Sality Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (40)

Sprache

en	30
de	4
ru	4
es	2

Land

us	20
pt	6
ru	6
gb	2
es	2

Akteure

Sality	3
Wannacry	1
SmokeLoader	1
StealthWorker	1
Cobalt Strike	1

Interesse

Typ

Not Defined	12
Operating System	6
Anti-Malware Software	2
Content Management System	2
Unified Communication Software	2

Hersteller

Not Defined	10
Microsoft	8
Symantec	2
Maianscriptworld	2
b3log	2

Produkt

Microsoft Windows	6
phpRaid	2
Symantec Endpoint Protection Manager	2
Maianscriptworld Maian Recipe	2
b3log Symphony	2

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	EPSS	CTI	CVE
1	WordPress wp-trackback.php mb_convert_encoding schwache Verschlüsselung	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.03358	0.00	CVE-2009-3622
2	Dragon Path Bharti Airtel Routers Hardware BDT-121 Admin Page Cross Site Scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00053	0.06	CVE-2022-28507
3	YaPiG view.php Cross Site Scripting	4.3	3.9	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01335	0.00	CVE-2005-1886
4	WordPress wp-register.php Cross Site Scripting	4.3	4.2	$5k-$25k	$0-$5k	High	Unavailable	0.00322	0.00	CVE-2007-5105
5	MetInfo URL Redirector login.php	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00107	0.00	CVE-2017-11718
6	phpRaid register.php erweiterte Rechte	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00000	0.04
7	vu Mass Mailer Login Page redir.asp SQL Injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00238	0.00	CVE-2007-6138
8	DZCP deV!L`z Clanportal config.php erweiterte Rechte	7.3	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00943	0.51	CVE-2010-0966
9	Symantec Endpoint Protection Manager SAP XML Parser XML External Entity	7.3	6.6	$5k-$25k	$0-$5k	High	Official Fix	0.83177	0.00	CVE-2013-5014
10	Mozilla Firefox/Thunderbird/Firefox ESR NPAPI Plugin Cross Site Request Forgery	6.5	6.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00419	0.00	CVE-2019-11712
11	Linux Kernel oom_kill.c __oom_reap_task_mm Pufferüberlauf	4.7	4.7	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00062	0.00	CVE-2017-18202
12	Node.js HTTP Header Denial of Service	6.4	6.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.01647	0.00	CVE-2018-12121
13	TestLink Plugin summary.jelly Cross Site Scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00054	0.00	CVE-2018-1000113
14	Microsoft Windows Windows Media Player Information Disclosure	2.5	2.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00184	0.03	CVE-2017-11768
15	W3C Jigsaw Host Header Cross Site Scripting	6.3	5.7	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.01034	0.00	CVE-2002-1053
16	Microsoft Windows Subsystem for Linux erweiterte Rechte	6.4	5.8	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.00213	0.00	CVE-2018-0743
17	Microsoft Windows DirectX Information Disclosure	5.1	4.9	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00043	0.00	CVE-2019-0837
18	WordPress wpdb->prepare SQL Injection	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00389	0.09	CVE-2017-16510
19	Microsoft Lync/Skype for Business Security Feature erweiterte Rechte	7.0	6.7	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00284	0.03	CVE-2018-8238
20	Iptanus File Upload Plugin Shortcode Cross Site Scripting	6.0	5.4	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00185	0.00	CVE-2018-9172

