CozyDuke Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (2)

Sprache

en	2

Land

us	2

Akteure

CozyDuke	1

Interesse

Typ

Smartphone Operating System	2

Hersteller

Google	2

Produkt

Google Android	2

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	EPSS	CTI	CVE
1	Google Android Qualcomm Networking Driver rndis_ipa.c erweiterte Rechte	5.7	5.7	$5k-$25k	$25k-$100k	Not Defined	Official Fix	0.00280	0.00	CVE-2016-5868
2	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash Information Disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02016	0.02	CVE-2007-1192

Kampagnen (1)

These are the campaigns that can be associated with the actor:

MiniDionis

IOC - Indicator of Compromise (8)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Hostname	Akteur	Kampagnen	Identifiziert	Typ	Akzeptanz
1	64.244.34.200		CozyDuke	MiniDionis	24.12.2020	verifiziert	High
2	121.193.130.170		CozyDuke		24.12.2020	verifiziert	High
3	XXX.XXX.XXX.XXX		Xxxxxxxx	Xxxxxxxxxx	24.12.2020	verifiziert	High
4	XXX.XX.XXX.X		Xxxxxxxx		24.12.2020	verifiziert	High
5	XXX.XXX.XXX.XX		Xxxxxxxx		24.12.2020	verifiziert	High
6	XXX.XXX.XXX.XX	xxxx_xxx_xx.xxxxxxxxx.xxx	Xxxxxxxx		24.12.2020	verifiziert	High
7	XXX.XXX.XXX.XX	xxxxxx.xxxxxxxxx.xxx	Xxxxxxxx		24.12.2020	verifiziert	High
8	XXX.XX.X.XX		Xxxxxxxx		24.12.2020	verifiziert	High

TTP - Tactics, Techniques, Procedures (2)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klassifizierung	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1068		CWE-264	Execution with Unnecessary Privileges	prädiktiv	High
2	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	prädiktiv	High

IOA - Indicator of Attack (2)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	data/gbconfiguration.dat	prädiktiv	High
2	File	xxxxxxx/xxx/xxxxxxxx/xxx/xxxxx_xxx.x	prädiktiv	High

Referenzen (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!