16	XX.XX.XXX.XX	xx-xx-xxx-xx.xxxxx.xxxxxxxxxx.xx	Xxxxx	05/20/2022	verified	High
17	XX.XX.XX.XXX	xx-xx-xx-xxx-xxxxxx.xxx.xxxxxxxxxxxxxxx.xxx	Xxxxx	05/20/2022	verified	High
18	XXX.XX.XXX.XXX	xxx-xx-xxx-xxx.xxxxxx-xx.xxxxxxxxxxx.xxx	Xxxxx	05/20/2022	verified	High
19	XXX.XXX.XXX.XXX		Xxxxx	05/20/2022	verified	High
20	XXX.XXX.XX.XXX	xx-xxx-xxx-xxx-xxx.xxxx.xxxxx.xxxxxxxx-xx.xx	Xxxxx	05/20/2022	verified	High
21	XXX.X.XXX.XXX	xxx-x-xxx-xxx.xxxxx.xxxxxxxxxx.xx	Xxxxx	05/20/2022	verified	High
22	XXX.XX.XXX.XX		Xxxxx	05/20/2022	verified	High
23	XXX.XXX.XXX.XXX		Xxxxx	05/20/2022	verified	High
24	XXX.XXX.XX.XXX	xxxxx-x.xxx-xxxxxxx.xxx	Xxxxx	05/20/2022	verified	High
25	XXX.XX.XXX.XXX		Xxxxx	01/01/2021	verified	High
26	XXX.XX.XX.XX	xxxxx.xxx.xxx	Xxxxx	05/20/2022	verified	High
27	XXX.XXX.XXX.XXX		Xxxxx	05/20/2022	verified	High
28	XXX.XXX.XXX.XX	xxxx-xxx-xxx-xxx-xx.xxxxxx.xxxxxxx.xxx	Xxxxx	05/20/2022	verified	High
29	XXX.XXX.XXX.XXX	xxxxxxx.xxxxxxx.xx	Xxxxx	05/20/2022	verified	High
30	XXX.XX.XX.XX	xxxx-xxx-xx-xx-xx.xxxxxxxx.xxxxxxxxxxxxx.xx	Xxxxx	05/20/2022	verified	High
31	XXX.XX.XX.XXX		Xxxxx	01/01/2021	verified	High

TTP - Tactics, Techniques, Procedures (22)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CWE-22, CWE-425	Path Traversal	predictive	High
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	High
3	T1059	CWE-94	Argument Injection	predictive	High
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	predictive	High
5	T1068	CWE-264, CWE-266, CWE-269, CWE-284	Execution with Unnecessary Privileges	predictive	High
6	TXXXX.XXX	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	predictive	High
7	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
8	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	predictive	High
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
12	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
13	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
14	TXXXX.XXX	CWE-XXX	Xxxxxxxxxxxx	predictive	High
15	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	predictive	High
16	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	predictive	High
17	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
18	TXXXX.XXX	CWE-XXX	Xxxxxxxx	predictive	High
19	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
20	TXXXX.XXX	CWE-XX	Xxxxxxxxxxxxx	predictive	High
21	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
22	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (184)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/cgi-bin/nobody	predictive	High
2	File	/doorgets/app/views/ajax/commentView.php	predictive	High
3	File	/etc/passwd	predictive	Medium
4	File	/GponForm/device_Form?script/	predictive	High
5	File	/index.php	predictive	Medium
6	File	/index.php?controller=GzUser&action=edit&id=1	predictive	High
7	File	/rom-0	predictive	Low
8	File	/timeline2.php	predictive	High
9	File	/tmp	predictive	Low
10	File	/uncpath/	predictive	Medium
11	File	/user-utils/users/md5.json	predictive	High
12	File	/wp-admin/admin-ajax.php	predictive	High
13	File	AbstractController.php	predictive	High
14	File	ActBar.ocx	predictive	Medium
15	File	adclick.php	predictive	Medium
16	File	add_comment.php	predictive	High
17	File	add_ons.php	predictive	Medium
18	File	admin.comms.php	predictive	High
19	File	admin.php	predictive	Medium
20	File	admin/bad.php	predictive	High
21	File	admin/users/new	predictive	High
