SharpPanda Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (140)

Sprache

en	102
zh	22
jp	8
it	6
es	2

Land

us	84
cn	32
sg	20
jp	4

Akteure

SharpPanda	10
Cobalt Strike	4
XOR DDoS	1
Meterpreter	1
Pikabot	1

Interesse

Typ

Not Defined	34
Programming Language Software	14
Database Software	8
Wireless LAN Software	6
Firewall Software	6

Hersteller

Not Defined	42
Oracle	12
Netgear	4
Citrix	4
pfSense	2

Produkt

PHP	10
Oracle MySQL Server	6
Oracle WebLogic Server	4
MantisBT	4
Netgear CBR40	2

Schwachstellen

#	Schwachstelle	Base	Temp	0day	Heute	Aus	Mas	CTI	EPSS	CVE
1	Thomas R. Pasawicz HyperBook Guestbook Password Database gbconfiguration.dat Hash Information Disclosure	5.3	5.2	$5k-$25k	$0-$5k	High	Workaround	0.02	0.02016	CVE-2007-1192
2	vu Mass Mailer Login Page redir.asp SQL Injection	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.06	0.00181	CVE-2007-6138
3	PHP bis 5.1.2 phpinfo() Array Cross Site Scripting	6.3	5.7	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.05	0.08985	CVE-2006-0996
4	vBulletin redirector.php Redirect	6.6	6.6	$0-$5k	$0-$5k	Not Defined	Not Defined	0.27	0.00141	CVE-2018-6200
5	Cisco ASA Version Information Disclosure	5.3	4.6	$5k-$25k	$0-$5k	Unproven	Official Fix	0.04	0.00288	CVE-2014-3398
6	Apache HTTP Server mod_ssl ap_hook_process_connection Denial of Service	7.5	7.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00	0.01166	CVE-2017-3169
7	PHP phpinfo Cross Site Scripting	4.3	3.9	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.12	0.02101	CVE-2007-1287
8	Serendipity exit.php erweiterte Rechte	6.3	6.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.09	0.00000
9	WoltLab Burning Book addentry.php SQL Injection	7.3	6.8	$0-$5k	$0-$5k	Functional	Unavailable	0.02	0.00804	CVE-2006-5509
10	Linux Foundation Xen EFLAGS Register SYSENTER erweiterte Rechte	6.2	5.9	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.04	0.00062	CVE-2013-1917
11	AXIS 2110 Network Camera editcgi.cgi Directory Traversal	5.3	5.0	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.02	0.01492	CVE-2004-2426
12	Synology DiskStation Manager SliceUpload imageSelector.cgi erweiterte Rechte	6.5	6.2	$0-$5k	$0-$5k	High	Official Fix	0.05	0.97290	CVE-2013-6955
13	Hestia Control Panel Domain Name Privilege Escalation	5.9	5.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.00139	CVE-2021-27231
14	Bitrix Site Manager redirect.php erweiterte Rechte	5.3	4.7	$0-$5k	$0-$5k	Unproven	Unavailable	0.12	0.00113	CVE-2008-2052
15	PHP Link Directory Administration Page index.html Cross Site Scripting	4.3	4.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.48	0.00374	CVE-2007-0529
16	Moodle erweiterte Rechte	6.5	6.5	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.04	0.00061	CVE-2023-35133
17	Extreme Networks ExtremeWireless Aerohive HiveOS/IQ Engine NetConfig UI Administrative Interface erweiterte Rechte	8.8	8.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02	0.85139	CVE-2020-16152
18	Advance B2B Script tradeshow-list-detail.php SQL Injection	8.5	8.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00	0.00242	CVE-2017-17602
19	Asus NAS-M25 Cookie erweiterte Rechte	9.8	9.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00	0.90045	CVE-2022-4221
20	Apache Log4j Socket Server erweiterte Rechte	8.5	8.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.02	0.81948	CVE-2017-5645

Kampagnen (1)

These are the campaigns that can be associated with the actor:

G20 Nations

IOC - Indicator of Compromise (14)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP-Adresse	Hostname	Akteur	Kampagnen	Identifiziert	Typ	Akzeptanz
1	13.236.189.80	ec2-13-236-189-80.ap-southeast-2.compute.amazonaws.com	SharpPanda	G20 Nations	02.06.2023	verifiziert	Medium
2	45.76.190.210	45.76.190.210.vultrusercontent.com	SharpPanda		10.03.2023	verifiziert	High
3	45.91.225.139		SharpPanda		10.02.2022	verifiziert	High
4	XX.XXX.XXX.XX	xxxxxxx-xxxxxxxx.xxxxxxxx.xxx	Xxxxxxxxxx		10.02.2022	verifiziert	High
5	XX.XXX.XXX.XX		Xxxxxxxxxx		10.03.2023	verifiziert	High
6	XX.XXX.XXX.XX		Xxxxxxxxxx		10.03.2023	verifiziert	High
7	XXX.XX.XXX.XX		Xxxxxxxxxx		10.03.2023	verifiziert	High
8	XXX.XXX.XXX.XX		Xxxxxxxxxx		10.03.2023	verifiziert	High
9	XXX.XXX.XXX.XXX		Xxxxxxxxxx		10.03.2023	verifiziert	High
10	XXX.XXX.XXX.XX		Xxxxxxxxxx		10.03.2023	verifiziert	High
11	XXX.XXX.XXX.XXX	xxxxx.xxxxxxx.xxx	Xxxxxxxxxx		10.02.2022	verifiziert	High
12	XXX.XXX.XXX.XX	xxx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx		10.03.2023	verifiziert	High
13	XXX.XXX.XXX.XX	xxx.xxx.xxx.xx.xxxxxxxxxxxxxxxx.xxx	Xxxxxxxxxx		10.03.2023	verifiziert	High
14	XXX.XX.XXX.XX		Xxxxxxxxxx		10.03.2023	verifiziert	High

