XDSpy Analysis

IOB - Indicator of Behavior (14)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en12
es2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

Interest

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Type

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vendor

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Product

Apache HTTP Server2
Oracle iPlanet Web Server2
phpEventMan2
Google Chrome OS2
OTRS2

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Vulnerabilities

#VulnerabilityBaseTemp0dayTodayExpRemCTIEPSSCVE
1GNU C Library vfprintf numeric error7.87.0$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.020.01537CVE-2012-0864
2nginx URI String access control6.56.2$0-$5k$0-$5kNot DefinedOfficial Fix0.020.40746CVE-2013-4547
3Apache HTTP Server mod_proxy heap-based overflow7.36.6$25k-$100k$0-$5kProof-of-ConceptOfficial Fix0.010.24053CVE-2004-0492
4Postfix Admin functions.inc.php sql injection7.37.0$5k-$25k$0-$5kHighOfficial Fix0.040.01232CVE-2014-2655
5Apple macOS iBooks redirect6.25.9$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.01136CVE-2017-2497
6Apple macOS libarchive link following5.45.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.00950CVE-2016-7619
7HPE Aruba ClearPass privileges management9.28.8$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.14584CVE-2017-5824
8Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash information disclosure5.35.2$5k-$25k$0-$5kHighWorkaround0.040.04187CVE-2007-1192
9DZCP deV!L`z Clanportal config.php code injection7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.410.04187CVE-2010-0966
10Google Chrome OS format string8.88.4$100k and more$5k-$25kNot DefinedOfficial Fix0.030.01136CVE-2016-5169
11phpEventMan text.ctrl.php file inclusion7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.000.06790CVE-2007-0702
12OTRS sql injection6.36.0$0-$5k$0-$5kNot DefinedOfficial Fix0.010.01649CVE-2010-0438
13OTRS StateGetStatesByType sql injection7.37.0$0-$5k$0-$5kNot DefinedOfficial Fix0.000.02172CVE-2014-1471
14Oracle iPlanet Web Server Administration Console cross site scripting6.36.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.010.01213CVE-2012-0516

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP addressHostnameActorCampaignsTypeConfidence
162.213.213.17062-213-213-170.ip.stuart.beXDSpyverifiedHigh
2XX.XX.XXX.XXxx-xx-xxx-xx.xxxxx.xxxxxxxxxx.xxXxxxxverifiedHigh
3XX.XXX.XX.XXxx-xx-xxx-xx.xxxx.xxxxx.xxxXxxxxverifiedHigh

TTP - Tactics, Techniques, Procedures (6)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueVulnerabilitiesAccess VectorTypeConfidence
1T1059CWE-94Cross Site ScriptingpredictiveHigh
2T1059.007CWE-80Cross Site ScriptingpredictiveHigh
3TXXXXCWE-XXX, CWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxpredictiveHigh
4TXXXX.XXXCWE-XXXXxxx XxxxxxxxpredictiveHigh
5TXXXXCWE-XXXxx XxxxxxxxxpredictiveHigh
6TXXXXCWE-XXXXxxxxxxxxxxxxpredictiveHigh

IOA - Indicator of Attack (9)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1Filedata/gbconfiguration.datpredictiveHigh
2Filefunctions.inc.phppredictiveHigh
3Filexxx/xxxxxx.xxxpredictiveHigh
4Filexxxx.xxxx.xxxpredictiveHigh
5ArgumentxxxxxxxxpredictiveMedium
6Argumentxxxxxxx-xxxxxxpredictiveHigh
7ArgumentxxxxxpredictiveLow
8Argumentxxxx_xxxxxpredictiveMedium
9Patternxxxxxxx-xxxxxx|xx|predictiveHigh

References (2)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!