OldGremlin Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (219)

Sprache

en	194
zh	8
fr	6
es	4
de	2

Land

us	94
cn	64
at	10
ru	8
ce	4

Akteure

Cobalt Strike	13
NetSupportManager RAT	12
Raccoon	10
SideWinder	8
RecordBreaker	7

Interesse

Typ

Not Defined	78
Router Operating System	14
WordPress Plugin	12
Content Management System	8
Web Server	8

Hersteller

Not Defined	64
Microsoft	10
Cisco	6
Linksys	6
Fortinet	4

Produkt

cPanel	6
nginx	4
Microsoft Windows	4
Cacti	4
Siemens SPPA-T3000 Application Server	4

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	CTI	EPSS	CVE
1	Atmail Remote Code Execution	9.8	9.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.04	0.00251	CVE-2013-5033
2	Arduino LED erweiterte Rechte	5.2	5.2	$0-$5k	Wird berechnet	Not Defined	Not Defined	0.00	0.00109	CVE-2019-13991
3	Palo Alto PAN-OS GlobalProtect Clientless VPN Pufferüberlauf	8.8	8.6	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00112	CVE-2021-3056
4	Microsoft IIS IP/Domain Restriction erweiterte Rechte	6.5	5.7	$25k-$100k	$0-$5k	Unproven	Official Fix	0.09	0.00817	CVE-2014-4078
5	WordPress SQL Injection	6.8	6.7	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03	0.00467	CVE-2022-21664
6	VeronaLabs wp-statistics Plugin API Endpoint Blind SQL Injection	8.5	8.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.00250	CVE-2019-13275
7	Linksys WRT54GL Web Management Interface SysInfo1.htm Information Disclosure	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.18	0.00046	CVE-2024-1406
8	RoundCube Webmail Email Message rcube_string_replacer.php linkref_addindex Cross Site Scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00	0.00612	CVE-2020-35730
9	Teclib GLPI unlock_tasks.php SQL Injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.03	0.12149	CVE-2019-10232
10	Sophos Firewall User Portal/Webadmin schwache Authentisierung	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.97434	CVE-2022-1040
11	nginx erweiterte Rechte	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.09	0.00241	CVE-2020-12440
12	CutePHP CuteNews erweiterte Rechte	7.5	6.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.02086	CVE-2019-11447
13	WordPress Object erweiterte Rechte	5.3	5.2	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.00432	CVE-2022-21663
14	Microsoft Windows Active Directory Domain Services Privilege Escalation	8.8	8.1	$100k und mehr	$0-$5k	Proof-of-Concept	Official Fix	0.00	0.07920	CVE-2022-26923
15	QNAP QTS Media Library erweiterte Rechte	8.5	8.2	$0-$5k	$0-$5k	High	Official Fix	0.03	0.01394	CVE-2017-13067
16	Peplink Balance Cookie admin.cgi SQL Injection	8.5	7.7	$0-$5k	Wird berechnet	Proof-of-Concept	Official Fix	0.02	0.01457	CVE-2017-8835
17	Cisco Internet of Things Field Network Director Web-based User Interface XML External Entity	5.4	5.3	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.00150	CVE-2019-1698
18	Mycroft AI WebSocket Server erweiterte Rechte	7.7	7.7	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00	0.00269	CVE-2018-1000621
19	RealNetworks RealServer Port 7070 Service Denial of Service	7.5	7.3	$0-$5k	$0-$5k	Not Defined	Workaround	0.03	0.02116	CVE-2000-0272
20	Microsoft Windows Themes Information Disclosure	5.9	5.6	$25k-$100k	$5k-$25k	Unproven	Official Fix	0.04	0.00073	CVE-2024-21320

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Hostname	Akteur	Identifiziert	Typ	Akzeptanz
1	5.181.156.84	no-rdns.mivocloud.com	OldGremlin	02.06.2022	verifiziert	High
2	45.61.138.170		OldGremlin	02.06.2022	verifiziert	High
3	XX.XXX.XXX.XXX		Xxxxxxxxxx	18.04.2022	verifiziert	High
4	XX.XXX.XXX.XXX	xx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	02.06.2022	verifiziert	High
5	XXX.XXX.XX.XX	xxx.xxx.xx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	02.06.2022	verifiziert	High
6	XXX.XX.XX.X		Xxxxxxxxxx	18.04.2022	verifiziert	High
7	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx	18.04.2022	verifiziert	High

