Ekipa RAT تحليل

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (171)

اللغة

en	92
de	36
ja	18
fr	8
it	6

البلد

us	172

الفاعلين

Ekipa RAT	4
Cobalt Strike	3
RedLine Stealer	3
Rhadamanthys	2
Ave Maria	2

الاهتمام

النوع

Not Defined	70
Content Management System	12
Operating System	6
Photo Gallery Software	6
Network Management Software	6

المجهز

Not Defined	50
Microsoft	10
HP	8
Fortinet	4
Virtual Programming	4

منتج

Microsoft Windows	6
Virtual Programming VP-ASP	4
Pearlinger Products	4
DMXReady Blog Manager	4
Coinsoft Technologies phpCOIN	4

الثغرات

#	الثغرة	Base	Temp	0day	اليوم	ق�	معالجة	EPSS	CTI	CVE
1	BD Totalys MultiProcessor توثيق ضعيف	8.1	7.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00044	0.04	CVE-2022-40263
2	Hassan Consulting Shopping Cart shop.cgi اجتياز الدليل	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02149	0.00	CVE-2000-0921
3	Squitosoft Squito Gallery photolist.inc.php تلف الذاكرة	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01371	0.03	CVE-2005-2258
4	PhotoPost PhotoPost vBGallery File Upload upload.php تجاوز الصلاحيات	6.3	5.8	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.00546	0.03	CVE-2008-7088
5	Midicart Software MidiCart PHP Shopping Cart search_list.php سكربتات مشتركة	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.07338	0.03	CVE-2005-1502
6	HP Integrated Lights-Out الكشف عن المعلومات	9.8	8.5	$5k-$25k	$0-$5k	Unproven	Official Fix	0.02286	0.05	CVE-2012-3271
7	Dell EMC PowerScale OneFS master.passwd ثغرات غير معروفة	4.1	4.1	$5k-$25k	$0-$5k	Not Defined	Not Defined	0.00044	0.00	CVE-2022-22563
8	Asternic Flash Operator Panel User Control Panel تجاوز الصلاحيات	7.5	7.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00214	0.04	CVE-2018-5694
9	Ilohamail سكربتات مشتركة	4.3	4.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00000	0.08
10	Cybernetikz Easy Social Icons Authentication admin.php طلب تزوير مشترك	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00554	0.00	CVE-2015-2084
11	HD FLV PLayer Plugin functions.php hd_update_media حقن إس كيو إل	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00152	0.13	CVE-2012-10011
12	Franklin Fueling Systems Colibri Controller Module اجتياز الدليل	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.64772	0.07	CVE-2021-46417
13	Fortinet FortiADC سكربتات مشتركة	6.4	6.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00072	0.03	CVE-2022-38374
14	FacileForms facileforms.frame.php تجاوز الصلاحيات	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01845	0.00	CVE-2008-2990
15	htmltonuke htmltonuke.php تجاوز الصلاحيات	7.3	6.7	$0-$5k	$0-$5k	Proof-of-Concept	Unavailable	0.01849	0.06	CVE-2006-0308
16	SimpleBoard file_upload.php تجاوز الصلاحيات	8.1	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.12891	0.00	CVE-2006-3528
17	Skrypty Ppa Gallery functions.inc.php تلف الذاكرة	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02429	0.00	CVE-2005-2199
18	Mamboxchange Extended Registration registration_detailed.inc.php تجاوز الصلاحيات	7.3	6.4	$0-$5k	$0-$5k	Unproven	Unavailable	0.05054	0.04	CVE-2006-5254
19	EyouCMS Index.php wechat_return XML External Entity	5.5	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00087	0.00	CVE-2021-42194
20	Sennheiser HeadSetup Certificates SennComCCKey.pem Key توثيق ضعيف	5.7	5.4	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00457	0.05	CVE-2018-17612

