MsAttacker Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (12)

Sprache

en	12

Land

cn	6
us	6

Akteure

MsAttacker	2
APT41	1
MyKings	1

Interesse

Typ

Not Defined	6
Operating System	4
Hospitality Software	2

Hersteller

Not Defined	6
guzzlehttp	2
PHP Scripts Mall	2
Orange	2

Produkt

FreeBSD	4
guzzlehttp psr7	2
PHP Scripts Mall hotel-booking-script	2
CodeIgniter	2
Orange Livebox	2

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	CTI	EPSS	CVE
1	PHP Scripts Mall hotel-booking-script Cross Site Scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00058	CVE-2018-15190
2	guzzlehttp psr7 Header Parser erweiterte Rechte	6.4	6.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01	0.00095	CVE-2022-24775
3	DZCP deV!L`z Clanportal config.php erweiterte Rechte	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.60	0.00943	CVE-2010-0966
4	Webwizguide Web Wiz Forums Filters functions_filters.asp formatSQLInput SQL Injection	7.3	6.6	$0-$5k	Wird berechnet	Proof-of-Concept	Official Fix	0.04	0.00369	CVE-2007-1548
5	Orange Livebox Service Port 8080 get_getnetworkconf.cgi erweiterte Rechte	8.5	8.3	$0-$5k	$0-$5k	Not Defined	Workaround	0.00	0.02105	CVE-2018-20377
6	FreeBSD sendmsg(2) erweiterte Rechte	7.8	7.6	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00070	CVE-2016-1887
7	FreeBSD portsnap erweiterte Rechte	7.3	7.0	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00	0.00000
8	FreeBSD setgroups Syscall erweiterte Rechte	7.8	7.3	$5k-$25k	Wird berechnet	Unproven	Official Fix	0.02	0.00042	CVE-2016-1881
9	FineCMS Redirector Weixin.php	6.2	6.2	$0-$5k	Wird berechnet	Not Defined	Not Defined	0.07	0.00121	CVE-2017-11586
10	Oracle WebLogic Server unbekannte Schwachstelle	5.3	4.6	$25k-$100k	$0-$5k	Unproven	Official Fix	0.02	0.01156	CVE-2014-4241
11	CodeIgniter Sendmail Email.php erweiterte Rechte	8.5	8.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.04920	CVE-2016-10131

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Akteur	Identifiziert	Typ	Akzeptanz
1	23.27.127.200	MsAttacker	24.12.2020	verifiziert	High
2	XXX.XX.XXX.X	Xxxxxxxxxx	24.12.2020	verifiziert	High
3	XXX.XX.XXX.XX	Xxxxxxxxxx	24.12.2020	verifiziert	High
4	XXX.XX.XXX.XXX	Xxxxxxxxxx	24.12.2020	verifiziert	High

TTP - Tactics, Techniques, Procedures (7)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	prädiktiv	High
2	T1059	CWE-94	Argument Injection	prädiktiv	High
3	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	prädiktiv	High
4	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
5	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	prädiktiv	High
6	TXXXX	CWE-XX	Xxx Xxxxxxxxx	prädiktiv	High
7	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High

IOA - Indicator of Attack (11)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	/get_getnetworkconf.cgi	prädiktiv	High
2	File	controllers/Weixin.php	prädiktiv	High
3	File	xxxxxxxxx/xxxxxxxxx_xxxxxxx.xxx	prädiktiv	High
4	File	xxx/xxxxxx.xxx	prädiktiv	High
5	Library	xxxxxx/xxxxxxxxx/xxxxx.xxx	prädiktiv	High
6	Argument	xxxxxxxx	prädiktiv	Medium
7	Argument	xxxxx->xxxx	prädiktiv	Medium
8	Argument	xxxxx xxxx/xxxx xxxx/xxxxxxx xxxxx	prädiktiv	High
9	Argument	xxxx	prädiktiv	Low
10	Argument	xxx	prädiktiv	Low
11	Network Port	xxx/xxxx	prädiktiv	Medium

Referenzen (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Do you know our Splunk app?

Download it now for free!