22	File	admincp.php?app=user&do=save	predictive	High
23	File	ajax.php?type=../admin-panel/autoload&page=manage-users	predictive	High
24	File	apc.php	predictive	Low
25	File	xxxxxxx.xxx	predictive	Medium
26	File	xxxx_xxxxxxxxxxx.xxx	predictive	High
27	File	xxx-xxx/	predictive	Medium
28	File	xxx/xxx.x	predictive	Medium
29	File	xxxxxxx_xxx.xxx	predictive	High
30	File	xxxxxxx.x	predictive	Medium
31	File	xxxx/xxxxxxxxxxxxxxx.xxx	predictive	High
32	File	xxxxxx_xxxxx.x	predictive	High
33	File	xxxx/xxxxxxxx.xxxx.xxxxxxx.xxx	predictive	High
34	File	xxxx_x.x	predictive	Medium
35	File	xxxxxxx/xxxxx/xxxxxx.x	predictive	High
36	File	xxxxxxx/xxx/xxxxx/xxx-xxxxx.x	predictive	High
37	File	xxxxxxx/xxx/xxxxxxxx/xxxxxxxxx/xxxxxxx.x	predictive	High
38	File	xxxxxxx.x	predictive	Medium
39	File	xxxxx.xxx	predictive	Medium
40	File	xxxxxxxxxxxxxx.xx	predictive	High
41	File	xxxx.xxx	predictive	Medium
42	File	xxx/xxxx/xxxx.x	predictive	High
43	File	xxxx.xxx	predictive	Medium
44	File	xxxxxxx/xxxx_xxxxxxxxx.xxx	predictive	High
45	File	xxxxx.xxx	predictive	Medium
46	File	xxxxxx/xxxxxx.xxxx	predictive	High
47	File	xxxx.xxx	predictive	Medium
48	File	xxxxxxxxx.xxx	predictive	High
49	File	xx.xx	predictive	Low
50	File	xxx/xxxxxx.xxx	predictive	High
51	File	xxxxxxx/xxxxxxx/xxxxxxxx.xxx.xxx	predictive	High
52	File	xxxxxxx/xxxxxxx/xxxxxxxx_xxxxxxxx.xxx.xxx	predictive	High
53	File	xxxxx.xxx	predictive	Medium
54	File	xxxxxxxxx/xxx/xxxxxx.x	predictive	High
55	File	xxxxxxxxx/xxx/xxxx.x	predictive	High
56	File	xxxx.xxx	predictive	Medium
57	File	xxx.xxx	predictive	Low
58	File	xxx/xxx_xxxxxxx_xx.x	predictive	High
59	File	xxxxxx/xxx/xxxxxxxx.x	predictive	High
60	File	xxxxxxxxx/xxxx-xxxxxx.x	predictive	High
61	File	xxxxx.xxx.xxx	predictive	High
62	File	xxxxxxx.xxx	predictive	Medium
63	File	xxxxx.xx	predictive	Medium
64	File	xxxxx.xxx	predictive	Medium
65	File	xxxxxx.xxx?x=xxxxxxx_xxx&xx	predictive	High
66	File	xxxxxxxx.xxx	predictive	Medium
67	File	xxx/xxx_xxx.x	predictive	High
68	File	xx.xxx	predictive	Low
69	File	xxxx.xxxxxx.xx	predictive	High
70	File	xxxxx/xxx/xxxx_xxxxx.x	predictive	High
71	File	xxxx.xxx	predictive	Medium
72	File	xxxxx.xx	predictive	Medium
73	File	xxxxx-xxx.x	predictive	Medium
74	File	xxx-xxxx.x	predictive	Medium
75	File	xxxxx.xxx	predictive	Medium
76	File	xxxxx.xxx	predictive	Medium
77	File	xxxxxxxx.xxx	predictive	Medium
78	File	xxxxxxxx.xxxx	predictive	High
79	File	xxxxxxxx.xxx	predictive	Medium
80	File	xxxxxxxx.xxx	predictive	Medium
81	File	xxxxxxxx.xx	predictive	Medium
82	File	xxxxxxxx_xxxxxx.xxx	predictive	High
83	File	xxxxxxxxx	predictive	Medium
84	File	xxxxxxx_xxx_xxxxx_xxxxxx.xxxx	predictive	High
85	File	xxxxxxxxxx/xxxxxxxxxx_xxxxxxxxxx.xxx	predictive	High
86	File	xxxxxxxxxxxxxxxxxx.xxxx	predictive	High
87	File	x.xxx	predictive	Low
88	File	xxxxxx.xxx	predictive	Medium
89	File	xxxxxx/xxxxxxxx.xxx	predictive	High
90	File	xxxxxxx/xxxxx/xxxx-xxx/xxxxxx.x	predictive	High
91	File	xxxxxxxx/xxxxxxxxxxx/xxxxx/	predictive	High
92	File	xxxxxx.xxx	predictive	Medium
93	File	xxxxx.x	predictive	Low
94	File	xxxx.x	predictive	Low
95	File	xxxxxxx/xxxxxxxx.xxx	predictive	High
96	File	xxxx.xxx	predictive	Medium
97	File	xxxxxxxxxxx.x	predictive	High
98	File	xxxxxxxxxxxxxxxx.xxxx	predictive	High
99	File	xxxxx.xx	predictive	Medium
100	File	xxxxxxxx.x	predictive	Medium
101	File	xxxx-xxxxxxxx.xxx	predictive	High
102	File	xxxxxxx.xxx	predictive	Medium
103	File	xxxx/xxxxxxxx.xxx	predictive	High