IOC - Indicator of Compromise (31)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Hostname	Akteur	Identifiziert	Typ	Akzeptanz
1	5.101.0.44		Sality	12.04.2022	verifiziert	High
2	20.53.203.50		Sality	01.08.2022	verifiziert	High
3	20.72.235.82		Sality	01.08.2022	verifiziert	High
4	20.81.111.85		Sality	01.08.2022	verifiziert	High
5	20.84.181.62		Sality	01.08.2022	verifiziert	High
6	20.103.85.33		Sality	01.08.2022	verifiziert	High
7	20.109.209.108		Sality	01.08.2022	verifiziert	High
8	XX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxxxxx	01.08.2022	verifiziert	High
9	XX.XXX.XX.XXX	xxx-xxx-xx-xxx.xxxxxx.xxxxxx.xxxxxxxxxxxxxxxxxx.xxx	Xxxxxx	01.08.2022	verifiziert	High
10	XX.XXX.XXX.XX		Xxxxxx	08.04.2022	verifiziert	High
11	XX.XX.XXX.XXX	xxxxxxxxxxx.xxxxxxx-xxxx.xxx.xxx	Xxxxxx	12.04.2022	verifiziert	High
12	XX.XX.X.XX	xxxxxxx.x.xxxxxxxxx.xxx	Xxxxxx	12.04.2022	verifiziert	High
13	XX.XXX.XXX.XX		Xxxxxx	08.04.2022	verifiziert	High
14	XX.XX.XXX.XXX	xxxxxxxxx.xxxxxxxxxxx.xxx	Xxxxxx	08.04.2022	verifiziert	High
15	XX.XXX.XXX.XXX		Xxxxxx	12.04.2022	verifiziert	High
16	XX.XXX.XX.XXX	xx-xxx-xx-xxx-xxxxxx.xxxxxxx.xxx	Xxxxxx	29.10.2023	verifiziert	High
17	XX.XXX.XXX.XX	xx-xxxxx.xx.xxxxxxxxxxxxx.xx	Xxxxxx	12.04.2022	verifiziert	High
18	XX.XX.XXX.XXX	xx-xx-xxx-xxx.xxxxx.xxx.xx	Xxxxxx	12.04.2022	verifiziert	High
19	XXX.XX.XX.XX	xxxxxxxxxxx.x.xxxxxxxxx.xxx	Xxxxxx	12.04.2022	verifiziert	High
20	XXX.XXX.XXX.XXX	xx-xxx-xxx.xxxxx.xxx	Xxxxxx	12.04.2022	verifiziert	High
21	XXX.XXX.XX.XXX	xx-xxx-xxx-xx-xxx.xx.xxxxxxxxxxxx.xxx	Xxxxxx	12.04.2022	verifiziert	High
22	XXX.X.XXX.XXX		Xxxxxx	12.04.2022	verifiziert	High
23	XXX.XXX.XX.XX	x.xx.xxxx.xxx.xxxxxx.xx-xxxxxxx.xxx	Xxxxxx	12.04.2022	verifiziert	High
24	XXX.XX.XXX.X	xx-xxxxx.xxx.xx.xx	Xxxxxx	12.04.2022	verifiziert	High
25	XXX.XX.XX.XXX		Xxxxxx	08.04.2022	verifiziert	High
26	XXX.XX.XXX.XXX		Xxxxxx	08.04.2022	verifiziert	High
27	XXX.XX.XXX.XXX		Xxxxxx	08.04.2022	verifiziert	High
28	XXX.XXX.XX.XXX	xxxx-x.xxxxxxxxxxxx	Xxxxxx	08.04.2022	verifiziert	High
29	XXX.XXX.XXX.XXX	xxx.xxx.xxx.xxx.xxxxxx.xxxx-xxxx.xxx	Xxxxxx	08.04.2022	verifiziert	High
30	XXX.XX.XX.XX	xxxx.xxxxxxx.xx	Xxxxxx	08.04.2022	verifiziert	High
31	XXX.XX.XX.XXX	xxx.xxxxxxx.xx	Xxxxxx	12.04.2022	verifiziert	High

TTP - Tactics, Techniques, Procedures (8)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Klassifizierung	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1059	CAPEC-242	CWE-94	Argument Injection	prädiktiv	High
2	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	prädiktiv	High
3	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
4	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	prädiktiv	High
5	TXXXX	CAPEC-	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	prädiktiv	High
6	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	prädiktiv	High
7	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	prädiktiv	High
8	TXXXX	CAPEC-	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	prädiktiv	High

IOA - Indicator of Attack (35)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	/getcfg.php	prädiktiv	Medium
2	File	/settings/avatar	prädiktiv	High
3	File	bin/icinga	prädiktiv	Medium
4	File	inc/config.php	prädiktiv	High
5	File	index.php	prädiktiv	Medium
6	File	xxxxxx/xxxxx.xxx	prädiktiv	High
7	File	xxxxxx.xx	prädiktiv	Medium
8	File	xx/xxx_xxxx.x	prädiktiv	High
9	File	xxx.xxx	prädiktiv	Low
10	File	xxxxx.xxx	prädiktiv	Medium
11	File	xxxxxxxx.xxx	prädiktiv	Medium
12	File	xxxxxxxxxxxxxxxxxxx/xxxxxxx.xxxxx	prädiktiv	High
13	File	xxxxxxxxx.xx	prädiktiv	Medium
14	File	xxxx/xxxxxxxxxxxx.x	prädiktiv	High
15	File	xxxx.xxx	prädiktiv	Medium
16	File	xx-xxxxxxxx.xxx	prädiktiv	High
17	File	xx-xxxxxxxxx.xxx	prädiktiv	High
18	Argument	xxxxxxxx	prädiktiv	Medium
19	Argument	xxxxxxxxx	prädiktiv	Medium
20	Argument	xxxxxxx	prädiktiv	Low
21	Argument	xxxxxxxxxxx	prädiktiv	Medium
22	Argument	xxxxx	prädiktiv	Low
23	Argument	xx	prädiktiv	Low
24	Argument	xxxxxx	prädiktiv	Low
25	Argument	xxxxxxxx	prädiktiv	Medium
26	Argument	xxxx	prädiktiv	Low
27	Argument	xxxxxxx_xxx	prädiktiv	Medium
28	Argument	xxxxxxxx	prädiktiv	Medium
29	Argument	xxxxxxxxxxxxx	prädiktiv	High
30	Argument	xxxx_xxxxx	prädiktiv	Medium
31	Argument	_xxxxxxx	prädiktiv	Medium
32	Input Value	xxxx -x xxxxxxxx=xxxxxx.xxxxxxx xxxx://xxx.xxx.x.x/xxxxxx.xxx	prädiktiv	High
33	Pattern	\|xx\|xx\|xx\|	prädiktiv	Medium
34	Network Port	xxx/xxxx (xxxx) / xxx/xxxx (xxxxx)	prädiktiv	High
35	Network Port	xxx xxxxxx xxxx	prädiktiv	High

Referenzen (6)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Interested in the pricing of exploits?

See the underground prices here!