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Schwachstellen	Zugriffsart	Typ	Akzeptanz
1	T1006	CWE-22, CWE-23	Path Traversal	prädiktiv	High
2	T1040	CWE-294	Authentication Bypass by Capture-replay	prädiktiv	High
3	T1055	CWE-74	Improper Neutralization of Data within XPath Expressions	prädiktiv	High
4	TXXXX	CWE-XX, CWE-XX	Xxxxxxxx Xxxxxxxxx	prädiktiv	High
5	TXXXX.XXX	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	prädiktiv	High
6	TXXXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
7	TXXXX.XXX	CWE-XXX	Xxx Xx Xxxx-xxxxx Xxxxxxxx	prädiktiv	High
8	TXXXX	CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	prädiktiv	High
9	TXXXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	prädiktiv	High
10	TXXXX.XXX	CWE-XXX	Xxxx Xxxxxxxx	prädiktiv	High
11	TXXXX	CWE-XXX	7xx Xxxxxxxx Xxxxxxxx	prädiktiv	High
12	TXXXX	CWE-XX	Xxx Xxxxxxxxx	prädiktiv	High
13	TXXXX	CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	prädiktiv	High
14	TXXXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	prädiktiv	High
15	TXXXX	CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	prädiktiv	High

IOA - Indicator of Attack (60)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Klasse	Indicator	Typ	Akzeptanz
1	File	/cgi-bin/system_mgr.cgi	prädiktiv	High
2	File	/data/config.ftp.php	prädiktiv	High
3	File	/forum/away.php	prädiktiv	High
4	File	/modules/profile/index.php	prädiktiv	High
5	File	/out.php	prädiktiv	Medium
6	File	/tmp	prädiktiv	Low
7	File	/uncpath/	prädiktiv	Medium
8	File	xxxxxxx.xxx	prädiktiv	Medium
9	File	xxxxxxxx.xxx	prädiktiv	Medium
10	File	xxxxx_xxxxx.xxx	prädiktiv	High
11	File	xxxx-xxxxxxx.x	prädiktiv	High
12	File	xxxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx/xxxxxxxxxxx.xxx	prädiktiv	High
13	File	xxx-xxx/xxxxxx.xxx	prädiktiv	High
14	File	xxxxxxx.xxx	prädiktiv	Medium
15	File	xxxx/xxxxxxxxxxxxxxx.xxx	prädiktiv	High
16	File	xxxxxxx.xxxxx.xxx	prädiktiv	High
17	File	xxxxxxx.xxx	prädiktiv	Medium
18	File	xxxx.xxx	prädiktiv	Medium
19	File	xxx_xxxx.x	prädiktiv	Medium
20	File	xxxx.xxx	prädiktiv	Medium
21	File	xxxx_xxxxx.x	prädiktiv	Medium
22	File	xxx/xxxxxx.xxx	prädiktiv	High
23	File	xxxxx.xxxx	prädiktiv	Medium
24	File	xxxxx.xxx	prädiktiv	Medium
25	File	xxx-xxx.xxxx.xx	prädiktiv	High
26	File	xxxxx.xxx	prädiktiv	Medium
27	File	xxxxxxxx.xxx	prädiktiv	Medium
28	File	xxxxxxxxxx.xxx	prädiktiv	High
29	File	xxxxxxxxx-xxxx-xxxxxx.xxx	prädiktiv	High
30	File	xxx.xxx	prädiktiv	Low
31	File	xxxxxx/xxxxxxxxxxxxx.xxx	prädiktiv	High
32	Library	xxxxxxxx.xxx	prädiktiv	Medium
33	Library	xxxxxxxx/xxxxxxx/xxxxx/xxx.xxx	prädiktiv	High
34	Library	xxxxxxxxxxx.xxx	prädiktiv	High
35	Argument	--xxxxxx/--xxxxxxxx	prädiktiv	High
36	Argument	xxxxxx	prädiktiv	Low
37	Argument	xxxxxx/xxxx/xxxx/xxxxx/xxxxxx/x_xxxxxxx/x_xxxxxxxx/x_xxxxxxx/x_xxxxx	prädiktiv	High
38	Argument	xxxxxx/xxxxxxxx/xxxxxxxxxxxxxx	prädiktiv	High
39	Argument	xxxxxxxxxxx	prädiktiv	Medium
40	Argument	xxx_xxxxx_xxxx	prädiktiv	High
41	Argument	xxxxxxxx	prädiktiv	Medium
42	Argument	xxxxxxx	prädiktiv	Low
43	Argument	xxxxxx	prädiktiv	Low
44	Argument	xxxx	prädiktiv	Low
45	Argument	xxxx	prädiktiv	Low
46	Argument	xxxxxxxx	prädiktiv	Medium
47	Argument	xx	prädiktiv	Low
48	Argument	xx	prädiktiv	Low
49	Argument	xxxxxx	prädiktiv	Low
50	Argument	xxxxxxxx	prädiktiv	Medium
51	Argument	xxxx	prädiktiv	Low
52	Argument	xxxxxxx	prädiktiv	Low
53	Argument	xxxx_xx	prädiktiv	Low
54	Argument	xxx	prädiktiv	Low
55	Argument	xxx	prädiktiv	Low
56	Argument	xxxxxxxx	prädiktiv	Medium
57	Argument	xxxxxxxx/xxxxxxxx	prädiktiv	High
58	Input Value	../	prädiktiv	Low
59	Input Value	x' xx x=x--	prädiktiv	Medium
60	Network Port	xxx xxxxxx xxxx	prädiktiv	High

Referenzen (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ ZurückÜbersichtWeiter ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!