DetaRAT Analyse

IOB - Indicator of Behavior (71)

Zeitverlauf

Sprache

en56
de14
ru2

Land

us26
de12
ca4

Akteure

Aktivitäten

Interesse

Zeitverlauf

Typ

Hersteller

Produkt

Moodle6
Linksys WAG54GS4
WordPress4
Adobe Flash Player4
Vlad Alexa Mancini PHPFootball4

Schwachstellen

#SchwachstelleBaseTemp0dayHeuteAusMasCTIEPSSCVE
1Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash Information Disclosure5.35.2$5k-$25k$0-$5kHighWorkaround0.020.02016CVE-2007-1192
2Tiki Admin Password tiki-login.php schwache Authentisierung8.07.7$0-$5k$0-$5kNot DefinedOfficial Fix3.050.00936CVE-2020-15906
3Joomla CMS com_easyblog SQL Injection6.36.1$5k-$25k$5k-$25kNot DefinedNot Defined0.660.00000
4DZCP deV!L`z Clanportal config.php erweiterte Rechte7.36.6$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.610.00954CVE-2010-0966
5Michael Salzer Guestbox gbshow.php Cross Site Scripting4.33.9$0-$5k$0-$5kProof-of-ConceptOfficial Fix0.020.04283CVE-2006-0860
6Vunet VU Web Visitor Analyst redir.asp SQL Injection7.37.1$0-$5k$0-$5kHighWorkaround0.040.00119CVE-2010-2338
7DolphinPHP User Management Page Cross Site Scripting3.53.2$0-$5k$0-$5kProof-of-ConceptNot Defined0.040.00053CVE-2022-1086
8LogicBoard CMS away.php Redirect6.36.1$0-$5k$0-$5kNot DefinedUnavailable3.030.00000
9vu Mass Mailer Login Page redir.asp SQL Injection7.36.9$0-$5k$0-$5kProof-of-ConceptNot Defined0.360.00181CVE-2007-6138
10Mozilla Firefox/Thunderbird SetOffsets Denial of Service7.57.2$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.09052CVE-2013-1677
11IBM InfoSphere Master Data Management Cross Site Scripting3.53.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00063CVE-2015-1968
12IBM Rational Collaborative Lifecycle Management Jazz Foundation Cross Site Scripting3.53.4$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00063CVE-2015-0130
13McAfee ePolicy Orchestrator Cross Site Scripting4.34.1$5k-$25k$0-$5kNot DefinedOfficial Fix0.000.00192CVE-2015-4559
14Moodle configonlylib.php min_get_slash_argument Directory Traversal6.36.0$5k-$25k$0-$5kNot DefinedOfficial Fix0.020.00177CVE-2015-1493
15WordPress Shortcodes/Post Content erweiterte Rechte6.35.7$5k-$25k$0-$5kProof-of-ConceptOfficial Fix0.040.11322CVE-2013-0235
16Moodle Contacts/Messages Information Disclosure5.34.6$5k-$25k$0-$5kUnprovenOfficial Fix0.040.00124CVE-2015-2266
17Moodle mdeploy.php erweiterte Rechte6.35.5$5k-$25k$0-$5kUnprovenOfficial Fix0.000.00112CVE-2015-2267
18Moodle Regular Expression Denial of Service5.34.6$5k-$25k$0-$5kUnprovenOfficial Fix0.000.00282CVE-2015-2268
19Adobe Flash Player Pufferüberlauf10.08.7$25k-$100k$0-$5kUnprovenOfficial Fix0.000.03041CVE-2015-0342
20WhatsApp Messenger Profile Image Information Disclosure5.35.0$5k-$25k$0-$5kProof-of-ConceptUnavailable0.020.00000

IOC - Indicator of Compromise (2)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

IDIP-AdresseHostnameAkteurKampagnenIdentifiziertTypAkzeptanz
1173.212.224.110vmi587275.contaboserver.netDetaRAT07.09.2021verifiziertHigh
2XXX.XXX.XX.XXXxxxxxxxxx.xxxxxxxxxxxxx.xxxXxxxxxx07.09.2021verifiziertHigh

TTP - Tactics, Techniques, Procedures (10)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

IOA - Indicator of Attack (31)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDKlasseIndicatorTypAkzeptanz
1File/forum/away.phpprädiktivHigh
2File/wordpress/wp-admin/admin.phpprädiktivHigh
3Fileadmin/index.phpprädiktivHigh
4Filedata/gbconfiguration.datprädiktivHigh
5Filefilter.phpprädiktivMedium
6Filexxxxxx.xxxprädiktivMedium
7Filexxx/xxxxxx.xxxprädiktivHigh
8Filexxx/xxxx/xxx.x/xxxx_xxxxxx.xprädiktivHigh
9Filexxxxx.xxxprädiktivMedium
10Filexxxxxxx.xxxprädiktivMedium
11Filexxxxxxxxx/xxxx-xxxxprädiktivHigh
12Filexxxx.xxxprädiktivMedium
13Filexxxxx/xxxxxxx/prädiktivHigh
14Filexxxxxx.xxxprädiktivMedium
15Filexxxxx.xxxprädiktivMedium
16Filexxxxxxxxxxxxxx.xxxprädiktivHigh
17Filexxxxx.xxxprädiktivMedium
18Filexxxx-xxxxx.xxxprädiktivHigh
19Libraryxxx/xxxxxxxxxxxxx.xxxprädiktivHigh
20ArgumentxxxxxxxxprädiktivMedium
21ArgumentxxxxxxxprädiktivLow
22ArgumentxxxxprädiktivLow
23ArgumentxxxxxxxxprädiktivMedium
24ArgumentxxprädiktivLow
25ArgumentxxxxxxxxxxprädiktivMedium
26ArgumentxxxxxxprädiktivLow
27ArgumentxxxxxxxxprädiktivMedium
28Argumentxxxxxxx_xxprädiktivMedium
29ArgumentxxxxxxxprädiktivLow
30ArgumentxxxxprädiktivLow
31ArgumentxxxxxprädiktivLow

Referenzen (2)

The following list contains external sources which discuss the actor and the associated activities:

Do you know our Splunk app?

Download it now for free!