Quantum تحليل

IOB - Indicator of Behavior (86)

التسلسل الزمني

اللغة

en76
ru6
fr2
de2

البلد

الفاعلين

النشاطات

الاهتمام

التسلسل الزمني

النوع

المجهز

منتج

GNU binutils10
Apache HTTP Server6
GNU C Library6
Moxa EDR-8106
Adobe PhoneGap Push Plugin2

الثغرات

#الثغرةBaseTemp0dayاليومق�معالجةCTIEPSSCVE
1libxslt EXSLT Math.random Prediction تشفير ضعيف5.55.3$0-$5kجاري الحسابNot DefinedOfficial Fix0.000.00086CVE-2015-9019
2GNU C Library fnmatch_loop.c fnmatch الكشف عن المعلومات5.65.4$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00546CVE-2015-8984
3GNU C Library strxfrm تلف الذاكرة9.18.6$0-$5k$0-$5kNot DefinedOfficial Fix0.030.00670CVE-2015-8982
4TablePress XML External Entity5.35.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00049CVE-2017-10889
5Salutation Responsive WordPress + BuddyPress Theme Stored سكربتات مشتركة4.44.4$0-$5k$0-$5kNot DefinedNot Defined0.000.00057CVE-2017-1000227
6libxml2 Recover Mode الحرمان من الخدمة4.03.9$0-$5k$0-$5kNot DefinedOfficial Fix0.020.00378CVE-2017-5969
7elfutils elf_getdata.c _libelf_set_rawdata_wrlock تلف الذاكرة5.45.3$0-$5k$0-$5kNot DefinedOfficial Fix0.000.01258CVE-2016-10255
8elfutils ELF File common.h allocate_elf تلف الذاكرة5.45.3$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00986CVE-2016-10254
9GNU C Library wstrops.c IO_wstr_overflow تلف الذاكرة7.77.3$0-$5k$0-$5kNot DefinedOfficial Fix0.060.00508CVE-2015-8983
10FluentForm Plugin حقن إس كيو إل4.74.6$0-$5k$0-$5kNot DefinedNot Defined0.000.00076CVE-2023-24410
11Network Manager VPNC Plugin تجاوز الصلاحيات7.37.2$0-$5k$0-$5kHighOfficial Fix0.000.00364CVE-2018-10900
12Microsoft SharePoint Server Privilege Escalation8.88.1$5k-$25k$0-$5kUnprovenOfficial Fix0.000.00762CVE-2022-38053
13Progress MOVEit Transfer حقن إس كيو إل7.37.0$0-$5kجاري الحسابNot DefinedOfficial Fix0.000.00136CVE-2021-38159
14akismet Plugin سكربتات مشتركة5.25.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00078CVE-2015-9357
15Snazzy Maps Plugin سكربتات مشتركة5.24.9$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00078CVE-2018-17947
16WordPress Password Reset wp-login.php mail تجاوز الصلاحيات6.15.8$5k-$25k$0-$5kProof-of-ConceptNot Defined0.000.02827CVE-2017-8295
17BSD FTP Client HTTP Redirect تجاوز الصلاحيات6.56.2$0-$5k$0-$5kHighOfficial Fix0.040.95879CVE-2014-8517
18ProfilePress Plugin Image Uploader ImageUploader.php تجاوز الصلاحيات7.37.3$0-$5k$0-$5kNot DefinedNot Defined0.000.00334CVE-2021-34623
19Iomega/LenovoEMC NAS API تجاوز الصلاحيات7.97.9$0-$5k$0-$5kNot DefinedNot Defined0.000.00168CVE-2019-6160
20Alienvault OSSIM/USM gauge.php حقن إس كيو إل9.89.4$0-$5k$0-$5kHighOfficial Fix0.020.96284CVE-2016-8582

IOC - Indicator of Compromise (5)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDعنوان بروتوكول الإنترنتHostnameممثلحملاتIdentifiedالنوعالثقة
1138.68.42.130prod-sfo2-1.qencode-master-cf283c7cc10911ecb9daa269211215a9Quantum26/04/2022verifiedعالي
2XXX.XXX.XXX.XXXxxxxxx26/04/2022verifiedعالي
3XXX.XX.XXX.XXXxxxxxxxxxxxxx.xxxxxxxXxxxxxx28/06/2023verifiedعالي
4XXX.XXX.XXX.XXXXxxxxxx26/04/2022verifiedعالي
5XXX.XXX.XXX.XXXxxxxxx.xxxxxxxxxxxxx.xxxXxxxxxx26/04/2022verifiedعالي