TTP - Tactics, Techniques, Procedures (18)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1006	CWE-21, CWE-22, CWE-23	Path Traversal	prädiktiv	High
2	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	prädiktiv	High
3	T1059	CWE-94	Argument Injection	prädiktiv	High
4	T1059.007	CWE-79, CWE-80	Cross Site Scripting	prädiktiv	High
5	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
6	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	prädiktiv	High
7	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	prädiktiv	High
8	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	prädiktiv	High
9	TXXXX	CWE-XXX	Xxxxxxxx Xx Xxxx Xxxxxxx Xxxxxxxxx Xxxxx	prädiktiv	High
10	TXXXX	CWE-XX	Xxx Xxxxxxxxx	prädiktiv	High
11	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	prädiktiv	High
12	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
13	TXXXX	CWE-XXX	Xxxxxxx Xxxxxxxxxx Xx Xxx-xxxxxxxx	prädiktiv	High
14	TXXXX	CWE-XXX	Xxxxxxxxx Xxxxxx Xxxx	prädiktiv	High
15	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxx Xxxx	prädiktiv	High
16	TXXXX.XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
17	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	prädiktiv	High
18	TXXXX.XXX	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	prädiktiv	High

IOA - Indicator of Attack (100)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	/api/RecordingList/DownloadRecord?file=	prädiktiv	High
2	File	/apply.cgi	prädiktiv	Medium
3	File	/php/ping.php	prädiktiv	High
4	File	/rapi/read_url	prädiktiv	High
5	File	/scripts/unlock_tasks.php	prädiktiv	High
6	File	/SysInfo1.htm	prädiktiv	High
7	File	/sysinfo_json.cgi	prädiktiv	High
8	File	/system/user/modules/mod_users/controller.php	prädiktiv	High
9	File	/uncpath/	prädiktiv	Medium
10	File	/wp-admin/admin-post.php?es_skip=1&option_name	prädiktiv	High
11	File	AppCompatCache.exe	prädiktiv	High
12	File	xxxxxxx/xxxx.xxx	prädiktiv	High
13	File	xxxxxxxx.xxx	prädiktiv	Medium
14	File	xxx-xxx/xxxxxxx.xx	prädiktiv	High
15	File	xxx-xxx/xxxxx/xxxxx.xxx	prädiktiv	High
16	File	xxxxxx/xxx.x	prädiktiv	Medium
17	File	xxxxxxxx_xxxxxxxxxxxxxxxxx.xxx	prädiktiv	High
18	File	xxxxxxxxx.xxx.xxx	prädiktiv	High
19	File	xxxxx/xxxxx.xxx	prädiktiv	High
20	File	xxxx_xxxxx.xxx	prädiktiv	High
21	File	xxxxx.xxx	prädiktiv	Medium
22	File	xxxxxx.xxx	prädiktiv	Medium
23	File	xxxxxxx/xxxx-xxxxx-xxxxxx.xxx	prädiktiv	High
24	File	xxxxxxx/xxxx-xxxxx-xxxxxx.xxx?xxxxxx=x	prädiktiv	High
25	File	xx/xx-xx.x	prädiktiv	Medium
26	File	xxx/xxxx_xxxx.x	prädiktiv	High
27	File	xxxxxx/xxxxxxxxxxx	prädiktiv	High
28	File	xxxx_xxxxxx.x	prädiktiv	High
29	File	xxxx/xxxxxxx.x	prädiktiv	High
30	File	xxxxxxxx/xxxxx-xxxxxx-xxxx-xxxxxxx.xxx	prädiktiv	High
31	File	xxxxxxxx/xxxxxxxx/xxxxx-xxxxxxxx-xxxxx.xxx	prädiktiv	High
32	File	xxxxx.xxx?xxx=xxxx&xxx=xxxxxxxx	prädiktiv	High
33	File	xxxxxxxxxx.xxx	prädiktiv	High
34	File	xxxxxxx_xxxxxxx/xxxx.xxx	prädiktiv	High