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	عنوان بروتوكول الإنترنت	ممثل	Identified	النوع	الثقة
1	85.208.136.130	Ekipa RAT	27/02/2024	verified	عالي
2	146.70.87.148	Ekipa RAT	27/02/2024	verified	عالي
3	XXX.XX.XX.XXX	Xxxxx Xxx	27/02/2024	verified	عالي
4	XXX.XX.XX.XXX	Xxxxx Xxx	27/02/2024	verified	عالي
5	XXX.XXX.XXX.XXX	Xxxxx Xxx	27/02/2024	verified	عالي
6	XXX.XXX.XXX.XXX	Xxxxx Xxx	27/02/2024	verified	عالي
7	XXX.XX.XX.XXX	Xxxxx Xxx	27/02/2024	verified	عالي

TTP - Tactics, Techniques, Procedures (11)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	الفئة	الثغرات	متجه الوصول	النوع	الثقة
1	T1006	CAPEC-126	CWE-21, CWE-22	Path Traversal	predictive	عالي
2	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	عالي
3	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	عالي
4	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	عالي
5	TXXXX.XXX	CAPEC-16	CWE-XXX, CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	عالي
6	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	عالي
7	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	predictive	عالي
8	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	عالي
9	TXXXX.XXX	CAPEC-459	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	عالي
10	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	عالي
11	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	عالي

