APT37 Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (117)

Sprache

en	78
de	32
pl	4
zh	2
es	2

Land

us	94
pl	12
ru	4
vn	4

Akteure

APT37	2
Cobalt Strike	1
STRRAT	1
BumbleBee	1
Houdini	1

Interesse

Typ

Not Defined	14
Database Administration Software	6
Programming Language Software	4
Content Management System	4
Web Server	2

Hersteller

Not Defined	22
Siemens	4
SourceCodester	2
Microsoft	2
RDM	2

Produkt

phpMyAdmin	6
Siemens EN100 Ethernet Module	4
SourceCodester Employee and Visitor Gate Pass Logg ...	2
nginx	2
Microsoft .NET Framework	2

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	CTI	EPSS	CVE
1	PHP phpinfo Cross Site Scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.08	0.02101	CVE-2007-1287
2	Lars Ellingsen Guestserver guestbook.cgi Cross Site Scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.15	0.00169	CVE-2005-4222
3	RDM Intuitive 650 TDB Controller Password erweiterte Rechte	7.5	7.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00206	CVE-2016-4505
4	Siemens EN100 Ethernet Module Web Server Memory Information Disclosure	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00516	CVE-2016-4785
5	DZCP deV!L`z Clanportal config.php erweiterte Rechte	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.43	0.00943	CVE-2010-0966
6	Siemens EN100 Ethernet Module Web Server Information Disclosure	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.00516	CVE-2016-4784
7	RDM Intuitive 650 TDB Controller Cross Site Request Forgery	6.1	5.8	$0-$5k	Wird berechnet	Not Defined	Official Fix	0.00	0.00069	CVE-2016-4506
8	TikiWiki tiki-register.php erweiterte Rechte	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	8.86	0.01009	CVE-2006-6168
9	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	4.95	0.00000
10	MGB OpenSource Guestbook email.php SQL Injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.74	0.01302	CVE-2007-0354
11	FLDS redir.php SQL Injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.15	0.00203	CVE-2008-5928
12	SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php SQL Injection	7.1	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.06	0.00135	CVE-2023-2090
13	Apple Mac OS X Server Wiki Server SQL Injection	5.3	4.6	$5k-$25k	$0-$5k	Unproven	Official Fix	2.75	0.00339	CVE-2015-5911
14	Responsive Menus Configuration Setting responsive_menus.module responsive_menus_admin_form_submit Cross Site Scripting	3.2	3.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00073	CVE-2018-25085
15	PHPWind goto.php Redirect	6.3	6.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.06	0.00348	CVE-2015-4134
16	Winn Winn GuestBook addPost Cross Site Scripting	4.3	4.1	$0-$5k	Wird berechnet	High	Official Fix	0.02	0.00336	CVE-2011-5026
17	Cplinks cpDynaLinks category.php SQL Injection	7.3	7.1	$0-$5k	Wird berechnet	High	Unavailable	0.02	0.00387	CVE-2007-5408
18	vldPersonals index.php Cross Site Scripting	4.3	3.9	$0-$5k	Wird berechnet	Proof-of-Concept	Official Fix	0.04	0.00155	CVE-2014-9004
19	esoftpro Online Guestbook Pro ogp_show.php SQL Injection	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.06	0.00135	CVE-2010-4996
20	PHP locale_methods.c get_icu_disp_value_src_php Pufferüberlauf	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.04	0.01086	CVE-2014-9912

Kampagnen (3)

These are the campaigns that can be associated with the actor:

IOC - Indicator of Compromise (6)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Hostname	Akteur	Kampagnen	Identifiziert	Typ	Akzeptanz
1	34.13.42.35		APT37	Scarcruft	15.12.2020	verifiziert	High
2	120.192.73.202		APT37	Scarcruft	15.12.2020	verifiziert	High
3	XXX.XX.XXX.XXX	xxx-xxx-xx-xxx.xxxxxxx-xxx	Xxxxx		18.03.2024	verifiziert	High
4	XXX.XXX.XX.XX		Xxxxx	Xxxxxxxxx	15.12.2020	verifiziert	High
5	XXX.XXX.XX.XXX		Xxxxx	Xxxxx#xxxxx	26.07.2022	verifiziert	High
6	XXX.X.XXX.XX	xxx-x-xxx-xx.xxxxxx.xx	Xxxxx	Xxxxxxxx	15.12.2020	verifiziert	High

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1059	CWE-94	Argument Injection	prädiktiv	High
2	T1059.007	CWE-79, CWE-80	Cross Site Scripting	prädiktiv	High
3	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
4	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	prädiktiv	High
5	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	prädiktiv	High
6	TXXXX	CWE-XX	Xxx Xxxxxxxxx	prädiktiv	High
7	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	prädiktiv	High
8	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	prädiktiv	High

IOA - Indicator of Attack (29)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	/admin/maintenance/view_designation.php	prädiktiv	High
2	File	/forum/away.php	prädiktiv	High
3	File	adclick.php	prädiktiv	Medium
4	File	category.php	prädiktiv	Medium
5	File	xxxxx.xxx	prädiktiv	Medium
6	File	xxxxxxxx/xxxxxx.xxx	prädiktiv	High
7	File	xxx/xxxx/xxxxxx/xxxxxx_xxxxxxx.x	prädiktiv	High
8	File	xxxxxxxxxxx.xxx	prädiktiv	High
9	File	xxxx.xxx	prädiktiv	Medium
10	File	xxxxxxxxx.xxx	prädiktiv	High
11	File	xxx/xxxxxx.xxx	prädiktiv	High
12	File	xxxxxxxx/xxxxxxx.xxx	prädiktiv	High
13	File	xxxxx.xxx	prädiktiv	Medium
14	File	xxxxxxxxx/xxxxxx.xxx	prädiktiv	High
15	File	xxx_xxxx.xxx	prädiktiv	Medium
16	File	xxxxx.xxx	prädiktiv	Medium
17	File	xxxxxxxxxx_xxxxx.xxxxxx	prädiktiv	High
18	File	xxxx-xxxxxxxx.xxx	prädiktiv	High
19	File	xx-xxxxxxxx/xxxxx-xx-xxxxx.xxx	prädiktiv	High
20	Argument	xxxxxxxx	prädiktiv	Medium
21	Argument	xxxxxxxx	prädiktiv	Medium
22	Argument	xxxx	prädiktiv	Low
23	Argument	xx	prädiktiv	Low
24	Argument	xxx	prädiktiv	Low
25	Argument	xxxx	prädiktiv	Low
26	Argument	xxxxxxxx	prädiktiv	Medium
27	Argument	xxxxxx	prädiktiv	Low
28	Argument	xxxxxxxx	prädiktiv	Medium
29	Argument	xxx	prädiktiv	Low

Referenzen (5)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!