35	File	xxxxx.xxx	prädiktiv	Medium
36	File	xxxx/xxxxxxxxx/xxxxxx/xxxxxxxxxxxxxxxxxxxxx.xxx	prädiktiv	High
37	File	xxx/xxx.xxx	prädiktiv	Medium
38	File	xxxxxx.x	prädiktiv	Medium
39	File	xxxx.xxx	prädiktiv	Medium
40	File	xxxxx.xxx	prädiktiv	Medium
41	File	xxxxxx/?x=xxxxx/\xxxxx\xxx/xxxxxxxxxxxxxx&xxxxxxxx=xxxx_xxxx_xxxx_xxxxx&xxxx[x]=xxxxxx&xxxx[x][]	prädiktiv	High
42	File	xxxxx_xxxxxx_xxxxxxxx.xxx	prädiktiv	High
43	File	xxxxxxxx.xxx	prädiktiv	Medium
44	File	xxxxxxx/xxxxxxxxxx	prädiktiv	High
45	File	xxxxxxx-xxxxxxxxxx/xxx/xxxxx.xxx	prädiktiv	High
46	File	xxxx.xxx	prädiktiv	Medium
47	File	xxxxx/xxxxx.xxx	prädiktiv	High
48	File	xxxxxxxx.xxx	prädiktiv	Medium
49	File	xxxxxxxxx.xxx	prädiktiv	High
50	File	xxxx.xxx	prädiktiv	Medium
51	File	xxxxxxxxxx	prädiktiv	Medium
52	File	xxxxxxx/xxxxx.xxx	prädiktiv	High
53	File	xx-xxxxx/xxxxx-xxxx.xxx	prädiktiv	High
54	Argument	xxxxxx	prädiktiv	Low
55	Argument	xxxxxxx_xxxx	prädiktiv	Medium
56	Argument	xxxxxx_xxxx	prädiktiv	Medium
57	Argument	xxxxx	prädiktiv	Low
58	Argument	xxx	prädiktiv	Low
59	Argument	xxxxxxxx	prädiktiv	Medium
60	Argument	xxxxxx	prädiktiv	Low
61	Argument	xxxxxxxxxxxxxxxxx	prädiktiv	High
62	Argument	xxxxx	prädiktiv	Low
63	Argument	xxxxxxxxxxx/xxxxxxxx/xxx/xxxxx	prädiktiv	High
64	Argument	xxxxxx_xx	prädiktiv	Medium
65	Argument	xxxxx	prädiktiv	Low
66	Argument	xxxxxx	prädiktiv	Low
67	Argument	xxxxxxxxxxxx	prädiktiv	Medium
68	Argument	xxxxxx	prädiktiv	Low
69	Argument	xx_xxxx [xx][x]/xx_xxxx [xx][x]/xx_xxxx [xx][x]/xx_xxxx [xx][x]/xxxxx	prädiktiv	High
70	Argument	xxxx	prädiktiv	Low
71	Argument	xxxx	prädiktiv	Low
72	Argument	xx	prädiktiv	Low
73	Argument	xxxxxxxxx	prädiktiv	Medium
74	Argument	xxxxxxxx[xx]	prädiktiv	Medium
75	Argument	xxxxxxx	prädiktiv	Low
76	Argument	xxx_xxxx	prädiktiv	Medium
77	Argument	xxxxx_xx	prädiktiv	Medium
78	Argument	xxxxxxxx	prädiktiv	Medium
79	Argument	x_x_x	prädiktiv	Low
80	Argument	xxxxxxx/xxxxx	prädiktiv	High
81	Argument	xxxxxx_xxx	prädiktiv	Medium
82	Argument	xxxxxx	prädiktiv	Low
83	Argument	xxxx_xx	prädiktiv	Low
84	Argument	xxxxxxxx_xxxxxxxx	prädiktiv	High
85	Argument	xxxxxxxxxxxxxxxxxxxxx	prädiktiv	High
86	Argument	xxxx_xx	prädiktiv	Low
87	Argument	xxx	prädiktiv	Low
88	Argument	xxxx	prädiktiv	Low
89	Argument	xxxxxxxx	prädiktiv	Medium
90	Argument	xxxx/xx/xxxx/xxx	prädiktiv	High
91	Argument	xxxxxxxx	prädiktiv	Medium
92	Input Value	.%xx.../.%xx.../	prädiktiv	High
93	Input Value	../../../../../xxx/xxx/xxxxx/xxxx/xxxxxxxx/xxxxx/xxx.xxx	prädiktiv	High
94	Input Value	xxxxxxx -xxx	prädiktiv	Medium
95	Input Value	xxxxxxxxxx	prädiktiv	Medium
96	Network Port	xxxx	prädiktiv	Low
97	Network Port	xxxx	prädiktiv	Low
98	Network Port	xxxx xxxx	prädiktiv	Medium
99	Network Port	xxx/xxx	prädiktiv	Low
100	Network Port	xxx/xxxx	prädiktiv	Medium

Referenzen (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Might our Artificial Intelligence support you?

Check our Alexa App!