104	File	xxxxx/xxxxxxxx.xxx	predictive	High
105	File	xxxx/xxxxxxxx.xxx	predictive	High
106	File	xx-xxxxx/xxxxx-xxxx.xxx?xx-xxxxx-xxxxxx[]=xxxxxxxx	predictive	High
107	File	xx-xxxxx.xxx	predictive	Medium
108	File	xx-xxxxxxxx.xxx	predictive	High
109	File	xxxxxx.xxx	predictive	Medium
110	Library	xxxxxxxx.xxx	predictive	Medium
111	Library	xxx/xxx/xxxxxx.xx	predictive	High
112	Library	xxx/xxx/xxxxx.xxx	predictive	High
113	Library	xxxxxxxx.xxx	predictive	Medium
114	Library	xxxxxxxx.xxx	predictive	Medium
115	Library	xxxx.xxx	predictive	Medium
116	Library	xxx/xxx/xxxx/xxx/xxxx.xxx	predictive	High
117	Argument	xxxxxxx	predictive	Low
118	Argument	xxxxxx	predictive	Low
119	Argument	xxx_xxx	predictive	Low
120	Argument	xxxx_xxxx	predictive	Medium
121	Argument	xxxxxxxx	predictive	Medium
122	Argument	xxxx_xx	predictive	Low
123	Argument	xxxxxxxxxxxxx	predictive	High
124	Argument	xxxxxxx	predictive	Low
125	Argument	xxxx	predictive	Low
126	Argument	xxxxxxx	predictive	Low
127	Argument	xxxxxxxxxxx/xxxx/xxxxxxx	predictive	High
128	Argument	xxxx	predictive	Low
129	Argument	xxxxx	predictive	Low
130	Argument	xxxxx	predictive	Low
131	Argument	xxxxxxx=xxxxxxxx	predictive	High
132	Argument	xxxx	predictive	Low
133	Argument	xxxx_xxxxx	predictive	Medium
134	Argument	xxxxxxxx	predictive	Medium
135	Argument	xx	predictive	Low
136	Argument	xx_xxxxxxxx	predictive	Medium
137	Argument	xxx	predictive	Low
138	Argument	xxxxxxx_xxxx	predictive	Medium
139	Argument	xxxxxxxxx-xxxxxxx/xxxxxxxxx/xxxxxxxxxx	predictive	High
140	Argument	xxxx	predictive	Low
141	Argument	xxxxxxxxxxxxx	predictive	High
142	Argument	xxxxxx?xxxxxx	predictive	High
143	Argument	xxxxxxx	predictive	Low
144	Argument	xxxx	predictive	Low
145	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	High
146	Argument	xxxx	predictive	Low
147	Argument	xxxx	predictive	Low
148	Argument	xxxx	predictive	Low
149	Argument	xxxxxxxx	predictive	Medium
150	Argument	xxxx_xxxx	predictive	Medium
151	Argument	xxxxxxxxxxxx	predictive	Medium
152	Argument	xxxxxxxxx	predictive	Medium
153	Argument	xxxxxxxx/xxxx/xxxxx	predictive	High
154	Argument	xxxxxxx	predictive	Low
155	Argument	xxx_xxxx	predictive	Medium
156	Argument	xxxxxxxx	predictive	Medium
157	Argument	xxxx/xxxx	predictive	Medium
158	Argument	xxxxxx	predictive	Low
159	Argument	xxxxxxxxxxxx	predictive	Medium
160	Argument	xxxxxx	predictive	Low
161	Argument	xxx	predictive	Low
162	Argument	xxxxxxxxxx	predictive	Medium
163	Argument	xxxx	predictive	Low
164	Argument	xxxxxxxx	predictive	Medium
165	Argument	xxxxx	predictive	Low
166	Argument	xxx/xxxxx_xxxxxxx.$	predictive	High
167	Argument	xxxx	predictive	Low
168	Argument	xxx	predictive	Low
169	Argument	xxxxx	predictive	Low
170	Argument	xxx	predictive	Low
171	Argument	xxxxxxxx	predictive	Medium
172	Argument	xxxx_xxxxx	predictive	Medium
173	Argument	xxxx_xxxxx	predictive	Medium
174	Argument	xxx	predictive	Low
175	Argument	_xxxxxx[xxxx_xxxx]	predictive	High
176	Input Value	xxxx	predictive	Low
177	Input Value	xxxxxxxxx' xxx 'x'='x	predictive	High
178	Input Value	xxxx	predictive	Low
179	Pattern	\|xx\|xx\|xx\|	predictive	Medium
180	Pattern	\|xx\|xxx\|xx xx xx xx\|	predictive	High
181	Network Port	xxxx xxxx	predictive	Medium
182	Network Port	xxx/xxxx (xxx)	predictive	High
183	Network Port	xxx/xxxxx	predictive	Medium
184	Network Port	xxx xxxxxx xxxx	predictive	High

References (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!