BelialDemon Analyse

IOB - Indicator of Behavior (22)

Zeitverlauf

Sprache

en22

Land

tt12

Akteure

Aktivitäten

Interesse

Zeitverlauf

Typ

Hersteller

Produkt

Sympa2
thinkphp-bjyblog2
Symantec Messaging Gateway2
ownCloud2
Huawei Mate 202

Schwachstellen

#SchwachstelleBaseTemp0dayHeuteAusMasCTIEPSSCVE
1SonicBOOM riscv-boom erweiterte Rechte5.55.5$0-$5k$0-$5kNot DefinedNot Defined0.000.00055CVE-2020-29561
2United Planet Intrexx Professional Cross Site Scripting4.84.6$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00089CVE-2020-24188
3Huawei Mate 20 Digital Balance erweiterte Rechte3.93.7$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00058CVE-2020-1831
4Aviatrix Controller Web Interface Cross Site Request Forgery5.45.1$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00053CVE-2020-13416
5Tenda Tenda W30E NatStaticSetting Pufferüberlauf6.56.4$0-$5k$0-$5kNot DefinedNot Defined0.000.00075CVE-2022-45516
6Tenda W30E CertListInfo Pufferüberlauf5.55.3$0-$5k$0-$5kNot DefinedNot Defined0.000.00075CVE-2022-45525
7thinkphp-bjyblog AdminBaseController.class.php exit Cross Site Scripting4.84.8$0-$5k$0-$5kNot DefinedNot Defined0.000.00078CVE-2021-43682
8WPG Plugin Pufferüberlauf8.07.7$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00968CVE-2021-27362
9ownCloud erweiterte Rechte6.86.5$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00103CVE-2020-28645
10Star Practice Management Web WIP Detail erweiterte Rechte4.34.3$0-$5k$0-$5kNot DefinedNot Defined0.000.00065CVE-2020-28401
11Microsoft .NET Framework XML Denial of Service6.46.3$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.00410CVE-2018-0764
12Wireshark Dissection Engine Denial of Service4.24.0$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00334CVE-2020-26419
13Sympa SOAP API authenticateAndRun erweiterte Rechte6.36.0$0-$5kWird berechnetNot DefinedOfficial Fix0.000.00266CVE-2020-29668
14Symantec Messaging Gateway Web UI Information Disclosure4.34.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.00065CVE-2020-12595
15Google Chrome Omnibox schwache Authentisierung6.46.1$25k-$100k$5k-$25kNot DefinedOfficial Fix0.000.00542CVE-2020-6565
16osTicket ajax.draft.php _uploadInlineImage Cross Site Scripting5.24.9$0-$5k$0-$5kNot DefinedOfficial Fix0.000.00078CVE-2020-24917
17uppy Package erweiterte Rechte7.47.1$0-$5kWird berechnetNot DefinedOfficial Fix0.000.00327CVE-2020-8205

Kampagnen (1)

These are the campaigns that can be associated with the actor:

  • Matanbuchus

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-AdresseHostnameAkteurKampagnenIdentifiziertTypAkzeptanz
134.94.151.129129.151.94.34.bc.googleusercontent.comBelialDemonMatanbuchus29.08.2021verifiziertMedium
2XX.XXX.XX.XXxx.xx.xxx.xx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxxxxxxxXxxxxxxxxxx29.08.2021verifiziertMedium
3XX.XXX.XXX.XXXxxx.xxx.xxx.xx.xx.xxxxxxxxxxxxxxxxx.xxxXxxxxxxxxxxXxxxxxxxxxx29.08.2021verifiziertMedium

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IDTechniqueSchwachstellenZugriffsartTypAkzeptanz
1T1059.007CWE-79Cross Site ScriptingprädiktivHigh
2TXXXXCWE-XXXXxxxxxxxx Xxxx Xxxxxxxxxxx XxxxxxxxxxprädiktivHigh
3TXXXX.XXXCWE-XXXXxxxxxxx XxxxxxxxxxxxxprädiktivHigh
4TXXXXCWE-XXXXxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx XxxxxxxxxxxprädiktivHigh

IOA - Indicator of Attack (7)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlasseIndicatorTypAkzeptanz
1File/goform/CertListInfoprädiktivHigh
2File/goform/NatStaticSettingprädiktivHigh
3Filexxxxxxxxxxxxxxxxxxx.xxxxx.xxxprädiktivHigh
4Filexxxxxxx/xxxx.xxxxx.xxxprädiktivHigh
5ArgumentxxxxxxxxxxprädiktivMedium
6ArgumentxxxxprädiktivLow
7ArgumentxxxxxxxprädiktivLow

Referenzen (2)

The following list contains external sources which discuss the actor and the associated activities:

Interested in the pricing of exploits?

See the underground prices here!