IOA - Indicator of Attack (159)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	الفئة	Indicator	النوع	الثقة
1	File	/bl-plugins/backup/plugin.php	predictive	عالي
2	File	/cgi-bin/nightled.cgi	predictive	عالي
3	File	/controller/Index.php	predictive	عالي
4	File	/etc/master.passwd	predictive	عالي
5	File	/etc/passwd	predictive	متوسط
6	File	/opt/zimbra/jetty/webapps/zimbra/public	predictive	عالي
7	File	/secure/admin/InsightDefaultCustomFieldConfig.jspa	predictive	عالي
8	File	/secure/admin/RestoreDefaults.jspa	predictive	عالي
9	File	/wmiwizard.jsp	predictive	عالي
10	File	accounts/inc/include.php	predictive	عالي
11	File	acrotxt.php	predictive	متوسط
12	File	addpost_newpoll.php	predictive	عالي
13	File	admin.php	predictive	متوسط
14	File	admin.php/index/upload because app/common/service/UploadService.php	predictive	عالي
15	File	admin/handlers.php	predictive	عالي
16	File	adminBoards.php	predictive	عالي
17	File	adminSmileys.php	predictive	عالي
18	File	akocomments.php	predictive	عالي
19	File	ampie.swf	predictive	متوسط
20	File	xxxxxxxxxxx/xxxxxx/xxxxxx.xxx	predictive	عالي
21	File	xxxxxxxx.xxxxxxx.xxx	predictive	عالي
22	File	xxxxxxxxx/xxxxx.xxx	predictive	عالي
23	File	xx-xxxxxx/xxxx/xxxxxx-xxxx.xxx	predictive	عالي
24	File	xx-xxxxxx/xxxxx/xxxxxxxxxxx/xxxx-xxxxxxxx.xxx	predictive	عالي
25	File	xx-xxxxxx/xxxx/xxxxxx-xxxxxx.xxx	predictive	عالي
26	File	xx-xxxxxx/xxxxxxxx.xxxxx.xxx	predictive	عالي
27	File	xx_xxxxxxxxx_xxxx.xxx	predictive	عالي
28	File	xx_xxxxxxxxxx_xxxx.xxx	predictive	عالي
29	File	xxxxx.xxx	predictive	متوسط
30	File	xx_xxxx.xxx	predictive	متوسط
31	File	xxxx_xxxxxxx.xxx	predictive	عالي
32	File	xxx-xxx/xxxxxxx.xx	predictive	عالي
33	File	xxx-xxx/xxxxxxxx.xxx	predictive	عالي
34	File	xxxx_xxxxxxxx/xx.xxx	predictive	عالي
35	File	xxxxxxxx_xxxxxxx.xxx	predictive	عالي
36	File	xxxxxxxxxxxxxxxxxxxx.xxxx	predictive	عالي
37	File	xxxxxxxxx.xxx	predictive	عالي
38	File	xxxxxxxxxxx\xxxxx.xxx	predictive	عالي
39	File	xxx.xxx	predictive	واطئ
40	File	xxxxxxxxxxxxxxxxxxxx.xxxx	predictive	عالي
41	File	xxxxxx.xxx	predictive	متوسط
42	File	xxxxxxx.xxx	predictive	متوسط
43	File	xxxxxxxxxxxxxxx.xxx	predictive	عالي
44	File	xxxxxxxx_xxx.xxx	predictive	عالي
45	File	xxxxxxxx.xx	predictive	متوسط
46	File	xxxxxxxx.xxx.xxx	predictive	عالي
47	File	xxxxxxxxxxx.xxxxx.xxx	predictive	عالي
48	File	xxxxx_xxxxxx.x	predictive	عالي
49	File	xxxx_xxxxxx.xxx	predictive	عالي
50	File	xxxxxxxxx.xxx	predictive	عالي
51	File	xxxxxxx.xxx	predictive	متوسط
52	File	xxxxxxxxxx.xxx	predictive	عالي
53	File	xxxxx_xxxxxx.xxx	predictive	عالي
54	File	xxxxxxxxx.xxx	predictive	عالي
55	File	xxx/xxxxxxxxx.xxx.xxx	predictive	عالي
56	File	xxx_xxxxxxxxxxxxxx.xxx	predictive	عالي
57	File	xxxxx.xxx	predictive	متوسط
58	File	xxxx.xxx.xxx	predictive	متوسط
59	File	xxxxxxx.xxxxxxxxxx.xxx	predictive	عالي
60	File	xxxxxxxxxx/xxxxx.xx	predictive	عالي
61	File	xxxx_xxxx.xxx	predictive	عالي
62	File	xxx_xxxxxxx.xxx	predictive	عالي
63	File	xxxxx.xxx	predictive	متوسط
64	File	xxx_xxxx.xxx	predictive	متوسط
65	File	xxxx.xxx	predictive	متوسط
66	File	xxxxxxxxxxxxx.xxxx	predictive	عالي
67	File	xxxxxxxxx.xxx	predictive	عالي
68	File	xxx_xxxxx.xxx	predictive	عالي
69	File	xxxxx.xxxxxxxxxx.xxx	predictive	عالي
70	File	xxxxxxxxx.xxx.xxx	predictive	عالي
71	File	xxxxxxxx.xxx	predictive	متوسط
72	File	xxxxxxxxxxxxxxxxxxxxxxxxxxx!xxxxxxx.xxxx	predictive	عالي
73	File	xxxxxxxxxxxx_xxxxxxxx.xxx.xxx	predictive	عالي
74	File	xxxxxxx_xxxxxx_xxxxx.xxx	predictive	عالي
75	File	xxxxxxx_xxxxxx_xxxxxx.xxx	predictive	عالي
76	File	xxxxxx_xxxx.xxx	predictive	عالي
77	File	xxxxxxxxxxxx.xxx	predictive	عالي