TTP - Tactics, Techniques, Procedures (13)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueالثغراتمتجه الوصولالنوعالثقة
1T1059CWE-94Argument Injectionpredictiveعالي
2T1059.007CWE-79Cross Site Scriptingpredictiveعالي
3T1068CWE-264, CWE-269, CWE-284Execution with Unnecessary Privilegespredictiveعالي
4TXXXXCWE-XX, CWE-XXXxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxxpredictiveعالي
5TXXXX.XXXCWE-XXXXxxx Xxxxxxxxpredictiveعالي
6TXXXXCWE-XXXXxxxxxxxxx Xxxxxxpredictiveعالي
7TXXXXCWE-XXXxx Xxxxxxxxxpredictiveعالي
8TXXXXCWE-XXXXxxxxxxxxxx Xxxxxxxxxxpredictiveعالي
9TXXXXCWE-XXXXxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxxpredictiveعالي
10TXXXX.XXXCWE-XXXXxxxxxxx Xxxxxxxxxxx Xxxxxxxxxxpredictiveعالي
11TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxxpredictiveعالي
12TXXXX.XXXCWE-XXXXxx Xxxxxxxxxx Xxxxxpredictiveعالي
13TXXXX.XXXCWE-XXXXxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxxpredictiveعالي

IOA - Indicator of Attack (42)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDالفئةIndicatorالنوعالثقة
1File/etc/shadowpredictiveمتوسط
2File/goform/net\_Web\_get_valuepredictiveعالي
3File/goform/net_WebCSRGenpredictiveعالي
4File/goform/WebRSAKEYGenpredictiveعالي
5File/uncpath/predictiveمتوسط
6File/wp-content/plugins/updraftplus/admin.phppredictiveعالي
7Filexxxxx/xxxxxx_xxxxxx_xxxxxxx/xxxxx-xxx-xxxxx.xxxpredictiveعالي
8Filexxx/xxxxxxx.xpredictiveعالي
9Filexxxxxx.xpredictiveمتوسط
10Filexxxxx.xpredictiveواطئ
11Filexxxxxx.xpredictiveمتوسط
12Filexxx.xpredictiveواطئ
13Filexxx_xxxxxxx.xpredictiveعالي
14Filexxx/xxxxx/xxxxx.xpredictiveعالي
15Filexxxxxx-xxxxxxx-xxxxxxxx.xxxpredictiveعالي
16Filexxxxxxx_xxxx.xpredictiveعالي
17Filexxxxxxxxx.xxxpredictiveعالي
18Filexxxxx.xxxpredictiveمتوسط
19Filexxxx.xpredictiveواطئ
20Filexxxx.xpredictiveواطئ
21Filexxx/xxxxx/xxxxx_xxxx_xxxxxxxxx.xxxpredictiveعالي
22Filexxxx_xxxx.xxxpredictiveعالي
23Filexxxxxx/xxxxxx/xxxx.xpredictiveعالي
24Filexxxxx/xxxxxxx.xpredictiveعالي
25Filexxxxxxxxxxx.xxxpredictiveعالي
26Filexxxxxxx.xxxpredictiveمتوسط
27Filexxxxxxxx.xxxpredictiveمتوسط
28Filexxxx-xxxxxx.xpredictiveعالي
29Filexx-xxxxx.xxxpredictiveمتوسط
30File~/xxx/xxxxxxx/xxxxxxxxxxxxx.xxxpredictiveعالي
31Argumentxxpredictiveواطئ
32Argumentxxxx_xxpredictiveواطئ
33Argumentxxxxpredictiveواطئ
34Argumentxx_xxxxxxx_xxxxpredictiveعالي
35Argumentxxxxpredictiveواطئ
36Argumentxxxpredictiveواطئ
37Argumentxxxxxxxxxxxxxx_xxxpredictiveعالي
38Argumentxxxxxx_xxxx/xxxxxx_xxxxxpredictiveعالي
39Argumentxxxxxxxxxxxxxxpredictiveعالي
40Argumentxxxxxxxxxxxxxxpredictiveعالي
41Argumentxxxxxx\_xxxxpredictiveمتوسط
42Argumentxxxx/xxxpredictiveمتوسط

المصادر (3)

The following list contains external sources which discuss the actor and the associated activities:

Want to stay up to date on a daily basis?

Enable the mail alert feature now!