NDSW Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (72)

Sprache

en	60
ru	6
de	4
it	2

Land

ru	56
us	16

Akteure

NDSW	3
Locky	2
Emotet (Trickbot + Zeus Panda)	1
Hancitor (HelloFax Theme)	1
YKCOL (Locky Variant)	1

Interesse

Typ

Not Defined	16
Forum Software	8
WordPress Plugin	4
Programming Language Software	4
Content Management System	2

Hersteller

Not Defined	16
Thomas R. Pasawicz	2
Lars Ellingsen	2
AlilG	2
MGB	2

Produkt

Add Comments Plugin	2
WP Symposium	2
WordPress	2
Thomas R. Pasawicz HyperBook Guestbook	2
PHP Link Directory	2

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	CTI	EPSS	CVE
1	PHP Link Directory Administration Page index.html Cross Site Scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.26	0.00374	CVE-2007-0529
2	LogicBoard CMS away.php Redirect	6.3	6.1	$0-$5k	$0-$5k	Not Defined	Unavailable	2.04	0.00000
3	Esoftpro Online Guestbook Pro ogp_show.php SQL Injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.09	0.00108	CVE-2009-4935
4	phpMyAdmin phpinfo.php Information Disclosure	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.05	0.00142	CVE-2016-9848
5	DZCP deV!L`z Clanportal config.php erweiterte Rechte	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.40	0.00943	CVE-2010-0966
6	Flat PHP Board Directory Traversal	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.01	0.00000
7	Simple PHP Guestbook guestbook.php Cross Site Scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.00000
8	212cafe 212cafeboard view.php SQL Injection	7.3	7.1	$0-$5k	Wird berechnet	High	Unavailable	0.08	0.00064	CVE-2008-4713
9	Microsoft Office Object Remote Code Execution	7.0	6.3	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02	0.97339	CVE-2017-8570
10	Lars Ellingsen Guestserver guestbook.cgi Cross Site Scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.06	0.00169	CVE-2005-4222
11	Huawei SmartCare Dashboard Stored Cross Site Scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00065	CVE-2017-15312
12	Flat PHP Board Directory Traversal	3.3	3.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.04	0.00000
13	MGB OpenSource Guestbook email.php SQL Injection	7.3	7.3	$0-$5k	$0-$5k	High	Unavailable	0.35	0.01302	CVE-2007-0354
14	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash Information Disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
15	jforum User erweiterte Rechte	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05	0.00289	CVE-2019-7550
16	Cannot PHP infoBoard erweiterte Rechte	7.3	6.9	$0-$5k	Wird berechnet	Proof-of-Concept	Not Defined	0.00	0.01049	CVE-2008-4334
17	Phplinkdirectory PHP Link Directory conf_users_edit.php Cross Site Request Forgery	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.04	0.00526	CVE-2011-0643
18	Add Comments Plugin Setting Cross Site Scripting	3.6	3.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00056	CVE-2022-3909
19	AlilG AliBoard File Upload usercp.php erweiterte Rechte	6.3	6.1	$0-$5k	$0-$5k	High	Unavailable	0.00	0.00529	CVE-2008-7029
20	GetSimpleCMS index.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.05	0.00123	CVE-2019-9915

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Hostname	Akteur	Identifiziert	Typ	Akzeptanz
1	109.234.35.249	v1020533.hosted-by-vdsina.ru	NDSW	29.07.2022	verifiziert	High
2	XXX.XX.XXX.XX		Xxxx	29.07.2022	verifiziert	High
3	XXX.XXX.XXX.XXX	xxxx.xx	Xxxx	29.07.2022	verifiziert	High

TTP - Tactics, Techniques, Procedures (9)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1006	CWE-22	Path Traversal	prädiktiv	High
2	T1059	CWE-94	Argument Injection	prädiktiv	High
3	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	prädiktiv	High
4	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
5	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	prädiktiv	High
6	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	prädiktiv	High
7	TXXXX	CWE-XX	Xxx Xxxxxxxxx	prädiktiv	High
8	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	prädiktiv	High
9	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	prädiktiv	High

IOA - Indicator of Attack (39)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	/forum/away.php	prädiktiv	High
2	File	admin/conf_users_edit.php	prädiktiv	High
3	File	admin/index.php	prädiktiv	High
4	File	blog.php	prädiktiv	Medium
5	File	comments/feed	prädiktiv	High
6	File	xxxx/xxxxxxxxxxxxxxx.xxx	prädiktiv	High
7	File	xxxxxxxx.xxx	prädiktiv	Medium
8	File	xxx/xxx/xxxxx	prädiktiv	High
9	File	xxxxx.xxx	prädiktiv	Medium
10	File	xxxxx.xxx	prädiktiv	Medium
11	File	xxxxxxxxx.xxx	prädiktiv	High
12	File	xxxxxxxxx.xxx	prädiktiv	High
13	File	xxxxxxxxxx/xxxxxxxxxx/xxxxxxxx/xxxxxxxxxxxxxxxxxxx.xxx	prädiktiv	High
14	File	xxx/xxxxxx.xxx	prädiktiv	High
15	File	xxxxx.xxxx	prädiktiv	Medium
16	File	xxxxxxxx.xxx	prädiktiv	Medium
17	File	xxxx.xxx	prädiktiv	Medium
18	File	xxx_xxxx.xxx	prädiktiv	Medium
19	File	xxxxxxx.xxx	prädiktiv	Medium
20	File	xxxxxxxx/xxxxx/xxxxxxxx?xxxxxxxx	prädiktiv	High
21	File	xxx.x	prädiktiv	Low
22	File	xxxxxx.xxx	prädiktiv	Medium
23	File	xxxx.xxx	prädiktiv	Medium
24	File	xxxxxx.xxx	prädiktiv	Medium
25	Argument	xxxxxx	prädiktiv	Low
26	Argument	xxxxxxxx	prädiktiv	Medium
27	Argument	xxx	prädiktiv	Low
28	Argument	xxxxxxxxxxx	prädiktiv	Medium
29	Argument	xxxxxxx	prädiktiv	Low
30	Argument	xx	prädiktiv	Low
31	Argument	xxxx	prädiktiv	Low
32	Argument	xxx	prädiktiv	Low
33	Argument	xxxxxxxx	prädiktiv	Medium
34	Argument	xxxxxxxx	prädiktiv	Medium
35	Argument	xxxxxxxx	prädiktiv	Medium
36	Argument	xxxxxx	prädiktiv	Low
37	Argument	xxxx	prädiktiv	Low
38	Argument	xxxxx	prädiktiv	Low
39	Argument	xxxxxxxx	prädiktiv	Medium

Referenzen (2)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Might our Artificial Intelligence support you?

Check our Alexa App!