78	File	xxxx$xx.xxx	predictive	متوسط
79	File	xxxx.xxx	predictive	متوسط
80	File	xxxx.xxx	predictive	متوسط
81	File	xxxxxxx.xxx	predictive	متوسط
82	File	xxxxxxxxxxxxxxxx.xxx	predictive	عالي
83	File	xxxxx/xxxxxxxx/xxxxxxxxx.xxx	predictive	عالي
84	File	xxxx_xxxxxxx.xxxxx.xxx	predictive	عالي
85	File	xxxxx_xxxxx.xxx	predictive	عالي
86	File	xxx-xxxxxxxxx.xxx	predictive	عالي
87	File	xxxxxx.xxx	predictive	متوسط
88	File	xxxxxxxxx.xxx	predictive	عالي
89	File	xx-xxxxx/xxxxx.xxx	predictive	عالي
90	File	xxxxxx.xxx	predictive	متوسط
91	File	_xxxxxxxxx.xxx	predictive	عالي
92	File	~/xxx/xxxxx.xxx	predictive	عالي
93	Library	xxxxxx[xxxxxx_xxxx	predictive	عالي
94	Library	xxxxxx.xxxxxxx('xxxxx_xxxx:/xxx/xxxxxx')	predictive	عالي
95	Argument	xxxxxx	predictive	واطئ
96	Argument	xxxx_xxxx	predictive	متوسط
97	Argument	xxxxxxxx	predictive	متوسط
98	Argument	xxxxx	predictive	واطئ
99	Argument	xxxxxx	predictive	واطئ
100	Argument	xxxx_xxx_xxxx	predictive	عالي
101	Argument	xxx	predictive	واطئ
102	Argument	xxx	predictive	واطئ
103	Argument	xxxxxxxxxx	predictive	متوسط
104	Argument	xxxxxxxxxx	predictive	متوسط
105	Argument	xxxx_xx	predictive	واطئ
106	Argument	xxxxxxx	predictive	واطئ
107	Argument	xxxxxx	predictive	واطئ
108	Argument	xxxxxx[xxxxxx_xxxx]	predictive	عالي
109	Argument	xxxxxx[xxx_xxxx_xxxx]	predictive	عالي
110	Argument	xxx_x_xxx	predictive	متوسط
111	Argument	xxxx_xxxx	predictive	متوسط
112	Argument	xxx	predictive	واطئ
113	Argument	xxx[xxx]	predictive	متوسط
114	Argument	xx_xxxxxxx	predictive	متوسط
115	Argument	xxxxxxx	predictive	واطئ
116	Argument	xxxxxxx	predictive	واطئ
117	Argument	xxxxxxx_xxxxxxx	predictive	عالي
118	Argument	xxxx_xx	predictive	واطئ
119	Argument	xxxxxxxxxxxxxx[xxxxxxxxxxxxxxxxxx]	predictive	عالي
120	Argument	xx	predictive	واطئ
121	Argument	xxxxx_xxxx	predictive	متوسط
122	Argument	xxxx	predictive	واطئ
123	Argument	xxxxxx	predictive	واطئ
124	Argument	xxxxxx	predictive	واطئ
125	Argument	xxxxxxx	predictive	واطئ
126	Argument	xxx_xxxx_xxxx	predictive	عالي
127	Argument	xxxxxxxxx_xxxxxxxx_xxxx	predictive	عالي
128	Argument	xxxxxxx_xxxx	predictive	متوسط
129	Argument	xxxx	predictive	واطئ
130	Argument	xxxx_xxxx	predictive	متوسط
131	Argument	xxxxxx_xxxxxx[xxxxxx_xxxx]	predictive	عالي
132	Argument	xxxxxx xxxxxx	predictive	عالي
133	Argument	xxxx	predictive	واطئ
134	Argument	xxxxxxxxx	predictive	متوسط
135	Argument	xxxx_xxxx/xxxxx_xxxx	predictive	عالي
136	Argument	xxxxxxxxxx[x]	predictive	عالي
137	Argument	xxxxxx	predictive	واطئ
138	Argument	xxxxx	predictive	واطئ
139	Argument	xxxxxxxxxxx	predictive	متوسط
140	Argument	xxx	predictive	واطئ
141	Argument	xxxxxxxxxxxxxxxxxxx	predictive	عالي
142	Argument	xxxxxxxxxxxx	predictive	متوسط
143	Argument	xxxx$xx.xxx	predictive	متوسط
144	Argument	xxxx	predictive	واطئ
145	Argument	xxxx_xxxxx_xx	predictive	عالي
146	Argument	xxxx_xxxx	predictive	متوسط
147	Argument	xxxxx_xxxx	predictive	متوسط
148	Argument	xxxxxx	predictive	واطئ
149	Argument	xxxxxx	predictive	واطئ
150	Argument	xxxxxxxxxx	predictive	متوسط
151	Argument	xxxxxxxx	predictive	متوسط
152	Argument	xxxx	predictive	واطئ
153	Argument	xxxxxxxxxxxxx.xxxxxxxxxx	predictive	عالي
154	Argument	xxxxxxxx	predictive	متوسط
155	Argument	xxxx_xx	predictive	واطئ
156	Argument	x-xxxxxxxxx-xxx	predictive	عالي
157	Argument	_xxxx[_xxx_xxxx_xxxx	predictive	عالي
158	Argument	_xxxx[_xxx_xxxx_xxxx]	predictive	عالي
159	Network Port	xxx/xxxx	predictive	متوسط

المصادر (2)

The following list contains external sources which discuss the actor and the associated activities:

التالي ▸نظرة عامة◂ السابق

Want to stay up to date on a daily basis?

Enable the mail alert feature now!